./Ultimate.py --spec ../sv-benchmarks/c/properties/unreach-call.prp --file ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version c3fed411 Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-tmp.no-commuhash-c3fed41 [2021-12-16 03:59:49,897 INFO L177 SettingsManager]: Resetting all preferences to default values... [2021-12-16 03:59:49,900 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2021-12-16 03:59:49,955 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2021-12-16 03:59:49,956 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2021-12-16 03:59:49,959 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2021-12-16 03:59:49,962 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2021-12-16 03:59:49,965 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2021-12-16 03:59:49,967 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2021-12-16 03:59:49,973 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2021-12-16 03:59:49,974 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2021-12-16 03:59:49,975 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2021-12-16 03:59:49,975 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2021-12-16 03:59:49,978 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2021-12-16 03:59:49,979 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2021-12-16 03:59:49,984 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2021-12-16 03:59:49,985 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2021-12-16 03:59:49,986 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2021-12-16 03:59:49,991 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2021-12-16 03:59:49,997 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2021-12-16 03:59:49,999 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2021-12-16 03:59:50,000 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2021-12-16 03:59:50,002 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2021-12-16 03:59:50,003 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2021-12-16 03:59:50,005 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2021-12-16 03:59:50,006 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2021-12-16 03:59:50,006 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2021-12-16 03:59:50,008 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2021-12-16 03:59:50,008 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2021-12-16 03:59:50,009 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2021-12-16 03:59:50,009 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2021-12-16 03:59:50,010 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2021-12-16 03:59:50,012 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2021-12-16 03:59:50,012 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2021-12-16 03:59:50,014 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2021-12-16 03:59:50,014 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2021-12-16 03:59:50,014 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2021-12-16 03:59:50,015 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2021-12-16 03:59:50,015 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2021-12-16 03:59:50,016 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2021-12-16 03:59:50,016 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2021-12-16 03:59:50,017 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf [2021-12-16 03:59:50,059 INFO L113 SettingsManager]: Loading preferences was successful [2021-12-16 03:59:50,059 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2021-12-16 03:59:50,060 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2021-12-16 03:59:50,060 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2021-12-16 03:59:50,061 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2021-12-16 03:59:50,062 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2021-12-16 03:59:50,062 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2021-12-16 03:59:50,062 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2021-12-16 03:59:50,063 INFO L138 SettingsManager]: * Use SBE=true [2021-12-16 03:59:50,063 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2021-12-16 03:59:50,064 INFO L138 SettingsManager]: * Overapproximate operations on floating types=true [2021-12-16 03:59:50,064 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2021-12-16 03:59:50,064 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2021-12-16 03:59:50,065 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2021-12-16 03:59:50,065 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2021-12-16 03:59:50,065 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2021-12-16 03:59:50,065 INFO L138 SettingsManager]: * Use constant arrays=true [2021-12-16 03:59:50,066 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2021-12-16 03:59:50,066 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2021-12-16 03:59:50,066 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2021-12-16 03:59:50,066 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2021-12-16 03:59:50,066 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-16 03:59:50,067 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2021-12-16 03:59:50,067 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2021-12-16 03:59:50,067 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2021-12-16 03:59:50,067 INFO L138 SettingsManager]: * Trace refinement strategy=CAMEL [2021-12-16 03:59:50,067 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2021-12-16 03:59:50,068 INFO L138 SettingsManager]: * Large block encoding in concurrent analysis=OFF [2021-12-16 03:59:50,068 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2021-12-16 03:59:50,068 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2021-12-16 03:59:50,068 INFO L138 SettingsManager]: * Trace refinement exception blacklist=NONE [2021-12-16 03:59:50,068 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2021-12-16 03:59:50,312 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2021-12-16 03:59:50,337 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2021-12-16 03:59:50,340 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2021-12-16 03:59:50,341 INFO L271 PluginConnector]: Initializing CDTParser... [2021-12-16 03:59:50,342 INFO L275 PluginConnector]: CDTParser initialized [2021-12-16 03:59:50,343 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-16 03:59:50,407 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/5efec87a6/d5541375bdf3485fbd30197032812939/FLAG19e214875 [2021-12-16 03:59:51,141 INFO L306 CDTParser]: Found 1 translation units. [2021-12-16 03:59:51,142 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-16 03:59:51,176 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/5efec87a6/d5541375bdf3485fbd30197032812939/FLAG19e214875 [2021-12-16 03:59:51,243 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/5efec87a6/d5541375bdf3485fbd30197032812939 [2021-12-16 03:59:51,246 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2021-12-16 03:59:51,247 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2021-12-16 03:59:51,248 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2021-12-16 03:59:51,248 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2021-12-16 03:59:51,253 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2021-12-16 03:59:51,253 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 16.12 03:59:51" (1/1) ... [2021-12-16 03:59:51,254 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@3d871c8d and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:51, skipping insertion in model container [2021-12-16 03:59:51,255 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 16.12 03:59:51" (1/1) ... [2021-12-16 03:59:51,264 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2021-12-16 03:59:51,364 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-12-16 03:59:52,221 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-16 03:59:52,458 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-16 03:59:52,471 INFO L203 MainTranslator]: Completed pre-run [2021-12-16 03:59:52,630 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-16 03:59:52,779 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-16 03:59:52,817 INFO L208 MainTranslator]: Completed translation [2021-12-16 03:59:52,819 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52 WrapperNode [2021-12-16 03:59:52,820 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2021-12-16 03:59:52,822 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2021-12-16 03:59:52,822 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2021-12-16 03:59:52,823 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2021-12-16 03:59:52,830 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:52,891 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:52,971 INFO L137 Inliner]: procedures = 146, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1425 [2021-12-16 03:59:52,972 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2021-12-16 03:59:52,972 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2021-12-16 03:59:52,973 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2021-12-16 03:59:52,973 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2021-12-16 03:59:52,983 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:52,984 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:53,012 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:53,013 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:53,068 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:53,083 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:53,100 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:53,122 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2021-12-16 03:59:53,125 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2021-12-16 03:59:53,126 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2021-12-16 03:59:53,126 INFO L275 PluginConnector]: RCFGBuilder initialized [2021-12-16 03:59:53,127 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (1/1) ... [2021-12-16 03:59:53,135 INFO L168 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-16 03:59:53,144 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-12-16 03:59:53,165 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2021-12-16 03:59:53,182 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2021-12-16 03:59:53,202 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2021-12-16 03:59:53,202 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2021-12-16 03:59:53,203 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~int [2021-12-16 03:59:53,203 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2021-12-16 03:59:53,203 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2021-12-16 03:59:53,203 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2021-12-16 03:59:53,203 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2021-12-16 03:59:53,203 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2021-12-16 03:59:53,203 INFO L130 BoogieDeclarations]: Found specification of procedure state [2021-12-16 03:59:53,204 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2021-12-16 03:59:53,204 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2021-12-16 03:59:53,204 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2021-12-16 03:59:53,204 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2021-12-16 03:59:53,204 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2021-12-16 03:59:53,204 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2021-12-16 03:59:53,204 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2021-12-16 03:59:53,205 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2021-12-16 03:59:53,205 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2021-12-16 03:59:53,205 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2021-12-16 03:59:53,205 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2021-12-16 03:59:53,205 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2021-12-16 03:59:53,205 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2021-12-16 03:59:53,205 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2021-12-16 03:59:53,206 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2021-12-16 03:59:53,206 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2021-12-16 03:59:53,206 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2021-12-16 03:59:53,206 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2021-12-16 03:59:53,206 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2021-12-16 03:59:53,206 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2021-12-16 03:59:53,206 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2021-12-16 03:59:53,207 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2021-12-16 03:59:53,207 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2021-12-16 03:59:53,207 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2021-12-16 03:59:53,207 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2021-12-16 03:59:53,207 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2021-12-16 03:59:53,207 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2021-12-16 03:59:53,208 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2021-12-16 03:59:53,208 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2021-12-16 03:59:53,208 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2021-12-16 03:59:53,208 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2021-12-16 03:59:53,208 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2021-12-16 03:59:53,208 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2021-12-16 03:59:53,208 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2021-12-16 03:59:53,209 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2021-12-16 03:59:53,209 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2021-12-16 03:59:53,209 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2021-12-16 03:59:53,209 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2021-12-16 03:59:53,210 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2021-12-16 03:59:53,210 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2021-12-16 03:59:53,210 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2021-12-16 03:59:53,210 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2021-12-16 03:59:53,210 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2021-12-16 03:59:53,210 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2021-12-16 03:59:53,210 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2021-12-16 03:59:53,211 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2021-12-16 03:59:53,211 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2021-12-16 03:59:53,211 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2021-12-16 03:59:53,212 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2021-12-16 03:59:53,212 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2021-12-16 03:59:53,213 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2021-12-16 03:59:53,213 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2021-12-16 03:59:53,213 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2021-12-16 03:59:53,214 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2021-12-16 03:59:53,214 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2021-12-16 03:59:53,214 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2021-12-16 03:59:53,214 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2021-12-16 03:59:53,214 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2021-12-16 03:59:53,214 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2021-12-16 03:59:53,214 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2021-12-16 03:59:53,215 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2021-12-16 03:59:53,215 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2021-12-16 03:59:53,215 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2021-12-16 03:59:53,215 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2021-12-16 03:59:53,215 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2021-12-16 03:59:53,215 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~int [2021-12-16 03:59:53,215 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2021-12-16 03:59:53,216 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2021-12-16 03:59:53,216 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2021-12-16 03:59:53,216 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2021-12-16 03:59:53,217 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2021-12-16 03:59:53,217 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2021-12-16 03:59:53,573 INFO L236 CfgBuilder]: Building ICFG [2021-12-16 03:59:53,575 INFO L262 CfgBuilder]: Building CFG for each procedure with an implementation [2021-12-16 03:59:53,878 INFO L768 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2021-12-16 03:59:54,558 INFO L277 CfgBuilder]: Performing block encoding [2021-12-16 03:59:54,569 INFO L296 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2021-12-16 03:59:54,569 INFO L301 CfgBuilder]: Removed 1 assume(true) statements. [2021-12-16 03:59:54,572 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 16.12 03:59:54 BoogieIcfgContainer [2021-12-16 03:59:54,572 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2021-12-16 03:59:54,574 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2021-12-16 03:59:54,574 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2021-12-16 03:59:54,577 INFO L275 PluginConnector]: TraceAbstraction initialized [2021-12-16 03:59:54,578 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 16.12 03:59:51" (1/3) ... [2021-12-16 03:59:54,579 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@2931c110 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 16.12 03:59:54, skipping insertion in model container [2021-12-16 03:59:54,579 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 03:59:52" (2/3) ... [2021-12-16 03:59:54,579 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@2931c110 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 16.12 03:59:54, skipping insertion in model container [2021-12-16 03:59:54,579 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 16.12 03:59:54" (3/3) ... [2021-12-16 03:59:54,581 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-16 03:59:54,585 INFO L204 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2021-12-16 03:59:54,586 INFO L163 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2021-12-16 03:59:54,631 INFO L338 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2021-12-16 03:59:54,637 INFO L339 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mLoopAccelerationTechnique=FAST_UPR [2021-12-16 03:59:54,637 INFO L340 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2021-12-16 03:59:54,662 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2021-12-16 03:59:54,671 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2021-12-16 03:59:54,671 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 03:59:54,672 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 03:59:54,672 INFO L402 