onRecoveryStateExit called twice for a single recovery state

[jordr]

~/code/exp/libtasn1/CVE-2015-3622 $
klee -inline=strcmp,strlen -libc=uclibc --posix-runtime --search=dfs -skip-functions-not=asn1_get_tag_der,asn1_parser2tree,read,__fd_open,_asn1_yylex -output-module -debug-only=recovery -keep=_asn1_check_identifier,_asn1_set_name,_asn1_set_value,__ctype_b_loc,_asn1_str_cpy,_asn1_add_static_node,hash_pjw_bare,_asn1_get_last_right,_asn1_type_set_config,asn1_create_element,type_field259,_asn1_get_up260,_asn1_copy_structure2,asn1_find_node,_asn1_expand_identifier,_asn1_set_right test.bc 32 2>&1 | grep asn1_get_octet_string
...
[6e6b35] KLEE: ■ ■ ■ ■ ■ ■  __wrap__asn1_get_octet_string (skipped)
[baf203] KLEE: ■ ■ ■ ■ ■ ■  __wrap__asn1_get_octet_string (recovery) 
[dc58bf] KLEE: > > > > > >  __wrap__asn1_get_octet_string
[dc58bf] KLEE: R R R R R R  __wrap__asn1_get_octet_string
[dc58bf] KLEE: R R R R R R R  _asn1_get_octet_string
[dc58bf] KLEE: < < < < < <  __wrap__asn1_get_octet_string
[baf203] KLEE: ■ ■ ■ ■ ■ ■  __wrap__asn1_get_octet_string (recovery) 
[dc58bf] KLEE: > > > > > >  __wrap__asn1_get_octet_string
[dc58bf] KLEE: R R R R R R  __wrap__asn1_get_octet_string
[dc58bf] KLEE: R R R R R R R  _asn1_get_octet_string
[dc58bf] KLEE: < < < < < <  __wrap__asn1_get_octet_string
[dc58bf] KLEE: < < < < < <  __wrap__asn1_get_octet_string
[1]    10772 abort (core dumped) 

[jordr]

Debug: onRecoveryStateExit called twice for a single recovery state

[jordr]

Seemingly, when the solver does not answer True or False, a fork is triggered:

chopper/lib/Core/Executor.cpp

Lines 1007 to 1037 in 1a3a0cc

	if (res==Solver::True) {
	if (!isInternal) {
	if (pathWriter) {
	current.pathOS << "1";
	}
	}
	return StatePair(&current, 0);
	} else if (res==Solver::False) {
	if (!isInternal) {
	if (pathWriter) {
	current.pathOS << "0";
	}
	}
	return StatePair(0, &current);
	} else {
	TimerStatIncrementer timer(stats::forkTime);
	ExecutionState *falseState = NULL, *trueState = &current;
	ref<Expr> negatedCondition = Expr::createIsZero(condition);
	++stats::forks;
	falseState = trueState->branch();
	addedStates.push_back(falseState);
	if (trueState->isRecoveryState()) {
	DEBUG_WITH_TYPE(
	DEBUG_BASIC,
	klee_message("forked recovery state: %p", falseState)
	);
	interpreterHandler->incRecoveryStatesCount();
	}

This explains the duplication of recovery states. This is fine but means we need a more elaborate way of handling timers that takes this in account, so leaving the issue up