./Ultimate.py --spec ../sv-benchmarks/c/properties/unreach-call.prp --file ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version 839c364b Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-839c364b5d67a0f615c82cb70ab247790648d4a9-839c364 [2021-12-14 17:45:43,666 INFO L177 SettingsManager]: Resetting all preferences to default values... [2021-12-14 17:45:43,668 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2021-12-14 17:45:43,697 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2021-12-14 17:45:43,702 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2021-12-14 17:45:43,705 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2021-12-14 17:45:43,708 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2021-12-14 17:45:43,712 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2021-12-14 17:45:43,713 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2021-12-14 17:45:43,715 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2021-12-14 17:45:43,716 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2021-12-14 17:45:43,717 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2021-12-14 17:45:43,717 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2021-12-14 17:45:43,718 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2021-12-14 17:45:43,719 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2021-12-14 17:45:43,720 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2021-12-14 17:45:43,721 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2021-12-14 17:45:43,722 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2021-12-14 17:45:43,724 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2021-12-14 17:45:43,725 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2021-12-14 17:45:43,727 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2021-12-14 17:45:43,729 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2021-12-14 17:45:43,736 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2021-12-14 17:45:43,737 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2021-12-14 17:45:43,739 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2021-12-14 17:45:43,743 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2021-12-14 17:45:43,743 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2021-12-14 17:45:43,744 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2021-12-14 17:45:43,745 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2021-12-14 17:45:43,747 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2021-12-14 17:45:43,748 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2021-12-14 17:45:43,748 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2021-12-14 17:45:43,750 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2021-12-14 17:45:43,752 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2021-12-14 17:45:43,753 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2021-12-14 17:45:43,754 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2021-12-14 17:45:43,755 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2021-12-14 17:45:43,756 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2021-12-14 17:45:43,756 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2021-12-14 17:45:43,757 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2021-12-14 17:45:43,758 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2021-12-14 17:45:43,759 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf [2021-12-14 17:45:43,785 INFO L113 SettingsManager]: Loading preferences was successful [2021-12-14 17:45:43,787 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2021-12-14 17:45:43,788 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2021-12-14 17:45:43,788 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2021-12-14 17:45:43,789 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2021-12-14 17:45:43,789 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2021-12-14 17:45:43,790 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2021-12-14 17:45:43,790 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2021-12-14 17:45:43,790 INFO L138 SettingsManager]: * Use SBE=true [2021-12-14 17:45:43,791 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2021-12-14 17:45:43,792 INFO L138 SettingsManager]: * Overapproximate operations on floating types=true [2021-12-14 17:45:43,792 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2021-12-14 17:45:43,792 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2021-12-14 17:45:43,792 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2021-12-14 17:45:43,793 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2021-12-14 17:45:43,793 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2021-12-14 17:45:43,793 INFO L138 SettingsManager]: * Use constant arrays=true [2021-12-14 17:45:43,793 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2021-12-14 17:45:43,793 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2021-12-14 17:45:43,794 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2021-12-14 17:45:43,794 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2021-12-14 17:45:43,794 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-14 17:45:43,794 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2021-12-14 17:45:43,795 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2021-12-14 17:45:43,795 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2021-12-14 17:45:43,795 INFO L138 SettingsManager]: * Trace refinement strategy=CAMEL [2021-12-14 17:45:43,795 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2021-12-14 17:45:43,796 INFO L138 SettingsManager]: * Large block encoding in concurrent analysis=OFF [2021-12-14 17:45:43,797 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2021-12-14 17:45:43,797 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2021-12-14 17:45:43,797 INFO L138 SettingsManager]: * Trace refinement exception blacklist=NONE [2021-12-14 17:45:43,797 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2021-12-14 17:45:44,049 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2021-12-14 17:45:44,070 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2021-12-14 17:45:44,072 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2021-12-14 17:45:44,073 INFO L271 PluginConnector]: Initializing CDTParser... [2021-12-14 17:45:44,074 INFO L275 PluginConnector]: CDTParser initialized [2021-12-14 17:45:44,075 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-14 17:45:44,146 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/ad7be89a0/f8b9a2967afa4497aa35b895e9b1bcac/FLAGdc2a2db63 [2021-12-14 17:45:44,811 INFO L306 CDTParser]: Found 1 translation units. [2021-12-14 17:45:44,811 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-14 17:45:44,850 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/ad7be89a0/f8b9a2967afa4497aa35b895e9b1bcac/FLAGdc2a2db63 [2021-12-14 17:45:45,021 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/ad7be89a0/f8b9a2967afa4497aa35b895e9b1bcac [2021-12-14 17:45:45,025 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2021-12-14 17:45:45,026 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2021-12-14 17:45:45,029 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2021-12-14 17:45:45,029 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2021-12-14 17:45:45,032 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2021-12-14 17:45:45,033 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.12 05:45:45" (1/1) ... [2021-12-14 17:45:45,036 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@a1c4bda and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:45, skipping insertion in model container [2021-12-14 17:45:45,036 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.12 05:45:45" (1/1) ... [2021-12-14 17:45:45,043 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2021-12-14 17:45:45,140 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-12-14 17:45:45,843 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-14 17:45:46,152 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-14 17:45:46,168 INFO L203 MainTranslator]: Completed pre-run [2021-12-14 17:45:46,279 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-14 17:45:46,396 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-14 17:45:46,434 INFO L208 MainTranslator]: Completed translation [2021-12-14 17:45:46,436 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46 WrapperNode [2021-12-14 17:45:46,436 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2021-12-14 17:45:46,437 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2021-12-14 17:45:46,438 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2021-12-14 17:45:46,438 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2021-12-14 17:45:46,444 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,498 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,582 INFO L137 Inliner]: procedures = 146, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1425 [2021-12-14 17:45:46,583 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2021-12-14 17:45:46,584 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2021-12-14 17:45:46,584 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2021-12-14 17:45:46,584 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2021-12-14 17:45:46,592 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,592 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,609 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,610 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,658 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,683 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,723 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,732 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2021-12-14 17:45:46,733 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2021-12-14 17:45:46,733 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2021-12-14 17:45:46,733 INFO L275 PluginConnector]: RCFGBuilder initialized [2021-12-14 17:45:46,734 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (1/1) ... [2021-12-14 17:45:46,745 INFO L168 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-14 17:45:46,755 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-12-14 17:45:46,773 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2021-12-14 17:45:46,785 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2021-12-14 17:45:46,812 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2021-12-14 17:45:46,812 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2021-12-14 17:45:46,813 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~int [2021-12-14 17:45:46,813 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2021-12-14 17:45:46,813 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2021-12-14 17:45:46,813 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2021-12-14 17:45:46,813 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2021-12-14 17:45:46,813 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2021-12-14 17:45:46,813 INFO L130 BoogieDeclarations]: Found specification of procedure state [2021-12-14 17:45:46,813 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2021-12-14 17:45:46,813 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2021-12-14 17:45:46,814 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2021-12-14 17:45:46,814 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2021-12-14 17:45:46,814 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2021-12-14 17:45:46,814 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2021-12-14 17:45:46,814 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2021-12-14 17:45:46,814 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2021-12-14 17:45:46,815 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2021-12-14 17:45:46,815 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2021-12-14 17:45:46,815 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2021-12-14 17:45:46,815 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2021-12-14 17:45:46,815 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2021-12-14 17:45:46,815 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2021-12-14 17:45:46,816 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2021-12-14 17:45:46,816 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2021-12-14 17:45:46,816 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2021-12-14 17:45:46,816 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2021-12-14 17:45:46,816 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2021-12-14 17:45:46,816 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2021-12-14 17:45:46,816 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2021-12-14 17:45:46,817 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2021-12-14 17:45:46,817 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2021-12-14 17:45:46,817 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2021-12-14 17:45:46,817 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2021-12-14 17:45:46,817 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2021-12-14 17:45:46,817 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2021-12-14 17:45:46,818 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2021-12-14 17:45:46,818 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2021-12-14 17:45:46,818 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2021-12-14 17:45:46,818 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2021-12-14 17:45:46,819 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2021-12-14 17:45:46,819 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2021-12-14 17:45:46,819 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2021-12-14 17:45:46,819 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2021-12-14 17:45:46,820 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2021-12-14 17:45:46,820 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2021-12-14 17:45:46,820 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2021-12-14 17:45:46,820 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2021-12-14 17:45:46,820 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2021-12-14 17:45:46,820 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2021-12-14 17:45:46,821 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2021-12-14 17:45:46,821 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2021-12-14 17:45:46,821 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2021-12-14 17:45:46,821 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2021-12-14 17:45:46,821 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2021-12-14 17:45:46,822 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2021-12-14 17:45:46,822 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2021-12-14 17:45:46,823 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2021-12-14 17:45:46,823 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2021-12-14 17:45:46,824 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2021-12-14 17:45:46,825 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2021-12-14 17:45:46,825 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2021-12-14 17:45:46,825 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2021-12-14 17:45:46,825 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2021-12-14 17:45:46,826 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2021-12-14 17:45:46,826 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2021-12-14 17:45:46,826 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2021-12-14 17:45:46,826 