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 03:59:54,677 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 03:59:54,677 INFO L85 PathProgramCache]: Analyzing trace with hash 742124414, now seen corresponding path program 1 times [2021-12-16 03:59:54,685 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-16 03:59:54,685 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [2101513517] [2021-12-16 03:59:54,685 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 03:59:54,686 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-16 03:59:54,935 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:55,067 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-16 03:59:55,070 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:55,097 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-16 03:59:55,100 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:55,116 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-16 03:59:55,119 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:55,145 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-16 03:59:55,147 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:55,158 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-16 03:59:55,161 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:55,169 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-16 03:59:55,170 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-16 03:59:55,170 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [2101513517] [2021-12-16 03:59:55,171 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [2101513517] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 03:59:55,171 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 03:59:55,172 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2021-12-16 03:59:55,174 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1804238495] [2021-12-16 03:59:55,174 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 03:59:55,180 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2021-12-16 03:59:55,180 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-16 03:59:55,202 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2021-12-16 03:59:55,203 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2021-12-16 03:59:55,206 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 03:59:56,379 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 03:59:56,379 INFO L93 Difference]: Finished difference Result 1541 states and 2218 transitions. [2021-12-16 03:59:56,380 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-16 03:59:56,382 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2021-12-16 03:59:56,382 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 03:59:56,398 INFO L225 Difference]: With dead ends: 1541 [2021-12-16 03:59:56,399 INFO L226 Difference]: Without dead ends: 1042 [2021-12-16 03:59:56,405 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 15 GetRequests, 12 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2021-12-16 03:59:56,408 INFO L933 BasicCegarLoop]: 705 mSDtfsCounter, 1084 mSDsluCounter, 810 mSDsCounter, 0 mSdLazyCounter, 407 mSolverCounterSat, 283 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.8s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1162 SdHoareTripleChecker+Valid, 1515 SdHoareTripleChecker+Invalid, 690 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 283 IncrementalHoareTripleChecker+Valid, 407 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.9s IncrementalHoareTripleChecker+Time [2021-12-16 03:59:56,409 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1162 Valid, 1515 Invalid, 690 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [283 Valid, 407 Invalid, 0 Unknown, 0 Unchecked, 0.9s Time] [2021-12-16 03:59:56,426 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1042 states. [2021-12-16 03:59:56,520 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1042 to 924. [2021-12-16 03:59:56,523 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-16 03:59:56,529 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2021-12-16 03:59:56,531 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2021-12-16 03:59:56,532 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 03:59:56,532 INFO L470 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2021-12-16 03:59:56,533 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 03:59:56,533 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2021-12-16 03:59:56,536 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2021-12-16 03:59:56,536 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 03:59:56,536 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 03:59:56,537 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable0 [2021-12-16 03:59:56,537 INFO L402 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 03:59:56,537 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 03:59:56,538 INFO L85 PathProgramCache]: Analyzing trace with hash -2097093995, now seen corresponding path program 1 times [2021-12-16 03:59:56,538 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-16 03:59:56,538 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [2132119458] [2021-12-16 03:59:56,538 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 03:59:56,539 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-16 03:59:56,581 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:56,638 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-16 03:59:56,642 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:56,652 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-16 03:59:56,654 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:56,661 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-16 03:59:56,665 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:56,676 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-16 03:59:56,678 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:56,687 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-16 03:59:56,689 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:56,697 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-16 03:59:56,697 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-16 03:59:56,697 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [2132119458] [2021-12-16 03:59:56,698 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [2132119458] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 03:59:56,698 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 03:59:56,698 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2021-12-16 03:59:56,699 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1333562708] [2021-12-16 03:59:56,699 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 03:59:56,700 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-16 03:59:56,700 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-16 03:59:56,701 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-16 03:59:56,701 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-16 03:59:56,702 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 03:59:57,461 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 03:59:57,463 INFO L93 Difference]: Finished difference Result 1951 states and 2732 transitions. [2021-12-16 03:59:57,464 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-16 03:59:57,464 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2021-12-16 03:59:57,464 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 03:59:57,470 INFO L225 Difference]: With dead ends: 1951 [2021-12-16 03:59:57,471 INFO L226 Difference]: Without dead ends: 1041 [2021-12-16 03:59:57,477 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 18 GetRequests, 13 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=15, Invalid=27, Unknown=0, NotChecked=0, Total=42 [2021-12-16 03:59:57,482 INFO L933 BasicCegarLoop]: 740 mSDtfsCounter, 987 mSDsluCounter, 887 mSDsCounter, 0 mSdLazyCounter, 381 mSolverCounterSat, 247 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.5s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1049 SdHoareTripleChecker+Valid, 1627 SdHoareTripleChecker+Invalid, 628 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 247 IncrementalHoareTripleChecker+Valid, 381 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.7s IncrementalHoareTripleChecker+Time [2021-12-16 03:59:57,483 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1049 Valid, 1627 Invalid, 628 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [247 Valid, 381 Invalid, 0 Unknown, 0 Unchecked, 0.7s Time] [2021-12-16 03:59:57,487 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1041 states. [2021-12-16 03:59:57,539 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1041 to 923. [2021-12-16 03:59:57,541 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-16 03:59:57,560 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2021-12-16 03:59:57,561 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2021-12-16 03:59:57,561 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 03:59:57,562 INFO L470 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2021-12-16 03:59:57,562 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 5.4) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 03:59:57,562 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2021-12-16 03:59:57,566 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2021-12-16 03:59:57,566 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 03:59:57,566 INFO L514 BasicCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 03:59:57,566 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable1 [2021-12-16 03:59:57,567 INFO L402 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 03:59:57,567 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 03:59:57,567 INFO L85 PathProgramCache]: Analyzing trace with hash 171125928, now seen corresponding path program 1 times [2021-12-16 03:59:57,568 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-16 03:59:57,568 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1135633472] [2021-12-16 03:59:57,568 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 03:59:57,568 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-16 03:59:57,593 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,675 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-16 03:59:57,677 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,686 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-16 03:59:57,692 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,701 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-16 03:59:57,703 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,708 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-16 03:59:57,710 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,716 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-16 03:59:57,719 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,728 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2021-12-16 03:59:57,733 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,740 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2021-12-16 03:59:57,744 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:57,754 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 89 trivial. 0 not checked. [2021-12-16 03:59:57,755 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-16 03:59:57,755 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1135633472] [2021-12-16 03:59:57,755 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1135633472] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 03:59:57,756 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 03:59:57,756 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [6] imperfect sequences [] total 6 [2021-12-16 03:59:57,756 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1266384851] [2021-12-16 03:59:57,756 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 03:59:57,757 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 6 states [2021-12-16 03:59:57,757 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-16 03:59:57,760 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 6 interpolants. [2021-12-16 03:59:57,760 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=9, Invalid=21, Unknown=0, NotChecked=0, Total=30 [2021-12-16 03:59:57,761 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-16 03:59:58,864 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 03:59:58,864 INFO L93 Difference]: Finished difference Result 2974 states and 4185 transitions. [2021-12-16 03:59:58,866 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 7 states. [2021-12-16 03:59:58,866 INFO L78 Accepts]: Start accepts. Automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2021-12-16 03:59:58,867 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 03:59:58,880 INFO L225 Difference]: With dead ends: 2974 [2021-12-16 03:59:58,886 INFO L226 Difference]: Without dead ends: 2060 [2021-12-16 03:59:58,892 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 23 GetRequests, 16 SyntacticMatches, 0 SemanticMatches, 7 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 2 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=23, Invalid=49, Unknown=0, NotChecked=0, Total=72 [2021-12-16 03:59:58,898 INFO L933 BasicCegarLoop]: 690 mSDtfsCounter, 1091 mSDsluCounter, 2067 mSDsCounter, 0 mSdLazyCounter, 715 mSolverCounterSat, 270 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.8s Time, 0 mProtectedPredicate, 0 mProtectedAction, 1173 SdHoareTripleChecker+Valid, 2757 SdHoareTripleChecker+Invalid, 985 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 270 IncrementalHoareTripleChecker+Valid, 715 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.9s IncrementalHoareTripleChecker+Time [2021-12-16 03:59:58,900 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [1173 Valid, 2757 Invalid, 985 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [270 Valid, 715 Invalid, 0 Unknown, 0 Unchecked, 0.9s Time] [2021-12-16 03:59:58,903 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2060 states. [2021-12-16 03:59:58,986 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2060 to 1924. [2021-12-16 03:59:58,990 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1437 states have (on average 1.3625608907446067) internal successors, (1958), 1469 states have internal predecessors, (1958), 358 states have call successors, (358), 121 states have call predecessors, (358), 128 states have return successors, (381), 363 states have call predecessors, (381), 357 states have call successors, (381) [2021-12-16 03:59:59,002 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2697 transitions. [2021-12-16 03:59:59,003 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2697 transitions. Word has length 71 [2021-12-16 03:59:59,005 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 03:59:59,005 INFO L470 AbstractCegarLoop]: Abstraction has 1924 states and 2697 transitions. [2021-12-16 03:59:59,006 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 6 states, 6 states have (on average 5.666666666666667) internal successors, (34), 5 states have internal predecessors, (34), 3 states have call successors, (8), 2 states have call predecessors, (8), 1 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-16 03:59:59,007 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2697 transitions. [2021-12-16 03:59:59,017 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2021-12-16 03:59:59,018 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 03:59:59,018 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 03:59:59,018 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable2 [2021-12-16 03:59:59,019 INFO L402 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 03:59:59,019 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 03:59:59,019 INFO L85 PathProgramCache]: Analyzing trace with hash 1729160309, now seen corresponding path program 1 times [2021-12-16 03:59:59,022 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-16 03:59:59,022 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1555994409] [2021-12-16 03:59:59,022 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 03:59:59,022 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-16 03:59:59,080 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,151 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-16 03:59:59,152 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,159 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-16 03:59:59,160 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,164 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-16 03:59:59,166 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,170 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-16 03:59:59,171 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,176 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-16 03:59:59,177 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,181 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 37 [2021-12-16 03:59:59,182 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,186 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 43 [2021-12-16 03:59:59,187 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,190 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 48 [2021-12-16 03:59:59,192 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,195 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 57 [2021-12-16 03:59:59,196 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,200 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 63 [2021-12-16 03:59:59,201 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,214 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 69 [2021-12-16 03:59:59,224 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,234 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-16 03:59:59,254 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,306 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-16 03:59:59,313 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,342 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 91 [2021-12-16 03:59:59,344 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,348 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 97 [2021-12-16 03:59:59,349 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,353 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 114 [2021-12-16 03:59:59,354 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,359 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 120 [2021-12-16 03:59:59,361 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,366 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 14 proven. 4 refuted. 0 times theorem prover too weak. 107 trivial. 0 not checked. [2021-12-16 03:59:59,366 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-16 03:59:59,366 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1555994409] [2021-12-16 03:59:59,366 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1555994409] provided 0 perfect and 1 imperfect interpolant sequences [2021-12-16 03:59:59,366 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleZ3 [284937748] [2021-12-16 03:59:59,367 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 03:59:59,367 INFO L168 SolverBuilder]: Constructing external solver with command: z3 -smt2 -in SMTLIB2_COMPLIANT=true [2021-12-16 03:59:59,367 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-12-16 03:59:59,372 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (exit command is (exit), workingDir is null) [2021-12-16 03:59:59,398 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Waiting until timeout for monitored process [2021-12-16 03:59:59,667 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 03:59:59,673 INFO L263 TraceCheckSpWp]: Trace formula consists of 961 conjuncts, 17 conjunts are in the unsatisfiable core [2021-12-16 03:59:59,681 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-16 04:00:00,008 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 62 proven. 0 refuted. 0 times theorem prover too weak. 63 trivial. 0 not checked. [2021-12-16 04:00:00,009 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-16 04:00:00,009 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleZ3 [284937748] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 04:00:00,009 INFO L186 FreeRefinementEngine]: Found 1 perfect and 1 imperfect interpolant sequences. [2021-12-16 04:00:00,010 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [7] total 7 [2021-12-16 04:00:00,010 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [945215400] [2021-12-16 04:00:00,010 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 04:00:00,011 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-16 04:00:00,011 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-16 04:00:00,011 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-16 04:00:00,012 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2021-12-16 04:00:00,013 INFO L87 Difference]: Start difference. First operand 1924 states and 2697 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-16 04:00:00,105 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 04:00:00,105 INFO L93 Difference]: Finished difference Result 3838 states and 5422 transitions. [2021-12-16 04:00:00,106 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-16 04:00:00,106 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2021-12-16 04:00:00,106 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 04:00:00,132 INFO L225 Difference]: With dead ends: 3838 [2021-12-16 04:00:00,132 INFO L226 Difference]: Without dead ends: 1928 [2021-12-16 04:00:00,140 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 181 GetRequests, 173 SyntacticMatches, 3 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=12, Invalid=30, Unknown=0, NotChecked=0, Total=42 [2021-12-16 04:00:00,156 INFO L933 BasicCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1969 mSDsCounter, 0 mSdLazyCounter, 11 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2627 SdHoareTripleChecker+Invalid, 12 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 11 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2021-12-16 04:00:00,156 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [2 Valid, 2627 Invalid, 12 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 11 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2021-12-16 04:00:00,159 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1928 states. [2021-12-16 04:00:00,260 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1928 to 1924. [2021-12-16 04:00:00,264 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1924 states, 1433 states have (on average 1.357990230286113) internal successors, (1946), 1467 states have internal predecessors, (1946), 358 states have call successors, (358), 121 states have call predecessors, (358), 132 states have return successors, (392), 365 states have call predecessors, (392), 357 states have call successors, (392) [2021-12-16 04:00:00,280 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1924 states to 1924 states and 2696 transitions. [2021-12-16 04:00:00,281 INFO L78 Accepts]: Start accepts. Automaton has 1924 states and 2696 transitions. Word has length 141 [2021-12-16 04:00:00,283 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 04:00:00,283 INFO L470 AbstractCegarLoop]: Abstraction has 1924 states and 2696 transitions. [2021-12-16 04:00:00,283 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-16 04:00:00,283 INFO L276 IsEmpty]: Start isEmpty. Operand 1924 states and 2696 transitions. [2021-12-16 04:00:00,294 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2021-12-16 04:00:00,295 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:00,295 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:00,326 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true (2)] Forceful destruction successful, exit code 0 [2021-12-16 04:00:00,525 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable3,2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 -smt2 -in SMTLIB2_COMPLIANT=true [2021-12-16 04:00:00,526 INFO L402 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:00,526 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:00,527 INFO L85 PathProgramCache]: Analyzing trace with hash 568539780, now seen corresponding path program 1 times [2021-12-16 04:00:00,527 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-16 04:00:00,527 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [388356397] [2021-12-16 04:00:00,527 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:00,527 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-16 04:00:00,601 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,665 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 2 [2021-12-16 04:00:00,667 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,673 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 8 [2021-12-16 04:00:00,675 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,680 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 14 [2021-12-16 04:00:00,681 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,686 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 20 [2021-12-16 04:00:00,688 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,694 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 26 [2021-12-16 04:00:00,695 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,699 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 44 [2021-12-16 04:00:00,701 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,705 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 50 [2021-12-16 04:00:00,707 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,710 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 61 [2021-12-16 04:00:00,711 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,719 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 67 [2021-12-16 04:00:00,720 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,724 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 72 [2021-12-16 04:00:00,725 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,729 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 81 [2021-12-16 04:00:00,730 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,734 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 87 [2021-12-16 04:00:00,735 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,747 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 93 [2021-12-16 04:00:00,767 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,861 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-16 04:00:00,878 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:00,964 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 1 [2021-12-16 04:00:00,981 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:01,072 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 3 [2021-12-16 04:00:01,074 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:01,110 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 122 [2021-12-16 04:00:01,112 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:01,115 INFO L376 atingTraceCheckCraig]: Compute interpolants for subsequence at non-pending call position 128 [2021-12-16 04:00:01,116 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:01,120 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-12-16 04:00:01,120 INFO L139 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2021-12-16 04:00:01,120 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [388356397] [2021-12-16 04:00:01,121 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [388356397] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 04:00:01,121 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 04:00:01,121 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [16] imperfect sequences [] total 16 [2021-12-16 04:00:01,121 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1383828527] [2021-12-16 04:00:01,121 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 04:00:01,122 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 16 states [2021-12-16 04:00:01,122 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2021-12-16 04:00:01,122 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 16 interpolants. [2021-12-16 04:00:01,123 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=31, Invalid=209, Unknown=0, NotChecked=0, Total=240 [2021-12-16 04:00:01,123 INFO L87 Difference]: Start difference. First operand 1924 states and 2696 transitions. Second operand has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-12-16 04:00:02,817 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 04:00:02,818 INFO L93 Difference]: Finished difference Result 3994 states and 5630 transitions. [2021-12-16 04:00:02,818 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 15 states. [2021-12-16 04:00:02,819 INFO L78 Accepts]: Start accepts. Automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) Word has length 148 [2021-12-16 04:00:02,820 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 04:00:02,832 INFO L225 Difference]: With dead ends: 3994 [2021-12-16 04:00:02,832 INFO L226 Difference]: Without dead ends: 2084 [2021-12-16 04:00:02,840 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 58 GetRequests, 37 SyntacticMatches, 0 SemanticMatches, 21 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 41 ImplicationChecksByTransitivity, 0.3s TimeCoverageRelationStatistics Valid=69, Invalid=437, Unknown=0, NotChecked=0, Total=506 [2021-12-16 04:00:02,841 INFO L933 BasicCegarLoop]: 620 mSDtfsCounter, 511 mSDsluCounter, 6191 mSDsCounter, 0 mSdLazyCounter, 1806 mSolverCounterSat, 228 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 1.2s Time, 0 mProtectedPredicate, 0 mProtectedAction, 532 SdHoareTripleChecker+Valid, 6811 SdHoareTripleChecker+Invalid, 2034 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 228 IncrementalHoareTripleChecker+Valid, 1806 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 1.4s IncrementalHoareTripleChecker+Time [2021-12-16 04:00:02,842 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [532 Valid, 6811 Invalid, 2034 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [228 Valid, 1806 Invalid, 0 Unknown, 0 Unchecked, 1.4s Time] [2021-12-16 04:00:02,844 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2084 states. [2021-12-16 04:00:02,932 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2084 to 1954. [2021-12-16 04:00:02,936 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1954 states, 1455 states have (on average 1.3484536082474228) internal successors, (1962), 1489 states have internal predecessors, (1962), 364 states have call successors, (364), 121 states have call predecessors, (364), 134 states have return successors, (402), 373 states have call predecessors, (402), 363 states have call successors, (402) [2021-12-16 04:00:02,945 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1954 states to 1954 states and 2728 transitions. [2021-12-16 04:00:02,946 INFO L78 Accepts]: Start accepts. Automaton has 1954 states and 2728 transitions. Word has length 148 [2021-12-16 04:00:02,947 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 04:00:02,947 INFO L470 AbstractCegarLoop]: Abstraction has 1954 states and 2728 transitions. [2021-12-16 04:00:02,947 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 16 states, 15 states have (on average 5.866666666666666) internal successors, (88), 11 states have internal predecessors, (88), 3 states have call successors, (19), 4 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 3 states have call successors, (18) [2021-12-16 04:00:02,947 INFO L276 IsEmpty]: Start isEmpty. Operand 1954 states and 2728 transitions. [2021-12-16 04:00:02,954 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2021-12-16 04:00:02,954 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:02,955 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:02,955 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable4 [2021-12-16 04:00:02,955 INFO L402 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:02,956 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:02,956 INFO L85 PathProgramCache]: Analyzing trace with hash -799997024, now seen corresponding path program 1 times [2021-12-16 04:00:02,956 INFO L121 FreeRefinementEngine]: Executing refinement strategy CAMEL [2021-12-16 04:00:02,956 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1219207413] [2021-12-16 04:00:02,956 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:02,957 INFO L126 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2021-12-16 04:00:03,352 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-16 04:00:03,353 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2021-12-16 04:00:03,457 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-16 04:00:03,557 INFO L133 FreeRefinementEngine]: Strategy CAMEL found a feasible trace [2021-12-16 04:00:03,558 INFO L628 BasicCegarLoop]: Counterexample is feasible [2021-12-16 04:00:03,558 INFO L764 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2021-12-16 04:00:03,560 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable5 [2021-12-16 04:00:03,563 INFO L732 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2021-12-16 04:00:03,566 INFO L179 ceAbstractionStarter]: Computing trace abstraction results [2021-12-16 04:00:03,595 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,596 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,596 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,596 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,597 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,597 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,597 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,597 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,597 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,598 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:03,711 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 16.12 04:00:03 BoogieIcfgContainer [2021-12-16 04:00:03,711 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2021-12-16 04:00:03,712 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2021-12-16 04:00:03,712 INFO L271 PluginConnector]: Initializing Witness Printer... [2021-12-16 04:00:03,712 INFO L275 PluginConnector]: Witness Printer initialized [2021-12-16 04:00:03,713 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 16.12 03:59:54" (3/4) ... [2021-12-16 04:00:03,715 INFO L140 WitnessPrinter]: No result that supports witness generation found [2021-12-16 04:00:03,715 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2021-12-16 04:00:03,716 INFO L158 Benchmark]: Toolchain (without parser) took 12469.19ms. Allocated memory was 88.1MB in the beginning and 264.2MB in the end (delta: 176.2MB). Free memory was 62.9MB in the beginning and 113.5MB in the end (delta: -50.6MB). Peak memory consumption was 124.1MB. Max. memory is 16.1GB. [2021-12-16 04:00:03,716 INFO L158 Benchmark]: CDTParser took 0.27ms. Allocated memory is still 73.4MB. Free memory was 52.7MB in the beginning and 52.6MB in the end (delta: 25.2kB). There was no memory consumed. Max. memory is 16.1GB. [2021-12-16 04:00:03,717 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1573.34ms. Allocated memory was 88.1MB in the beginning and 111.1MB in the end (delta: 23.1MB). Free memory was 62.9MB in the beginning and 50.8MB in the end (delta: 12.1MB). Peak memory consumption was 44.2MB. Max. memory is 16.1GB. [2021-12-16 04:00:03,717 INFO L158 Benchmark]: Boogie Procedure Inliner took 149.85ms. Allocated memory is still 111.1MB. Free memory was 50.8MB in the beginning and 42.4MB in the end (delta: 8.4MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2021-12-16 04:00:03,717 INFO L158 Benchmark]: Boogie Preprocessor took 151.96ms. Allocated memory is still 111.1MB. Free memory was 42.4MB in the beginning and 57.4MB in the end (delta: -15.0MB). Peak memory consumption was 6.5MB. Max. memory is 16.1GB. [2021-12-16 04:00:03,718 INFO L158 Benchmark]: RCFGBuilder took 1447.31ms. Allocated memory was 111.1MB in the beginning and 178.3MB in the end (delta: 67.1MB). Free memory was 57.4MB in the beginning and 93.7MB in the end (delta: -36.3MB). Peak memory consumption was 30.7MB. Max. memory is 16.1GB. [2021-12-16 04:00:03,718 INFO L158 Benchmark]: TraceAbstraction took 9137.60ms. Allocated memory was 178.3MB in the beginning and 264.2MB in the end (delta: 86.0MB). Free memory was 93.3MB in the beginning and 113.5MB in the end (delta: -20.2MB). Peak memory consumption was 67.9MB. Max. memory is 16.1GB. [2021-12-16 04:00:03,718 INFO L158 Benchmark]: Witness Printer took 3.52ms. Allocated memory is still 264.2MB. Free memory is still 113.5MB. There was no memory consumed. Max. memory is 16.1GB. [2021-12-16 04:00:03,721 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.27ms. Allocated memory is still 73.4MB. Free memory was 52.7MB in the beginning and 52.6MB in the end (delta: 25.2kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1573.34ms. Allocated memory was 88.1MB in the beginning and 111.1MB in the end (delta: 23.1MB). Free memory was 62.9MB in the beginning and 50.8MB in the end (delta: 12.1MB). Peak memory consumption was 44.2MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 149.85ms. Allocated memory is still 111.1MB. Free memory was 50.8MB in the beginning and 42.4MB in the end (delta: 8.4MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 151.96ms. Allocated memory is still 111.1MB. Free memory was 42.4MB in the beginning and 57.4MB in the end (delta: -15.0MB). Peak memory consumption was 6.5MB. Max. memory is 16.1GB. * RCFGBuilder took 1447.31ms. Allocated memory was 111.1MB in the beginning and 178.3MB in the end (delta: 67.1MB). Free memory was 57.4MB in the beginning and 93.7MB in the end (delta: -36.3MB). Peak memory consumption was 30.7MB. Max. memory is 16.1GB. * TraceAbstraction took 9137.60ms. Allocated memory was 178.3MB in the beginning and 264.2MB in the end (delta: 86.0MB). Free memory was 93.3MB in the beginning and 113.5MB in the end (delta: -20.2MB). Peak memory consumption was 67.9MB. Max. memory is 16.1GB. * Witness Printer took 3.52ms. Allocated memory is still 264.2MB. Free memory is still 113.5MB. There was no memory consumed. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - UnprovableResult [Line: 5554]: Unable to prove that call to reach_error is unreachable Unable to prove that call to reach_error is unreachable Reason: overapproximation of bitwiseOr at line 5123. Possible FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=1] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg4=51336, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=1] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg4=51336, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg3={0:0}, ldvarg4=51336, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=1] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg3={0:0}, ldvarg4=51336, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=1] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=1] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={18:0}, set={0:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=1] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=1] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, dev_to_hdlc(dev)={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={23:-8}, tmp={0:0}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, tmp={0:0}, tmp___0={23:-8}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, tmp={0:0}, tmp___0={23:-8}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, st->last_poll=1383515028900253225896057, st->settings.timeout=19, st->up=1383515028900253225896091, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:0}, tmp___0={23:-8}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, st->rxseq=1383515028900253225896063, tmp={0:0}, tmp___0={23:-8}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=1383515028900253225896063, \result=1383515028900253225896063, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=1383515028900253225896063] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=1383515028900253225896063, \result=1383515028900253225896063, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=4294887551, val=1383515028900253225896063] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=18446744073709548352, __fswab32(st->rxseq)=1383515028900253225896063, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, st->rxseq=1383515028900253225896063, tmp={0:0}, tmp___0={23:-8}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, st->txseq=-2, tmp={0:0}, tmp___0={23:-8}, tmp___1=4294887551] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=-2, \result=-2, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=-2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=-2, \result=-2, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=4294967294, val=-2] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=18446744073709548352, __fswab32(st->txseq)=-2, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, st->txseq=-2, tmp={0:0}, tmp___0={23:-8}, tmp___1=4294887551] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={1383515028900253225896071:1383515028900253225896092}, calloc(1UL, size)={-18446744073709551617:0}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551617:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-18446744073709551617:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, cond=1, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={1383515028900253225896071:1383515028900253225896092}, calloc(1UL, size)={-18446744073709551617:0}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551617:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-18446744073709551617:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={-18446744073709551617:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, calloc(1UL, size)={-18446744073709551617:0}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-18446744073709551617:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-18446744073709551617:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={-18446744073709551617:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551617:0}, tmp___7={-18446744073709551617:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, e={-18446744073709551617:0}, e={-18446744073709551617:0}, i=0, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, e={-18446744073709551617:0}, e={-18446744073709551617:0}, i=0, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, e={-18446744073709551617:0}, e={-18446744073709551617:0}, i=0, jiffies=18446744073709476616, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, e={-18446744073709551617:0}, e={-18446744073709551617:0}, i=0, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={-18446744073709551617:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551617:0}, tmp___7={-18446744073709551617:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={-18446744073709551617:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={-18446744073709551617:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={-18446744073709551617:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=1] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, arg0={-18446744073709551617:0}, arg0={-18446744073709551617:0}, arg1=4, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-18446744073709551617:231}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551617:0}, skb={-18446744073709551617:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-18446744073709551617:231}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551617:0}, skb={-18446744073709551617:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=1383515028900253225896077, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-18446744073709551617:231}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551617:0}, skb={-18446744073709551617:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={-18446744073709551617:231}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-18446744073709551617:0}, skb={-18446744073709551617:0}, tmp=51341, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=4294967294, \old(par2)=4294887551, \old(type)=2, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967294, par2=4294887551, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551617:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=4294967294, \old(par2)=4294887551, \old(type)=2, __fswab32(type)=2, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, data={23:68}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967294, par2=4294887551, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551617:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=4294967294, \old(par2)=4294887551, \old(type)=2, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, data={23:68}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967294, par2=4294887551, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551617:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=0, \result=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=0, \result=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=4294967294, \old(par2)=4294887551, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, data={23:68}, dev={0:-3264}, dev={0:-3264}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=4294967294, par2=4294887551, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-18446744073709551617:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={23:0}, __this_module={1383515028900253225896071:1383515028900253225896092}, arg0={-18446744073709551617:0}, arg0={-18446744073709551617:0}, arg1=18, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={23:0}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, tmp={0:0}, tmp___0={23:-8}, tmp___1=4294887551, tmp___2=4294967294] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, tmp={0:0}, tmp___0={23:-8}, tmp___1=4294887551, tmp___2=4294967294] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, tmp={0:0}, tmp___0={23:-8}, tmp___1=4294887551, tmp___2=4294967294] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=18446744073709548352, __this_module={1383515028900253225896071:1383515028900253225896092}, arg=18446744073709548352, cisco_header_ops={17:0}, dev={0:-3264}, hdlc={0:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={23:-8}, tmp={0:0}, tmp___0={23:-8}, tmp___1=4294887551, tmp___2=4294967294] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=4294887569, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=51336, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=4294887569, tmp___1=51336, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={1383515028900253225896071:1383515028900253225896092}, cisco_header_ops={17:0}, jiffies=18446744073709476616, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 8.9s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.1s, AutomataDifference: 5.0s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, PartialOrderReductionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 3918 SdHoareTripleChecker+Valid, 4.0s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 3675 mSDsluCounter, 15337 SdHoareTripleChecker+Invalid, 3.3s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 11924 mSDsCounter, 1029 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 3320 IncrementalHoareTripleChecker+Invalid, 4349 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 1029 mSolverCounterUnsat, 3413 mSDtfsCounter, 3320 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 295 GetRequests, 251 SyntacticMatches, 3 SemanticMatches, 41 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 50 ImplicationChecksByTransitivity, 0.4s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1954occurred in iteration=5, InterpolantAutomatonStates: 37, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.5s AutomataMinimizationTime, 5 MinimizatonAttempts, 506 StatesRemovedByMinimization, 5 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.1s SsaConstructionTime, 0.7s SatisfiabilityAnalysisTime, 1.6s InterpolantComputationTime, 781 NumberOfCodeBlocks, 781 NumberOfCodeBlocksAsserted, 7 NumberOfCheckSat, 592 ConstructedInterpolants, 0 QuantifiedInterpolants, 1341 SizeOfPredicates, 2 NumberOfNonLiveVariables, 961 ConjunctsInSsa, 17 ConjunctsInUnsatCore, 6 InterpolantComputations, 5 PerfectInterpolantSequences, 540/544 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate could not prove your program: unable to determine feasibility of some traces [2021-12-16 04:00:03,783 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Using bit-precise analysis Retrying with bit-precise analysis ### Bit-precise run ### Calling Ultimate with: /usr/bin/java -Dosgi.configuration.area=/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.5.800.v20200727-1323.jar -data @noDefault -ultimatedata /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i -s /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 --- Real Ultimate output --- This is Ultimate 0.2.2-tmp.no-commuhash-c3fed41 [2021-12-16 04:00:05,817 INFO L177 SettingsManager]: Resetting all preferences to default values... [2021-12-16 04:00:05,820 INFO L181 SettingsManager]: Resetting UltimateCore preferences to default values [2021-12-16 04:00:05,858 INFO L184 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2021-12-16 04:00:05,858 INFO L181 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2021-12-16 04:00:05,863 INFO L181 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2021-12-16 04:00:05,865 INFO L181 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2021-12-16 04:00:05,871 INFO L181 SettingsManager]: Resetting LassoRanker preferences to default values [2021-12-16 04:00:05,874 INFO L181 SettingsManager]: Resetting Reaching Definitions preferences to default values [2021-12-16 04:00:05,879 INFO L181 SettingsManager]: Resetting SyntaxChecker preferences to default values [2021-12-16 04:00:05,880 INFO L181 SettingsManager]: Resetting Sifa preferences to default values [2021-12-16 04:00:05,882 INFO L184 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2021-12-16 04:00:05,882 INFO L181 SettingsManager]: Resetting LTL2Aut preferences to default values [2021-12-16 04:00:05,885 INFO L181 SettingsManager]: Resetting PEA to Boogie preferences to default values [2021-12-16 04:00:05,886 INFO L181 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2021-12-16 04:00:05,890 INFO L181 SettingsManager]: Resetting ChcToBoogie preferences to default values [2021-12-16 04:00:05,891 INFO L181 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2021-12-16 04:00:05,892 INFO L181 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2021-12-16 04:00:05,897 INFO L181 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2021-12-16 04:00:05,901 INFO L181 SettingsManager]: Resetting CodeCheck preferences to default values [2021-12-16 04:00:05,904 INFO L181 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2021-12-16 04:00:05,908 INFO L181 SettingsManager]: Resetting RCFGBuilder preferences to default values [2021-12-16 04:00:05,910 INFO L181 SettingsManager]: Resetting Referee preferences to default values [2021-12-16 04:00:05,911 INFO L181 SettingsManager]: Resetting TraceAbstraction preferences to default values [2021-12-16 04:00:05,915 INFO L184 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2021-12-16 04:00:05,916 INFO L184 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2021-12-16 04:00:05,916 INFO L181 SettingsManager]: Resetting TreeAutomizer preferences to default values [2021-12-16 04:00:05,918 INFO L181 SettingsManager]: Resetting IcfgToChc preferences to default values [2021-12-16 04:00:05,918 INFO L181 SettingsManager]: Resetting IcfgTransformer preferences to default values [2021-12-16 04:00:05,919 INFO L184 SettingsManager]: ReqToTest provides no preferences, ignoring... [2021-12-16 04:00:05,919 INFO L181 SettingsManager]: Resetting Boogie Printer preferences to default values [2021-12-16 04:00:05,920 INFO L181 SettingsManager]: Resetting ChcSmtPrinter preferences to default values [2021-12-16 04:00:05,921 INFO L181 SettingsManager]: Resetting ReqPrinter preferences to default values [2021-12-16 04:00:05,922 INFO L181 SettingsManager]: Resetting Witness Printer preferences to default values [2021-12-16 04:00:05,923 INFO L184 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2021-12-16 04:00:05,924 INFO L181 SettingsManager]: Resetting CDTParser preferences to default values [2021-12-16 04:00:05,924 INFO L184 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2021-12-16 04:00:05,925 INFO L184 SettingsManager]: ReqParser provides no preferences, ignoring... [2021-12-16 04:00:05,925 INFO L181 SettingsManager]: Resetting SmtParser preferences to default values [2021-12-16 04:00:05,927 INFO L181 SettingsManager]: Resetting Witness Parser preferences to default values [2021-12-16 04:00:05,927 INFO L188 SettingsManager]: Finished resetting all preferences to default values... [2021-12-16 04:00:05,931 INFO L101 SettingsManager]: Beginning loading settings from /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Bitvector.epf [2021-12-16 04:00:05,965 INFO L113 SettingsManager]: Loading preferences was successful [2021-12-16 04:00:05,965 INFO L115 SettingsManager]: Preferences different from defaults after loading the file: [2021-12-16 04:00:05,967 INFO L136 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2021-12-16 04:00:05,967 INFO L138 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2021-12-16 04:00:05,968 INFO L136 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2021-12-16 04:00:05,968 INFO L138 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2021-12-16 04:00:05,969 INFO L136 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2021-12-16 04:00:05,970 INFO L138 SettingsManager]: * Create parallel compositions if possible=false [2021-12-16 04:00:05,970 INFO L138 SettingsManager]: * Use SBE=true [2021-12-16 04:00:05,970 INFO L136 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2021-12-16 04:00:05,971 INFO L138 SettingsManager]: * Check division by zero=IGNORE [2021-12-16 04:00:05,971 INFO L138 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2021-12-16 04:00:05,971 INFO L138 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2021-12-16 04:00:05,972 INFO L138 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2021-12-16 04:00:05,972 INFO L138 SettingsManager]: * Adapt memory model on pointer casts if necessary=true [2021-12-16 04:00:05,972 INFO L138 SettingsManager]: * Use bitvectors instead of ints=true [2021-12-16 04:00:05,972 INFO L138 SettingsManager]: * Memory model=HoenickeLindenmann_4ByteResolution [2021-12-16 04:00:05,972 INFO L138 SettingsManager]: * Check if freed pointer was valid=false [2021-12-16 04:00:05,973 INFO L138 SettingsManager]: * Use constant arrays=true [2021-12-16 04:00:05,973 INFO L138 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2021-12-16 04:00:05,973 INFO L136 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2021-12-16 04:00:05,973 INFO L138 SettingsManager]: * Size of a code block=SequenceOfStatements [2021-12-16 04:00:05,974 INFO L138 SettingsManager]: * SMT solver=External_DefaultMode [2021-12-16 04:00:05,974 INFO L138 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-16 04:00:05,974 INFO L136 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2021-12-16 04:00:05,979 INFO L138 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2021-12-16 04:00:05,980 INFO L138 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2021-12-16 04:00:05,980 INFO L138 SettingsManager]: * Trace refinement strategy=WOLF [2021-12-16 04:00:05,980 INFO L138 SettingsManager]: * Command for external solver=cvc4 --incremental --print-success --lang smt [2021-12-16 04:00:05,980 INFO L138 SettingsManager]: * Large block encoding in concurrent analysis=OFF [2021-12-16 04:00:05,980 INFO L138 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2021-12-16 04:00:05,981 INFO L138 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2021-12-16 04:00:05,981 INFO L138 SettingsManager]: * Trace refinement exception blacklist=NONE [2021-12-16 04:00:05,981 INFO L138 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2021-12-16 04:00:05,982 INFO L138 SettingsManager]: * Logic for external solver=AUFBV WARNING: An illegal reflective access operation has occurred WARNING: Illegal reflective access by com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 (file:/storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/plugins/com.sun.xml.bind_2.2.0.v201505121915.jar) to method java.lang.ClassLoader.defineClass(java.lang.String,byte[],int,int) WARNING: Please consider reporting this to the maintainers of com.sun.xml.bind.v2.runtime.reflect.opt.Injector$1 WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations WARNING: All illegal access operations will be denied in a future release Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> aa96c32cec5c31a75c9cdd0122db38bdeb379765e4b6aca9c91d1bb4fedaed44 [2021-12-16 04:00:06,295 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2021-12-16 04:00:06,315 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2021-12-16 04:00:06,317 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2021-12-16 04:00:06,320 INFO L271 PluginConnector]: Initializing CDTParser... [2021-12-16 04:00:06,320 INFO L275 PluginConnector]: CDTParser initialized [2021-12-16 04:00:06,322 INFO L432 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-16 04:00:06,389 INFO L220 CDTParser]: Created temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/1c2596ef7/d0e582c90c0a4864aaffd57d13fb1b9a/FLAG79c3a5068 [2021-12-16 04:00:07,184 INFO L306 CDTParser]: Found 1 translation units. [2021-12-16 04:00:07,184 INFO L160 CDTParser]: Scanning /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-16 04:00:07,220 INFO L349 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/1c2596ef7/d0e582c90c0a4864aaffd57d13fb1b9a/FLAG79c3a5068 [2021-12-16 04:00:07,405 INFO L357 CDTParser]: Successfully deleted /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/data/1c2596ef7/d0e582c90c0a4864aaffd57d13fb1b9a [2021-12-16 04:00:07,407 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2021-12-16 04:00:07,408 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2021-12-16 04:00:07,409 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2021-12-16 04:00:07,409 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2021-12-16 04:00:07,412 INFO L275 PluginConnector]: CACSL2BoogieTranslator initialized [2021-12-16 04:00:07,412 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 16.12 04:00:07" (1/1) ... [2021-12-16 04:00:07,413 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@181aaea8 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:07, skipping insertion in model container [2021-12-16 04:00:07,413 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 16.12 04:00:07" (1/1) ... [2021-12-16 04:00:07,419 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2021-12-16 04:00:07,517 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-12-16 04:00:08,350 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-16 04:00:08,739 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-16 04:00:08,773 INFO L200 MainTranslator]: Restarting translation with changed settings: SettingsChange [mNewPreferredMemoryModel=HoenickeLindenmann_1ByteResolution] [2021-12-16 04:00:08,802 INFO L178 MainTranslator]: Built tables and reachable declarations [2021-12-16 04:00:08,935 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-16 04:00:09,004 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-16 04:00:09,009 INFO L203 MainTranslator]: Completed pre-run [2021-12-16 04:00:09,165 WARN L230 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate/releaseScripts/default/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i[158033,158046] [2021-12-16 04:00:09,301 INFO L209 PostProcessor]: Analyzing one entry point: main [2021-12-16 04:00:09,349 INFO L208 MainTranslator]: Completed translation [2021-12-16 04:00:09,349 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09 WrapperNode [2021-12-16 04:00:09,350 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2021-12-16 04:00:09,350 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2021-12-16 04:00:09,351 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2021-12-16 04:00:09,351 INFO L275 PluginConnector]: Boogie Procedure Inliner initialized [2021-12-16 04:00:09,356 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,384 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,479 INFO L137 Inliner]: procedures = 158, calls = 357, calls flagged for inlining = 63, calls inlined = 60, statements flattened = 1390 [2021-12-16 04:00:09,480 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2021-12-16 04:00:09,480 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2021-12-16 04:00:09,480 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2021-12-16 04:00:09,481 INFO L275 PluginConnector]: Boogie Preprocessor initialized [2021-12-16 04:00:09,494 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,494 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,512 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,516 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,565 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,588 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,606 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,620 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2021-12-16 04:00:09,624 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2021-12-16 04:00:09,625 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2021-12-16 04:00:09,626 INFO L275 PluginConnector]: RCFGBuilder initialized [2021-12-16 04:00:09,626 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (1/1) ... [2021-12-16 04:00:09,633 INFO L168 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2021-12-16 04:00:09,642 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 [2021-12-16 04:00:09,656 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) [2021-12-16 04:00:09,697 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab32 [2021-12-16 04:00:09,697 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab32 [2021-12-16 04:00:09,697 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE1 [2021-12-16 04:00:09,698 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE8 [2021-12-16 04:00:09,698 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE4 [2021-12-16 04:00:09,698 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~$Pointer$ [2021-12-16 04:00:09,698 INFO L130 BoogieDeclarations]: Found specification of procedure read~intINTTYPE2 [2021-12-16 04:00:09,698 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$ [2021-12-16 04:00:09,698 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2021-12-16 04:00:09,698 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2021-12-16 04:00:09,699 INFO L130 BoogieDeclarations]: Found specification of procedure state [2021-12-16 04:00:09,699 INFO L138 BoogieDeclarations]: Found implementation of procedure state [2021-12-16 04:00:09,699 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2021-12-16 04:00:09,699 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2021-12-16 04:00:09,699 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_ioctl [2021-12-16 04:00:09,700 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_ioctl [2021-12-16 04:00:09,700 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_rx [2021-12-16 04:00:09,700 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_rx [2021-12-16 04:00:09,700 INFO L130 BoogieDeclarations]: Found specification of procedure debug_lockdep_rcu_enabled [2021-12-16 04:00:09,700 INFO L138 BoogieDeclarations]: Found implementation of procedure debug_lockdep_rcu_enabled [2021-12-16 04:00:09,700 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_type_trans [2021-12-16 04:00:09,701 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_type_trans [2021-12-16 04:00:09,701 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2021-12-16 04:00:09,701 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2021-12-16 04:00:09,701 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2021-12-16 04:00:09,702 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2021-12-16 04:00:09,702 INFO L130 BoogieDeclarations]: Found specification of procedure rcu_is_watching [2021-12-16 04:00:09,702 INFO L138 BoogieDeclarations]: Found implementation of procedure rcu_is_watching [2021-12-16 04:00:09,702 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2021-12-16 04:00:09,702 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2021-12-16 04:00:09,703 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2021-12-16 04:00:09,703 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2021-12-16 04:00:09,704 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE4 [2021-12-16 04:00:09,704 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE2 [2021-12-16 04:00:09,704 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE1 [2021-12-16 04:00:09,704 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~intINTTYPE8 [2021-12-16 04:00:09,704 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2021-12-16 04:00:09,704 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2021-12-16 04:00:09,705 INFO L130 BoogieDeclarations]: Found specification of procedure assume_abort_if_not [2021-12-16 04:00:09,705 INFO L138 BoogieDeclarations]: Found implementation of procedure assume_abort_if_not [2021-12-16 04:00:09,705 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2021-12-16 04:00:09,705 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2021-12-16 04:00:09,705 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2021-12-16 04:00:09,706 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_hard_header [2021-12-16 04:00:09,706 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_hard_header [2021-12-16 04:00:09,706 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2021-12-16 04:00:09,706 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2021-12-16 04:00:09,707 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2021-12-16 04:00:09,707 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2021-12-16 04:00:09,707 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2021-12-16 04:00:09,708 INFO L130 BoogieDeclarations]: Found specification of procedure lockdep_rcu_suspicious [2021-12-16 04:00:09,708 INFO L138 BoogieDeclarations]: Found implementation of procedure lockdep_rcu_suspicious [2021-12-16 04:00:09,709 INFO L130 BoogieDeclarations]: Found specification of procedure __bad_percpu_size [2021-12-16 04:00:09,709 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE8 [2021-12-16 04:00:09,710 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE2 [2021-12-16 04:00:09,710 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2021-12-16 04:00:09,710 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2021-12-16 04:00:09,710 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE4 [2021-12-16 04:00:09,711 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_to_user [2021-12-16 04:00:09,687 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Waiting until timeout for monitored process [2021-12-16 04:00:09,711 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_to_user [2021-12-16 04:00:09,712 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2021-12-16 04:00:09,712 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2021-12-16 04:00:09,712 INFO L138 BoogieDeclarations]: Found implementation of procedure add_timer [2021-12-16 04:00:09,712 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2021-12-16 04:00:09,712 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2021-12-16 04:00:09,712 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE8 [2021-12-16 04:00:09,713 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE1 [2021-12-16 04:00:09,713 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE2 [2021-12-16 04:00:09,713 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2021-12-16 04:00:09,713 INFO L130 BoogieDeclarations]: Found specification of procedure write~intINTTYPE4 [2021-12-16 04:00:09,714 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2021-12-16 04:00:09,714 INFO L130 BoogieDeclarations]: Found specification of procedure might_fault [2021-12-16 04:00:09,714 INFO L138 BoogieDeclarations]: Found implementation of procedure might_fault [2021-12-16 04:00:09,714 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~intINTTYPE1 [2021-12-16 04:00:09,714 INFO L130 BoogieDeclarations]: Found specification of procedure cisco_keepalive_send [2021-12-16 04:00:09,714 INFO L138 BoogieDeclarations]: Found implementation of procedure cisco_keepalive_send [2021-12-16 04:00:09,715 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2021-12-16 04:00:09,715 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2021-12-16 04:00:09,715 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2021-12-16 04:00:09,715 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2021-12-16 04:00:09,715 INFO L130 BoogieDeclarations]: Found specification of procedure spin_lock [2021-12-16 04:00:09,716 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_lock [2021-12-16 04:00:09,716 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock [2021-12-16 04:00:09,716 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock [2021-12-16 04:00:09,716 INFO L130 BoogieDeclarations]: Found specification of procedure read~unchecked~intINTTYPE1 [2021-12-16 04:00:09,716 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2021-12-16 04:00:09,717 INFO L138 BoogieDeclarations]: Found implementation of procedure linkwatch_fire_event [2021-12-16 04:00:09,717 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2021-12-16 04:00:09,717 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2021-12-16 04:00:09,717 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2021-12-16 04:00:09,718 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2021-12-16 04:00:09,718 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2021-12-16 04:00:09,718 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2021-12-16 04:00:10,108 INFO L236 CfgBuilder]: Building ICFG [2021-12-16 04:00:10,110 INFO L262 CfgBuilder]: Building CFG for each procedure with an implementation [2021-12-16 04:00:10,183 INFO L768 $ProcedureCfgBuilder]: dead code at ProgramPoint ldv_stopFINAL: assume true; [2021-12-16 04:00:19,632 INFO L277 CfgBuilder]: Performing block encoding [2021-12-16 04:00:19,652 INFO L296 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2021-12-16 04:00:19,657 INFO L301 CfgBuilder]: Removed 1 assume(true) statements. [2021-12-16 04:00:19,661 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 16.12 04:00:19 BoogieIcfgContainer [2021-12-16 04:00:19,661 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2021-12-16 04:00:19,663 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2021-12-16 04:00:19,663 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2021-12-16 04:00:19,665 INFO L275 PluginConnector]: TraceAbstraction initialized [2021-12-16 04:00:19,666 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 16.12 04:00:07" (1/3) ... [2021-12-16 04:00:19,667 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@30a7a19a and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 16.12 04:00:19, skipping insertion in model container [2021-12-16 04:00:19,667 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 16.12 04:00:09" (2/3) ... [2021-12-16 04:00:19,667 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@30a7a19a and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 16.12 04:00:19, skipping insertion in model container [2021-12-16 04:00:19,668 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 16.12 04:00:19" (3/3) ... [2021-12-16 04:00:19,669 INFO L111 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_cisco.ko-entry_point.cil.out.i [2021-12-16 04:00:19,674 INFO L204 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2021-12-16 04:00:19,675 INFO L163 ceAbstractionStarter]: Applying trace abstraction to program that has 1 error locations. [2021-12-16 04:00:19,724 INFO L338 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2021-12-16 04:00:19,730 INFO L339 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mHoare=true, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopsAndPotentialCycles, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mLoopAccelerationTechnique=FAST_UPR [2021-12-16 04:00:19,730 INFO L340 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2021-12-16 04:00:19,755 INFO L276 IsEmpty]: Start isEmpty. Operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) [2021-12-16 04:00:19,764 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 48 [2021-12-16 04:00:19,764 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:19,765 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:19,766 INFO L402 AbstractCegarLoop]: === Iteration 1 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:19,771 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:19,771 INFO L85 PathProgramCache]: Analyzing trace with hash -796223239, now seen corresponding path program 1 times [2021-12-16 04:00:19,783 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-16 04:00:19,783 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [71608903] [2021-12-16 04:00:19,784 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:19,785 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-16 04:00:19,785 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-16 04:00:19,789 INFO L229 MonitoredProcess]: Starting monitored process 2 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-16 04:00:19,804 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Waiting until timeout for monitored process [2021-12-16 04:00:20,080 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:20,090 INFO L263 TraceCheckSpWp]: Trace formula consists of 242 conjuncts, 2 conjunts are in the unsatisfiable core [2021-12-16 04:00:20,096 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-16 04:00:20,276 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-16 04:00:20,276 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-16 04:00:20,277 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-16 04:00:20,277 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [71608903] [2021-12-16 04:00:20,277 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [71608903] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 04:00:20,278 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 04:00:20,278 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2021-12-16 04:00:20,279 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [1568776988] [2021-12-16 04:00:20,280 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 04:00:20,290 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 3 states [2021-12-16 04:00:20,290 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-16 04:00:20,333 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2021-12-16 04:00:20,333 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2021-12-16 04:00:20,339 INFO L87 Difference]: Start difference. First operand has 488 states, 358 states have (on average 1.3715083798882681) internal successors, (491), 371 states have internal predecessors, (491), 97 states have call successors, (97), 32 states have call predecessors, (97), 31 states have return successors, (93), 93 states have call predecessors, (93), 93 states have call successors, (93) Second operand has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 04:00:20,526 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 04:00:20,527 INFO L93 Difference]: Finished difference Result 1423 states and 2029 transitions. [2021-12-16 04:00:20,533 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2021-12-16 04:00:20,534 INFO L78 Accepts]: Start accepts. Automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 47 [2021-12-16 04:00:20,535 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 04:00:20,565 INFO L225 Difference]: With dead ends: 1423 [2021-12-16 04:00:20,565 INFO L226 Difference]: Without dead ends: 924 [2021-12-16 04:00:20,578 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 46 GetRequests, 45 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2021-12-16 04:00:20,586 INFO L933 BasicCegarLoop]: 767 mSDtfsCounter, 628 mSDsluCounter, 661 mSDsCounter, 0 mSdLazyCounter, 12 mSolverCounterSat, 3 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 628 SdHoareTripleChecker+Valid, 1428 SdHoareTripleChecker+Invalid, 15 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 3 IncrementalHoareTripleChecker+Valid, 12 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2021-12-16 04:00:20,589 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [628 Valid, 1428 Invalid, 15 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [3 Valid, 12 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2021-12-16 04:00:20,608 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 924 states. [2021-12-16 04:00:20,725 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 924 to 924. [2021-12-16 04:00:20,729 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 924 states, 685 states have (on average 1.3562043795620438) internal successors, (929), 699 states have internal predecessors, (929), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-16 04:00:20,736 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 924 states to 924 states and 1284 transitions. [2021-12-16 04:00:20,738 INFO L78 Accepts]: Start accepts. Automaton has 924 states and 1284 transitions. Word has length 47 [2021-12-16 04:00:20,738 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 04:00:20,739 INFO L470 AbstractCegarLoop]: Abstraction has 924 states and 1284 transitions. [2021-12-16 04:00:20,739 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 3 states, 3 states have (on average 8.0) internal successors, (24), 3 states have internal predecessors, (24), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 04:00:20,739 INFO L276 IsEmpty]: Start isEmpty. Operand 924 states and 1284 transitions. [2021-12-16 04:00:20,742 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 51 [2021-12-16 04:00:20,743 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:20,743 INFO L514 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:20,759 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (2)] Forceful destruction successful, exit code 0 [2021-12-16 04:00:20,955 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 2 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-16 04:00:20,955 INFO L402 AbstractCegarLoop]: === Iteration 2 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:20,956 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:20,956 INFO L85 PathProgramCache]: Analyzing trace with hash 566714884, now seen corresponding path program 1 times [2021-12-16 04:00:20,957 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-16 04:00:20,957 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1270383884] [2021-12-16 04:00:20,957 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:20,957 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-16 04:00:20,957 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-16 04:00:20,959 INFO L229 MonitoredProcess]: Starting monitored process 3 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-16 04:00:20,960 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Waiting until timeout for monitored process [2021-12-16 04:00:21,281 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:21,295 INFO L263 TraceCheckSpWp]: Trace formula consists of 246 conjuncts, 3 conjunts are in the unsatisfiable core [2021-12-16 04:00:21,297 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-16 04:00:21,450 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2021-12-16 04:00:21,450 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-16 04:00:21,453 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-16 04:00:21,453 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [1270383884] [2021-12-16 04:00:21,453 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [1270383884] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 04:00:21,453 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 04:00:21,453 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [4] imperfect sequences [] total 4 [2021-12-16 04:00:21,454 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [62366406] [2021-12-16 04:00:21,454 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 04:00:21,455 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 4 states [2021-12-16 04:00:21,455 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-16 04:00:21,455 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 4 interpolants. [2021-12-16 04:00:21,456 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=5, Invalid=7, Unknown=0, NotChecked=0, Total=12 [2021-12-16 04:00:21,456 INFO L87 Difference]: Start difference. First operand 924 states and 1284 transitions. Second operand has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 04:00:21,778 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 04:00:21,779 INFO L93 Difference]: Finished difference Result 1833 states and 2547 transitions. [2021-12-16 04:00:21,779 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 4 states. [2021-12-16 04:00:21,780 INFO L78 Accepts]: Start accepts. Automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) Word has length 50 [2021-12-16 04:00:21,781 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 04:00:21,791 INFO L225 Difference]: With dead ends: 1833 [2021-12-16 04:00:21,792 INFO L226 Difference]: Without dead ends: 923 [2021-12-16 04:00:21,797 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 51 GetRequests, 48 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=9, Invalid=11, Unknown=0, NotChecked=0, Total=20 [2021-12-16 04:00:21,801 INFO L933 BasicCegarLoop]: 782 mSDtfsCounter, 794 mSDsluCounter, 671 mSDsCounter, 0 mSdLazyCounter, 36 mSolverCounterSat, 37 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.2s Time, 0 mProtectedPredicate, 0 mProtectedAction, 794 SdHoareTripleChecker+Valid, 1453 SdHoareTripleChecker+Invalid, 73 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 37 IncrementalHoareTripleChecker+Valid, 36 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.2s IncrementalHoareTripleChecker+Time [2021-12-16 04:00:21,801 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [794 Valid, 1453 Invalid, 73 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [37 Valid, 36 Invalid, 0 Unknown, 0 Unchecked, 0.2s Time] [2021-12-16 04:00:21,804 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 923 states. [2021-12-16 04:00:21,875 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 923 to 923. [2021-12-16 04:00:21,878 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 923 states, 684 states have (on average 1.3523391812865497) internal successors, (925), 698 states have internal predecessors, (925), 178 states have call successors, (178), 61 states have call predecessors, (178), 60 states have return successors, (177), 177 states have call predecessors, (177), 177 states have call successors, (177) [2021-12-16 04:00:21,885 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 923 states to 923 states and 1280 transitions. [2021-12-16 04:00:21,887 INFO L78 Accepts]: Start accepts. Automaton has 923 states and 1280 transitions. Word has length 50 [2021-12-16 04:00:21,887 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 04:00:21,887 INFO L470 AbstractCegarLoop]: Abstraction has 923 states and 1280 transitions. [2021-12-16 04:00:21,887 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 4 states, 4 states have (on average 6.75) internal successors, (27), 4 states have internal predecessors, (27), 2 states have call successors, (6), 2 states have call predecessors, (6), 1 states have return successors, (5), 1 states have call predecessors, (5), 1 states have call successors, (5) [2021-12-16 04:00:21,887 INFO L276 IsEmpty]: Start isEmpty. Operand 923 states and 1280 transitions. [2021-12-16 04:00:21,892 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 72 [2021-12-16 04:00:21,892 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:21,892 INFO L514 BasicCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:21,905 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (3)] Forceful destruction successful, exit code 0 [2021-12-16 04:00:22,105 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 3 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-16 04:00:22,105 INFO L402 AbstractCegarLoop]: === Iteration 3 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:22,106 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:22,106 INFO L85 PathProgramCache]: Analyzing trace with hash -965053755, now seen corresponding path program 1 times [2021-12-16 04:00:22,106 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-16 04:00:22,107 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [211408215] [2021-12-16 04:00:22,107 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:22,107 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-16 04:00:22,107 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-16 04:00:22,108 INFO L229 MonitoredProcess]: Starting monitored process 4 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-16 04:00:22,110 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Waiting until timeout for monitored process [2021-12-16 04:00:22,430 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:22,440 INFO L263 TraceCheckSpWp]: Trace formula consists of 304 conjuncts, 4 conjunts are in the unsatisfiable core [2021-12-16 04:00:22,443 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-16 04:00:22,723 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 49 trivial. 0 not checked. [2021-12-16 04:00:22,723 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-16 04:00:22,724 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-16 04:00:22,724 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [211408215] [2021-12-16 04:00:22,724 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [211408215] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 04:00:22,724 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 04:00:22,724 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2021-12-16 04:00:22,724 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [661731930] [2021-12-16 04:00:22,724 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 04:00:22,725 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-16 04:00:22,725 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-16 04:00:22,725 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-16 04:00:22,726 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-16 04:00:22,726 INFO L87 Difference]: Start difference. First operand 923 states and 1280 transitions. Second operand has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-16 04:00:22,948 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 04:00:22,948 INFO L93 Difference]: Finished difference Result 2738 states and 3820 transitions. [2021-12-16 04:00:22,949 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-16 04:00:22,949 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) Word has length 71 [2021-12-16 04:00:22,950 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 04:00:22,962 INFO L225 Difference]: With dead ends: 2738 [2021-12-16 04:00:22,962 INFO L226 Difference]: Without dead ends: 1824 [2021-12-16 04:00:22,969 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 72 GetRequests, 67 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=17, Invalid=25, Unknown=0, NotChecked=0, Total=42 [2021-12-16 04:00:22,972 INFO L933 BasicCegarLoop]: 752 mSDtfsCounter, 627 mSDsluCounter, 2144 mSDsCounter, 0 mSdLazyCounter, 21 mSolverCounterSat, 2 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.1s Time, 0 mProtectedPredicate, 0 mProtectedAction, 627 SdHoareTripleChecker+Valid, 2896 SdHoareTripleChecker+Invalid, 23 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 2 IncrementalHoareTripleChecker+Valid, 21 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.1s IncrementalHoareTripleChecker+Time [2021-12-16 04:00:22,973 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [627 Valid, 2896 Invalid, 23 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [2 Valid, 21 Invalid, 0 Unknown, 0 Unchecked, 0.1s Time] [2021-12-16 04:00:22,976 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1824 states. [2021-12-16 04:00:23,066 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1824 to 1824. [2021-12-16 04:00:23,070 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1824 states, 1353 states have (on average 1.3540280857354028) internal successors, (1832), 1381 states have internal predecessors, (1832), 350 states have call successors, (350), 121 states have call predecessors, (350), 120 states have return successors, (359), 349 states have call predecessors, (359), 349 states have call successors, (359) [2021-12-16 04:00:23,081 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1824 states to 1824 states and 2541 transitions. [2021-12-16 04:00:23,083 INFO L78 Accepts]: Start accepts. Automaton has 1824 states and 2541 transitions. Word has length 71 [2021-12-16 04:00:23,084 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 04:00:23,085 INFO L470 AbstractCegarLoop]: Abstraction has 1824 states and 2541 transitions. [2021-12-16 04:00:23,085 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 7.4) internal successors, (37), 5 states have internal predecessors, (37), 3 states have call successors, (8), 3 states have call predecessors, (8), 2 states have return successors, (7), 2 states have call predecessors, (7), 2 states have call successors, (7) [2021-12-16 04:00:23,085 INFO L276 IsEmpty]: Start isEmpty. Operand 1824 states and 2541 transitions. [2021-12-16 04:00:23,095 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 142 [2021-12-16 04:00:23,095 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:23,095 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:23,123 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (4)] Forceful destruction successful, exit code 0 [2021-12-16 04:00:23,320 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 4 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-16 04:00:23,321 INFO L402 AbstractCegarLoop]: === Iteration 4 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:23,321 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:23,321 INFO L85 PathProgramCache]: Analyzing trace with hash -574025911, now seen corresponding path program 1 times [2021-12-16 04:00:23,323 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-16 04:00:23,323 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [511847937] [2021-12-16 04:00:23,323 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:23,323 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-16 04:00:23,323 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-16 04:00:23,324 INFO L229 MonitoredProcess]: Starting monitored process 5 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-16 04:00:23,327 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Waiting until timeout for monitored process [2021-12-16 04:00:23,818 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:23,852 INFO L263 TraceCheckSpWp]: Trace formula consists of 608 conjuncts, 9 conjunts are in the unsatisfiable core [2021-12-16 04:00:23,857 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-16 04:00:24,231 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-12-16 04:00:24,232 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-16 04:00:24,232 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-16 04:00:24,232 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [511847937] [2021-12-16 04:00:24,232 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [511847937] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 04:00:24,232 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 04:00:24,233 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2021-12-16 04:00:24,233 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [855436962] [2021-12-16 04:00:24,233 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 04:00:24,233 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 5 states [2021-12-16 04:00:24,233 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-16 04:00:24,234 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2021-12-16 04:00:24,234 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-16 04:00:24,234 INFO L87 Difference]: Start difference. First operand 1824 states and 2541 transitions. Second operand has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-16 04:00:24,374 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 04:00:24,374 INFO L93 Difference]: Finished difference Result 3658 states and 5130 transitions. [2021-12-16 04:00:24,375 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2021-12-16 04:00:24,375 INFO L78 Accepts]: Start accepts. Automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) Word has length 141 [2021-12-16 04:00:24,376 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 04:00:24,387 INFO L225 Difference]: With dead ends: 3658 [2021-12-16 04:00:24,387 INFO L226 Difference]: Without dead ends: 1848 [2021-12-16 04:00:24,394 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 140 GetRequests, 137 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2021-12-16 04:00:24,395 INFO L933 BasicCegarLoop]: 658 mSDtfsCounter, 2 mSDsluCounter, 1969 mSDsCounter, 0 mSdLazyCounter, 11 mSolverCounterSat, 1 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 2 SdHoareTripleChecker+Valid, 2627 SdHoareTripleChecker+Invalid, 12 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 1 IncrementalHoareTripleChecker+Valid, 11 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2021-12-16 04:00:24,396 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [2 Valid, 2627 Invalid, 12 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [1 Valid, 11 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2021-12-16 04:00:24,399 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1848 states. [2021-12-16 04:00:24,462 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1848 to 1844. [2021-12-16 04:00:24,466 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1844 states, 1367 states have (on average 1.3504023408924652) internal successors, (1846), 1397 states have internal predecessors, (1846), 350 states have call successors, (350), 121 states have call predecessors, (350), 126 states have return successors, (374), 353 states have call predecessors, (374), 349 states have call successors, (374) [2021-12-16 04:00:24,476 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1844 states to 1844 states and 2570 transitions. [2021-12-16 04:00:24,478 INFO L78 Accepts]: Start accepts. Automaton has 1844 states and 2570 transitions. Word has length 141 [2021-12-16 04:00:24,479 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 04:00:24,479 INFO L470 AbstractCegarLoop]: Abstraction has 1844 states and 2570 transitions. [2021-12-16 04:00:24,480 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 5 states, 5 states have (on average 16.6) internal successors, (83), 4 states have internal predecessors, (83), 2 states have call successors, (18), 2 states have call predecessors, (18), 3 states have return successors, (17), 3 states have call predecessors, (17), 2 states have call successors, (17) [2021-12-16 04:00:24,480 INFO L276 IsEmpty]: Start isEmpty. Operand 1844 states and 2570 transitions. [2021-12-16 04:00:24,490 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 149 [2021-12-16 04:00:24,490 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:24,490 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 3, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:24,516 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (5)] Forceful destruction successful, exit code 0 [2021-12-16 04:00:24,709 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 5 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-16 04:00:24,709 INFO L402 AbstractCegarLoop]: === Iteration 5 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:24,710 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:24,710 INFO L85 PathProgramCache]: Analyzing trace with hash -1293113785, now seen corresponding path program 1 times [2021-12-16 04:00:24,711 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-16 04:00:24,711 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [59786991] [2021-12-16 04:00:24,711 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:24,711 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-16 04:00:24,711 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-16 04:00:24,713 INFO L229 MonitoredProcess]: Starting monitored process 6 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-16 04:00:24,715 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Waiting until timeout for monitored process [2021-12-16 04:00:25,187 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2021-12-16 04:00:25,222 INFO L263 TraceCheckSpWp]: Trace formula consists of 634 conjuncts, 22 conjunts are in the unsatisfiable core [2021-12-16 04:00:25,226 INFO L286 TraceCheckSpWp]: Computing forward predicates... [2021-12-16 04:00:26,079 INFO L134 CoverageAnalysis]: Checked inductivity of 125 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2021-12-16 04:00:26,080 INFO L324 TraceCheckSpWp]: Omiting computation of backward sequence because forward sequence was already perfect [2021-12-16 04:00:26,080 INFO L139 FreeRefinementEngine]: Strategy WOLF found an infeasible trace [2021-12-16 04:00:26,080 INFO L333 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleMathsat [59786991] [2021-12-16 04:00:26,080 INFO L160 FreeRefinementEngine]: IpTcStrategyModuleMathsat [59786991] provided 1 perfect and 0 imperfect interpolant sequences [2021-12-16 04:00:26,080 INFO L186 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2021-12-16 04:00:26,080 INFO L199 FreeRefinementEngine]: Number of different interpolants: perfect sequences [12] imperfect sequences [] total 12 [2021-12-16 04:00:26,080 INFO L115 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [766046108] [2021-12-16 04:00:26,080 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2021-12-16 04:00:26,081 INFO L546 AbstractCegarLoop]: INTERPOLANT automaton has 12 states [2021-12-16 04:00:26,081 INFO L103 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy WOLF [2021-12-16 04:00:26,081 INFO L143 InterpolantAutomaton]: Constructing interpolant automaton starting with 12 interpolants. [2021-12-16 04:00:26,081 INFO L145 InterpolantAutomaton]: CoverageRelationStatistics Valid=21, Invalid=111, Unknown=0, NotChecked=0, Total=132 [2021-12-16 04:00:26,082 INFO L87 Difference]: Start difference. First operand 1844 states and 2570 transitions. Second operand has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2021-12-16 04:00:32,695 WARN L534 Checker$ProtectedHtc]: IncrementalHoareTripleChecker took 1.06s for a HTC check with result INVALID. Formula has sorts [Array, Bool, BitVec], hasArrays=true, hasNonlinArith=false, quantifiers [] [2021-12-16 04:00:35,176 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2021-12-16 04:00:35,176 INFO L93 Difference]: Finished difference Result 3746 states and 5240 transitions. [2021-12-16 04:00:35,179 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 13 states. [2021-12-16 04:00:35,180 INFO L78 Accepts]: Start accepts. Automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) Word has length 148 [2021-12-16 04:00:35,180 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2021-12-16 04:00:35,191 INFO L225 Difference]: With dead ends: 3746 [2021-12-16 04:00:35,191 INFO L226 Difference]: Without dead ends: 1916 [2021-12-16 04:00:35,197 INFO L932 BasicCegarLoop]: 0 DeclaredPredicates, 152 GetRequests, 138 SyntacticMatches, 0 SemanticMatches, 14 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.7s TimeCoverageRelationStatistics Valid=37, Invalid=203, Unknown=0, NotChecked=0, Total=240 [2021-12-16 04:00:35,198 INFO L933 BasicCegarLoop]: 669 mSDtfsCounter, 36 mSDsluCounter, 6636 mSDsCounter, 0 mSdLazyCounter, 157 mSolverCounterSat, 8 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 8.4s Time, 0 mProtectedPredicate, 0 mProtectedAction, 39 SdHoareTripleChecker+Valid, 7305 SdHoareTripleChecker+Invalid, 165 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 8 IncrementalHoareTripleChecker+Valid, 157 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 8.7s IncrementalHoareTripleChecker+Time [2021-12-16 04:00:35,198 INFO L934 BasicCegarLoop]: SdHoareTripleChecker [39 Valid, 7305 Invalid, 165 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [8 Valid, 157 Invalid, 0 Unknown, 0 Unchecked, 8.7s Time] [2021-12-16 04:00:35,201 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1916 states. [2021-12-16 04:00:35,263 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1916 to 1884. [2021-12-16 04:00:35,267 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 1884 states, 1397 states have (on average 1.340014316392269) internal successors, (1872), 1427 states have internal predecessors, (1872), 356 states have call successors, (356), 121 states have call predecessors, (356), 130 states have return successors, (386), 363 states have call predecessors, (386), 355 states have call successors, (386) [2021-12-16 04:00:35,281 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1884 states to 1884 states and 2614 transitions. [2021-12-16 04:00:35,282 INFO L78 Accepts]: Start accepts. Automaton has 1884 states and 2614 transitions. Word has length 148 [2021-12-16 04:00:35,284 INFO L84 Accepts]: Finished accepts. word is rejected. [2021-12-16 04:00:35,284 INFO L470 AbstractCegarLoop]: Abstraction has 1884 states and 2614 transitions. [2021-12-16 04:00:35,284 INFO L471 AbstractCegarLoop]: INTERPOLANT automaton has has 12 states, 12 states have (on average 7.333333333333333) internal successors, (88), 9 states have internal predecessors, (88), 2 states have call successors, (19), 2 states have call predecessors, (19), 5 states have return successors, (18), 5 states have call predecessors, (18), 2 states have call successors, (18) [2021-12-16 04:00:35,284 INFO L276 IsEmpty]: Start isEmpty. Operand 1884 states and 2614 transitions. [2021-12-16 04:00:35,290 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 184 [2021-12-16 04:00:35,291 INFO L506 BasicCegarLoop]: Found error trace [2021-12-16 04:00:35,291 INFO L514 BasicCegarLoop]: trace histogram [8, 8, 7, 4, 4, 4, 3, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2021-12-16 04:00:35,317 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (6)] Forceful destruction successful, exit code 0 [2021-12-16 04:00:35,511 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 6 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-16 04:00:35,512 INFO L402 AbstractCegarLoop]: === Iteration 6 === Targeting ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION] === [2021-12-16 04:00:35,512 INFO L144 PredicateUnifier]: Initialized classic predicate unifier [2021-12-16 04:00:35,512 INFO L85 PathProgramCache]: Analyzing trace with hash -669328497, now seen corresponding path program 1 times [2021-12-16 04:00:35,514 INFO L121 FreeRefinementEngine]: Executing refinement strategy WOLF [2021-12-16 04:00:35,514 INFO L333 FreeRefinementEngine]: Using trace check IpTcStrategyModuleMathsat [1827636900] [2021-12-16 04:00:35,514 INFO L95 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2021-12-16 04:00:35,514 INFO L168 SolverBuilder]: Constructing external solver with command: mathsat -unsat_core_generation=3 [2021-12-16 04:00:35,514 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat [2021-12-16 04:00:35,518 INFO L229 MonitoredProcess]: Starting monitored process 7 with /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (exit command is (exit), workingDir is null) [2021-12-16 04:00:35,520 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Waiting until timeout for monitored process [2021-12-16 04:00:41,887 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-16 04:00:41,888 INFO L352 TraceCheck]: Trace is feasible, we will do another trace check, this time with branch encoders. [2021-12-16 04:00:44,334 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2021-12-16 04:00:44,758 INFO L133 FreeRefinementEngine]: Strategy WOLF found a feasible trace [2021-12-16 04:00:44,759 INFO L628 BasicCegarLoop]: Counterexample is feasible [2021-12-16 04:00:44,760 INFO L764 garLoopResultBuilder]: Registering result UNSAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2021-12-16 04:00:44,842 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 (7)] Forceful destruction successful, exit code 0 [2021-12-16 04:00:44,983 WARN L452 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: 7 /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/mathsat -unsat_core_generation=3 [2021-12-16 04:00:44,986 INFO L732 BasicCegarLoop]: Path program histogram: [1, 1, 1, 1, 1, 1] [2021-12-16 04:00:44,990 INFO L179 ceAbstractionStarter]: Computing trace abstraction results [2021-12-16 04:00:45,028 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,029 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,029 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,029 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,030 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,030 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,030 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,030 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,031 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,031 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,151 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 16.12 04:00:45 BoogieIcfgContainer [2021-12-16 04:00:45,151 INFO L132 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2021-12-16 04:00:45,152 INFO L113 PluginConnector]: ------------------------Witness Printer---------------------------- [2021-12-16 04:00:45,152 INFO L271 PluginConnector]: Initializing Witness Printer... [2021-12-16 04:00:45,152 INFO L275 PluginConnector]: Witness Printer initialized [2021-12-16 04:00:45,153 INFO L185 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 16.12 04:00:19" (3/4) ... [2021-12-16 04:00:45,154 INFO L131 WitnessPrinter]: Generating witness for reachability counterexample [2021-12-16 04:00:45,172 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,174 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,174 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,174 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,175 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,175 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,175 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,175 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,175 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,176 WARN L418 cessorBacktranslator]: Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled [2021-12-16 04:00:45,374 INFO L141 WitnessManager]: Wrote witness to /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/witness.graphml [2021-12-16 04:00:45,374 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2021-12-16 04:00:45,375 INFO L158 Benchmark]: Toolchain (without parser) took 37966.99ms. Allocated memory was 50.3MB in the beginning and 291.5MB in the end (delta: 241.2MB). Free memory was 28.7MB in the beginning and 198.8MB in the end (delta: -170.1MB). Peak memory consumption was 205.9MB. Max. memory is 16.1GB. [2021-12-16 04:00:45,375 INFO L158 Benchmark]: CDTParser took 0.20ms. Allocated memory is still 50.3MB. Free memory was 32.3MB in the beginning and 32.2MB in the end (delta: 45.8kB). There was no memory consumed. Max. memory is 16.1GB. [2021-12-16 04:00:45,376 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1940.89ms. Allocated memory was 50.3MB in the beginning and 102.8MB in the end (delta: 52.4MB). Free memory was 28.5MB in the beginning and 41.0MB in the end (delta: -12.5MB). Peak memory consumption was 45.9MB. Max. memory is 16.1GB. [2021-12-16 04:00:45,376 INFO L158 Benchmark]: Boogie Procedure Inliner took 129.20ms. Allocated memory was 102.8MB in the beginning and 192.9MB in the end (delta: 90.2MB). Free memory was 41.0MB in the beginning and 145.8MB in the end (delta: -104.8MB). Peak memory consumption was 11.3MB. Max. memory is 16.1GB. [2021-12-16 04:00:45,376 INFO L158 Benchmark]: Boogie Preprocessor took 142.67ms. Allocated memory is still 192.9MB. Free memory was 145.8MB in the beginning and 136.6MB in the end (delta: 9.3MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2021-12-16 04:00:45,377 INFO L158 Benchmark]: RCFGBuilder took 10037.31ms. Allocated memory is still 192.9MB. Free memory was 136.6MB in the beginning and 134.3MB in the end (delta: 2.3MB). Peak memory consumption was 59.6MB. Max. memory is 16.1GB. [2021-12-16 04:00:45,377 INFO L158 Benchmark]: TraceAbstraction took 25488.70ms. Allocated memory was 192.9MB in the beginning and 291.5MB in the end (delta: 98.6MB). Free memory was 133.2MB in the beginning and 79.4MB in the end (delta: 53.8MB). Peak memory consumption was 153.3MB. Max. memory is 16.1GB. [2021-12-16 04:00:45,377 INFO L158 Benchmark]: Witness Printer took 222.86ms. Allocated memory is still 291.5MB. Free memory was 79.4MB in the beginning and 198.8MB in the end (delta: -119.4MB). Peak memory consumption was 16.0MB. Max. memory is 16.1GB. [2021-12-16 04:00:45,379 INFO L339 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.20ms. Allocated memory is still 50.3MB. Free memory was 32.3MB in the beginning and 32.2MB in the end (delta: 45.8kB). There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1940.89ms. Allocated memory was 50.3MB in the beginning and 102.8MB in the end (delta: 52.4MB). Free memory was 28.5MB in the beginning and 41.0MB in the end (delta: -12.5MB). Peak memory consumption was 45.9MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 129.20ms. Allocated memory was 102.8MB in the beginning and 192.9MB in the end (delta: 90.2MB). Free memory was 41.0MB in the beginning and 145.8MB in the end (delta: -104.8MB). Peak memory consumption was 11.3MB. Max. memory is 16.1GB. * Boogie Preprocessor took 142.67ms. Allocated memory is still 192.9MB. Free memory was 145.8MB in the beginning and 136.6MB in the end (delta: 9.3MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * RCFGBuilder took 10037.31ms. Allocated memory is still 192.9MB. Free memory was 136.6MB in the beginning and 134.3MB in the end (delta: 2.3MB). Peak memory consumption was 59.6MB. Max. memory is 16.1GB. * TraceAbstraction took 25488.70ms. Allocated memory was 192.9MB in the beginning and 291.5MB in the end (delta: 98.6MB). Free memory was 133.2MB in the beginning and 79.4MB in the end (delta: 53.8MB). Peak memory consumption was 153.3MB. Max. memory is 16.1GB. * Witness Printer took 222.86ms. Allocated memory is still 291.5MB. Free memory was 79.4MB in the beginning and 198.8MB in the end (delta: -119.4MB). Peak memory consumption was 16.0MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.boogie.preprocessor: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Nested struct field access of VarList #Ultimate.meminit_#ptr#1 : $Pointer$ not handled * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. - GenericResult: Unfinished Backtranslation The program execution was not completely translated back. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - CounterExampleResult [Line: 5554]: a call to reach_error is reachable a call to reach_error is reachable We found a FailurePath: [L5577] int LDV_IN_INTERRUPT = 1; [L5578] struct sk_buff *proto_group1 ; [L5579] int ldv_state_variable_0 ; [L5580] int ldv_state_variable_3 ; [L5581] int ldv_timer_state_1 = 0; [L5582] int ldv_state_variable_2 ; [L5583] struct net_device *proto_group0 ; [L5584] int ref_cnt ; [L5585] int ldv_state_variable_1 ; [L5586] struct timer_list *ldv_timer_list_1 ; [L5964-L5966] static struct hdlc_proto proto = {0, 0, & cisco_start, & cisco_stop, 0, & cisco_ioctl, & cisco_type_trans, & cisco_rx, 0, & __this_module, 0}; [L5967] static struct header_ops const cisco_header_ops = {& cisco_hard_header, 0, 0, 0, 0}; [L6078] int ldv_retval_0 ; [L6374] Element set_impl[15] ; [L6375] int last_index = 0; [L6509] Set LDV_SKBS ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6142] struct ifreq *ldvarg0 ; [L6143] void *tmp ; [L6144] unsigned int ldvarg1 ; [L6145] unsigned int tmp___0 ; [L6146] unsigned short ldvarg4 ; [L6147] unsigned short tmp___1 ; [L6148] struct sk_buff *ldvarg3 ; [L6149] void *tmp___2 ; [L6150] struct net_device *ldvarg5 ; [L6151] void *tmp___3 ; [L6152] void *ldvarg2 ; [L6153] void *tmp___4 ; [L6154] void *ldvarg6 ; [L6155] void *tmp___5 ; [L6156] int tmp___6 ; [L6157] int tmp___7 ; [L6158] int tmp___8 ; [L6159] int tmp___9 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] CALL, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=40, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=40, tmp___0=2147483648] [L6161] RET, EXPR ldv_zalloc(40UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6161] tmp = ldv_zalloc(40UL) [L6162] ldvarg0 = (struct ifreq *)tmp [L6163] tmp___0 = __VERIFIER_nondet_uint() [L6164] ldvarg1 = tmp___0 [L6165] tmp___1 = __VERIFIER_nondet_ushort() [L6166] ldvarg4 = tmp___1 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6167] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5] [L6167] tmp___2 = ldv_zalloc(232UL) [L6168] ldvarg3 = (struct sk_buff *)tmp___2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6169] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}] [L6169] tmp___3 = ldv_zalloc(3264UL) [L6170] ldvarg5 = (struct net_device *)tmp___3 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6171] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}] [L6171] tmp___4 = ldv_zalloc(1UL) [L6172] ldvarg2 = tmp___4 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] CALL, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6173] RET, EXPR ldv_zalloc(1UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}] [L6173] tmp___5 = ldv_zalloc(1UL) [L6174] ldvarg6 = tmp___5 [L6175] CALL ldv_initialize() [L6528] CALL ldv_set_init(LDV_SKBS) [L6380] set = set_impl [L6381] last_index = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={18:0}, set_impl={18:0}] [L6528] RET ldv_set_init(LDV_SKBS) [L6175] RET ldv_initialize() [L6176] ldv_state_variable_1 = 1 [L6177] ref_cnt = 0 [L6178] ldv_state_variable_0 = 1 [L6179] ldv_state_variable_3 = 0 [L6180] ldv_state_variable_2 = 0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: [L6202] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6203] COND TRUE ldv_state_variable_0 == 1 [L6204] CALL, EXPR mod_init() [L6067] FCALL register_hdlc_protocol(& proto) [L6068] return (0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6204] RET, EXPR mod_init() [L6204] ldv_retval_0 = mod_init() [L6205] COND TRUE ldv_retval_0 == 0 [L6206] ldv_state_variable_0 = 3 [L6207] ldv_state_variable_2 = 1 [L6208] ldv_state_variable_3 = 1 [L6209] CALL ldv_initialize_hdlc_proto_3() [L6101] void *tmp ; [L6102] void *tmp___0 ; VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] CALL, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=232, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=232, tmp___0=2147483648] [L6104] RET, EXPR ldv_zalloc(232UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6104] tmp = ldv_zalloc(232UL) [L6105] proto_group1 = (struct sk_buff *)tmp VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] CALL, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND TRUE tmp___0 != 0 [L5525] return ((void *)0); VAL [\old(size)=3264, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=3264, tmp___0=2147483648] [L6106] RET, EXPR ldv_zalloc(3264UL) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}] [L6106] tmp___0 = ldv_zalloc(3264UL) [L6107] proto_group0 = (struct net_device *)tmp___0 VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0={0:0}] [L6209] RET ldv_initialize_hdlc_proto_3() [L6212] COND FALSE !(ldv_retval_0 != 0) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=0, tmp___7=1] [L6185] COND TRUE ldv_state_variable_1 != 0 [L6186] CALL choose_timer_1(ldv_timer_list_1) [L6114] LDV_IN_INTERRUPT = 2 [L6115] EXPR timer->data [L6115] EXPR timer->function [L6115] CALL (*(timer->function))(timer->data) [L5877] struct net_device *dev ; [L5878] hdlc_device *hdlc ; [L5879] struct hdlc_device *tmp ; [L5880] struct cisco_state *st ; [L5881] struct cisco_state *tmp___0 ; [L5882] __u32 tmp___1 ; [L5883] __u32 tmp___2 ; [L5885] dev = (struct net_device *)arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] CALL, EXPR dev_to_hdlc(dev) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5638] void *tmp ; [L5640] CALL, EXPR netdev_priv((struct net_device const *)dev) [L5595] return ((void *)dev + 3264U); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5640] RET, EXPR netdev_priv((struct net_device const *)dev) [L5640] tmp = netdev_priv((struct net_device const *)dev) [L5641] return ((struct hdlc_device *)tmp); VAL [\result={0:3264}, __this_module={0:0}, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5886] RET, EXPR dev_to_hdlc(dev) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, dev_to_hdlc(dev)={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5886] tmp = dev_to_hdlc(dev) [L5887] hdlc = tmp VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:3264}] [L5888] CALL, EXPR state(hdlc) VAL [__this_module={0:0}, cisco_header_ops={17:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5670] EXPR hdlc->state [L5670] return ((struct cisco_state *)hdlc->state); [L5888] RET, EXPR state(hdlc) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, state(hdlc)={0:0}, tmp={0:3264}] [L5888] tmp___0 = state(hdlc) [L5889] st = tmp___0 VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5890] CALL spin_lock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5263] FCALL _raw_spin_lock(& lock->ldv_6338.rlock) [L5890] RET spin_lock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}] [L5891] EXPR st->up [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L [L5891] EXPR st->last_poll [L5891] EXPR st->settings.timeout [L5891] st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->last_poll=0, st->settings.timeout=0, st->up=2, st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L=0, tmp={0:3264}, tmp___0={0:0}] [L5891] COND FALSE !(st->up != 0 && (long )((st->last_poll + (unsigned long )(st->settings.timeout * 250U)) - (unsigned long )jiffies) < 0L) [L5897] EXPR st->rxseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] CALL, EXPR __fswab32(st->rxseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5897] RET, EXPR __fswab32(st->rxseq) VAL [\old(arg)=0, __fswab32(st->rxseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->rxseq=0, tmp={0:3264}, tmp___0={0:0}] [L5897] tmp___1 = __fswab32(st->rxseq) [L5898] EXPR st->txseq [L5898] st->txseq = st->txseq + 1U [L5899] EXPR st->txseq VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] CALL, EXPR __fswab32(st->txseq) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=0] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(val)=0, \result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=0, val=0] [L5899] RET, EXPR __fswab32(st->txseq) VAL [\old(arg)=0, __fswab32(st->txseq)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, st->txseq=0, tmp={0:3264}, tmp___0={0:0}, tmp___1=0] [L5899] tmp___2 = __fswab32(st->txseq) [L5900] CALL cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5695] struct sk_buff *skb ; [L5696] struct cisco_packet *data ; [L5697] __u32 tmp ; [L5698] __u32 tmp___0 ; [L5700] CALL, EXPR ldv_dev_alloc_skb_12(22U) [L6356] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6512] void *skb ; [L6513] void *tmp___7 ; VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5519] void *p ; [L5520] void *tmp ; [L5521] int tmp___0 ; [L5523] tmp___0 = __VERIFIER_nondet_int() [L5524] COND FALSE !(tmp___0 != 0) [L5527] EXPR, FCALL calloc(1UL, size) [L5527] tmp = calloc(1UL, size) [L5528] p = tmp VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={-9223372036854775805:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-9223372036854775805:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-9223372036854775805:0}, tmp___0=0] [L5529] CALL assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5498] COND FALSE !(!cond) VAL [\old(cond)=1, \old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, cond=1, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5529] RET assume_abort_if_not((unsigned long )p != (unsigned long )((void *)0)) VAL [\old(last_index)=0, \old(size)=248, __this_module={0:0}, calloc(1UL, size)={-9223372036854775805:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-9223372036854775805:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-9223372036854775805:0}, tmp___0=0] [L5530] return (p); VAL [\old(last_index)=0, \old(size)=248, \result={-9223372036854775805:0}, __this_module={0:0}, calloc(1UL, size)={-9223372036854775805:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={-9223372036854775805:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=248, tmp={-9223372036854775805:0}, tmp___0=0] [L6515] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={-9223372036854775805:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6515] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6516] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-9223372036854775805:0}, tmp___7={-9223372036854775805:0}] [L6517] COND FALSE !(! skb) [L6520] CALL ldv_set_add(LDV_SKBS, skb) [L6388] int i ; [L6390] i = 0 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={-9223372036854775805:0}, e={-9223372036854775805:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6391] COND TRUE 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={-9223372036854775805:0}, e={-9223372036854775805:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6392] COND FALSE !(i < last_index) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={-9223372036854775805:0}, e={-9223372036854775805:0}, i=0, jiffies=0, last_index=0, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6402] COND TRUE last_index < 15 [L6403] set_impl[last_index] = e [L6404] last_index = last_index + 1 VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, e={-9223372036854775805:0}, e={-9223372036854775805:0}, i=0, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6520] RET ldv_set_add(LDV_SKBS, skb) [L6521] return (skb); VAL [\old(last_index)=0, \result={-9223372036854775805:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-9223372036854775805:0}, tmp___7={-9223372036854775805:0}] [L6358] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(length)=22, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, ldv_skb_alloc()={-9223372036854775805:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6358] tmp = ldv_skb_alloc() [L6359] return (tmp); VAL [\old(last_index)=0, \old(length)=22, \result={-9223372036854775805:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, length=22, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={-9223372036854775805:0}] [L5700] RET, EXPR ldv_dev_alloc_skb_12(22U) [L5700] skb = ldv_dev_alloc_skb_12(22U) [L5701] COND FALSE !((unsigned long )skb == (unsigned long )((struct sk_buff *)0)) [L5706] CALL skb_reserve(skb, 4) [L5475] EXPR skb->data [L5475] skb->data = skb->data + (unsigned long )len [L5476] EXPR skb->tail [L5476] skb->tail = skb->tail + (sk_buff_data_t )len [L5706] RET skb_reserve(skb, 4) [L5707] CALL cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5676] struct hdlc_header *data ; [L5677] __u16 tmp ; [L5679] CALL skb_push(skb, 4U) [L6687] CALL, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(last_index)=0, \old(size)=1, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5502] void *p ; [L5503] void *tmp ; [L5504] int tmp___0 ; [L5506] tmp___0 = __VERIFIER_nondet_int() [L5507] COND TRUE tmp___0 != 0 [L5508] return ((void *)0); VAL [\old(last_index)=0, \old(size)=1, \result={0:0}, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, size=1, tmp___0=2147483648] [L6687] RET, EXPR ldv_malloc(sizeof(unsigned char)) VAL [\old(arg1)=4, \old(last_index)=0, __this_module={0:0}, arg0={-9223372036854775805:0}, arg0={-9223372036854775805:0}, arg1=4, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_malloc(sizeof(unsigned char))={0:0}, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L6687] return ldv_malloc(sizeof(unsigned char)); [L5679] RET skb_push(skb, 4U) [L5680] EXPR skb->data [L5680] data = (struct hdlc_header *)skb->data [L5681] COND TRUE (unsigned int )type == 32821U [L5682] data->address = 143U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:2}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-9223372036854775805:0}, skb={-9223372036854775805:0}, type=32821] [L5686] data->control = 0U VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:2}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-9223372036854775805:0}, skb={-9223372036854775805:0}, type=32821] [L5687] CALL, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(val)=32821, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5123] return ((__u16 )((int )((short )((int )val << 8)) | (int )((short )((int )val >> 8)))); VAL [\old(last_index)=0, \old(val)=32821, \result=13696, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=32821] [L5687] RET, EXPR __fswab16((int )type) VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, __fswab16((int )type)=13696, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:2}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-9223372036854775805:0}, skb={-9223372036854775805:0}, type=32821] [L5687] tmp = __fswab16((int )type) [L5688] data->protocol = tmp [L5689] return (4); VAL [\old(last_index)=0, \old(len)=0, \old(type)=32821, \result=4, __this_module={0:0}, cisco_header_ops={17:0}, daddr={0:0}, daddr={0:0}, data={0:2}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, len=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, saddr={0:0}, saddr={0:0}, set_impl={18:0}, skb={-9223372036854775805:0}, skb={-9223372036854775805:0}, tmp=13696, type=32821] [L5707] RET cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_hard_header(skb, dev, 32821, (void const *)0, (void const *)0, 0U)=4, cisco_header_ops={17:0}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-9223372036854775805:0}, type=2] [L5708] EXPR skb->data [L5708] data = (struct cisco_packet *)skb->data + 4U [L5709] CALL, EXPR __fswab32(type) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=2] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=2, \result=2, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=2, val=2] [L5709] RET, EXPR __fswab32(type) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:74}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-9223372036854775805:0}, type=2] [L5709] tmp = __fswab32(type) [L5710] data->type = tmp [L5711] data->par1 = par1 [L5712] data->par2 = par2 [L5713] data->rel = 65535U VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __this_module={0:0}, cisco_header_ops={17:0}, data={0:74}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-9223372036854775805:0}, tmp=2, type=2] [L5714] CALL, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5128] __u32 tmp ; [L5130] CALL, EXPR __arch_swab32(val) [L5117] return (val); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, val=300000] [L5130] RET, EXPR __arch_swab32(val) [L5130] tmp = __arch_swab32(val) [L5131] return (tmp); VAL [\old(last_index)=0, \old(val)=300000, \result=300000, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp=300000, val=300000] [L5714] RET, EXPR __fswab32(((__u32 )jiffies + 75000U) * 4U) VAL [\old(last_index)=0, \old(par1)=0, \old(par2)=0, \old(type)=2, __fswab32(((__u32 )jiffies + 75000U) * 4U)=300000, __this_module={0:0}, cisco_header_ops={17:0}, data={0:74}, dev={0:0}, dev={0:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, par1=0, par2=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, skb={-9223372036854775805:0}, tmp=2, type=2] [L5714] tmp___0 = __fswab32(((__u32 )jiffies + 75000U) * 4U) [L5715] data->time = tmp___0 [L5716] CALL skb_put(skb, 18U) [L6690] EXPR arg0->data [L6690] EXPR arg0->tail [L6690] unsigned char *ret_val = arg0->data + arg0->tail; [L6691] EXPR arg0->tail [L6691] arg0->tail += arg1 [L6692] return ret_val; VAL [\old(arg1)=18, \old(last_index)=0, \result={0:6}, __this_module={0:0}, arg0={-9223372036854775805:0}, arg0={-9223372036854775805:0}, arg1=18, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, ret_val={0:6}, set_impl={18:0}] [L5716] RET skb_put(skb, 18U) [L5717] skb->priority = 7U [L5718] skb->dev = dev [L5719] CALL skb_reset_network_header(skb) [L5483] EXPR skb->data [L5483] EXPR skb->head [L5483] skb->network_header = (int )((__u16 )((long )skb->data)) - (int )((__u16 )((long )skb->head)) [L5719] RET skb_reset_network_header(skb) [L5720] CALL dev_queue_xmit(skb) [L6643] return __VERIFIER_nondet_int(); [L5720] RET dev_queue_xmit(skb) [L5900] RET cisco_keepalive_send(dev, 2U, tmp___2, tmp___1) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5901] CALL spin_unlock(& st->lock) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5270] FCALL _raw_spin_unlock(& lock->ldv_6338.rlock) [L5901] RET spin_unlock(& st->lock) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5902] EXPR st->settings.interval [L5902] st->timer.expires = (unsigned long )(st->settings.interval * 250U) + (unsigned long )jiffies [L5903] st->timer.function = & cisco_timer [L5904] st->timer.data = arg VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L5905] FCALL add_timer(& st->timer) VAL [\old(arg)=0, __this_module={0:0}, arg=0, cisco_header_ops={17:0}, dev={0:0}, hdlc={0:3264}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=2, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, st={0:0}, tmp={0:3264}, tmp___0={0:0}, tmp___1=0, tmp___2=0] [L6115] RET (*(timer->function))(timer->data) [L6116] LDV_IN_INTERRUPT = 1 [L6117] ldv_timer_state_1 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, timer={0:0}, timer={0:0}] [L6186] RET choose_timer_1(ldv_timer_list_1) [L6182] tmp___6 = __VERIFIER_nondet_int() [L6184] case 0: [L6190] case 1: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1] [L6191] COND TRUE ldv_state_variable_0 != 0 [L6192] tmp___7 = __VERIFIER_nondet_int() [L6194] case 0: VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6195] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 [L6196] CALL mod_exit() [L6074] FCALL unregister_hdlc_protocol(& proto) [L6196] RET mod_exit() [L6197] ldv_state_variable_0 = 2 VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, ldvarg0={0:0}, ldvarg1=5, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=5, ldvarg5={0:0}, ldvarg6={0:0}, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp={0:0}, tmp___0=5, tmp___1=5, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0] [L6315] CALL ldv_check_final_state() [L6579] int tmp___7 ; [L6581] CALL, EXPR ldv_set_is_empty(LDV_SKBS) [L6470] return (last_index == 0); VAL [\result=0, __this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={18:0}] [L6581] RET, EXPR ldv_set_is_empty(LDV_SKBS) [L6581] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6582] COND FALSE !(\read(tmp___7)) VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}, tmp___7=0] [L6584] CALL ldv_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] [L5554] reach_error() VAL [__this_module={0:0}, cisco_header_ops={17:0}, jiffies=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=2, proto={16:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={18:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 33 procedures, 489 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 25.3s, OverallIterations: 6, TraceHistogramMax: 8, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.1s, AutomataDifference: 10.2s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, PartialOrderReductionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 2090 SdHoareTripleChecker+Valid, 9.1s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 2087 mSDsluCounter, 15709 SdHoareTripleChecker+Invalid, 8.8s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 12081 mSDsCounter, 51 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 237 IncrementalHoareTripleChecker+Invalid, 288 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 51 mSolverCounterUnsat, 3628 mSDtfsCounter, 237 mSolverCounterSat, 0.1s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 461 GetRequests, 435 SyntacticMatches, 0 SemanticMatches, 26 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 6 ImplicationChecksByTransitivity, 0.9s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=1884occurred in iteration=5, InterpolantAutomatonStates: 30, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.5s AutomataMinimizationTime, 5 MinimizatonAttempts, 36 StatesRemovedByMinimization, 2 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.3s SsaConstructionTime, 7.0s SatisfiabilityAnalysisTime, 2.0s InterpolantComputationTime, 640 NumberOfCodeBlocks, 640 NumberOfCodeBlocksAsserted, 6 NumberOfCheckSat, 452 ConstructedInterpolants, 0 QuantifiedInterpolants, 646 SizeOfPredicates, 16 NumberOfNonLiveVariables, 2034 ConjunctsInSsa, 40 ConjunctsInUnsatCore, 5 InterpolantComputations, 5 PerfectInterpolantSequences, 419/419 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! [2021-12-16 04:00:45,451 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE