mory location that is reachable from the precondition for the first time is taken to mean that this memory location had better been allocated since the beginning of the function for the operation to be safe, hence we &quot;abduce&quot; that this was the case and add it to the pre-condition (unless we already know that address to be invalid of course).</p><p>2. Normalize values (<code>AbstractValue.t</code>) in and out of the state according to their canonical representatives as per the current path conditio