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2021-12-14 17:45:46,826 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2021-12-14 17:45:46,826 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2021-12-14 17:45:46,827 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2021-12-14 17:45:46,827 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2021-12-14 17:45:46,828 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2021-12-14 17:45:46,828 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2021-12-14 17:45:46,828 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~int [2021-12-14 17:45:46,828 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2021-12-14 17:45:46,828 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2021-12-14 17:45:46,828 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2021-12-14 17:45:46,829 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2021-12-14 17:45:46,829 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2021-12-14 17:45:46,829 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2021-12-14 17:45:47,192 INFO L236 CfgBuilder]: Building ICFG [2021-12-14 17:45:47,194 INFO L262 CfgBuilder]: Building CFG for each procedure with an implementation [2021-12-14 17:45:47,407 INFO L768 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2021-12-14 17:45:48,054 INFO L277 CfgBuilder]: Performing block encoding [2021-12-14 17:45:48,071 INFO L296 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2021-12-14 17:45:48,071 INFO L301 CfgBuilder]: Removed 1 assume(true) statements. [2021-12-14 17:45:48,075 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.12 05:45:48 BoogieIcfgContainer [2021-12-14 17:45:48,076 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2021-12-14 17:45:48,078 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2021-12-14 17:45:48,078 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2021-12-14 17:45:48,081 INFO L275 PluginConnector]: TraceAbstraction initialized [2021-12-14 17:45:48,082 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 14.12 05:45:45" (1/3) ... [2021-12-14 17:45:48,083 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@6ff37cee and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.12 05:45:48, skipping insertion in model container [2021-12-14 17:45:48,083 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:45:46" (2/3) ... [2021-12-14 17:45:48,084 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@6ff37cee and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.12 05:45:48, skipping insertion in model container [2021-12-14 17:45:48,084 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.12 05:45:48" (3/3) ... [2021-12-14 17:45:48,086 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-14 17:45:48,091 INFO L204 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2021-12-14 17:45:48,092 INFO L163 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2021-12-14 17:45:48,152 INFO L338 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2021-12-14 17:45:48,164 INFO L339 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mLoopAccelerationTechnique=FAST_UPR [2021-12-14 17:45:48,165 INFO L340 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2021-12-14 17:45:48,205 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2021-12-14 17:45:48,213 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2021-12-14 17:45:48,214 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:45:48,214 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:45:48,215 INFO L402 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:45:48,219 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:45:48,220 INFO L85 PathProgramCache]: Analyzing trace with hash 742124414, now seen corresponding path program 1 times [2021-12-14 17:45:48,227 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-14 17:45:48,228 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [352193889] [2021-12-14 17:45:48,228 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:45:48,229 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-14 17:45:48,393 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:48,560 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-14 17:45:48,565 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:48,592 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-14 17:45:48,595 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:48,608 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-14 17:45:48,611 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:48,626 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-14 17:45:48,629 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:48,644 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-14 17:45:48,647 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:48,658 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-14 17:45:48,659 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-14 17:45:48,659 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [352193889] [2021-12-14 17:45:48,663 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [352193889] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:45:48,663 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:45:48,663 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2021-12-14 17:45:48,665 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1614268138] [2021-12-14 17:45:48,666 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:45:48,670 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2021-12-14 17:45:48,670 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-14 17:45:48,694 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2021-12-14 17:45:48,694 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2021-12-14 17:45:48,697 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:45:49,857 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:45:49,858 INFO L93 Difference]: Finished difference Result 1541 states and 2218 transitions. [2021-12-14 17:45:49,859 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-14 17:45:49,860 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2021-12-14 17:45:49,861 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:45:49,888 INFO L225 Difference]: With dead ends: 1541 [2021-12-14 17:45:49,889 INFO L226 Difference]: Without dead ends: 1042 [2021-12-14 17:45:49,895 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 15 GetRequests, 12 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2021-12-14 17:45:49,898 INFO L933 BasicCegarLoop]: 706 mSDtfsCounter, 1084 mSDsluCounter, 811 mSDsCounter, 0 mSdLazyCounter, 407 mSolverCounterSat, 283 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.8s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1162 SdHoareTripleChecker+Valid, 1517 SdHoareTripleChecker+Invalid, 690 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 283 IncrementalHoareTripleChecker+Valid, 407 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.9s IncrementalHoareTripleChecker+Time [2021-12-14 17:45:49,899 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1162 Valid, 1517 Invalid, 690 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [283 Valid, 407 Invalid, 0 Unknown, 0 Unchecked, 0.9s Time] [2021-12-14 17:45:49,916 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1042 states. [2021-12-14 17:45:49,993 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1042 to 924. [2021-12-14 17:45:49,996 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-14 17:45:50,002 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2021-12-14 17:45:50,004 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2021-12-14 17:45:50,005 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:45:50,005 INFO L470 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2021-12-14 17:45:50,006 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:45:50,006 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2021-12-14 17:45:50,009 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2021-12-14 17:45:50,009 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:45:50,009 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:45:50,010 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable0 [2021-12-14 17:45:50,010 INFO L402 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:45:50,010 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:45:50,011 INFO L85 PathProgramCache]: Analyzing trace with hash -2097093995, now seen corresponding path program 1 times [2021-12-14 17:45:50,011 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-14 17:45:50,011 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [391686443] [2021-12-14 17:45:50,011 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:45:50,012 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-14 17:45:50,037 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:50,081 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-14 17:45:50,083 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:50,088 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-14 17:45:50,090 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:50,095 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-14 17:45:50,096 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:50,101 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-14 17:45:50,103 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:50,108 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-14 17:45:50,110 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:50,115 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-14 17:45:50,115 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-14 17:45:50,116 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [391686443] [2021-12-14 17:45:50,116 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [391686443] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:45:50,116 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:45:50,116 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2021-12-14 17:45:50,116 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [131868447] [2021-12-14 17:45:50,117 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:45:50,118 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-14 17:45:50,118 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-14 17:45:50,119 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-14 17:45:50,119 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-14 17:45:50,119 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:45:50,914 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:45:50,914 INFO L93 Difference]: Finished difference Result 1951 states and 2732 transitions. [2021-12-14 17:45:50,915 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-14 17:45:50,915 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2021-12-14 17:45:50,916 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:45:50,925 INFO L225 Difference]: With dead ends: 1951 [2021-12-14 17:45:50,925 INFO L226 Difference]: Without dead ends: 1041 [2021-12-14 17:45:50,929 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 18 GetRequests, 13 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=15, Invalid=27, Unknown=0, NotChecked=0, Total=42 [2021-12-14 17:45:50,934 INFO L933 BasicCegarLoop]: 740 mSDtfsCounter, 987 mSDsluCounter, 887 mSDsCounter, 0 mSdLazyCounter, 381 mSolverCounterSat, 247 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.5s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1049 SdHoareTripleChecker+Valid, 1627 SdHoareTripleChecker+Invalid, 628 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 247 IncrementalHoareTripleChecker+Valid, 381 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.6s IncrementalHoareTripleChecker+Time [2021-12-14 17:45:50,934 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1049 Valid, 1627 Invalid, 628 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [247 Valid, 381 Invalid, 0 Unknown, 0 Unchecked, 0.6s Time] [2021-12-14 17:45:50,936 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1041 states. [2021-12-14 17:45:50,978 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1041 to 923. [2021-12-14 17:45:50,980 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-14 17:45:50,986 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2021-12-14 17:45:50,987 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2021-12-14 17:45:50,987 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:45:50,987 INFO L470 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2021-12-14 17:45:50,987 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:45:50,988 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2021-12-14 17:45:50,991 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2021-12-14 17:45:50,992 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:45:50,992 INFO L514 BasicCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:45:50,992 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable1 [2021-12-14 17:45:50,992 INFO L402 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:45:50,993 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:45:50,993 INFO L85 PathProgramCache]: Analyzing trace with hash 171125928, now seen corresponding path program 1 times [2021-12-14 17:45:50,993 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-14 17:45:50,994 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [280612692] [2021-12-14 17:45:50,994 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:45:50,994 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-14 17:45:51,019 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,079 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-14 17:45:51,081 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,086 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-14 17:45:51,091 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,100 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-14 17:45:51,101 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,107 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-14 17:45:51,109 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,115 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-14 17:45:51,117 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,124 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2021-12-14 17:45:51,127 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,134 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2021-12-14 17:45:51,137 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:51,147 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 89 trivial. 0 not checked. [2021-12-14 17:45:51,148 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-14 17:45:51,149 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [280612692] [2021-12-14 17:45:51,149 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [280612692] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:45:51,149 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:45:51,149 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2021-12-14 17:45:51,149 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1563737913] [2021-12-14 17:45:51,150 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:45:51,151 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 6 states [2021-12-14 17:45:51,151 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-14 17:45:51,153 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2021-12-14 17:45:51,153 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2021-12-14 17:45:51,154 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-14 17:45:52,330 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:45:52,331 INFO L93 Difference]: Finished difference Result 2974 states and 4185 transitions. [2021-12-14 17:45:52,331 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2021-12-14 17:45:52,332 INFO L78 Accepts]: Start accepts. Automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2021-12-14 17:45:52,332 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:45:52,343 INFO L225 Difference]: With dead ends: 2974 [2021-12-14 17:45:52,343 INFO L226 Difference]: Without dead ends: 2060 [2021-12-14 17:45:52,347 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 23 GetRequests, 16 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=49, Unknown=0, NotChecked=0, Total=72 [2021-12-14 17:45:52,349 INFO L933 BasicCegarLoop]: 691 mSDtfsCounter, 1091 mSDsluCounter, 2026 mSDsCounter, 0 mSdLazyCounter, 714 mSolverCounterSat, 273 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.8s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1173 SdHoareTripleChecker+Valid, 2717 SdHoareTripleChecker+Invalid, 987 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 273 IncrementalHoareTripleChecker+Valid, 714 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.0s IncrementalHoareTripleChecker+Time [2021-12-14 17:45:52,349 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1173 Valid, 2717 Invalid, 987 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [273 Valid, 714 Invalid, 0 Unknown, 0 Unchecked, 1.0s Time] [2021-12-14 17:45:52,351 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2060 states. [2021-12-14 17:45:52,419 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2060 to 1924. [2021-12-14 17:45:52,422 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1437 states have (on average 1.3625608907446067) internal successors, (1958), 1469 states have internal predecessors, (1958), 358 states have call successors, (358), 121 states have call predecessors, (358), 128 states have return successors, (381), 363 states have call predecessors, (381), 357 states have call successors, (381) [2021-12-14 17:45:52,432 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2697 transitions. [2021-12-14 17:45:52,433 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2697 transitions. Word has length 71 [2021-12-14 17:45:52,433 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:45:52,434 INFO L470 AbstractCegarLoop]: Abstraction has 1924 states and 2697 transitions. [2021-12-14 17:45:52,434 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-14 17:45:52,434 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2697 transitions. [2021-12-14 17:45:52,441 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2021-12-14 17:45:52,441 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:45:52,441 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:45:52,442 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable2 [2021-12-14 17:45:52,442 INFO L402 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:45:52,442 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:45:52,442 INFO L85 PathProgramCache]: Analyzing trace with hash 1729160309, now seen corresponding path program 1 times [2021-12-14 17:45:52,443 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-14 17:45:52,443 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1021205597] [2021-12-14 17:45:52,443 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:45:52,443 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-14 17:45:52,498 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,576 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-14 17:45:52,578 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,584 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-14 17:45:52,586 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,594 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-14 17:45:52,596 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,601 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-14 17:45:52,603 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,608 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-14 17:45:52,610 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,614 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 37 [2021-12-14 17:45:52,616 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,621 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 43 [2021-12-14 17:45:52,623 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,627 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 48 [2021-12-14 17:45:52,628 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,631 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 57 [2021-12-14 17:45:52,632 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,635 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 63 [2021-12-14 17:45:52,636 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,648 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 69 [2021-12-14 17:45:52,658 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,670 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-14 17:45:52,677 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,724 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-14 17:45:52,727 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,757 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 91 [2021-12-14 17:45:52,760 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,769 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 97 [2021-12-14 17:45:52,774 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,777 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 114 [2021-12-14 17:45:52,779 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,784 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 120 [2021-12-14 17:45:52,786 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:52,798 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 14 proven. 4 refuted. 0 times theorem prover too weak. 107 trivial. 0 not checked. [2021-12-14 17:45:52,799 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-14 17:45:52,800 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1021205597] [2021-12-14 17:45:52,800 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1021205597] provided 0 perfect and 1 imperfect interpolant sequences [2021-12-14 17:45:52,800 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleZ3 [2084223988] [2021-12-14 17:45:52,800 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:45:52,800 INFO L168 SolverBuilder]: Constructing external solver with command: z3 -smt2 -in SMTLIB2_COMPLIANT=true [2021-12-14 17:45:52,801 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-12-14 17:45:52,807 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (exit command is (exit), workingDir is null) [2021-12-14 17:45:52,827 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Waiting until timeout for monitored process [2021-12-14 17:45:53,126 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:53,130 INFO L263 TraceCheckSpWp]: Trace formula consists of 961 conjuncts, 17 conjunts are in the unsatisfiable core [2021-12-14 17:45:53,138 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-14 17:45:53,482 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 62 proven. 0 refuted. 0 times theorem prover too weak. 63 trivial. 0 not checked. [2021-12-14 17:45:53,482 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-14 17:45:53,483 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleZ3 [2084223988] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:45:53,483 INFO L186 FreeRefinementEngine]: Found 1 perfect and 1 imperfect interpolant sequences. [2021-12-14 17:45:53,483 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [7] total 7 [2021-12-14 17:45:53,483 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [271778341] [2021-12-14 17:45:53,484 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:45:53,484 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-14 17:45:53,484 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-14 17:45:53,485 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-14 17:45:53,485 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2021-12-14 17:45:53,485 INFO L87 Difference]: Start difference. First operand 1924 states and 2697 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-14 17:45:53,571 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:45:53,572 INFO L93 Difference]: Finished difference Result 3838 states and 5422 transitions. [2021-12-14 17:45:53,572 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-14 17:45:53,572 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2021-12-14 17:45:53,573 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:45:53,583 INFO L225 Difference]: With dead ends: 3838 [2021-12-14 17:45:53,583 INFO L226 Difference]: Without dead ends: 1928 [2021-12-14 17:45:53,591 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 181 GetRequests, 173 SyntacticMatches, 3 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2021-12-14 17:45:53,592 INFO L933 BasicCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1969 mSDsCounter, 0 mSdLazyCounter, 11 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2627 SdHoareTripleChecker+Invalid, 12 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 11 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2021-12-14 17:45:53,592 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [2 Valid, 2627 Invalid, 12 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 11 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2021-12-14 17:45:53,595 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1928 states. [2021-12-14 17:45:53,655 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1928 to 1924. [2021-12-14 17:45:53,658 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1433 states have (on average 1.357990230286113) internal successors, (1946), 1467 states have internal predecessors, (1946), 358 states have call successors, (358), 121 states have call predecessors, (358), 132 states have return successors, (392), 365 states have call predecessors, (392), 357 states have call successors, (392) [2021-12-14 17:45:53,668 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2696 transitions. [2021-12-14 17:45:53,669 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2696 transitions. Word has length 141 [2021-12-14 17:45:53,670 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:45:53,670 INFO L470 AbstractCegarLoop]: Abstraction has 1924 states and 2696 transitions. [2021-12-14 17:45:53,670 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-14 17:45:53,670 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2696 transitions. [2021-12-14 17:45:53,676 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2021-12-14 17:45:53,676 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:45:53,677 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:45:53,704 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Forceful destruction successful, exit code 0 [2021-12-14 17:45:53,891 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable3,2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true [2021-12-14 17:45:53,892 INFO L402 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:45:53,892 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:45:53,892 INFO L85 PathProgramCache]: Analyzing trace with hash 568539780, now seen corresponding path program 1 times [2021-12-14 17:45:53,892 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-14 17:45:53,892 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [229727925] [2021-12-14 17:45:53,893 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:45:53,893 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-14 17:45:53,979 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,030 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-14 17:45:54,031 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,050 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-14 17:45:54,051 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,055 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-14 17:45:54,057 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,061 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-14 17:45:54,062 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,066 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-14 17:45:54,067 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,070 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2021-12-14 17:45:54,071 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,075 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2021-12-14 17:45:54,076 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,079 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 61 [2021-12-14 17:45:54,080 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,083 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 67 [2021-12-14 17:45:54,084 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,088 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 72 [2021-12-14 17:45:54,088 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,092 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 81 [2021-12-14 17:45:54,092 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,096 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 87 [2021-12-14 17:45:54,096 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,108 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 93 [2021-12-14 17:45:54,133 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,219 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-14 17:45:54,253 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,339 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-14 17:45:54,346 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,442 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 3 [2021-12-14 17:45:54,445 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,481 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 122 [2021-12-14 17:45:54,482 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,486 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 128 [2021-12-14 17:45:54,486 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:45:54,490 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-12-14 17:45:54,490 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-14 17:45:54,491 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [229727925] [2021-12-14 17:45:54,491 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [229727925] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:45:54,491 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:45:54,491 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [16] imperfect sequences [] total 16 [2021-12-14 17:45:54,491 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [806693206] [2021-12-14 17:45:54,491 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:45:54,492 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 16 states [2021-12-14 17:45:54,492 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-14 17:45:54,492 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 16 interpolants. [2021-12-14 17:45:54,493 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=31, Invalid=209, Unknown=0, NotChecked=0, Total=240 [2021-12-14 17:45:54,493 INFO L87 Difference]: Start difference. First operand 1924 states and 2696 transitions. Second operand has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-12-14 17:45:56,132 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:45:56,133 INFO L93 Difference]: Finished difference Result 3994 states and 5630 transitions. [2021-12-14 17:45:56,133 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 15 states. [2021-12-14 17:45:56,134 INFO L78 Accepts]: Start accepts. Automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) Word has length 148 [2021-12-14 17:45:56,136 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:45:56,149 INFO L225 Difference]: With dead ends: 3994 [2021-12-14 17:45:56,149 INFO L226 Difference]: Without dead ends: 2084 [2021-12-14 17:45:56,156 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 58 GetRequests, 37 SyntacticMatches, 0 SemanticMatches, 21 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 41 ImplicationChecksByTransitivity, 0.3s TimeCoverageRelationStatistics Valid=69, Invalid=437, Unknown=0, NotChecked=0, Total=506 [2021-12-14 17:45:56,158 INFO L933 BasicCegarLoop]: 620 mSDtfsCounter, 511 mSDsluCounter, 6191 mSDsCounter, 0 mSdLazyCounter, 1806 mSolverCounterSat, 228 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 1.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 532 SdHoareTripleChecker+Valid, 6811 SdHoareTripleChecker+Invalid, 2034 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 228 IncrementalHoareTripleChecker+Valid, 1806 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.3s IncrementalHoareTripleChecker+Time [2021-12-14 17:45:56,159 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [532 Valid, 6811 Invalid, 2034 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [228 Valid, 1806 Invalid, 0 Unknown, 0 Unchecked, 1.3s Time] [2021-12-14 17:45:56,162 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2084 states. [2021-12-14 17:45:56,248 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2084 to 1954. [2021-12-14 17:45:56,252 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1954 states, 1455 states have (on average 1.3484536082474228) internal successors, (1962), 1489 states have internal predecessors, (1962), 364 states have call successors, (364), 121 states have call predecessors, (364), 134 states have return successors, (402), 373 states have call predecessors, (402), 363 states have call successors, (402) [2021-12-14 17:45:56,261 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1954 states to 1954 states and 2728 transitions. [2021-12-14 17:45:56,262 INFO L78 Accepts]: Start accepts. Automaton has 1954 states and 2728 transitions. Word has length 148 [2021-12-14 17:45:56,262 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:45:56,262 INFO L470 AbstractCegarLoop]: Abstraction has 1954 states and 2728 transitions. [2021-12-14 17:45:56,263 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-12-14 17:45:56,263 INFO L276 IsEmpty]: Start isEmpty. Operand 1954 states and 2728 transitions. [2021-12-14 17:45:56,269 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2021-12-14 17:45:56,269 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:45:56,270 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:45:56,270 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable4 [2021-12-14 17:45:56,270 INFO L402 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:45:56,271 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:45:56,271 INFO L85 PathProgramCache]: Analyzing trace with hash -799997024, now seen corresponding path program 1 times [2021-12-14 17:45:56,271 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-14 17:45:56,271 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1731616167] [2021-12-14 17:45:56,271 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:45:56,271 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-14 17:45:56,644 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-14 17:45:56,644 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2021-12-14 17:45:56,749 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-14 17:45:56,833 INFO L133 FreeRefinementEngine]: Strategy CAMEL found a feasible trace [2021-12-14 17:45:56,834 INFO L628 BasicCegarLoop]: Counterexample is feasible [2021-12-14 17:45:56,835 INFO L764 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2021-12-14 17:45:56,836 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable5 [2021-12-14 17:45:56,839 INFO L732 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2021-12-14 17:45:56,842 INFO L179 ceAbstractionStarter]: Computing trace abstraction results [2021-12-14 17:45:56,871 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,872 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,872 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,872 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,872 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,873 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,873 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,873 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,873 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,873 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:45:56,995 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 14.12 05:45:56 BoogieIcfgContainer [2021-12-14 17:45:56,995 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2021-12-14 17:45:56,996 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2021-12-14 17:45:56,996 INFO L271 PluginConnector]: Initializing Witness Printer... [2021-12-14 17:45:56,996 INFO L275 PluginConnector]: Witness Printer initialized [2021-12-14 17:45:56,996 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.12 05:45:48" (3/4) ... [2021-12-14 17:45:56,999 INFO L140 WitnessPrinter]: No result that supports witness generation found [2021-12-14 17:45:56,999 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2021-12-14 17:45:57,000 INFO L158 Benchmark]: Toolchain (without parser) took 11973.81ms. Allocated memory was 90.2MB in the beginning and 350.2MB in the end (delta: 260.0MB). Free memory was 50.0MB in the beginning and 215.9MB in the end (delta: -165.8MB). Peak memory consumption was 92.7MB. Max. memory is 16.1GB. [2021-12-14 17:45:57,000 INFO L158 Benchmark]: CDTParser took 0.26ms. Allocated memory is still 90.2MB. Free memory was 47.7MB in the beginning and 47.6MB in the end (delta: 70.0kB). There was no memory consumed. Max. memory is 16.1GB. [2021-12-14 17:45:57,000 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1407.81ms. Allocated memory was 90.2MB in the beginning and 119.5MB in the end (delta: 29.4MB). Free memory was 49.9MB in the beginning and 62.2MB in the end (delta: -12.3MB). Peak memory consumption was 39.3MB. Max. memory is 16.1GB. [2021-12-14 17:45:57,001 INFO L158 Benchmark]: Boogie Procedure Inliner took 145.88ms. Allocated memory is still 119.5MB. Free memory was 62.2MB in the beginning and 53.9MB in the end (delta: 8.3MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2021-12-14 17:45:57,001 INFO L158 Benchmark]: Boogie Preprocessor took 148.33ms. Allocated memory was 119.5MB in the beginning and 188.7MB in the end (delta: 69.2MB). Free memory was 53.9MB in the beginning and 139.4MB in the end (delta: -85.6MB). Peak memory consumption was 15.7MB. Max. memory is 16.1GB. [2021-12-14 17:45:57,001 INFO L158 Benchmark]: RCFGBuilder took 1343.44ms. Allocated memory is still 188.7MB. Free memory was 139.4MB in the beginning and 114.1MB in the end (delta: 25.3MB). Peak memory consumption was 59.8MB. Max. memory is 16.1GB. [2021-12-14 17:45:57,001 INFO L158 Benchmark]: TraceAbstraction took 8917.57ms. Allocated memory was 188.7MB in the beginning and 350.2MB in the end (delta: 161.5MB). Free memory was 113.1MB in the beginning and 215.9MB in the end (delta: -102.8MB). Peak memory consumption was 186.2MB. Max. memory is 16.1GB. [2021-12-14 17:45:57,002 INFO L158 Benchmark]: Witness Printer took 3.55ms. Allocated memory is still 350.2MB. Free memory is still 215.9MB. There was no memory consumed. Max. memory is 16.1GB. [2021-12-14 17:45:57,003 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.26ms. Allocated memory is still 90.2MB. Free memory was 47.7MB in the beginning and 47.6MB in the end (delta: 70.0kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1407.81ms. Allocated memory was 90.2MB in the beginning and 119.5MB in the end (delta: 29.4MB). Free memory was 49.9MB in the beginning and 62.2MB in the end (delta: -12.3MB). Peak memory consumption was 39.3MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 145.88ms. Allocated memory is still 119.5MB. Free memory was 62.2MB in the beginning and 53.9MB in the end (delta: 8.3MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 148.33ms. Allocated memory was 119.5MB in the beginning and 188.7MB in the end (delta: 69.2MB). Free memory was 53.9MB in the beginning and 139.4MB in the end (delta: -85.6MB). Peak memory consumption was 15.7MB. Max. memory is 16.1GB. * RCFGBuilder took 1343.44ms. Allocated memory is still 188.7MB. Free memory was 139.4MB in the beginning and 114.1MB in the end (delta: 25.3MB). Peak memory consumption was 59.8MB. Max. memory is 16.1GB. * TraceAbstraction took 8917.57ms. Allocated memory was 188.7MB in the beginning and 350.2MB in the end (delta: 161.5MB). Free memory was 113.1MB in the beginning and 215.9MB in the end (delta: -102.8MB). Peak memory consumption was 186.2MB. Max. memory is 16.1GB. * Witness Printer took 3.55ms. Allocated memory is still 350.2MB. Free memory is still 215.9MB. There was no memory consumed. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - UnprovableResult [Line: 5554]: Unable to prove that call to reach_error is unreachable Unable to prove that call to reach_error is unreachable Reason: overapproximation of bitwiseOr at line 5123. Possible FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=-13] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg4=62273, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-15] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg4=62273, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-5] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-6] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-7] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={18:0}, set={0:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=-9] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=-10] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, dev_to_hdlc(dev)={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={18446744073709548391:-8}, tmp={0:0}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, st->last_poll=0, st->settings.timeout=0, st->up=18446744073709548363, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, st->rxseq=18446744073709548374, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=18446744073709548374, \result=18446744073709548374, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=18446744073709548374] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=18446744073709548374, \result=18446744073709548374, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=4294964054, val=18446744073709548374] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=18446744073709548352, __fswab32(st->rxseq)=18446744073709548374, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, st->rxseq=18446744073709548374, tmp={0:0}, tmp___0={18446744073709548391:-8}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, st->txseq=-11, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=-11, \result=-11, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=-11] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=-11, \result=-11, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=4294967285, val=-11] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=18446744073709548352, __fswab32(st->txseq)=-11, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, st->txseq=-11, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={18446744073709548369:18446744073709548389}, calloc(1UL, size)={-18446744073709551615:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551615:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-18446744073709551615:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, cond=1, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={18446744073709548369:18446744073709548389}, calloc(1UL, size)={-18446744073709551615:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551615:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-18446744073709551615:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={-18446744073709551615:0}, __this_module={18446744073709548369:18446744073709548389}, calloc(1UL, size)={-18446744073709551615:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551615:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-18446744073709551615:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={-18446744073709551615:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551615:0}, tmp___7={-18446744073709551615:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, e={-18446744073709551615:0}, e={-18446744073709551615:0}, i=0, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={-18446744073709551615:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551615:0}, tmp___7={-18446744073709551615:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={-18446744073709551615:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={-18446744073709551615:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={-18446744073709551615:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=-14] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, arg0={-18446744073709551615:0}, arg0={-18446744073709551615:0}, arg1=4, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={28:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={28:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=18446744073709548375, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={28:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={28:-4}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551615:0}, skb={-18446744073709551615:0}, tmp=62295, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __this_module={18446744073709548369:18446744073709548389}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551615:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __fswab32(type)=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, data={28:68}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551615:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, data={28:68}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551615:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=300000] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=300000, val=300000] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=4294967285, \old(par2)=4294964054, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=300000, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, data={28:68}, dev={0:-3264}, dev={0:-3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967285, par2=4294964054, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551615:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={28:0}, __this_module={18446744073709548369:18446744073709548389}, arg0={-18446744073709551615:0}, arg0={-18446744073709551615:0}, arg1=18, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={28:0}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=18446744073709548352, __this_module={18446744073709548369:18446744073709548389}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={18446744073709548391:-8}, tmp={0:0}, tmp___0={18446744073709548391:-8}, tmp___1=4294964054, tmp___2=4294967285] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294964058, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=62273, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294964058, tmp___1=62273, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={18446744073709548369:18446744073709548389}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 8.7s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 5.0s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, PartialOrderReductionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 3918 SdHoareTripleChecker+Valid, 3.9s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 3675 mSDsluCounter, 15299 SdHoareTripleChecker+Invalid, 3.2s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 11884 mSDsCounter, 1032 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 3319 IncrementalHoareTripleChecker+Invalid, 4351 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 1032 mSolverCounterUnsat, 3415 mSDtfsCounter, 3319 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 295 GetRequests, 251 SyntacticMatches, 3 SemanticMatches, 41 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 50 ImplicationChecksByTransitivity, 0.4s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1954occurred in iteration=5, InterpolantAutomatonStates: 37, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.4s AutomataMinimizationTime, 5 MinimizatonAttempts, 506 StatesRemovedByMinimization, 5 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.1s SsaConstructionTime, 0.7s SatisfiabilityAnalysisTime, 1.6s InterpolantComputationTime, 781 NumberOfCodeBlocks, 781 NumberOfCodeBlocksAsserted, 7 NumberOfCheckSat, 592 ConstructedInterpolants, 0 QuantifiedInterpolants, 1363 SizeOfPredicates, 2 NumberOfNonLiveVariables, 961 ConjunctsInSsa, 17 ConjunctsInUnsatCore, 6 InterpolantComputations, 5 PerfectInterpolantSequences, 540/544 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces [2021-12-14 17:45:57,047 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis ### Bit-precise run ### Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-839c364b5d67a0f615c82cb70ab247790648d4a9-839c364 [2021-12-14 17:45:59,020 INFO L177 SettingsManager]: Resetting all preferences to default values... [2021-12-14 17:45:59,022 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2021-12-14 17:45:59,073 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2021-12-14 17:45:59,074 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2021-12-14 17:45:59,075 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2021-12-14 17:45:59,076 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2021-12-14 17:45:59,077 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2021-12-14 17:45:59,078 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2021-12-14 17:45:59,079 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2021-12-14 17:45:59,084 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2021-12-14 17:45:59,088 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2021-12-14 17:45:59,089 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2021-12-14 17:45:59,090 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2021-12-14 17:45:59,092 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2021-12-14 17:45:59,093 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2021-12-14 17:45:59,093 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2021-12-14 17:45:59,094 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2021-12-14 17:45:59,095 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2021-12-14 17:45:59,096 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2021-12-14 17:45:59,097 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2021-12-14 17:45:59,099 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2021-12-14 17:45:59,100 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2021-12-14 17:45:59,101 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2021-12-14 17:45:59,103 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2021-12-14 17:45:59,107 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2021-12-14 17:45:59,107 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2021-12-14 17:45:59,108 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2021-12-14 17:45:59,109 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2021-12-14 17:45:59,110 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2021-12-14 17:45:59,110 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2021-12-14 17:45:59,111 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2021-12-14 17:45:59,112 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2021-12-14 17:45:59,114 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2021-12-14 17:45:59,115 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2021-12-14 17:45:59,116 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2021-12-14 17:45:59,117 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2021-12-14 17:45:59,117 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2021-12-14 17:45:59,117 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2021-12-14 17:45:59,118 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2021-12-14 17:45:59,119 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2021-12-14 17:45:59,120 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf [2021-12-14 17:45:59,154 INFO L113 SettingsManager]: Loading preferences was successful [2021-12-14 17:45:59,154 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2021-12-14 17:45:59,155 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2021-12-14 17:45:59,155 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2021-12-14 17:45:59,156 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2021-12-14 17:45:59,157 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2021-12-14 17:45:59,158 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2021-12-14 17:45:59,158 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2021-12-14 17:45:59,158 INFO L138 SettingsManager]: * Use SBE=true [2021-12-14 17:45:59,158 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2021-12-14 17:45:59,159 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2021-12-14 17:45:59,159 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2021-12-14 17:45:59,159 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2021-12-14 17:45:59,160 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2021-12-14 17:45:59,160 INFO L138 SettingsManager]: * Adapt memory model on pointer casts if necessary=true [2021-12-14 17:45:59,160 INFO L138 SettingsManager]: * Use bitvectors instead of ints=true [2021-12-14 17:45:59,160 INFO L138 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2021-12-14 17:45:59,160 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2021-12-14 17:45:59,160 INFO L138 SettingsManager]: * Use constant arrays=true [2021-12-14 17:45:59,161 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2021-12-14 17:45:59,161 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2021-12-14 17:45:59,161 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2021-12-14 17:45:59,161 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2021-12-14 17:45:59,161 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-14 17:45:59,162 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2021-12-14 17:45:59,162 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2021-12-14 17:45:59,162 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2021-12-14 17:45:59,162 INFO L138 SettingsManager]: * Trace refinement strategy=WOLF [2021-12-14 17:45:59,162 INFO L138 SettingsManager]: * Command for external solver=cvc4 --incremental --print-success --lang smt [2021-12-14 17:45:59,162 INFO L138 SettingsManager]: * Large block encoding in concurrent analysis=OFF [2021-12-14 17:45:59,163 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2021-12-14 17:45:59,163 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2021-12-14 17:45:59,163 INFO L138 SettingsManager]: * Trace refinement exception blacklist=NONE [2021-12-14 17:45:59,163 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2021-12-14 17:45:59,163 INFO L138 SettingsManager]: * Logic for external solver=AUFBV WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2021-12-14 17:45:59,481 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2021-12-14 17:45:59,505 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2021-12-14 17:45:59,508 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2021-12-14 17:45:59,509 INFO L271 PluginConnector]: Initializing CDTParser... [2021-12-14 17:45:59,510 INFO L275 PluginConnector]: CDTParser initialized [2021-12-14 17:45:59,511 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-14 17:45:59,581 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/482977b31/3c24e72436a04482afada88357f0db9b/FLAGafb9d1b71 [2021-12-14 17:46:00,312 INFO L306 CDTParser]: Found 1 translation units. [2021-12-14 17:46:00,313 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-14 17:46:00,351 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/482977b31/3c24e72436a04482afada88357f0db9b/FLAGafb9d1b71 [2021-12-14 17:46:00,587 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/482977b31/3c24e72436a04482afada88357f0db9b [2021-12-14 17:46:00,591 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2021-12-14 17:46:00,593 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2021-12-14 17:46:00,594 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2021-12-14 17:46:00,595 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2021-12-14 17:46:00,598 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2021-12-14 17:46:00,598 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.12 05:46:00" (1/1) ... [2021-12-14 17:46:00,599 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@653b9b0 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:00, skipping insertion in model container [2021-12-14 17:46:00,600 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 14.12 05:46:00" (1/1) ... [2021-12-14 17:46:00,606 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2021-12-14 17:46:00,710 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-12-14 17:46:01,536 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-14 17:46:01,890 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-14 17:46:01,920 INFO L200 MainTranslator]: Restarting translation with changed settings: SettingsChange [mNewPreferredMemoryModel=HoenickeLindenmann_1ByteResolution] [2021-12-14 17:46:01,954 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-12-14 17:46:02,080 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-14 17:46:02,156 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-14 17:46:02,162 INFO L203 MainTranslator]: Completed pre-run [2021-12-14 17:46:02,279 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-14 17:46:02,365 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-14 17:46:02,417 INFO L208 MainTranslator]: Completed translation [2021-12-14 17:46:02,418 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02 WrapperNode [2021-12-14 17:46:02,418 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2021-12-14 17:46:02,419 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2021-12-14 17:46:02,420 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2021-12-14 17:46:02,420 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2021-12-14 17:46:02,426 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,469 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,552 INFO L137 Inliner]: procedures = 158, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1390 [2021-12-14 17:46:02,558 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2021-12-14 17:46:02,559 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2021-12-14 17:46:02,559 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2021-12-14 17:46:02,559 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2021-12-14 17:46:02,566 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,567 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,586 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,592 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,627 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,635 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,643 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,655 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2021-12-14 17:46:02,656 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2021-12-14 17:46:02,656 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2021-12-14 17:46:02,656 INFO L275 PluginConnector]: RCFGBuilder initialized [2021-12-14 17:46:02,657 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (1/1) ... [2021-12-14 17:46:02,674 INFO L168 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-14 17:46:02,684 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-12-14 17:46:02,700 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2021-12-14 17:46:02,728 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2021-12-14 17:46:02,743 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2021-12-14 17:46:02,743 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2021-12-14 17:46:02,743 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE1 [2021-12-14 17:46:02,743 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE8 [2021-12-14 17:46:02,744 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2021-12-14 17:46:02,744 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2021-12-14 17:46:02,744 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE2 [2021-12-14 17:46:02,744 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2021-12-14 17:46:02,744 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2021-12-14 17:46:02,744 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2021-12-14 17:46:02,744 INFO L130 BoogieDeclarations]: Found specification of procedure state [2021-12-14 17:46:02,745 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2021-12-14 17:46:02,745 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2021-12-14 17:46:02,745 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2021-12-14 17:46:02,745 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2021-12-14 17:46:02,745 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2021-12-14 17:46:02,745 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2021-12-14 17:46:02,745 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2021-12-14 17:46:02,745 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2021-12-14 17:46:02,746 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2021-12-14 17:46:02,746 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2021-12-14 17:46:02,746 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2021-12-14 17:46:02,746 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2021-12-14 17:46:02,746 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2021-12-14 17:46:02,746 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2021-12-14 17:46:02,746 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2021-12-14 17:46:02,747 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2021-12-14 17:46:02,747 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2021-12-14 17:46:02,747 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2021-12-14 17:46:02,787 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2021-12-14 17:46:02,788 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2021-12-14 17:46:02,788 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2021-12-14 17:46:02,788 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE4 [2021-12-14 17:46:02,789 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE2 [2021-12-14 17:46:02,789 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE1 [2021-12-14 17:46:02,789 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE8 [2021-12-14 17:46:02,789 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2021-12-14 17:46:02,789 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2021-12-14 17:46:02,789 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2021-12-14 17:46:02,790 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2021-12-14 17:46:02,790 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2021-12-14 17:46:02,790 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2021-12-14 17:46:02,790 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2021-12-14 17:46:02,790 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2021-12-14 17:46:02,790 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2021-12-14 17:46:02,790 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2021-12-14 17:46:02,791 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2021-12-14 17:46:02,791 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2021-12-14 17:46:02,791 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2021-12-14 17:46:02,792 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2021-12-14 17:46:02,793 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2021-12-14 17:46:02,793 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2021-12-14 17:46:02,793 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2021-12-14 17:46:02,794 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE8 [2021-12-14 17:46:02,794 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE2 [2021-12-14 17:46:02,794 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2021-12-14 17:46:02,794 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2021-12-14 17:46:02,795 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE4 [2021-12-14 17:46:02,795 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2021-12-14 17:46:02,795 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2021-12-14 17:46:02,795 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2021-12-14 17:46:02,795 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2021-12-14 17:46:02,795 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2021-12-14 17:46:02,796 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2021-12-14 17:46:02,808 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2021-12-14 17:46:02,808 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE8 [2021-12-14 17:46:02,808 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE1 [2021-12-14 17:46:02,809 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE2 [2021-12-14 17:46:02,809 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2021-12-14 17:46:02,809 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2021-12-14 17:46:02,809 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2021-12-14 17:46:02,809 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2021-12-14 17:46:02,823 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2021-12-14 17:46:02,823 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE1 [2021-12-14 17:46:02,824 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2021-12-14 17:46:02,824 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2021-12-14 17:46:02,824 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2021-12-14 17:46:02,824 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2021-12-14 17:46:02,824 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2021-12-14 17:46:02,824 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2021-12-14 17:46:02,824 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2021-12-14 17:46:02,825 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2021-12-14 17:46:02,825 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2021-12-14 17:46:02,825 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2021-12-14 17:46:02,825 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE1 [2021-12-14 17:46:02,825 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2021-12-14 17:46:02,825 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2021-12-14 17:46:02,825 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2021-12-14 17:46:02,826 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2021-12-14 17:46:02,826 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2021-12-14 17:46:02,826 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2021-12-14 17:46:02,826 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2021-12-14 17:46:02,826 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2021-12-14 17:46:03,249 INFO L236 CfgBuilder]: Building ICFG [2021-12-14 17:46:03,251 INFO L262 CfgBuilder]: Building CFG for each procedure with an implementation [2021-12-14 17:46:03,325 INFO L768 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2021-12-14 17:46:13,585 INFO L277 CfgBuilder]: Performing block encoding [2021-12-14 17:46:13,598 INFO L296 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2021-12-14 17:46:13,598 INFO L301 CfgBuilder]: Removed 1 assume(true) statements. [2021-12-14 17:46:13,601 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.12 05:46:13 BoogieIcfgContainer [2021-12-14 17:46:13,601 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2021-12-14 17:46:13,603 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2021-12-14 17:46:13,603 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2021-12-14 17:46:13,606 INFO L275 PluginConnector]: TraceAbstraction initialized [2021-12-14 17:46:13,606 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 14.12 05:46:00" (1/3) ... [2021-12-14 17:46:13,607 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@47f93b4a and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.12 05:46:13, skipping insertion in model container [2021-12-14 17:46:13,607 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 14.12 05:46:02" (2/3) ... [2021-12-14 17:46:13,607 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@47f93b4a and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 14.12 05:46:13, skipping insertion in model container [2021-12-14 17:46:13,607 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.12 05:46:13" (3/3) ... [2021-12-14 17:46:13,608 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-14 17:46:13,613 INFO L204 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2021-12-14 17:46:13,613 INFO L163 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2021-12-14 17:46:13,658 INFO L338 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2021-12-14 17:46:13,663 INFO L339 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mLoopAccelerationTechnique=FAST_UPR [2021-12-14 17:46:13,664 INFO L340 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2021-12-14 17:46:13,687 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2021-12-14 17:46:13,694 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2021-12-14 17:46:13,695 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:46:13,695 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:46:13,696 INFO L402 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:46:13,700 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:46:13,701 INFO L85 PathProgramCache]: Analyzing trace with hash -796223239, now seen corresponding path program 1 times [2021-12-14 17:46:13,712 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-14 17:46:13,713 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [781855180] [2021-12-14 17:46:13,713 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:46:13,715 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-14 17:46:13,716 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-14 17:46:13,718 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-14 17:46:13,721 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Waiting until timeout for monitored process [2021-12-14 17:46:14,034 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:46:14,043 INFO L263 TraceCheckSpWp]: Trace formula consists of 242 conjuncts, 2 conjunts are in the unsatisfiable core [2021-12-14 17:46:14,048 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-14 17:46:14,217 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-14 17:46:14,217 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-14 17:46:14,218 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-14 17:46:14,218 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [781855180] [2021-12-14 17:46:14,219 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [781855180] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:46:14,219 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:46:14,219 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2021-12-14 17:46:14,221 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [469238888] [2021-12-14 17:46:14,221 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:46:14,226 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 3 states [2021-12-14 17:46:14,226 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-14 17:46:14,247 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2021-12-14 17:46:14,248 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2021-12-14 17:46:14,251 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:46:14,412 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:46:14,412 INFO L93 Difference]: Finished difference Result 1423 states and 2029 transitions. [2021-12-14 17:46:14,413 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2021-12-14 17:46:14,415 INFO L78 Accepts]: Start accepts. Automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2021-12-14 17:46:14,415 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:46:14,432 INFO L225 Difference]: With dead ends: 1423 [2021-12-14 17:46:14,432 INFO L226 Difference]: Without dead ends: 924 [2021-12-14 17:46:14,441 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 46 GetRequests, 45 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2021-12-14 17:46:14,444 INFO L933 BasicCegarLoop]: 767 mSDtfsCounter, 628 mSDsluCounter, 661 mSDsCounter, 0 mSdLazyCounter, 12 mSolverCounterSat, 3 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 628 SdHoareTripleChecker+Valid, 1428 SdHoareTripleChecker+Invalid, 15 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 3 IncrementalHoareTripleChecker+Valid, 12 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2021-12-14 17:46:14,445 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [628 Valid, 1428 Invalid, 15 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [3 Valid, 12 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2021-12-14 17:46:14,461 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 924 states. [2021-12-14 17:46:14,588 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 924 to 924. [2021-12-14 17:46:14,595 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-14 17:46:14,604 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2021-12-14 17:46:14,606 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2021-12-14 17:46:14,607 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:46:14,607 INFO L470 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2021-12-14 17:46:14,607 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:46:14,607 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2021-12-14 17:46:14,610 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2021-12-14 17:46:14,610 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:46:14,610 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:46:14,624 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Forceful destruction successful, exit code 0 [2021-12-14 17:46:14,811 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-14 17:46:14,811 INFO L402 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:46:14,812 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:46:14,812 INFO L85 PathProgramCache]: Analyzing trace with hash 566714884, now seen corresponding path program 1 times [2021-12-14 17:46:14,813 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-14 17:46:14,813 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [343209142] [2021-12-14 17:46:14,813 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:46:14,813 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-14 17:46:14,814 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-14 17:46:14,815 INFO L229 MonitoredProcess]: Starting monitored process 3 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-14 17:46:14,816 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Waiting until timeout for monitored process [2021-12-14 17:46:15,064 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:46:15,073 INFO L263 TraceCheckSpWp]: Trace formula consists of 246 conjuncts, 3 conjunts are in the unsatisfiable core [2021-12-14 17:46:15,076 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-14 17:46:15,219 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-14 17:46:15,219 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-14 17:46:15,221 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-14 17:46:15,221 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [343209142] [2021-12-14 17:46:15,223 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [343209142] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:46:15,223 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:46:15,223 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2021-12-14 17:46:15,224 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [301997499] [2021-12-14 17:46:15,224 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:46:15,225 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2021-12-14 17:46:15,225 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-14 17:46:15,227 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2021-12-14 17:46:15,227 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2021-12-14 17:46:15,227 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:46:15,500 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:46:15,500 INFO L93 Difference]: Finished difference Result 1833 states and 2547 transitions. [2021-12-14 17:46:15,501 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2021-12-14 17:46:15,501 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2021-12-14 17:46:15,501 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:46:15,506 INFO L225 Difference]: With dead ends: 1833 [2021-12-14 17:46:15,507 INFO L226 Difference]: Without dead ends: 923 [2021-12-14 17:46:15,510 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 51 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2021-12-14 17:46:15,511 INFO L933 BasicCegarLoop]: 782 mSDtfsCounter, 794 mSDsluCounter, 671 mSDsCounter, 0 mSdLazyCounter, 36 mSolverCounterSat, 37 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.2s Time, 0 mProtectedPredicate, 0 mProtectedAction, 794 SdHoareTripleChecker+Valid, 1453 SdHoareTripleChecker+Invalid, 73 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 37 IncrementalHoareTripleChecker+Valid, 36 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.2s IncrementalHoareTripleChecker+Time [2021-12-14 17:46:15,512 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [794 Valid, 1453 Invalid, 73 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [37 Valid, 36 Invalid, 0 Unknown, 0 Unchecked, 0.2s Time] [2021-12-14 17:46:15,513 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 923 states. [2021-12-14 17:46:15,545 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 923 to 923. [2021-12-14 17:46:15,547 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-14 17:46:15,552 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2021-12-14 17:46:15,552 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2021-12-14 17:46:15,553 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:46:15,553 INFO L470 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2021-12-14 17:46:15,553 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-14 17:46:15,553 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2021-12-14 17:46:15,557 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2021-12-14 17:46:15,557 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:46:15,558 INFO L514 BasicCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:46:15,569 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Forceful destruction successful, exit code 0 [2021-12-14 17:46:15,769 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 3 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-14 17:46:15,769 INFO L402 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:46:15,770 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:46:15,770 INFO L85 PathProgramCache]: Analyzing trace with hash -965053755, now seen corresponding path program 1 times [2021-12-14 17:46:15,771 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-14 17:46:15,771 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [401517117] [2021-12-14 17:46:15,771 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:46:15,771 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-14 17:46:15,772 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-14 17:46:15,773 INFO L229 MonitoredProcess]: Starting monitored process 4 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-14 17:46:15,775 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Waiting until timeout for monitored process [2021-12-14 17:46:16,027 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:46:16,037 INFO L263 TraceCheckSpWp]: Trace formula consists of 304 conjuncts, 4 conjunts are in the unsatisfiable core [2021-12-14 17:46:16,040 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-14 17:46:16,325 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 49 trivial. 0 not checked. [2021-12-14 17:46:16,325 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-14 17:46:16,325 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-14 17:46:16,325 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [401517117] [2021-12-14 17:46:16,326 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [401517117] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:46:16,326 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:46:16,326 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2021-12-14 17:46:16,326 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [919189044] [2021-12-14 17:46:16,326 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:46:16,327 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-14 17:46:16,327 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-14 17:46:16,327 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-14 17:46:16,327 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-14 17:46:16,328 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-14 17:46:16,529 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:46:16,529 INFO L93 Difference]: Finished difference Result 2738 states and 3820 transitions. [2021-12-14 17:46:16,530 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-14 17:46:16,530 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2021-12-14 17:46:16,530 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:46:16,541 INFO L225 Difference]: With dead ends: 2738 [2021-12-14 17:46:16,563 INFO L226 Difference]: Without dead ends: 1824 [2021-12-14 17:46:16,568 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 72 GetRequests, 67 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=17, Invalid=25, Unknown=0, NotChecked=0, Total=42 [2021-12-14 17:46:16,569 INFO L933 BasicCegarLoop]: 751 mSDtfsCounter, 627 mSDsluCounter, 2142 mSDsCounter, 0 mSdLazyCounter, 21 mSolverCounterSat, 2 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 627 SdHoareTripleChecker+Valid, 2893 SdHoareTripleChecker+Invalid, 23 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 2 IncrementalHoareTripleChecker+Valid, 21 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2021-12-14 17:46:16,569 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [627 Valid, 2893 Invalid, 23 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [2 Valid, 21 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2021-12-14 17:46:16,572 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1824 states. [2021-12-14 17:46:16,634 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1824 to 1824. [2021-12-14 17:46:16,638 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1824 states, 1353 states have (on average 1.3540280857354028) internal successors, (1832), 1381 states have internal predecessors, (1832), 350 states have call successors, (350), 121 states have call predecessors, (350), 120 states have return successors, (359), 349 states have call predecessors, (359), 349 states have call successors, (359) [2021-12-14 17:46:16,647 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1824 states to 1824 states and 2541 transitions. [2021-12-14 17:46:16,648 INFO L78 Accepts]: Start accepts. Automaton has 1824 states and 2541 transitions. Word has length 71 [2021-12-14 17:46:16,649 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:46:16,649 INFO L470 AbstractCegarLoop]: Abstraction has 1824 states and 2541 transitions. [2021-12-14 17:46:16,649 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-14 17:46:16,650 INFO L276 IsEmpty]: Start isEmpty. Operand 1824 states and 2541 transitions. [2021-12-14 17:46:16,658 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2021-12-14 17:46:16,659 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:46:16,659 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:46:16,671 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Forceful destruction successful, exit code 0 [2021-12-14 17:46:16,867 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 4 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-14 17:46:16,868 INFO L402 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:46:16,868 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:46:16,868 INFO L85 PathProgramCache]: Analyzing trace with hash -574025911, now seen corresponding path program 1 times [2021-12-14 17:46:16,869 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-14 17:46:16,870 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [2035238143] [2021-12-14 17:46:16,870 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:46:16,870 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-14 17:46:16,871 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-14 17:46:16,872 INFO L229 MonitoredProcess]: Starting monitored process 5 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-14 17:46:16,874 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Waiting until timeout for monitored process [2021-12-14 17:46:17,291 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:46:17,318 INFO L263 TraceCheckSpWp]: Trace formula consists of 608 conjuncts, 9 conjunts are in the unsatisfiable core [2021-12-14 17:46:17,342 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-14 17:46:17,720 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-12-14 17:46:17,720 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-14 17:46:17,721 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-14 17:46:17,721 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [2035238143] [2021-12-14 17:46:17,721 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [2035238143] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:46:17,721 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:46:17,721 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2021-12-14 17:46:17,721 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1872373288] [2021-12-14 17:46:17,721 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:46:17,722 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-14 17:46:17,722 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-14 17:46:17,722 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-14 17:46:17,723 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-14 17:46:17,723 INFO L87 Difference]: Start difference. First operand 1824 states and 2541 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-14 17:46:17,825 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:46:17,826 INFO L93 Difference]: Finished difference Result 3658 states and 5130 transitions. [2021-12-14 17:46:17,826 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-14 17:46:17,827 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2021-12-14 17:46:17,827 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:46:17,837 INFO L225 Difference]: With dead ends: 3658 [2021-12-14 17:46:17,837 INFO L226 Difference]: Without dead ends: 1848 [2021-12-14 17:46:17,845 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 140 GetRequests, 137 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-14 17:46:17,846 INFO L933 BasicCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1969 mSDsCounter, 0 mSdLazyCounter, 11 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2627 SdHoareTripleChecker+Invalid, 12 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 11 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2021-12-14 17:46:17,846 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [2 Valid, 2627 Invalid, 12 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 11 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2021-12-14 17:46:17,849 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1848 states. [2021-12-14 17:46:17,906 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1848 to 1844. [2021-12-14 17:46:17,910 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1844 states, 1367 states have (on average 1.3504023408924652) internal successors, (1846), 1397 states have internal predecessors, (1846), 350 states have call successors, (350), 121 states have call predecessors, (350), 126 states have return successors, (374), 353 states have call predecessors, (374), 349 states have call successors, (374) [2021-12-14 17:46:17,918 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1844 states to 1844 states and 2570 transitions. [2021-12-14 17:46:17,919 INFO L78 Accepts]: Start accepts. Automaton has 1844 states and 2570 transitions. Word has length 141 [2021-12-14 17:46:17,920 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:46:17,920 INFO L470 AbstractCegarLoop]: Abstraction has 1844 states and 2570 transitions. [2021-12-14 17:46:17,920 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-14 17:46:17,921 INFO L276 IsEmpty]: Start isEmpty. Operand 1844 states and 2570 transitions. [2021-12-14 17:46:17,926 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2021-12-14 17:46:17,926 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:46:17,927 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:46:17,948 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Ended with exit code 0 [2021-12-14 17:46:18,147 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 5 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-14 17:46:18,148 INFO L402 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:46:18,148 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:46:18,148 INFO L85 PathProgramCache]: Analyzing trace with hash -1293113785, now seen corresponding path program 1 times [2021-12-14 17:46:18,149 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-14 17:46:18,149 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1856454535] [2021-12-14 17:46:18,149 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:46:18,150 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-14 17:46:18,150 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-14 17:46:18,151 INFO L229 MonitoredProcess]: Starting monitored process 6 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-14 17:46:18,195 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Waiting until timeout for monitored process [2021-12-14 17:46:18,600 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-14 17:46:18,634 INFO L263 TraceCheckSpWp]: Trace formula consists of 634 conjuncts, 25 conjunts are in the unsatisfiable core [2021-12-14 17:46:18,638 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-14 17:46:19,370 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-12-14 17:46:19,370 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-14 17:46:19,370 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-14 17:46:19,370 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1856454535] [2021-12-14 17:46:19,370 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1856454535] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-14 17:46:19,370 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-14 17:46:19,371 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [11] imperfect sequences [] total 11 [2021-12-14 17:46:19,371 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1469928132] [2021-12-14 17:46:19,371 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-14 17:46:19,371 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 11 states [2021-12-14 17:46:19,371 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-14 17:46:19,372 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 11 interpolants. [2021-12-14 17:46:19,372 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=19, Invalid=91, Unknown=0, NotChecked=0, Total=110 [2021-12-14 17:46:19,372 INFO L87 Difference]: Start difference. First operand 1844 states and 2570 transitions. Second operand has 11 states, 11 states have (on average 8.0) internal successors, (88), 9 states have internal predecessors, (88), 3 states have call successors, (19), 2 states have call predecessors, (19), 4 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-12-14 17:46:24,707 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-14 17:46:24,708 INFO L93 Difference]: Finished difference Result 3738 states and 5228 transitions. [2021-12-14 17:46:24,711 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 11 states. [2021-12-14 17:46:24,712 INFO L78 Accepts]: Start accepts. Automaton has has 11 states, 11 states have (on average 8.0) internal successors, (88), 9 states have internal predecessors, (88), 3 states have call successors, (19), 2 states have call predecessors, (19), 4 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) Word has length 148 [2021-12-14 17:46:24,712 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-14 17:46:24,721 INFO L225 Difference]: With dead ends: 3738 [2021-12-14 17:46:24,723 INFO L226 Difference]: Without dead ends: 1908 [2021-12-14 17:46:24,729 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 152 GetRequests, 139 SyntacticMatches, 0 SemanticMatches, 13 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 5 ImplicationChecksByTransitivity, 0.4s TimeCoverageRelationStatistics Valid=37, Invalid=173, Unknown=0, NotChecked=0, Total=210 [2021-12-14 17:46:24,731 INFO L933 BasicCegarLoop]: 671 mSDtfsCounter, 31 mSDsluCounter, 5999 mSDsCounter, 0 mSdLazyCounter, 118 mSolverCounterSat, 8 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 4.9s Time, 0 mProtectedPredicate, 0 mProtectedAction, 31 SdHoareTripleChecker+Valid, 6670 SdHoareTripleChecker+Invalid, 126 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 8 IncrementalHoareTripleChecker+Valid, 118 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 5.1s IncrementalHoareTripleChecker+Time [2021-12-14 17:46:24,735 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [31 Valid, 6670 Invalid, 126 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [8 Valid, 118 Invalid, 0 Unknown, 0 Unchecked, 5.1s Time] [2021-12-14 17:46:24,738 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1908 states. [2021-12-14 17:46:24,822 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1908 to 1884. [2021-12-14 17:46:24,825 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1884 states, 1397 states have (on average 1.340014316392269) internal successors, (1872), 1427 states have internal predecessors, (1872), 356 states have call successors, (356), 121 states have call predecessors, (356), 130 states have return successors, (386), 363 states have call predecessors, (386), 355 states have call successors, (386) [2021-12-14 17:46:24,844 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1884 states to 1884 states and 2614 transitions. [2021-12-14 17:46:24,845 INFO L78 Accepts]: Start accepts. Automaton has 1884 states and 2614 transitions. Word has length 148 [2021-12-14 17:46:24,846 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-14 17:46:24,846 INFO L470 AbstractCegarLoop]: Abstraction has 1884 states and 2614 transitions. [2021-12-14 17:46:24,846 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 11 states, 11 states have (on average 8.0) internal successors, (88), 9 states have internal predecessors, (88), 3 states have call successors, (19), 2 states have call predecessors, (19), 4 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-12-14 17:46:24,846 INFO L276 IsEmpty]: Start isEmpty. Operand 1884 states and 2614 transitions. [2021-12-14 17:46:24,853 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2021-12-14 17:46:24,853 INFO L506 BasicCegarLoop]: Found error trace [2021-12-14 17:46:24,854 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-14 17:46:24,886 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Forceful destruction successful, exit code 0 [2021-12-14 17:46:25,054 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 6 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-14 17:46:25,055 INFO L402 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-14 17:46:25,055 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-14 17:46:25,055 INFO L85 PathProgramCache]: Analyzing trace with hash -669328497, now seen corresponding path program 1 times [2021-12-14 17:46:25,056 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-14 17:46:25,057 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1522337272] [2021-12-14 17:46:25,057 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-14 17:46:25,057 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-14 17:46:25,057 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-14 17:46:25,062 INFO L229 MonitoredProcess]: Starting monitored process 7 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-14 17:46:25,065 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Waiting until timeout for monitored process [2021-12-14 17:46:27,010 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-14 17:46:27,011 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2021-12-14 17:46:28,627 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-14 17:46:29,061 INFO L133 FreeRefinementEngine]: Strategy WOLF found a feasible trace [2021-12-14 17:46:29,061 INFO L628 BasicCegarLoop]: Counterexample is feasible [2021-12-14 17:46:29,062 INFO L764 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2021-12-14 17:46:29,133 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Forceful destruction successful, exit code 0 [2021-12-14 17:46:29,283 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 7 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-14 17:46:29,287 INFO L732 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2021-12-14 17:46:29,289 INFO L179 ceAbstractionStarter]: Computing trace abstraction results [2021-12-14 17:46:29,337 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,340 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,342 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,342 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,342 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,343 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,343 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,343 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,343 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,343 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,478 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 14.12 05:46:29 BoogieIcfgContainer [2021-12-14 17:46:29,479 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2021-12-14 17:46:29,479 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2021-12-14 17:46:29,479 INFO L271 PluginConnector]: Initializing Witness Printer... [2021-12-14 17:46:29,480 INFO L275 PluginConnector]: Witness Printer initialized [2021-12-14 17:46:29,480 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 14.12 05:46:13" (3/4) ... [2021-12-14 17:46:29,482 INFO L131 WitnessPrinter]: Generating witness for reachability counterexample [2021-12-14 17:46:29,494 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,495 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,495 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,495 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,496 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,496 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,496 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,496 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,496 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,497 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-14 17:46:29,651 INFO L141 WitnessManager]: Wrote witness to /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/witness.graphml [2021-12-14 17:46:29,651 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2021-12-14 17:46:29,652 INFO L158 Benchmark]: Toolchain (without parser) took 29058.87ms. Allocated memory was 58.7MB in the beginning and 201.3MB in the end (delta: 142.6MB). Free memory was 29.6MB in the beginning and 55.7MB in the end (delta: -26.1MB). Peak memory consumption was 114.9MB. Max. memory is 16.1GB. [2021-12-14 17:46:29,652 INFO L158 Benchmark]: CDTParser took 0.13ms. Allocated memory is still 58.7MB. Free memory was 41.3MB in the beginning and 41.2MB in the end (delta: 51.5kB). There was no memory consumed. Max. memory is 16.1GB. [2021-12-14 17:46:29,652 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1824.09ms. Allocated memory was 58.7MB in the beginning and 102.8MB in the end (delta: 44.0MB). Free memory was 29.3MB in the beginning and 52.4MB in the end (delta: -23.1MB). Peak memory consumption was 47.6MB. Max. memory is 16.1GB. [2021-12-14 17:46:29,652 INFO L158 Benchmark]: Boogie Procedure Inliner took 138.53ms. Allocated memory is still 102.8MB. Free memory was 52.4MB in the beginning and 44.5MB in the end (delta: 7.9MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2021-12-14 17:46:29,653 INFO L158 Benchmark]: Boogie Preprocessor took 96.53ms. Allocated memory is still 102.8MB. Free memory was 44.5MB in the beginning and 35.7MB in the end (delta: 8.8MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2021-12-14 17:46:29,653 INFO L158 Benchmark]: RCFGBuilder took 10945.51ms. Allocated memory was 102.8MB in the beginning and 201.3MB in the end (delta: 98.6MB). Free memory was 35.2MB in the beginning and 140.2MB in the end (delta: -105.0MB). Peak memory consumption was 27.7MB. Max. memory is 16.1GB. [2021-12-14 17:46:29,654 INFO L158 Benchmark]: TraceAbstraction took 15875.98ms. Allocated memory is still 201.3MB. Free memory was 140.2MB in the beginning and 97.6MB in the end (delta: 42.6MB). Peak memory consumption was 99.2MB. Max. memory is 16.1GB. [2021-12-14 17:46:29,654 INFO L158 Benchmark]: Witness Printer took 172.01ms. Allocated memory is still 201.3MB. Free memory was 97.6MB in the beginning and 55.7MB in the end (delta: 41.9MB). Peak memory consumption was 41.9MB. Max. memory is 16.1GB. [2021-12-14 17:46:29,656 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.13ms. Allocated memory is still 58.7MB. Free memory was 41.3MB in the beginning and 41.2MB in the end (delta: 51.5kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1824.09ms. Allocated memory was 58.7MB in the beginning and 102.8MB in the end (delta: 44.0MB). Free memory was 29.3MB in the beginning and 52.4MB in the end (delta: -23.1MB). Peak memory consumption was 47.6MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 138.53ms. Allocated memory is still 102.8MB. Free memory was 52.4MB in the beginning and 44.5MB in the end (delta: 7.9MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 96.53ms. Allocated memory is still 102.8MB. Free memory was 44.5MB in the beginning and 35.7MB in the end (delta: 8.8MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * RCFGBuilder took 10945.51ms. Allocated memory was 102.8MB in the beginning and 201.3MB in the end (delta: 98.6MB). Free memory was 35.2MB in the beginning and 140.2MB in the end (delta: -105.0MB). Peak memory consumption was 27.7MB. Max. memory is 16.1GB. * TraceAbstraction took 15875.98ms. Allocated memory is still 201.3MB. Free memory was 140.2MB in the beginning and 97.6MB in the end (delta: 42.6MB). Peak memory consumption was 99.2MB. Max. memory is 16.1GB. * Witness Printer took 172.01ms. Allocated memory is still 201.3MB. Free memory was 97.6MB in the beginning and 55.7MB in the end (delta: 41.9MB). Peak memory consumption was 41.9MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - CounterExampleResult [Line: 5554]: a call to reach_error is reachable a call to reach_error is reachable We found a FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=2147483648] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={18:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:2199023258816}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:2199023255552}, dev={0:2199023255552}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:2199023258816}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:2199023255552}, dev={0:2199023255552}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:2199023258816}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, dev_to_hdlc(dev)={0:2199023258816}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:2199023258816}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={0:0}, cisco_header_ops={17:0}, hdlc={0:2199023258816}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={0:0}, tmp={0:2199023258816}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:2199023258816}, tmp___0={0:0}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:2199023258816}, tmp___0={0:0}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->last_poll=0, st->settings.timeout=0, st->up=2, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:2199023258816}, tmp___0={0:0}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:2199023258816}, tmp___0={0:0}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=2199023255552, __fswab32(st->rxseq)=0, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:2199023258816}, tmp___0={0:0}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:2199023258816}, tmp___0={0:0}, tmp___1=0] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=2199023255552, __fswab32(st->txseq)=0, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:2199023258816}, tmp___0={0:0}, tmp___1=0] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, cond=1, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={4611686018427387905:0}, __this_module={0:0}, calloc(1UL, size)={4611686018427387905:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={4611686018427387905:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={4611686018427387905:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={4611686018427387905:0}, e={4611686018427387905:0}, i=0, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp___7={4611686018427387905:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={4611686018427387905:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={4611686018427387905:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={4611686018427387905:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=4, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=13696, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=13696, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:0}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={4611686018427387905:0}, skb={4611686018427387905:0}, tmp=13696, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=300000] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=300000, val=300000] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=300000, __this_module={0:0}, cisco_header_ops={17:0}, data={0:72}, dev={0:2199023255552}, dev={0:2199023255552}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={4611686018427387905:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={0:4}, __this_module={0:0}, arg0={4611686018427387905:0}, arg0={4611686018427387905:0}, arg1=18, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={0:4}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:2199023258816}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:2199023258816}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:2199023258816}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=2199023255552, __this_module={0:0}, arg=2199023255552, cisco_header_ops={17:0}, dev={0:2199023255552}, hdlc={0:2199023258816}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:2199023258816}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 15.6s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 6.2s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, PartialOrderReductionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 2082 SdHoareTripleChecker+Valid, 5.4s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 2082 mSDsluCounter, 15071 SdHoareTripleChecker+Invalid, 5.2s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 11442 mSDsCounter, 51 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 198 IncrementalHoareTripleChecker+Invalid, 249 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 51 mSolverCounterUnsat, 3629 mSDtfsCounter, 198 mSolverCounterSat, 0.0s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 461 GetRequests, 436 SyntacticMatches, 0 SemanticMatches, 25 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 5 ImplicationChecksByTransitivity, 0.6s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1884occurred in iteration=5, InterpolantAutomatonStates: 28, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.4s AutomataMinimizationTime, 5 MinimizatonAttempts, 28 StatesRemovedByMinimization, 2 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.2s SsaConstructionTime, 2.4s SatisfiabilityAnalysisTime, 1.8s InterpolantComputationTime, 640 NumberOfCodeBlocks, 640 NumberOfCodeBlocksAsserted, 6 NumberOfCheckSat, 452 ConstructedInterpolants, 0 QuantifiedInterpolants, 680 SizeOfPredicates, 21 NumberOfNonLiveVariables, 2034 ConjunctsInSsa, 43 ConjunctsInUnsatCore, 5 InterpolantComputations, 5 PerfectInterpolantSequences, 419/419 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! [2021-12-14 17:46:29,731 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE