./Ultimate.py --spec ../sv-benchmarks/c/properties/unreach-call.prp --file ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version 0f8a17c6 Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.1-dev-0f8a17c [2021-11-17 00:54:11,897 INFO L177 SettingsManager]: Resetting all preferences to default values... [2021-11-17 00:54:11,898 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2021-11-17 00:54:11,940 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2021-11-17 00:54:11,950 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2021-11-17 00:54:11,951 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2021-11-17 00:54:11,952 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2021-11-17 00:54:11,953 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2021-11-17 00:54:11,954 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2021-11-17 00:54:11,955 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2021-11-17 00:54:11,956 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2021-11-17 00:54:11,957 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2021-11-17 00:54:11,957 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2021-11-17 00:54:11,960 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2021-11-17 00:54:11,961 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2021-11-17 00:54:11,963 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2021-11-17 00:54:11,965 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2021-11-17 00:54:11,969 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2021-11-17 00:54:11,970 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2021-11-17 00:54:11,974 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2021-11-17 00:54:11,979 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2021-11-17 00:54:11,980 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2021-11-17 00:54:11,981 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2021-11-17 00:54:11,982 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2021-11-17 00:54:11,984 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2021-11-17 00:54:11,987 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2021-11-17 00:54:11,988 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2021-11-17 00:54:11,989 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2021-11-17 00:54:11,990 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2021-11-17 00:54:11,991 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2021-11-17 00:54:11,991 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2021-11-17 00:54:11,992 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2021-11-17 00:54:11,992 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2021-11-17 00:54:11,993 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2021-11-17 00:54:11,994 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2021-11-17 00:54:11,995 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2021-11-17 00:54:11,995 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2021-11-17 00:54:11,996 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2021-11-17 00:54:11,996 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2021-11-17 00:54:11,996 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2021-11-17 00:54:11,997 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2021-11-17 00:54:11,997 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf [2021-11-17 00:54:12,021 INFO L113 SettingsManager]: Loading preferences was successful [2021-11-17 00:54:12,024 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2021-11-17 00:54:12,024 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2021-11-17 00:54:12,024 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2021-11-17 00:54:12,025 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2021-11-17 00:54:12,025 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2021-11-17 00:54:12,026 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2021-11-17 00:54:12,026 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2021-11-17 00:54:12,026 INFO L138 SettingsManager]: * Use SBE=true [2021-11-17 00:54:12,026 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2021-11-17 00:54:12,027 INFO L138 SettingsManager]: * Overapproximate operations on floating types=true [2021-11-17 00:54:12,027 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2021-11-17 00:54:12,027 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2021-11-17 00:54:12,027 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2021-11-17 00:54:12,028 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2021-11-17 00:54:12,028 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2021-11-17 00:54:12,028 INFO L138 SettingsManager]: * Use constant arrays=true [2021-11-17 00:54:12,028 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2021-11-17 00:54:12,028 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2021-11-17 00:54:12,028 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2021-11-17 00:54:12,028 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2021-11-17 00:54:12,028 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-11-17 00:54:12,029 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2021-11-17 00:54:12,029 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2021-11-17 00:54:12,029 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2021-11-17 00:54:12,029 INFO L138 SettingsManager]: * Trace refinement strategy=CAMEL [2021-11-17 00:54:12,029 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2021-11-17 00:54:12,030 INFO L138 SettingsManager]: * Large block encoding in concurrent analysis=OFF [2021-11-17 00:54:12,031 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2021-11-17 00:54:12,031 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2021-11-17 00:54:12,031 INFO L138 SettingsManager]: * Trace refinement exception blacklist=NONE [2021-11-17 00:54:12,031 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2021-11-17 00:54:12,250 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2021-11-17 00:54:12,278 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2021-11-17 00:54:12,280 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2021-11-17 00:54:12,280 INFO L271 PluginConnector]: Initializing CDTParser... [2021-11-17 00:54:12,281 INFO L275 PluginConnector]: CDTParser initialized [2021-11-17 00:54:12,281 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-11-17 00:54:12,358 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/d67040872/30dba7c059ff41ed968b045bd880f064/FLAG2181e79f0 [2021-11-17 00:54:12,860 INFO L306 CDTParser]: Found 1 translation units. [2021-11-17 00:54:12,860 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-11-17 00:54:12,912 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/d67040872/30dba7c059ff41ed968b045bd880f064/FLAG2181e79f0 [2021-11-17 00:54:13,381 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/d67040872/30dba7c059ff41ed968b045bd880f064 [2021-11-17 00:54:13,391 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2021-11-17 00:54:13,392 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2021-11-17 00:54:13,395 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2021-11-17 00:54:13,395 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2021-11-17 00:54:13,398 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2021-11-17 00:54:13,399 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 17.11 12:54:13" (1/1) ... [2021-11-17 00:54:13,400 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@170f75b8 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:13, skipping insertion in model container [2021-11-17 00:54:13,400 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 17.11 12:54:13" (1/1) ... [2021-11-17 00:54:13,407 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2021-11-17 00:54:13,487 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-11-17 00:54:14,061 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-11-17 00:54:14,244 INFO L207 PostProcessor]: Analyzing one entry point: main [2021-11-17 00:54:14,261 INFO L203 MainTranslator]: Completed pre-run [2021-11-17 00:54:14,462 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-11-17 00:54:14,559 INFO L207 PostProcessor]: Analyzing one entry point: main [2021-11-17 00:54:14,592 INFO L208 MainTranslator]: Completed translation [2021-11-17 00:54:14,594 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14 WrapperNode [2021-11-17 00:54:14,594 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2021-11-17 00:54:14,595 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2021-11-17 00:54:14,595 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2021-11-17 00:54:14,596 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2021-11-17 00:54:14,601 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,651 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,721 INFO L137 Inliner]: procedures = 146, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1422 [2021-11-17 00:54:14,722 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2021-11-17 00:54:14,722 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2021-11-17 00:54:14,722 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2021-11-17 00:54:14,723 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2021-11-17 00:54:14,729 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,730 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,746 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,747 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,787 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,795 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,800 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,810 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2021-11-17 00:54:14,810 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2021-11-17 00:54:14,811 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2021-11-17 00:54:14,811 INFO L275 PluginConnector]: RCFGBuilder initialized [2021-11-17 00:54:14,812 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (1/1) ... [2021-11-17 00:54:14,832 INFO L168 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-11-17 00:54:14,841 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-11-17 00:54:14,881 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2021-11-17 00:54:14,932 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2021-11-17 00:54:14,961 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2021-11-17 00:54:14,962 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2021-11-17 00:54:14,962 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~int [2021-11-17 00:54:14,962 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2021-11-17 00:54:14,962 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2021-11-17 00:54:14,962 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2021-11-17 00:54:14,962 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2021-11-17 00:54:14,962 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2021-11-17 00:54:14,962 INFO L130 BoogieDeclarations]: Found specification of procedure state [2021-11-17 00:54:14,963 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2021-11-17 00:54:14,963 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2021-11-17 00:54:14,963 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2021-11-17 00:54:14,963 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2021-11-17 00:54:14,963 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2021-11-17 00:54:14,963 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2021-11-17 00:54:14,963 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2021-11-17 00:54:14,963 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2021-11-17 00:54:14,964 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2021-11-17 00:54:14,964 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2021-11-17 00:54:14,964 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2021-11-17 00:54:14,964 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2021-11-17 00:54:14,964 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2021-11-17 00:54:14,964 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2021-11-17 00:54:14,964 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2021-11-17 00:54:14,964 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2021-11-17 00:54:14,965 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2021-11-17 00:54:14,965 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2021-11-17 00:54:14,965 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2021-11-17 00:54:14,965 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2021-11-17 00:54:14,965 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2021-11-17 00:54:14,965 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2021-11-17 00:54:14,965 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2021-11-17 00:54:14,965 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2021-11-17 00:54:14,966 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2021-11-17 00:54:14,966 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2021-11-17 00:54:14,966 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2021-11-17 00:54:14,966 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2021-11-17 00:54:14,966 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2021-11-17 00:54:14,967 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2021-11-17 00:54:14,967 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2021-11-17 00:54:14,967 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2021-11-17 00:54:14,967 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2021-11-17 00:54:14,967 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2021-11-17 00:54:14,967 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2021-11-17 00:54:14,968 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2021-11-17 00:54:14,968 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2021-11-17 00:54:14,968 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2021-11-17 00:54:14,968 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2021-11-17 00:54:14,968 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2021-11-17 00:54:14,968 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2021-11-17 00:54:14,969 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2021-11-17 00:54:14,969 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2021-11-17 00:54:14,969 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2021-11-17 00:54:14,969 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2021-11-17 00:54:14,969 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2021-11-17 00:54:14,970 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2021-11-17 00:54:14,970 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2021-11-17 00:54:14,971 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2021-11-17 00:54:14,971 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2021-11-17 00:54:14,971 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2021-11-17 00:54:14,972 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2021-11-17 00:54:14,972 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2021-11-17 00:54:14,972 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2021-11-17 00:54:14,972 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2021-11-17 00:54:14,972 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2021-11-17 00:54:14,972 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2021-11-17 00:54:14,973 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2021-11-17 00:54:14,973 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2021-11-17 00:54:14,973 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2021-11-17 00:54:14,973 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2021-11-17 00:54:14,973 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2021-11-17 00:54:14,974 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2021-11-17 00:54:14,974 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2021-11-17 00:54:14,974 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2021-11-17 00:54:14,974 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~int [2021-11-17 00:54:14,974 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2021-11-17 00:54:14,974 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2021-11-17 00:54:14,974 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2021-11-17 00:54:14,974 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2021-11-17 00:54:14,975 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2021-11-17 00:54:14,975 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2021-11-17 00:54:15,424 INFO L236 CfgBuilder]: Building ICFG [2021-11-17 00:54:15,426 INFO L262 CfgBuilder]: Building CFG for each procedure with an implementation [2021-11-17 00:54:15,574 INFO L768 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2021-11-17 00:54:16,032 INFO L277 CfgBuilder]: Performing block encoding [2021-11-17 00:54:16,045 INFO L296 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2021-11-17 00:54:16,045 INFO L301 CfgBuilder]: Removed 1 assume(true) statements. [2021-11-17 00:54:16,048 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 17.11 12:54:16 BoogieIcfgContainer [2021-11-17 00:54:16,048 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2021-11-17 00:54:16,051 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2021-11-17 00:54:16,051 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2021-11-17 00:54:16,053 INFO L275 PluginConnector]: TraceAbstraction initialized [2021-11-17 00:54:16,053 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 17.11 12:54:13" (1/3) ... [2021-11-17 00:54:16,054 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@6650195 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 17.11 12:54:16, skipping insertion in model container [2021-11-17 00:54:16,054 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:14" (2/3) ... [2021-11-17 00:54:16,055 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@6650195 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 17.11 12:54:16, skipping insertion in model container [2021-11-17 00:54:16,055 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 17.11 12:54:16" (3/3) ... [2021-11-17 00:54:16,057 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-11-17 00:54:16,060 INFO L204 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2021-11-17 00:54:16,060 INFO L163 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2021-11-17 00:54:16,094 INFO L338 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2021-11-17 00:54:16,098 INFO L339 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mLoopAccelerationTechnique=FAST_UPR [2021-11-17 00:54:16,098 INFO L340 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2021-11-17 00:54:16,115 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2021-11-17 00:54:16,121 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2021-11-17 00:54:16,121 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:16,122 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:16,122 INFO L402 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:16,125 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:16,125 INFO L85 PathProgramCache]: Analyzing trace with hash 742124414, now seen corresponding path program 1 times [2021-11-17 00:54:16,131 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-11-17 00:54:16,131 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1402531148] [2021-11-17 00:54:16,132 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:16,132 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-11-17 00:54:16,227 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:16,314 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-11-17 00:54:16,317 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:16,325 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-11-17 00:54:16,327 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:16,334 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-11-17 00:54:16,336 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:16,342 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-11-17 00:54:16,343 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:16,349 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-11-17 00:54:16,350 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:16,357 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-11-17 00:54:16,358 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-11-17 00:54:16,358 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1402531148] [2021-11-17 00:54:16,358 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1402531148] provided 1 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:16,359 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:16,359 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2021-11-17 00:54:16,360 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [67039653] [2021-11-17 00:54:16,360 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:16,363 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2021-11-17 00:54:16,363 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-11-17 00:54:16,378 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2021-11-17 00:54:16,378 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2021-11-17 00:54:16,381 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:17,176 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:17,176 INFO L93 Difference]: Finished difference Result 1541 states and 2218 transitions. [2021-11-17 00:54:17,177 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-11-17 00:54:17,178 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2021-11-17 00:54:17,179 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:17,190 INFO L225 Difference]: With dead ends: 1541 [2021-11-17 00:54:17,191 INFO L226 Difference]: Without dead ends: 1042 [2021-11-17 00:54:17,195 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 15 GetRequests, 12 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2021-11-17 00:54:17,197 INFO L933 BasicCegarLoop]: 706 mSDtfsCounter, 1084 mSDsluCounter, 811 mSDsCounter, 0 mSdLazyCounter, 408 mSolverCounterSat, 282 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.5s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1162 SdHoareTripleChecker+Valid, 1517 SdHoareTripleChecker+Invalid, 690 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 282 IncrementalHoareTripleChecker+Valid, 408 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.7s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:17,198 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1162 Valid, 1517 Invalid, 690 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [282 Valid, 408 Invalid, 0 Unknown, 0 Unchecked, 0.7s Time] [2021-11-17 00:54:17,209 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1042 states. [2021-11-17 00:54:17,260 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1042 to 924. [2021-11-17 00:54:17,262 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-11-17 00:54:17,265 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2021-11-17 00:54:17,267 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2021-11-17 00:54:17,267 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:17,267 INFO L470 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2021-11-17 00:54:17,267 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:17,267 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2021-11-17 00:54:17,269 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2021-11-17 00:54:17,269 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:17,270 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:17,270 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable0 [2021-11-17 00:54:17,270 INFO L402 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:17,270 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:17,271 INFO L85 PathProgramCache]: Analyzing trace with hash -2097093995, now seen corresponding path program 1 times [2021-11-17 00:54:17,271 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-11-17 00:54:17,271 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1514518793] [2021-11-17 00:54:17,271 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:17,271 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-11-17 00:54:17,317 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:17,354 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-11-17 00:54:17,356 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:17,359 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-11-17 00:54:17,360 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:17,363 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-11-17 00:54:17,364 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:17,368 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-11-17 00:54:17,369 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:17,373 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-11-17 00:54:17,374 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:17,377 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-11-17 00:54:17,377 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-11-17 00:54:17,377 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1514518793] [2021-11-17 00:54:17,377 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1514518793] provided 1 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:17,378 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:17,378 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2021-11-17 00:54:17,378 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [57691572] [2021-11-17 00:54:17,378 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:17,379 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-11-17 00:54:17,379 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-11-17 00:54:17,379 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-11-17 00:54:17,380 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-11-17 00:54:17,380 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:18,002 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:18,002 INFO L93 Difference]: Finished difference Result 1951 states and 2732 transitions. [2021-11-17 00:54:18,003 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-11-17 00:54:18,003 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2021-11-17 00:54:18,003 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:18,008 INFO L225 Difference]: With dead ends: 1951 [2021-11-17 00:54:18,009 INFO L226 Difference]: Without dead ends: 1041 [2021-11-17 00:54:18,012 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 18 GetRequests, 13 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=15, Invalid=27, Unknown=0, NotChecked=0, Total=42 [2021-11-17 00:54:18,013 INFO L933 BasicCegarLoop]: 740 mSDtfsCounter, 987 mSDsluCounter, 887 mSDsCounter, 0 mSdLazyCounter, 381 mSolverCounterSat, 247 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.5s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1049 SdHoareTripleChecker+Valid, 1627 SdHoareTripleChecker+Invalid, 628 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 247 IncrementalHoareTripleChecker+Valid, 381 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.5s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:18,013 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1049 Valid, 1627 Invalid, 628 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [247 Valid, 381 Invalid, 0 Unknown, 0 Unchecked, 0.5s Time] [2021-11-17 00:54:18,015 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1041 states. [2021-11-17 00:54:18,041 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1041 to 923. [2021-11-17 00:54:18,043 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-11-17 00:54:18,046 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2021-11-17 00:54:18,047 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2021-11-17 00:54:18,048 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:18,048 INFO L470 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2021-11-17 00:54:18,048 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:18,048 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2021-11-17 00:54:18,070 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2021-11-17 00:54:18,071 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:18,071 INFO L514 BasicCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:18,071 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable1 [2021-11-17 00:54:18,071 INFO L402 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:18,072 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:18,073 INFO L85 PathProgramCache]: Analyzing trace with hash 171125928, now seen corresponding path program 1 times [2021-11-17 00:54:18,073 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-11-17 00:54:18,073 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1351312654] [2021-11-17 00:54:18,073 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:18,073 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-11-17 00:54:18,095 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,179 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-11-17 00:54:18,180 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,186 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-11-17 00:54:18,188 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,192 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-11-17 00:54:18,193 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,197 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-11-17 00:54:18,198 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,202 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-11-17 00:54:18,204 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,208 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2021-11-17 00:54:18,210 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,215 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2021-11-17 00:54:18,217 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:18,222 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 89 trivial. 0 not checked. [2021-11-17 00:54:18,222 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-11-17 00:54:18,222 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1351312654] [2021-11-17 00:54:18,222 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1351312654] provided 1 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:18,223 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:18,223 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2021-11-17 00:54:18,223 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [325915791] [2021-11-17 00:54:18,223 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:18,224 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 6 states [2021-11-17 00:54:18,224 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-11-17 00:54:18,224 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2021-11-17 00:54:18,224 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2021-11-17 00:54:18,225 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-11-17 00:54:18,949 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:18,949 INFO L93 Difference]: Finished difference Result 2974 states and 4185 transitions. [2021-11-17 00:54:18,950 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2021-11-17 00:54:18,950 INFO L78 Accepts]: Start accepts. Automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2021-11-17 00:54:18,950 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:18,975 INFO L225 Difference]: With dead ends: 2974 [2021-11-17 00:54:18,979 INFO L226 Difference]: Without dead ends: 2060 [2021-11-17 00:54:18,983 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 23 GetRequests, 16 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=49, Unknown=0, NotChecked=0, Total=72 [2021-11-17 00:54:18,988 INFO L933 BasicCegarLoop]: 690 mSDtfsCounter, 1091 mSDsluCounter, 2067 mSDsCounter, 0 mSdLazyCounter, 715 mSolverCounterSat, 270 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.5s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1173 SdHoareTripleChecker+Valid, 2757 SdHoareTripleChecker+Invalid, 985 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 270 IncrementalHoareTripleChecker+Valid, 715 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.6s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:18,989 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1173 Valid, 2757 Invalid, 985 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [270 Valid, 715 Invalid, 0 Unknown, 0 Unchecked, 0.6s Time] [2021-11-17 00:54:18,991 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2060 states. [2021-11-17 00:54:19,068 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2060 to 1924. [2021-11-17 00:54:19,070 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1437 states have (on average 1.3625608907446067) internal successors, (1958), 1469 states have internal predecessors, (1958), 358 states have call successors, (358), 121 states have call predecessors, (358), 128 states have return successors, (381), 363 states have call predecessors, (381), 357 states have call successors, (381) [2021-11-17 00:54:19,077 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2697 transitions. [2021-11-17 00:54:19,077 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2697 transitions. Word has length 71 [2021-11-17 00:54:19,078 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:19,078 INFO L470 AbstractCegarLoop]: Abstraction has 1924 states and 2697 transitions. [2021-11-17 00:54:19,078 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-11-17 00:54:19,079 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2697 transitions. [2021-11-17 00:54:19,083 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2021-11-17 00:54:19,084 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:19,084 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:19,084 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable2 [2021-11-17 00:54:19,084 INFO L402 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:19,085 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:19,085 INFO L85 PathProgramCache]: Analyzing trace with hash 1729160309, now seen corresponding path program 1 times [2021-11-17 00:54:19,085 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-11-17 00:54:19,085 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1420363535] [2021-11-17 00:54:19,085 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:19,085 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-11-17 00:54:19,105 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,135 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-11-17 00:54:19,136 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,139 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-11-17 00:54:19,139 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,142 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-11-17 00:54:19,143 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,145 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-11-17 00:54:19,146 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,148 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-11-17 00:54:19,148 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,151 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 37 [2021-11-17 00:54:19,151 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,154 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 43 [2021-11-17 00:54:19,154 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,157 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 48 [2021-11-17 00:54:19,157 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,159 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 57 [2021-11-17 00:54:19,160 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,162 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 63 [2021-11-17 00:54:19,163 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,172 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 69 [2021-11-17 00:54:19,177 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,183 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-11-17 00:54:19,187 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,221 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-11-17 00:54:19,224 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,246 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 91 [2021-11-17 00:54:19,248 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,255 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 97 [2021-11-17 00:54:19,256 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,259 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 114 [2021-11-17 00:54:19,263 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,270 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 120 [2021-11-17 00:54:19,272 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,282 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 14 proven. 4 refuted. 0 times theorem prover too weak. 107 trivial. 0 not checked. [2021-11-17 00:54:19,283 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-11-17 00:54:19,283 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1420363535] [2021-11-17 00:54:19,284 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1420363535] provided 0 perfect and 1 imperfect interpolant sequences [2021-11-17 00:54:19,284 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleZ3 [841439105] [2021-11-17 00:54:19,284 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:19,284 INFO L168 SolverBuilder]: Constructing external solver with command: z3 -smt2 -in SMTLIB2_COMPLIANT=true [2021-11-17 00:54:19,284 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-11-17 00:54:19,304 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (exit command is (exit), workingDir is null) [2021-11-17 00:54:19,306 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Waiting until timeout for monitored process [2021-11-17 00:54:19,570 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:19,576 INFO L263 TraceCheckSpWp]: Trace formula consists of 913 conjuncts, 17 conjunts are in the unsatisfiable core [2021-11-17 00:54:19,583 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-11-17 00:54:19,895 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 62 proven. 0 refuted. 0 times theorem prover too weak. 63 trivial. 0 not checked. [2021-11-17 00:54:19,895 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-11-17 00:54:19,895 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleZ3 [841439105] provided 1 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:19,896 INFO L186 FreeRefinementEngine]: Found 1 perfect and 1 imperfect interpolant sequences. [2021-11-17 00:54:19,896 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [7] total 7 [2021-11-17 00:54:19,896 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [905038672] [2021-11-17 00:54:19,896 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:19,896 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-11-17 00:54:19,897 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-11-17 00:54:19,897 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-11-17 00:54:19,897 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2021-11-17 00:54:19,897 INFO L87 Difference]: Start difference. First operand 1924 states and 2697 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-11-17 00:54:19,994 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:19,994 INFO L93 Difference]: Finished difference Result 3838 states and 5422 transitions. [2021-11-17 00:54:19,995 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-11-17 00:54:19,995 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2021-11-17 00:54:19,996 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:20,004 INFO L225 Difference]: With dead ends: 3838 [2021-11-17 00:54:20,005 INFO L226 Difference]: Without dead ends: 1928 [2021-11-17 00:54:20,012 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 181 GetRequests, 173 SyntacticMatches, 3 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2021-11-17 00:54:20,013 INFO L933 BasicCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1969 mSDsCounter, 0 mSdLazyCounter, 11 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2627 SdHoareTripleChecker+Invalid, 12 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 11 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:20,014 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [2 Valid, 2627 Invalid, 12 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 11 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2021-11-17 00:54:20,047 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1928 states. [2021-11-17 00:54:20,095 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1928 to 1924. [2021-11-17 00:54:20,098 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1433 states have (on average 1.357990230286113) internal successors, (1946), 1467 states have internal predecessors, (1946), 358 states have call successors, (358), 121 states have call predecessors, (358), 132 states have return successors, (392), 365 states have call predecessors, (392), 357 states have call successors, (392) [2021-11-17 00:54:20,105 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2696 transitions. [2021-11-17 00:54:20,106 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2696 transitions. Word has length 141 [2021-11-17 00:54:20,106 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:20,106 INFO L470 AbstractCegarLoop]: Abstraction has 1924 states and 2696 transitions. [2021-11-17 00:54:20,107 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-11-17 00:54:20,107 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2696 transitions. [2021-11-17 00:54:20,111 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2021-11-17 00:54:20,111 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:20,112 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:20,137 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Forceful destruction successful, exit code 0 [2021-11-17 00:54:20,327 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable3,2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true [2021-11-17 00:54:20,327 INFO L402 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:20,328 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:20,328 INFO L85 PathProgramCache]: Analyzing trace with hash 568539780, now seen corresponding path program 1 times [2021-11-17 00:54:20,328 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-11-17 00:54:20,328 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [591489163] [2021-11-17 00:54:20,328 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:20,328 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-11-17 00:54:20,410 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,486 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-11-17 00:54:20,487 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,490 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-11-17 00:54:20,492 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,495 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-11-17 00:54:20,496 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,512 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-11-17 00:54:20,513 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,516 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-11-17 00:54:20,517 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,520 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2021-11-17 00:54:20,521 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,524 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2021-11-17 00:54:20,526 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,529 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 61 [2021-11-17 00:54:20,530 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,532 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 67 [2021-11-17 00:54:20,533 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,536 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 72 [2021-11-17 00:54:20,537 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,539 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 81 [2021-11-17 00:54:20,540 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,542 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 87 [2021-11-17 00:54:20,543 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,553 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 93 [2021-11-17 00:54:20,561 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,614 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-11-17 00:54:20,621 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,677 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-11-17 00:54:20,681 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,751 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 3 [2021-11-17 00:54:20,753 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,781 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 122 [2021-11-17 00:54:20,782 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,786 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 128 [2021-11-17 00:54:20,787 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:20,791 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-11-17 00:54:20,791 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-11-17 00:54:20,791 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [591489163] [2021-11-17 00:54:20,791 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [591489163] provided 1 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:20,792 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:20,792 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [16] imperfect sequences [] total 16 [2021-11-17 00:54:20,792 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1977681732] [2021-11-17 00:54:20,792 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:20,792 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 16 states [2021-11-17 00:54:20,793 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-11-17 00:54:20,793 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 16 interpolants. [2021-11-17 00:54:20,793 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=31, Invalid=209, Unknown=0, NotChecked=0, Total=240 [2021-11-17 00:54:20,793 INFO L87 Difference]: Start difference. First operand 1924 states and 2696 transitions. Second operand has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-11-17 00:54:22,135 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:22,136 INFO L93 Difference]: Finished difference Result 3994 states and 5630 transitions. [2021-11-17 00:54:22,136 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 15 states. [2021-11-17 00:54:22,137 INFO L78 Accepts]: Start accepts. Automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) Word has length 148 [2021-11-17 00:54:22,137 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:22,146 INFO L225 Difference]: With dead ends: 3994 [2021-11-17 00:54:22,146 INFO L226 Difference]: Without dead ends: 2084 [2021-11-17 00:54:22,152 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 58 GetRequests, 37 SyntacticMatches, 0 SemanticMatches, 21 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 41 ImplicationChecksByTransitivity, 0.2s TimeCoverageRelationStatistics Valid=69, Invalid=437, Unknown=0, NotChecked=0, Total=506 [2021-11-17 00:54:22,153 INFO L933 BasicCegarLoop]: 620 mSDtfsCounter, 511 mSDsluCounter, 6191 mSDsCounter, 0 mSdLazyCounter, 1806 mSolverCounterSat, 228 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.9s Time, 0 mProtectedPredicate, 0 mProtectedAction, 532 SdHoareTripleChecker+Valid, 6811 SdHoareTripleChecker+Invalid, 2034 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 228 IncrementalHoareTripleChecker+Valid, 1806 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.1s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:22,153 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [532 Valid, 6811 Invalid, 2034 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [228 Valid, 1806 Invalid, 0 Unknown, 0 Unchecked, 1.1s Time] [2021-11-17 00:54:22,155 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2084 states. [2021-11-17 00:54:22,203 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2084 to 1954. [2021-11-17 00:54:22,206 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1954 states, 1455 states have (on average 1.3484536082474228) internal successors, (1962), 1489 states have internal predecessors, (1962), 364 states have call successors, (364), 121 states have call predecessors, (364), 134 states have return successors, (402), 373 states have call predecessors, (402), 363 states have call successors, (402) [2021-11-17 00:54:22,214 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1954 states to 1954 states and 2728 transitions. [2021-11-17 00:54:22,215 INFO L78 Accepts]: Start accepts. Automaton has 1954 states and 2728 transitions. Word has length 148 [2021-11-17 00:54:22,215 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:22,215 INFO L470 AbstractCegarLoop]: Abstraction has 1954 states and 2728 transitions. [2021-11-17 00:54:22,215 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-11-17 00:54:22,215 INFO L276 IsEmpty]: Start isEmpty. Operand 1954 states and 2728 transitions. [2021-11-17 00:54:22,220 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2021-11-17 00:54:22,220 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:22,220 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:22,220 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable4 [2021-11-17 00:54:22,221 INFO L402 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:22,221 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:22,221 INFO L85 PathProgramCache]: Analyzing trace with hash -799997024, now seen corresponding path program 1 times [2021-11-17 00:54:22,221 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-11-17 00:54:22,221 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1294361065] [2021-11-17 00:54:22,222 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:22,222 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-11-17 00:54:22,435 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-11-17 00:54:22,435 INFO L355 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2021-11-17 00:54:22,507 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-11-17 00:54:22,572 INFO L133 FreeRefinementEngine]: Strategy CAMEL found a feasible trace [2021-11-17 00:54:22,573 INFO L628 BasicCegarLoop]: Counterexample is feasible [2021-11-17 00:54:22,574 INFO L764 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2021-11-17 00:54:22,575 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable5 [2021-11-17 00:54:22,577 INFO L732 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2021-11-17 00:54:22,579 INFO L179 ceAbstractionStarter]: Computing trace abstraction results [2021-11-17 00:54:22,603 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,604 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,605 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,605 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,605 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,605 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,606 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,606 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,606 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,606 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:22,689 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 17.11 12:54:22 BoogieIcfgContainer [2021-11-17 00:54:22,689 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2021-11-17 00:54:22,690 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2021-11-17 00:54:22,690 INFO L271 PluginConnector]: Initializing Witness Printer... [2021-11-17 00:54:22,690 INFO L275 PluginConnector]: Witness Printer initialized [2021-11-17 00:54:22,690 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 17.11 12:54:16" (3/4) ... [2021-11-17 00:54:22,692 INFO L140 WitnessPrinter]: No result that supports witness generation found [2021-11-17 00:54:22,693 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2021-11-17 00:54:22,693 INFO L158 Benchmark]: Toolchain (without parser) took 9301.43ms. Allocated memory was 138.4MB in the beginning and 396.4MB in the end (delta: 257.9MB). Free memory was 96.7MB in the beginning and 226.2MB in the end (delta: -129.5MB). Peak memory consumption was 127.8MB. Max. memory is 16.1GB. [2021-11-17 00:54:22,693 INFO L158 Benchmark]: CDTParser took 0.09ms. Allocated memory is still 75.5MB. Free memory is still 33.4MB. There was no memory consumed. Max. memory is 16.1GB. [2021-11-17 00:54:22,694 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1199.73ms. Allocated memory was 138.4MB in the beginning and 232.8MB in the end (delta: 94.4MB). Free memory was 96.7MB in the beginning and 158.3MB in the end (delta: -61.6MB). Peak memory consumption was 60.4MB. Max. memory is 16.1GB. [2021-11-17 00:54:22,694 INFO L158 Benchmark]: Boogie Procedure Inliner took 126.41ms. Allocated memory is still 232.8MB. Free memory was 158.3MB in the beginning and 150.9MB in the end (delta: 7.3MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2021-11-17 00:54:22,694 INFO L158 Benchmark]: Boogie Preprocessor took 87.56ms. Allocated memory is still 232.8MB. Free memory was 149.9MB in the beginning and 142.5MB in the end (delta: 7.3MB). Peak memory consumption was 6.3MB. Max. memory is 16.1GB. [2021-11-17 00:54:22,694 INFO L158 Benchmark]: RCFGBuilder took 1238.28ms. Allocated memory is still 232.8MB. Free memory was 142.5MB in the beginning and 132.7MB in the end (delta: 9.9MB). Peak memory consumption was 41.3MB. Max. memory is 16.1GB. [2021-11-17 00:54:22,694 INFO L158 Benchmark]: TraceAbstraction took 6638.44ms. Allocated memory was 232.8MB in the beginning and 396.4MB in the end (delta: 163.6MB). Free memory was 132.7MB in the beginning and 227.2MB in the end (delta: -94.6MB). Peak memory consumption was 70.1MB. Max. memory is 16.1GB. [2021-11-17 00:54:22,695 INFO L158 Benchmark]: Witness Printer took 3.01ms. Allocated memory is still 396.4MB. Free memory is still 226.2MB. There was no memory consumed. Max. memory is 16.1GB. [2021-11-17 00:54:22,696 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.09ms. Allocated memory is still 75.5MB. Free memory is still 33.4MB. There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1199.73ms. Allocated memory was 138.4MB in the beginning and 232.8MB in the end (delta: 94.4MB). Free memory was 96.7MB in the beginning and 158.3MB in the end (delta: -61.6MB). Peak memory consumption was 60.4MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 126.41ms. Allocated memory is still 232.8MB. Free memory was 158.3MB in the beginning and 150.9MB in the end (delta: 7.3MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 87.56ms. Allocated memory is still 232.8MB. Free memory was 149.9MB in the beginning and 142.5MB in the end (delta: 7.3MB). Peak memory consumption was 6.3MB. Max. memory is 16.1GB. * RCFGBuilder took 1238.28ms. Allocated memory is still 232.8MB. Free memory was 142.5MB in the beginning and 132.7MB in the end (delta: 9.9MB). Peak memory consumption was 41.3MB. Max. memory is 16.1GB. * TraceAbstraction took 6638.44ms. Allocated memory was 232.8MB in the beginning and 396.4MB in the end (delta: 163.6MB). Free memory was 132.7MB in the beginning and 227.2MB in the end (delta: -94.6MB). Peak memory consumption was 70.1MB. Max. memory is 16.1GB. * Witness Printer took 3.01ms. Allocated memory is still 396.4MB. Free memory is still 226.2MB. There was no memory consumed. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - UnprovableResult [Line: 5554]: Unable to prove that call to reach_error is unreachable Unable to prove that call to reach_error is unreachable Reason: overapproximation of bitwiseOr at line 5123. Possible FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=40, tmp___0=-13] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg4=62273, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=232, tmp___0=-15] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg4=62273, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=3264, tmp___0=-5] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=1, tmp___0=-6] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=1, tmp___0=-7] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={19:0}, set_impl={19:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=232, tmp___0=-9] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=3264, tmp___0=-10] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, dev_to_hdlc(dev)={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, state(hdlc)={18446744073709548391:-8}, tmp={0:0}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, st->last_poll=0, st->settings.timeout=0, st->up=18446744073709548363, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, st->rxseq=18446744073709548374, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=18446744073709548374, \result=18446744073709548374, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, val=18446744073709548374] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=18446744073709548374, \result=18446744073709548374, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp=4294964054, val=18446744073709548374] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=18446744073709548352, __fswab32(st->rxseq)=18446744073709548374, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, st->rxseq=18446744073709548374, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, st->txseq=-11, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=-11, \result=-11, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, val=-11] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=-11, \result=-11, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp=4294967285, val=-11] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=18446744073709548352, __fswab32(st->txseq)=-11, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, st->txseq=-11, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={18446744073709548369:18446744073709548389}, calloc(1UL, size)={-18446744073709551615:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551615:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=248, tmp={-18446744073709551615:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, cond=1, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={18446744073709548369:18446744073709548389}, calloc(1UL, size)={-18446744073709551615:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551615:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=248, tmp={-18446744073709551615:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={-18446744073709551615:0}, __this_module={18446744073709548369:18446744073709548389}, calloc(1UL, size)={-18446744073709551615:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551615:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=248, tmp={-18446744073709551615:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={-18446744073709551615:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, skb={-18446744073709551615:0}, tmp___7={-18446744073709551615:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={19:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={19:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={19:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={19:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={-18446744073709551615:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, skb={-18446744073709551615:0}, tmp___7={-18446744073709551615:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={-18446744073709551615:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={-18446744073709551615:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={-18446744073709551615:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, size=1, tmp___0=-14] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, arg0={-18446744073709551615:0}, arg0={-18446744073709551615:0}, arg1=4, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={23:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={19:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={23:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={19:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=18446744073709548375, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={23:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={19:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={23:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={19:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, tmp=62295, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __this_module={18446744073709548369:18446744073709548389}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, skb={-18446744073709551615:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __fswab32(type)=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, data={23:68}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, skb={-18446744073709551615:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, data={23:68}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, skb={-18446744073709551615:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, val=300000] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp=300000, val=300000] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=300000, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, data={23:68}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, skb={-18446744073709551615:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={23:0}, __this_module={18446744073709548369:18446744073709548389}, arg0={-18446744073709551615:0}, arg0={-18446744073709551615:0}, arg1=18, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={23:0}, set_impl={19:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={19:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] [L5554] reach_error() VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={20:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={19:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 6.5s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 3.7s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, PartialOrderReductionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 3918 SdHoareTripleChecker+Valid, 3.0s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 3675 mSDsluCounter, 15339 SdHoareTripleChecker+Invalid, 2.5s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 11925 mSDsCounter, 1028 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 3321 IncrementalHoareTripleChecker+Invalid, 4349 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 1028 mSolverCounterUnsat, 3414 mSDtfsCounter, 3321 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 295 GetRequests, 251 SyntacticMatches, 3 SemanticMatches, 41 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 50 ImplicationChecksByTransitivity, 0.3s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1954occurred in iteration=5, InterpolantAutomatonStates: 37, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.3s AutomataMinimizationTime, 5 MinimizatonAttempts, 506 StatesRemovedByMinimization, 5 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.1s SsaConstructionTime, 0.4s SatisfiabilityAnalysisTime, 1.2s InterpolantComputationTime, 781 NumberOfCodeBlocks, 781 NumberOfCodeBlocksAsserted, 7 NumberOfCheckSat, 592 ConstructedInterpolants, 0 QuantifiedInterpolants, 1351 SizeOfPredicates, 2 NumberOfNonLiveVariables, 913 ConjunctsInSsa, 17 ConjunctsInUnsatCore, 6 InterpolantComputations, 5 PerfectInterpolantSequences, 540/544 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces [2021-11-17 00:54:22,728 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis ### Bit-precise run ### Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.1-dev-0f8a17c [2021-11-17 00:54:24,539 INFO L177 SettingsManager]: Resetting all preferences to default values... [2021-11-17 00:54:24,541 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2021-11-17 00:54:24,575 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2021-11-17 00:54:24,575 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2021-11-17 00:54:24,577 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2021-11-17 00:54:24,578 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2021-11-17 00:54:24,583 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2021-11-17 00:54:24,585 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2021-11-17 00:54:24,589 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2021-11-17 00:54:24,590 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2021-11-17 00:54:24,591 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2021-11-17 00:54:24,591 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2021-11-17 00:54:24,593 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2021-11-17 00:54:24,594 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2021-11-17 00:54:24,599 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2021-11-17 00:54:24,600 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2021-11-17 00:54:24,600 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2021-11-17 00:54:24,602 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2021-11-17 00:54:24,606 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2021-11-17 00:54:24,607 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2021-11-17 00:54:24,608 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2021-11-17 00:54:24,609 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2021-11-17 00:54:24,610 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2021-11-17 00:54:24,615 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2021-11-17 00:54:24,616 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2021-11-17 00:54:24,616 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2021-11-17 00:54:24,617 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2021-11-17 00:54:24,618 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2021-11-17 00:54:24,618 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2021-11-17 00:54:24,619 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2021-11-17 00:54:24,619 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2021-11-17 00:54:24,620 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2021-11-17 00:54:24,621 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2021-11-17 00:54:24,622 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2021-11-17 00:54:24,622 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2021-11-17 00:54:24,622 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2021-11-17 00:54:24,622 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2021-11-17 00:54:24,623 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2021-11-17 00:54:24,624 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2021-11-17 00:54:24,624 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2021-11-17 00:54:24,628 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf [2021-11-17 00:54:24,658 INFO L113 SettingsManager]: Loading preferences was successful [2021-11-17 00:54:24,659 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2021-11-17 00:54:24,660 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2021-11-17 00:54:24,660 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2021-11-17 00:54:24,661 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2021-11-17 00:54:24,661 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2021-11-17 00:54:24,662 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2021-11-17 00:54:24,662 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2021-11-17 00:54:24,662 INFO L138 SettingsManager]: * Use SBE=true [2021-11-17 00:54:24,663 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2021-11-17 00:54:24,663 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * Use bitvectors instead of ints=true [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * Use constant arrays=true [2021-11-17 00:54:24,664 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2021-11-17 00:54:24,674 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2021-11-17 00:54:24,674 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2021-11-17 00:54:24,674 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2021-11-17 00:54:24,674 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-11-17 00:54:24,674 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2021-11-17 00:54:24,675 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2021-11-17 00:54:24,675 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2021-11-17 00:54:24,675 INFO L138 SettingsManager]: * Trace refinement strategy=WOLF [2021-11-17 00:54:24,675 INFO L138 SettingsManager]: * Command for external solver=cvc4 --incremental --print-success --lang smt [2021-11-17 00:54:24,675 INFO L138 SettingsManager]: * Large block encoding in concurrent analysis=OFF [2021-11-17 00:54:24,675 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2021-11-17 00:54:24,675 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2021-11-17 00:54:24,676 INFO L138 SettingsManager]: * Trace refinement exception blacklist=NONE [2021-11-17 00:54:24,676 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2021-11-17 00:54:24,676 INFO L138 SettingsManager]: * Logic for external solver=AUFBV WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2021-11-17 00:54:24,984 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2021-11-17 00:54:25,008 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2021-11-17 00:54:25,011 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2021-11-17 00:54:25,011 INFO L271 PluginConnector]: Initializing CDTParser... [2021-11-17 00:54:25,012 INFO L275 PluginConnector]: CDTParser initialized [2021-11-17 00:54:25,013 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-11-17 00:54:25,061 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/bbcc2c670/5d55f10c6e8345e58dc8e325fc033d53/FLAGe2eeade03 [2021-11-17 00:54:25,570 INFO L306 CDTParser]: Found 1 translation units. [2021-11-17 00:54:25,570 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-11-17 00:54:25,602 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/bbcc2c670/5d55f10c6e8345e58dc8e325fc033d53/FLAGe2eeade03 [2021-11-17 00:54:25,795 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/bbcc2c670/5d55f10c6e8345e58dc8e325fc033d53 [2021-11-17 00:54:25,797 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2021-11-17 00:54:25,798 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2021-11-17 00:54:25,799 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2021-11-17 00:54:25,799 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2021-11-17 00:54:25,802 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2021-11-17 00:54:25,802 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 17.11 12:54:25" (1/1) ... [2021-11-17 00:54:25,803 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@5aa19b73 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:25, skipping insertion in model container [2021-11-17 00:54:25,803 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 17.11 12:54:25" (1/1) ... [2021-11-17 00:54:25,807 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2021-11-17 00:54:25,894 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-11-17 00:54:26,438 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-11-17 00:54:26,643 INFO L207 PostProcessor]: Analyzing one entry point: main [2021-11-17 00:54:26,658 INFO L203 MainTranslator]: Completed pre-run [2021-11-17 00:54:26,763 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-11-17 00:54:26,838 INFO L207 PostProcessor]: Analyzing one entry point: main [2021-11-17 00:54:26,877 INFO L208 MainTranslator]: Completed translation [2021-11-17 00:54:26,878 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26 WrapperNode [2021-11-17 00:54:26,878 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2021-11-17 00:54:26,879 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2021-11-17 00:54:26,879 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2021-11-17 00:54:26,879 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2021-11-17 00:54:26,883 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:26,926 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:26,986 INFO L137 Inliner]: procedures = 158, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1387 [2021-11-17 00:54:26,986 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2021-11-17 00:54:26,987 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2021-11-17 00:54:26,987 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2021-11-17 00:54:26,987 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2021-11-17 00:54:26,993 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:26,993 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:27,010 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:27,010 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:27,072 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:27,080 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:27,114 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:27,134 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2021-11-17 00:54:27,152 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2021-11-17 00:54:27,153 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2021-11-17 00:54:27,153 INFO L275 PluginConnector]: RCFGBuilder initialized [2021-11-17 00:54:27,154 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (1/1) ... [2021-11-17 00:54:27,159 INFO L168 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-11-17 00:54:27,165 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-11-17 00:54:27,188 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2021-11-17 00:54:27,206 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2021-11-17 00:54:27,216 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2021-11-17 00:54:27,216 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2021-11-17 00:54:27,216 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE1 [2021-11-17 00:54:27,217 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE8 [2021-11-17 00:54:27,217 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2021-11-17 00:54:27,217 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2021-11-17 00:54:27,217 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE2 [2021-11-17 00:54:27,217 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2021-11-17 00:54:27,217 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2021-11-17 00:54:27,217 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2021-11-17 00:54:27,217 INFO L130 BoogieDeclarations]: Found specification of procedure state [2021-11-17 00:54:27,218 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2021-11-17 00:54:27,218 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2021-11-17 00:54:27,218 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2021-11-17 00:54:27,218 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2021-11-17 00:54:27,218 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2021-11-17 00:54:27,218 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2021-11-17 00:54:27,218 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2021-11-17 00:54:27,218 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2021-11-17 00:54:27,219 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2021-11-17 00:54:27,219 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2021-11-17 00:54:27,219 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2021-11-17 00:54:27,219 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2021-11-17 00:54:27,219 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2021-11-17 00:54:27,219 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2021-11-17 00:54:27,219 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2021-11-17 00:54:27,219 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2021-11-17 00:54:27,220 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2021-11-17 00:54:27,220 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2021-11-17 00:54:27,220 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2021-11-17 00:54:27,220 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2021-11-17 00:54:27,220 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2021-11-17 00:54:27,220 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE4 [2021-11-17 00:54:27,220 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE2 [2021-11-17 00:54:27,220 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE1 [2021-11-17 00:54:27,221 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE8 [2021-11-17 00:54:27,221 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2021-11-17 00:54:27,221 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2021-11-17 00:54:27,221 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2021-11-17 00:54:27,221 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2021-11-17 00:54:27,221 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2021-11-17 00:54:27,222 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2021-11-17 00:54:27,222 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2021-11-17 00:54:27,222 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2021-11-17 00:54:27,222 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2021-11-17 00:54:27,222 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2021-11-17 00:54:27,222 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2021-11-17 00:54:27,222 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2021-11-17 00:54:27,223 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2021-11-17 00:54:27,223 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2021-11-17 00:54:27,223 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2021-11-17 00:54:27,223 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2021-11-17 00:54:27,223 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2021-11-17 00:54:27,223 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE8 [2021-11-17 00:54:27,223 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE2 [2021-11-17 00:54:27,224 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2021-11-17 00:54:27,224 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2021-11-17 00:54:27,225 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE4 [2021-11-17 00:54:27,225 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2021-11-17 00:54:27,225 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2021-11-17 00:54:27,225 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2021-11-17 00:54:27,225 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2021-11-17 00:54:27,226 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2021-11-17 00:54:27,226 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2021-11-17 00:54:27,226 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2021-11-17 00:54:27,226 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE8 [2021-11-17 00:54:27,226 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE1 [2021-11-17 00:54:27,226 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE2 [2021-11-17 00:54:27,226 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2021-11-17 00:54:27,226 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2021-11-17 00:54:27,227 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2021-11-17 00:54:27,227 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2021-11-17 00:54:27,227 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2021-11-17 00:54:27,227 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE1 [2021-11-17 00:54:27,227 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2021-11-17 00:54:27,227 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2021-11-17 00:54:27,227 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2021-11-17 00:54:27,228 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2021-11-17 00:54:27,228 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2021-11-17 00:54:27,228 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2021-11-17 00:54:27,228 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2021-11-17 00:54:27,228 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2021-11-17 00:54:27,228 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2021-11-17 00:54:27,229 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2021-11-17 00:54:27,229 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE1 [2021-11-17 00:54:27,229 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2021-11-17 00:54:27,229 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2021-11-17 00:54:27,229 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2021-11-17 00:54:27,229 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2021-11-17 00:54:27,230 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2021-11-17 00:54:27,230 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2021-11-17 00:54:27,230 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2021-11-17 00:54:27,230 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2021-11-17 00:54:27,575 INFO L236 CfgBuilder]: Building ICFG [2021-11-17 00:54:27,578 INFO L262 CfgBuilder]: Building CFG for each procedure with an implementation [2021-11-17 00:54:27,637 INFO L768 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2021-11-17 00:54:29,147 INFO L277 CfgBuilder]: Performing block encoding [2021-11-17 00:54:29,154 INFO L296 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2021-11-17 00:54:29,155 INFO L301 CfgBuilder]: Removed 1 assume(true) statements. [2021-11-17 00:54:29,156 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 17.11 12:54:29 BoogieIcfgContainer [2021-11-17 00:54:29,156 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2021-11-17 00:54:29,158 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2021-11-17 00:54:29,158 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2021-11-17 00:54:29,160 INFO L275 PluginConnector]: TraceAbstraction initialized [2021-11-17 00:54:29,160 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 17.11 12:54:25" (1/3) ... [2021-11-17 00:54:29,160 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@206f5886 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 17.11 12:54:29, skipping insertion in model container [2021-11-17 00:54:29,161 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 17.11 12:54:26" (2/3) ... [2021-11-17 00:54:29,161 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@206f5886 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 17.11 12:54:29, skipping insertion in model container [2021-11-17 00:54:29,161 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 17.11 12:54:29" (3/3) ... [2021-11-17 00:54:29,162 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-11-17 00:54:29,165 INFO L204 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2021-11-17 00:54:29,165 INFO L163 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2021-11-17 00:54:29,207 INFO L338 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2021-11-17 00:54:29,212 INFO L339 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mLoopAccelerationTechnique=FAST_UPR [2021-11-17 00:54:29,212 INFO L340 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2021-11-17 00:54:29,236 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2021-11-17 00:54:29,246 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2021-11-17 00:54:29,247 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:29,248 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:29,249 INFO L402 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:29,252 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:29,253 INFO L85 PathProgramCache]: Analyzing trace with hash -796223239, now seen corresponding path program 1 times [2021-11-17 00:54:29,263 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-11-17 00:54:29,264 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [10032563] [2021-11-17 00:54:29,265 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:29,268 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-11-17 00:54:29,272 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-11-17 00:54:29,274 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-11-17 00:54:29,308 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Waiting until timeout for monitored process [2021-11-17 00:54:29,566 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:29,573 INFO L263 TraceCheckSpWp]: Trace formula consists of 242 conjuncts, 2 conjunts are in the unsatisfiable core [2021-11-17 00:54:29,577 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-11-17 00:54:29,704 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-11-17 00:54:29,704 INFO L328 TraceCheckSpWp]: Computing backward predicates... [2021-11-17 00:54:29,843 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-11-17 00:54:29,843 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-11-17 00:54:29,843 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [10032563] [2021-11-17 00:54:29,844 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [10032563] provided 2 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:29,844 INFO L186 FreeRefinementEngine]: Found 2 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:29,844 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [3, 3] imperfect sequences [] total 4 [2021-11-17 00:54:29,845 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1845242749] [2021-11-17 00:54:29,846 INFO L85 oduleStraightlineAll]: Using 2 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:29,848 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2021-11-17 00:54:29,848 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-11-17 00:54:29,865 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2021-11-17 00:54:29,865 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=6, Invalid=6, Unknown=0, NotChecked=0, Total=12 [2021-11-17 00:54:29,868 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 4 states, 4 states have (on average 7.75) internal successors, (31), 4 states have internal predecessors, (31), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:30,838 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:30,838 INFO L93 Difference]: Finished difference Result 1874 states and 2678 transitions. [2021-11-17 00:54:30,851 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2021-11-17 00:54:30,852 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 7.75) internal successors, (31), 4 states have internal predecessors, (31), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2021-11-17 00:54:30,853 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:30,875 INFO L225 Difference]: With dead ends: 1874 [2021-11-17 00:54:30,876 INFO L226 Difference]: Without dead ends: 1370 [2021-11-17 00:54:30,884 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 92 GetRequests, 90 SyntacticMatches, 0 SemanticMatches, 2 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=6, Invalid=6, Unknown=0, NotChecked=0, Total=12 [2021-11-17 00:54:30,891 INFO L933 BasicCegarLoop]: 852 mSDtfsCounter, 1723 mSDsluCounter, 1102 mSDsCounter, 0 mSdLazyCounter, 203 mSolverCounterSat, 182 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.6s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1723 SdHoareTripleChecker+Valid, 1954 SdHoareTripleChecker+Invalid, 385 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 182 IncrementalHoareTripleChecker+Valid, 203 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.8s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:30,892 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1723 Valid, 1954 Invalid, 385 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [182 Valid, 203 Invalid, 0 Unknown, 0 Unchecked, 0.8s Time] [2021-11-17 00:54:30,907 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1370 states. [2021-11-17 00:54:31,006 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1370 to 1370. [2021-11-17 00:54:31,009 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1370 states, 1016 states have (on average 1.359251968503937) internal successors, (1381), 1037 states have internal predecessors, (1381), 263 states have call successors, (263), 91 states have call predecessors, (263), 90 states have return successors, (262), 262 states have call predecessors, (262), 262 states have call successors, (262) [2021-11-17 00:54:31,016 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1370 states to 1370 states and 1906 transitions. [2021-11-17 00:54:31,017 INFO L78 Accepts]: Start accepts. Automaton has 1370 states and 1906 transitions. Word has length 47 [2021-11-17 00:54:31,018 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:31,018 INFO L470 AbstractCegarLoop]: Abstraction has 1370 states and 1906 transitions. [2021-11-17 00:54:31,018 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 7.75) internal successors, (31), 4 states have internal predecessors, (31), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:31,018 INFO L276 IsEmpty]: Start isEmpty. Operand 1370 states and 1906 transitions. [2021-11-17 00:54:31,022 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2021-11-17 00:54:31,022 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:31,022 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:31,042 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Ended with exit code 0 [2021-11-17 00:54:31,231 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-11-17 00:54:31,231 INFO L402 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:31,232 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:31,232 INFO L85 PathProgramCache]: Analyzing trace with hash 566714884, now seen corresponding path program 1 times [2021-11-17 00:54:31,234 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-11-17 00:54:31,234 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1029179006] [2021-11-17 00:54:31,234 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:31,234 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-11-17 00:54:31,235 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-11-17 00:54:31,240 INFO L229 MonitoredProcess]: Starting monitored process 3 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-11-17 00:54:31,241 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Waiting until timeout for monitored process [2021-11-17 00:54:31,416 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:31,423 INFO L263 TraceCheckSpWp]: Trace formula consists of 246 conjuncts, 3 conjunts are in the unsatisfiable core [2021-11-17 00:54:31,425 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-11-17 00:54:31,528 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-11-17 00:54:31,528 INFO L328 TraceCheckSpWp]: Computing backward predicates... [2021-11-17 00:54:31,604 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-11-17 00:54:31,604 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-11-17 00:54:31,604 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1029179006] [2021-11-17 00:54:31,604 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1029179006] provided 2 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:31,604 INFO L186 FreeRefinementEngine]: Found 2 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:31,605 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4, 4] imperfect sequences [] total 4 [2021-11-17 00:54:31,605 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1717118922] [2021-11-17 00:54:31,605 INFO L85 oduleStraightlineAll]: Using 2 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:31,606 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2021-11-17 00:54:31,606 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-11-17 00:54:31,606 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2021-11-17 00:54:31,606 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2021-11-17 00:54:31,607 INFO L87 Difference]: Start difference. First operand 1370 states and 1906 transitions. Second operand has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:31,793 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:31,794 INFO L93 Difference]: Finished difference Result 2725 states and 3791 transitions. [2021-11-17 00:54:31,794 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2021-11-17 00:54:31,795 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2021-11-17 00:54:31,795 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:31,801 INFO L225 Difference]: With dead ends: 2725 [2021-11-17 00:54:31,802 INFO L226 Difference]: Without dead ends: 1369 [2021-11-17 00:54:31,805 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 100 GetRequests, 97 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2021-11-17 00:54:31,806 INFO L933 BasicCegarLoop]: 782 mSDtfsCounter, 794 mSDsluCounter, 671 mSDsCounter, 0 mSdLazyCounter, 36 mSolverCounterSat, 37 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 794 SdHoareTripleChecker+Valid, 1453 SdHoareTripleChecker+Invalid, 73 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 37 IncrementalHoareTripleChecker+Valid, 36 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:31,807 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [794 Valid, 1453 Invalid, 73 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [37 Valid, 36 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2021-11-17 00:54:31,809 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1369 states. [2021-11-17 00:54:31,862 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1369 to 1369. [2021-11-17 00:54:31,864 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1369 states, 1015 states have (on average 1.3566502463054186) internal successors, (1377), 1036 states have internal predecessors, (1377), 263 states have call successors, (263), 91 states have call predecessors, (263), 90 states have return successors, (262), 262 states have call predecessors, (262), 262 states have call successors, (262) [2021-11-17 00:54:31,870 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1369 states to 1369 states and 1902 transitions. [2021-11-17 00:54:31,871 INFO L78 Accepts]: Start accepts. Automaton has 1369 states and 1902 transitions. Word has length 50 [2021-11-17 00:54:31,872 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:31,872 INFO L470 AbstractCegarLoop]: Abstraction has 1369 states and 1902 transitions. [2021-11-17 00:54:31,873 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-11-17 00:54:31,873 INFO L276 IsEmpty]: Start isEmpty. Operand 1369 states and 1902 transitions. [2021-11-17 00:54:31,876 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2021-11-17 00:54:31,877 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:31,877 INFO L514 BasicCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:31,900 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Forceful destruction successful, exit code 0 [2021-11-17 00:54:32,087 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 3 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-11-17 00:54:32,088 INFO L402 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:32,088 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:32,088 INFO L85 PathProgramCache]: Analyzing trace with hash -965053755, now seen corresponding path program 1 times [2021-11-17 00:54:32,089 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-11-17 00:54:32,089 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [2045299126] [2021-11-17 00:54:32,089 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:32,089 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-11-17 00:54:32,089 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-11-17 00:54:32,090 INFO L229 MonitoredProcess]: Starting monitored process 4 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-11-17 00:54:32,097 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Waiting until timeout for monitored process [2021-11-17 00:54:32,288 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:32,296 INFO L263 TraceCheckSpWp]: Trace formula consists of 304 conjuncts, 4 conjunts are in the unsatisfiable core [2021-11-17 00:54:32,298 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-11-17 00:54:32,474 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 49 trivial. 0 not checked. [2021-11-17 00:54:32,475 INFO L328 TraceCheckSpWp]: Computing backward predicates... [2021-11-17 00:54:32,638 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 89 trivial. 0 not checked. [2021-11-17 00:54:32,638 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-11-17 00:54:32,638 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [2045299126] [2021-11-17 00:54:32,639 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [2045299126] provided 2 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:32,639 INFO L186 FreeRefinementEngine]: Found 2 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:32,639 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5, 5] imperfect sequences [] total 7 [2021-11-17 00:54:32,639 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1340291700] [2021-11-17 00:54:32,639 INFO L85 oduleStraightlineAll]: Using 2 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:32,640 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 7 states [2021-11-17 00:54:32,640 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-11-17 00:54:32,640 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 7 interpolants. [2021-11-17 00:54:32,640 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=13, Invalid=29, Unknown=0, NotChecked=0, Total=42 [2021-11-17 00:54:32,641 INFO L87 Difference]: Start difference. First operand 1369 states and 1902 transitions. Second operand has 7 states, 7 states have (on average 5.714285714285714) internal successors, (40), 7 states have internal predecessors, (40), 3 states have call successors, (10), 3 states have call predecessors, (10), 2 states have return successors, (9), 2 states have call predecessors, (9), 2 states have call successors, (9) [2021-11-17 00:54:32,784 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:32,784 INFO L93 Difference]: Finished difference Result 4076 states and 5696 transitions. [2021-11-17 00:54:32,785 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-11-17 00:54:32,785 INFO L78 Accepts]: Start accepts. Automaton has has 7 states, 7 states have (on average 5.714285714285714) internal successors, (40), 7 states have internal predecessors, (40), 3 states have call successors, (10), 3 states have call predecessors, (10), 2 states have return successors, (9), 2 states have call predecessors, (9), 2 states have call successors, (9) Word has length 71 [2021-11-17 00:54:32,785 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:32,798 INFO L225 Difference]: With dead ends: 4076 [2021-11-17 00:54:32,798 INFO L226 Difference]: Without dead ends: 2716 [2021-11-17 00:54:32,803 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 142 GetRequests, 135 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=26, Invalid=46, Unknown=0, NotChecked=0, Total=72 [2021-11-17 00:54:32,804 INFO L933 BasicCegarLoop]: 752 mSDtfsCounter, 627 mSDsluCounter, 2896 mSDsCounter, 0 mSdLazyCounter, 26 mSolverCounterSat, 2 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 627 SdHoareTripleChecker+Valid, 3648 SdHoareTripleChecker+Invalid, 28 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 2 IncrementalHoareTripleChecker+Valid, 26 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:32,804 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [627 Valid, 3648 Invalid, 28 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [2 Valid, 26 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2021-11-17 00:54:32,806 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2716 states. [2021-11-17 00:54:32,892 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2716 to 2716. [2021-11-17 00:54:32,896 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 2716 states, 2015 states have (on average 1.3573200992555832) internal successors, (2735), 2057 states have internal predecessors, (2735), 520 states have call successors, (520), 181 states have call predecessors, (520), 180 states have return successors, (534), 519 states have call predecessors, (534), 519 states have call successors, (534) [2021-11-17 00:54:32,908 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 2716 states to 2716 states and 3789 transitions. [2021-11-17 00:54:32,908 INFO L78 Accepts]: Start accepts. Automaton has 2716 states and 3789 transitions. Word has length 71 [2021-11-17 00:54:32,909 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:32,909 INFO L470 AbstractCegarLoop]: Abstraction has 2716 states and 3789 transitions. [2021-11-17 00:54:32,909 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 7 states, 7 states have (on average 5.714285714285714) internal successors, (40), 7 states have internal predecessors, (40), 3 states have call successors, (10), 3 states have call predecessors, (10), 2 states have return successors, (9), 2 states have call predecessors, (9), 2 states have call successors, (9) [2021-11-17 00:54:32,909 INFO L276 IsEmpty]: Start isEmpty. Operand 2716 states and 3789 transitions. [2021-11-17 00:54:32,916 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2021-11-17 00:54:32,917 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:32,917 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:32,939 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Ended with exit code 0 [2021-11-17 00:54:33,127 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 4 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-11-17 00:54:33,127 INFO L402 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:33,128 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:33,128 INFO L85 PathProgramCache]: Analyzing trace with hash -574025911, now seen corresponding path program 1 times [2021-11-17 00:54:33,130 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-11-17 00:54:33,130 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [2081535779] [2021-11-17 00:54:33,131 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:33,131 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-11-17 00:54:33,131 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-11-17 00:54:33,132 INFO L229 MonitoredProcess]: Starting monitored process 5 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-11-17 00:54:33,136 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Waiting until timeout for monitored process [2021-11-17 00:54:33,437 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:33,458 INFO L263 TraceCheckSpWp]: Trace formula consists of 530 conjuncts, 9 conjunts are in the unsatisfiable core [2021-11-17 00:54:33,462 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-11-17 00:54:33,696 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-11-17 00:54:33,697 INFO L328 TraceCheckSpWp]: Computing backward predicates... [2021-11-17 00:54:34,040 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-11-17 00:54:34,041 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-11-17 00:54:34,041 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [2081535779] [2021-11-17 00:54:34,041 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [2081535779] provided 2 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:34,041 INFO L186 FreeRefinementEngine]: Found 2 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:34,041 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5, 5] imperfect sequences [] total 5 [2021-11-17 00:54:34,041 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1657705892] [2021-11-17 00:54:34,041 INFO L85 oduleStraightlineAll]: Using 2 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:34,042 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-11-17 00:54:34,042 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-11-17 00:54:34,042 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-11-17 00:54:34,043 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-11-17 00:54:34,043 INFO L87 Difference]: Start difference. First operand 2716 states and 3789 transitions. Second operand has 5 states, 5 states have (on average 17.6) internal successors, (88), 4 states have internal predecessors, (88), 2 states have call successors, (20), 2 states have call predecessors, (20), 3 states have return successors, (19), 3 states have call predecessors, (19), 2 states have call successors, (19) [2021-11-17 00:54:34,135 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:34,135 INFO L93 Difference]: Finished difference Result 5454 states and 7655 transitions. [2021-11-17 00:54:34,136 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-11-17 00:54:34,136 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 17.6) internal successors, (88), 4 states have internal predecessors, (88), 2 states have call successors, (20), 2 states have call predecessors, (20), 3 states have return successors, (19), 3 states have call predecessors, (19), 2 states have call successors, (19) Word has length 141 [2021-11-17 00:54:34,136 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:34,149 INFO L225 Difference]: With dead ends: 5454 [2021-11-17 00:54:34,149 INFO L226 Difference]: Without dead ends: 2752 [2021-11-17 00:54:34,158 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 280 GetRequests, 277 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-11-17 00:54:34,159 INFO L933 BasicCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1969 mSDsCounter, 0 mSdLazyCounter, 11 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2627 SdHoareTripleChecker+Invalid, 12 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 11 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:34,159 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [2 Valid, 2627 Invalid, 12 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 11 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2021-11-17 00:54:34,162 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2752 states. [2021-11-17 00:54:34,260 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2752 to 2746. [2021-11-17 00:54:34,264 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 2746 states, 2036 states have (on average 1.3536345776031433) internal successors, (2756), 2081 states have internal predecessors, (2756), 520 states have call successors, (520), 181 states have call predecessors, (520), 189 states have return successors, (552), 525 states have call predecessors, (552), 519 states have call successors, (552) [2021-11-17 00:54:34,273 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 2746 states to 2746 states and 3828 transitions. [2021-11-17 00:54:34,274 INFO L78 Accepts]: Start accepts. Automaton has 2746 states and 3828 transitions. Word has length 141 [2021-11-17 00:54:34,274 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:34,274 INFO L470 AbstractCegarLoop]: Abstraction has 2746 states and 3828 transitions. [2021-11-17 00:54:34,275 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 17.6) internal successors, (88), 4 states have internal predecessors, (88), 2 states have call successors, (20), 2 states have call predecessors, (20), 3 states have return successors, (19), 3 states have call predecessors, (19), 2 states have call successors, (19) [2021-11-17 00:54:34,275 INFO L276 IsEmpty]: Start isEmpty. Operand 2746 states and 3828 transitions. [2021-11-17 00:54:34,281 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2021-11-17 00:54:34,281 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:34,282 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:34,297 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Forceful destruction successful, exit code 0 [2021-11-17 00:54:34,494 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 5 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-11-17 00:54:34,495 INFO L402 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:34,495 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:34,495 INFO L85 PathProgramCache]: Analyzing trace with hash -1293113785, now seen corresponding path program 1 times [2021-11-17 00:54:34,496 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-11-17 00:54:34,496 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [841075564] [2021-11-17 00:54:34,496 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:34,497 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-11-17 00:54:34,497 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-11-17 00:54:34,501 INFO L229 MonitoredProcess]: Starting monitored process 6 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-11-17 00:54:34,502 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Waiting until timeout for monitored process [2021-11-17 00:54:34,804 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-11-17 00:54:34,827 INFO L263 TraceCheckSpWp]: Trace formula consists of 553 conjuncts, 25 conjunts are in the unsatisfiable core [2021-11-17 00:54:34,830 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-11-17 00:54:35,208 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-11-17 00:54:35,208 INFO L328 TraceCheckSpWp]: Computing backward predicates... [2021-11-17 00:54:36,260 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-11-17 00:54:36,261 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-11-17 00:54:36,261 INFO L332 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [841075564] [2021-11-17 00:54:36,261 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [841075564] provided 2 perfect and 0 imperfect interpolant sequences [2021-11-17 00:54:36,261 INFO L186 FreeRefinementEngine]: Found 2 perfect and 0 imperfect interpolant sequences. [2021-11-17 00:54:36,261 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [11, 11] imperfect sequences [] total 20 [2021-11-17 00:54:36,261 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [558719228] [2021-11-17 00:54:36,261 INFO L85 oduleStraightlineAll]: Using 2 perfect interpolants to construct interpolant automaton [2021-11-17 00:54:36,262 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 20 states [2021-11-17 00:54:36,262 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-11-17 00:54:36,263 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 20 interpolants. [2021-11-17 00:54:36,263 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=46, Invalid=334, Unknown=0, NotChecked=0, Total=380 [2021-11-17 00:54:36,263 INFO L87 Difference]: Start difference. First operand 2746 states and 3828 transitions. Second operand has 20 states, 20 states have (on average 5.35) internal successors, (107), 16 states have internal predecessors, (107), 4 states have call successors, (22), 2 states have call predecessors, (22), 6 states have return successors, (23), 8 states have call predecessors, (23), 4 states have call successors, (23) [2021-11-17 00:54:37,835 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-11-17 00:54:37,835 INFO L93 Difference]: Finished difference Result 5586 states and 7818 transitions. [2021-11-17 00:54:37,836 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 12 states. [2021-11-17 00:54:37,837 INFO L78 Accepts]: Start accepts. Automaton has has 20 states, 20 states have (on average 5.35) internal successors, (107), 16 states have internal predecessors, (107), 4 states have call successors, (22), 2 states have call predecessors, (22), 6 states have return successors, (23), 8 states have call predecessors, (23), 4 states have call successors, (23) Word has length 148 [2021-11-17 00:54:37,837 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-11-17 00:54:37,848 INFO L225 Difference]: With dead ends: 5586 [2021-11-17 00:54:37,849 INFO L226 Difference]: Without dead ends: 2854 [2021-11-17 00:54:37,859 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 299 GetRequests, 277 SyntacticMatches, 0 SemanticMatches, 22 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 41 ImplicationChecksByTransitivity, 0.6s TimeCoverageRelationStatistics Valid=73, Invalid=479, Unknown=0, NotChecked=0, Total=552 [2021-11-17 00:54:37,860 INFO L933 BasicCegarLoop]: 671 mSDtfsCounter, 65 mSDsluCounter, 6662 mSDsCounter, 0 mSdLazyCounter, 135 mSolverCounterSat, 15 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 1.3s Time, 0 mProtectedPredicate, 0 mProtectedAction, 68 SdHoareTripleChecker+Valid, 7333 SdHoareTripleChecker+Invalid, 150 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 15 IncrementalHoareTripleChecker+Valid, 135 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.4s IncrementalHoareTripleChecker+Time [2021-11-17 00:54:37,861 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [68 Valid, 7333 Invalid, 150 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [15 Valid, 135 Invalid, 0 Unknown, 0 Unchecked, 1.4s Time] [2021-11-17 00:54:37,864 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2854 states. [2021-11-17 00:54:37,966 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2854 to 2806. [2021-11-17 00:54:37,971 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 2806 states, 2081 states have (on average 1.3431042767900048) internal successors, (2795), 2126 states have internal predecessors, (2795), 529 states have call successors, (529), 181 states have call predecessors, (529), 195 states have return successors, (570), 540 states have call predecessors, (570), 528 states have call successors, (570) [2021-11-17 00:54:37,977 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 2806 states to 2806 states and 3894 transitions. [2021-11-17 00:54:37,978 INFO L78 Accepts]: Start accepts. Automaton has 2806 states and 3894 transitions. Word has length 148 [2021-11-17 00:54:37,979 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-11-17 00:54:37,979 INFO L470 AbstractCegarLoop]: Abstraction has 2806 states and 3894 transitions. [2021-11-17 00:54:37,980 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 20 states, 20 states have (on average 5.35) internal successors, (107), 16 states have internal predecessors, (107), 4 states have call successors, (22), 2 states have call predecessors, (22), 6 states have return successors, (23), 8 states have call predecessors, (23), 4 states have call successors, (23) [2021-11-17 00:54:37,980 INFO L276 IsEmpty]: Start isEmpty. Operand 2806 states and 3894 transitions. [2021-11-17 00:54:37,988 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2021-11-17 00:54:37,988 INFO L506 BasicCegarLoop]: Found error trace [2021-11-17 00:54:37,988 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-11-17 00:54:38,006 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Forceful destruction successful, exit code 0 [2021-11-17 00:54:38,206 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 6 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-11-17 00:54:38,206 INFO L402 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-11-17 00:54:38,207 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-11-17 00:54:38,207 INFO L85 PathProgramCache]: Analyzing trace with hash -669328497, now seen corresponding path program 1 times [2021-11-17 00:54:38,208 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-11-17 00:54:38,208 INFO L332 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1129407499] [2021-11-17 00:54:38,208 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-11-17 00:54:38,208 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-11-17 00:54:38,208 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-11-17 00:54:38,216 INFO L229 MonitoredProcess]: Starting monitored process 7 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-11-17 00:54:38,218 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Waiting until timeout for monitored process [2021-11-17 00:54:40,760 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-11-17 00:54:40,760 INFO L355 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2021-11-17 00:54:44,192 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-11-17 00:54:44,575 INFO L133 FreeRefinementEngine]: Strategy WOLF found a feasible trace [2021-11-17 00:54:44,575 INFO L628 BasicCegarLoop]: Counterexample is feasible [2021-11-17 00:54:44,576 INFO L764 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2021-11-17 00:54:44,629 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Forceful destruction successful, exit code 0 [2021-11-17 00:54:44,803 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 7 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-11-17 00:54:44,806 INFO L732 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2021-11-17 00:54:44,807 INFO L179 ceAbstractionStarter]: Computing trace abstraction results [2021-11-17 00:54:44,844 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,845 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,845 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,845 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,845 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,846 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,846 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,846 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,846 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,846 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:44,954 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 17.11 12:54:44 BoogieIcfgContainer [2021-11-17 00:54:44,955 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2021-11-17 00:54:44,955 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2021-11-17 00:54:44,955 INFO L271 PluginConnector]: Initializing Witness Printer... [2021-11-17 00:54:44,955 INFO L275 PluginConnector]: Witness Printer initialized [2021-11-17 00:54:44,956 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 17.11 12:54:29" (3/4) ... [2021-11-17 00:54:44,957 INFO L131 WitnessPrinter]: Generating witness for reachability counterexample [2021-11-17 00:54:45,002 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,003 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,004 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,004 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,004 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,004 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,004 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,005 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,005 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,005 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-11-17 00:54:45,117 INFO L141 WitnessManager]: Wrote witness to /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/witness.graphml [2021-11-17 00:54:45,117 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2021-11-17 00:54:45,118 INFO L158 Benchmark]: Toolchain (without parser) took 19319.79ms. Allocated memory was 71.3MB in the beginning and 264.2MB in the end (delta: 192.9MB). Free memory was 45.2MB in the beginning and 150.2MB in the end (delta: -105.0MB). Peak memory consumption was 179.5MB. Max. memory is 16.1GB. [2021-11-17 00:54:45,118 INFO L158 Benchmark]: CDTParser took 0.15ms. Allocated memory is still 71.3MB. Free memory is still 52.9MB. There was no memory consumed. Max. memory is 16.1GB. [2021-11-17 00:54:45,118 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1079.77ms. Allocated memory was 71.3MB in the beginning and 90.2MB in the end (delta: 18.9MB). Free memory was 44.9MB in the beginning and 43.9MB in the end (delta: 1.0MB). Peak memory consumption was 39.4MB. Max. memory is 16.1GB. [2021-11-17 00:54:45,118 INFO L158 Benchmark]: Boogie Procedure Inliner took 107.37ms. Allocated memory is still 90.2MB. Free memory was 43.9MB in the beginning and 35.8MB in the end (delta: 8.0MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2021-11-17 00:54:45,119 INFO L158 Benchmark]: Boogie Preprocessor took 164.06ms. Allocated memory was 90.2MB in the beginning and 119.5MB in the end (delta: 29.4MB). Free memory was 35.8MB in the beginning and 70.9MB in the end (delta: -35.1MB). Peak memory consumption was 8.7MB. Max. memory is 16.1GB. [2021-11-17 00:54:45,119 INFO L158 Benchmark]: RCFGBuilder took 2004.71ms. Allocated memory is still 119.5MB. Free memory was 70.9MB in the beginning and 48.7MB in the end (delta: 22.2MB). Peak memory consumption was 29.6MB. Max. memory is 16.1GB. [2021-11-17 00:54:45,119 INFO L158 Benchmark]: TraceAbstraction took 15797.04ms. Allocated memory was 119.5MB in the beginning and 264.2MB in the end (delta: 144.7MB). Free memory was 48.1MB in the beginning and 61.2MB in the end (delta: -13.1MB). Peak memory consumption was 130.6MB. Max. memory is 16.1GB. [2021-11-17 00:54:45,120 INFO L158 Benchmark]: Witness Printer took 162.14ms. Allocated memory is still 264.2MB. Free memory was 61.2MB in the beginning and 150.2MB in the end (delta: -89.0MB). Peak memory consumption was 4.3MB. Max. memory is 16.1GB. [2021-11-17 00:54:45,121 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.15ms. Allocated memory is still 71.3MB. Free memory is still 52.9MB. There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1079.77ms. Allocated memory was 71.3MB in the beginning and 90.2MB in the end (delta: 18.9MB). Free memory was 44.9MB in the beginning and 43.9MB in the end (delta: 1.0MB). Peak memory consumption was 39.4MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 107.37ms. Allocated memory is still 90.2MB. Free memory was 43.9MB in the beginning and 35.8MB in the end (delta: 8.0MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 164.06ms. Allocated memory was 90.2MB in the beginning and 119.5MB in the end (delta: 29.4MB). Free memory was 35.8MB in the beginning and 70.9MB in the end (delta: -35.1MB). Peak memory consumption was 8.7MB. Max. memory is 16.1GB. * RCFGBuilder took 2004.71ms. Allocated memory is still 119.5MB. Free memory was 70.9MB in the beginning and 48.7MB in the end (delta: 22.2MB). Peak memory consumption was 29.6MB. Max. memory is 16.1GB. * TraceAbstraction took 15797.04ms. Allocated memory was 119.5MB in the beginning and 264.2MB in the end (delta: 144.7MB). Free memory was 48.1MB in the beginning and 61.2MB in the end (delta: -13.1MB). Peak memory consumption was 130.6MB. Max. memory is 16.1GB. * Witness Printer took 162.14ms. Allocated memory is still 264.2MB. Free memory was 61.2MB in the beginning and 150.2MB in the end (delta: -89.0MB). Peak memory consumption was 4.3MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - CounterExampleResult [Line: 5554]: a call to reach_error is reachable a call to reach_error is reachable We found a FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=40, tmp___0=2147483648] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=232, tmp___0=2147483648] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=3264, tmp___0=2147483648] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=1, tmp___0=2147483648] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=1, tmp___0=2147483648] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={128:0}, set={0:0}, set_impl={128:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=232, tmp___0=2147483648] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=3264, tmp___0=2147483648] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:144123984202437824}, __this_module={0:0}, cisco_header_ops={2052:0}, dev={0:144123984202434560}, dev={0:144123984202434560}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:144123984202437824}, __this_module={0:0}, cisco_header_ops={2052:0}, dev={0:144123984202434560}, dev={0:144123984202434560}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:144123984202437824}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, dev_to_hdlc(dev)={0:144123984202437824}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:144123984202437824}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, hdlc={0:144123984202437824}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, state(hdlc)={9007199255003136:0}, tmp={0:144123984202437824}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, st->last_poll=0, st->settings.timeout=1073741824, st->up=2, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, st->rxseq=0, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp=0, val=0] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=144123984202434560, __fswab32(st->rxseq)=0, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, st->rxseq=0, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, st->txseq=8389120, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}, tmp___1=0] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=8389120, \result=8389120, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, val=8389120] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=8389120, \result=8389120, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp=8389120, val=8389120] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=144123984202434560, __fswab32(st->txseq)=8389120, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, st->txseq=8389120, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}, tmp___1=0] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={36:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={36:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=248, tmp={36:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, cond=1, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={36:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={36:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=248, tmp={36:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={36:0}, __this_module={0:0}, calloc(1UL, size)={36:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={36:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=248, tmp={36:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={36:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, skb={36:0}, tmp___7={36:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, e={36:0}, e={36:0}, i=0, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={128:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, e={36:0}, e={36:0}, i=0, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={128:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, e={36:0}, e={36:0}, i=0, jiffies=187144, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={128:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, e={36:0}, e={36:0}, i=0, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={128:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={36:0}, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, skb={36:0}, tmp___7={36:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={36:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={36:0}, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={36:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, size=1, tmp___0=2147483648] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={0:0}, arg0={36:0}, arg0={36:0}, arg1=4, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={2052:0}, daddr={0:0}, daddr={0:0}, data={36:2305878193594171520}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={128:0}, skb={36:0}, skb={36:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={2052:0}, daddr={0:0}, daddr={0:0}, data={36:2305878193594171520}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={128:0}, skb={36:0}, skb={36:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=13696, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=13696, __this_module={0:0}, cisco_header_ops={2052:0}, daddr={0:0}, daddr={0:0}, data={36:2305878193594171520}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={128:0}, skb={36:0}, skb={36:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={0:0}, cisco_header_ops={2052:0}, daddr={0:0}, daddr={0:0}, data={36:2305878193594171520}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={128:0}, skb={36:0}, skb={36:0}, tmp=13696, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=8389120, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={2052:0}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=8389120, par2=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, skb={36:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=8389120, \old(par2)=0, \old(type)=2, __fswab32(type)=2, __this_module={0:0}, cisco_header_ops={2052:0}, data={36:2305878193594171592}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=8389120, par2=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, skb={36:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=8389120, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_header_ops={2052:0}, data={36:2305878193594171592}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=8389120, par2=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, skb={36:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=1048576, \result=1048576, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, val=1048576] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=1048576, \result=1048576, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp=1048576, val=1048576] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=8389120, \old(par2)=0, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=1048576, __this_module={0:0}, cisco_header_ops={2052:0}, data={36:2305878193594171592}, dev={0:144123984202434560}, dev={0:144123984202434560}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=8389120, par2=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, skb={36:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={36:2305878193594171524}, __this_module={0:0}, arg0={36:0}, arg0={36:0}, arg1=18, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={36:2305878193594171524}, set_impl={128:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}, tmp___1=0, tmp___2=8389120] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}, tmp___1=0, tmp___2=8389120] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}, tmp___1=0, tmp___2=8389120] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=144123984202434560, __this_module={0:0}, arg=144123984202434560, cisco_header_ops={2052:0}, dev={0:144123984202434560}, hdlc={0:144123984202437824}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, st={9007199255003136:0}, tmp={0:144123984202437824}, tmp___0={9007199255003136:0}, tmp___1=0, tmp___2=8389120] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={128:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] [L5554] reach_error() VAL [__this_module={0:0}, cisco_header_ops={2052:0}, jiffies=187144, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={17179869190:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={128:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 15.6s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 3.1s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, PartialOrderReductionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 3214 SdHoareTripleChecker+Valid, 2.3s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 3211 mSDsluCounter, 17015 SdHoareTripleChecker+Invalid, 2.0s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 13300 mSDsCounter, 237 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 411 IncrementalHoareTripleChecker+Invalid, 648 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 237 mSolverCounterUnsat, 3715 mSDtfsCounter, 411 mSolverCounterSat, 0.0s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 913 GetRequests, 876 SyntacticMatches, 0 SemanticMatches, 37 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 42 ImplicationChecksByTransitivity, 0.7s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=2806occurred in iteration=5, InterpolantAutomatonStates: 30, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.5s AutomataMinimizationTime, 5 MinimizatonAttempts, 54 StatesRemovedByMinimization, 2 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.2s SsaConstructionTime, 2.9s SatisfiabilityAnalysisTime, 2.9s InterpolantComputationTime, 640 NumberOfCodeBlocks, 640 NumberOfCodeBlocksAsserted, 6 NumberOfCheckSat, 904 ConstructedInterpolants, 0 QuantifiedInterpolants, 1320 SizeOfPredicates, 21 NumberOfNonLiveVariables, 1875 ConjunctsInSsa, 43 ConjunctsInUnsatCore, 10 InterpolantComputations, 10 PerfectInterpolantSequences, 838/838 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! [2021-11-17 00:54:45,179 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE