; LLVM IR from shellphish/how2heap :: glibc_2.23 (house_of_orange)

; Unoptimized IR (clang -disable-llvm-passes):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

%struct._IO_FILE = type { i32, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, ptr, i32, i32, i64, i16, i8, [1 x i8], ptr, i64, ptr, ptr, ptr, ptr, i64, i32, [20 x i8] }

@stderr = external global ptr, align 8
@.str = external hidden unnamed_addr constant [194 x i8], align 1
@.str.1 = external hidden unnamed_addr constant [180 x i8], align 1
@.str.2 = external hidden unnamed_addr constant [9 x i8], align 1

; Function Attrs: nounwind uwtable
define dso_local i32 @main() #0 {
  %1 = alloca i32, align 4
  %2 = alloca ptr, align 8
  %3 = alloca ptr, align 8
  %4 = alloca i64, align 8
  %5 = alloca ptr, align 8
  %6 = alloca ptr, align 8
  %7 = alloca ptr, align 8
  store i32 0, ptr %1, align 4
  call void @llvm.lifetime.start.p0(i64 8, ptr %2) #5
  call void @llvm.lifetime.start.p0(i64 8, ptr %3) #5
  call void @llvm.lifetime.start.p0(i64 8, ptr %4) #5
  call void @llvm.lifetime.start.p0(i64 8, ptr %5) #5
  %8 = load ptr, ptr @stderr, align 8, !tbaa !5
  %9 = call i32 (ptr, ptr, ...) @fprintf(ptr noundef %8, ptr noundef @.str) #5
  %10 = load ptr, ptr @stderr, align 8, !tbaa !5
  %11 = call i32 (ptr, ptr, ...) @fprintf(ptr noundef %10, ptr noundef @.str.1) #5
  %12 = call noalias ptr @malloc(i64 noundef 1008) #6
  store ptr %12, ptr %2, align 8, !tbaa !5
  %13 = load ptr, ptr %2, align 8, !tbaa !5
  %14 = getelementptr inbounds i8, ptr %13, i64 1024
  %15 = getelementptr inbounds i8, ptr %14, i64 -16
  store ptr %15, ptr %5, align 8, !tbaa !5
  %16 = load ptr, ptr %5, align 8, !tbaa !5
  %17 = getelementptr inbounds i64, ptr %16, i64 1
  store i64 3073, ptr %17, align 8, !tbaa !9
  %18 = call noalias ptr @malloc(i64 noundef 4096) #6
  store ptr %18, ptr %3, align 8, !tbaa !5
  %19 = load ptr, ptr %5, align 8, !tbaa !5
  %20 = getelementptr inbounds i64, ptr %19, i64 2
  %21 = load i64, ptr %20, align 8, !tbaa !9
  %22 = add i64 %21, 2472
  store i64 %22, ptr %4, align 8, !tbaa !9
  %23 = load i64, ptr %4, align 8, !tbaa !9
  %24 = sub i64 %23, 16
  %25 = load ptr, ptr %5, align 8, !tbaa !5
  %26 = getelementptr inbounds i64, ptr %25, i64 3
  store i64 %24, ptr %26, align 8, !tbaa !9
  %27 = load ptr, ptr %5, align 8, !tbaa !5
  call void @llvm.memcpy.p0.p0.i64(ptr align 1 %27, ptr align 1 @.str.2, i64 8, i1 false)
  %28 = load ptr, ptr %5, align 8, !tbaa !5
  %29 = getelementptr inbounds i64, ptr %28, i64 1
  store i64 97, ptr %29, align 8, !tbaa !9
  call void @llvm.lifetime.start.p0(i64 8, ptr %6) #5
  %30 = load ptr, ptr %5, align 8, !tbaa !5
  store ptr %30, ptr %6, align 8, !tbaa !5
  %31 = load ptr, ptr %6, align 8, !tbaa !5
  %32 = getelementptr inbounds %struct._IO_FILE, ptr %31, i32 0, i32 27
  store i32 0, ptr %32, align 8, !tbaa !11
  %33 = load ptr, ptr %6, align 8, !tbaa !5
  %34 = getelementptr inbounds %struct._IO_FILE, ptr %33, i32 0, i32 4
  store ptr inttoptr (i64 2 to ptr), ptr %34, align 8, !tbaa !15
  %35 = load ptr, ptr %6, align 8, !tbaa !5
  %36 = getelementptr inbounds %struct._IO_FILE, ptr %35, i32 0, i32 5
  store ptr inttoptr (i64 3 to ptr), ptr %36, align 8, !tbaa !16
  call void @llvm.lifetime.start.p0(i64 8, ptr %7) #5
  %37 = load ptr, ptr %5, align 8, !tbaa !5
  %38 = getelementptr inbounds i64, ptr %37, i64 12
  store ptr %38, ptr %7, align 8, !tbaa !5
  %39 = load ptr, ptr %7, align 8, !tbaa !5
  %40 = getelementptr inbounds i64, ptr %39, i64 3
  store i64 ptrtoint (ptr @winner to i64), ptr %40, align 8, !tbaa !9
  %41 = load ptr, ptr %7, align 8, !tbaa !5
  %42 = ptrtoint ptr %41 to i64
  %43 = load ptr, ptr %6, align 8, !tbaa !5
  %44 = ptrtoint ptr %43 to i64
  %45 = add i64 %44, 216
  %46 = inttoptr i64 %45 to ptr
  store i64 %42, ptr %46, align 8, !tbaa !9
  %47 = call noalias ptr @malloc(i64 noundef 10) #6
  call void @llvm.lifetime.end.p0(i64 8, ptr %7) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %6) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %5) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %4) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %3) #5
  call void @llvm.lifetime.end.p0(i64 8, ptr %2) #5
  ret i32 0
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr nocapture) #1

; Function Attrs: nounwind
declare i32 @fprintf(ptr noundef, ptr noundef, ...) #2

; Function Attrs: nounwind allocsize(0)
declare noalias ptr @malloc(i64 noundef) #3

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p0.p0.i64(ptr noalias nocapture writeonly, ptr noalias nocapture readonly, i64, i1 immarg) #4

; Function Attrs: nounwind uwtable
declare dso_local i32 @winner(ptr noundef) #0

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr nocapture) #1

attributes #0 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { nounwind "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind allocsize(0) "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
attributes #5 = { nounwind }
attributes #6 = { nounwind allocsize(0) }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"long", !7, i64 0}
!11 = !{!12, !13, i64 192}
!12 = !{!"_IO_FILE", !13, i64 0, !6, i64 8, !6, i64 16, !6, i64 24, !6, i64 32, !6, i64 40, !6, i64 48, !6, i64 56, !6, i64 64, !6, i64 72, !6, i64 80, !6, i64 88, !6, i64 96, !6, i64 104, !13, i64 112, !13, i64 116, !10, i64 120, !14, i64 128, !7, i64 130, !7, i64 131, !6, i64 136, !10, i64 144, !6, i64 152, !6, i64 160, !6, i64 168, !6, i64 176, !10, i64 184, !13, i64 192, !7, i64 196}
!13 = !{!"int", !7, i64 0}
!14 = !{!"short", !7, i64 0}
!15 = !{!12, !6, i64 32}
!16 = !{!12, !6, i64 40}


; Optimized IR (opt -passes='default<O3>'):
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

@stderr = external local_unnamed_addr global ptr, align 8
@.str = external hidden unnamed_addr constant [194 x i8], align 1
@.str.1 = external hidden unnamed_addr constant [180 x i8], align 1
@.str.2 = external hidden unnamed_addr constant [9 x i8], align 1

; Function Attrs: nofree nounwind uwtable
define dso_local noundef i32 @main() local_unnamed_addr #0 {
  %1 = load ptr, ptr @stderr, align 8, !tbaa !5
  %2 = tail call i32 (ptr, ptr, ...) @fprintf(ptr noundef %1, ptr noundef nonnull @.str) #4
  %3 = load ptr, ptr @stderr, align 8, !tbaa !5
  %4 = tail call i32 (ptr, ptr, ...) @fprintf(ptr noundef %3, ptr noundef nonnull @.str.1) #4
  %5 = tail call noalias dereferenceable_or_null(1008) ptr @malloc(i64 noundef 1008) #5
  %6 = getelementptr inbounds i8, ptr %5, i64 1008
  %7 = getelementptr inbounds i8, ptr %5, i64 1016
  %8 = load i64, ptr @.str.2, align 1
  store i64 %8, ptr %6, align 1
  store i64 97, ptr %7, align 8, !tbaa !9
  %9 = getelementptr inbounds i8, ptr %5, i64 1200
  store i32 0, ptr %9, align 8, !tbaa !11
  %10 = getelementptr inbounds i8, ptr %5, i64 1040
  store ptr inttoptr (i64 2 to ptr), ptr %10, align 8, !tbaa !15
  %11 = getelementptr inbounds i8, ptr %5, i64 1048
  store ptr inttoptr (i64 3 to ptr), ptr %11, align 8, !tbaa !16
  %12 = getelementptr inbounds i8, ptr %5, i64 1104
  %13 = getelementptr inbounds i8, ptr %5, i64 1128
  store i64 ptrtoint (ptr @winner to i64), ptr %13, align 8, !tbaa !9
  %14 = ptrtoint ptr %12 to i64
  %15 = ptrtoint ptr %6 to i64
  %16 = add i64 %15, 216
  %17 = inttoptr i64 %16 to ptr
  store i64 %14, ptr %17, align 8, !tbaa !9
  ret i32 0
}

; Function Attrs: nofree nounwind
declare noundef i32 @fprintf(ptr nocapture noundef, ptr nocapture noundef readonly, ...) local_unnamed_addr #1

; Function Attrs: mustprogress nofree nounwind willreturn allockind("alloc,uninitialized") allocsize(0) memory(inaccessiblemem: readwrite)
declare noalias noundef ptr @malloc(i64 noundef) local_unnamed_addr #2

; Function Attrs: nounwind uwtable
declare dso_local i32 @winner(ptr noundef) #3

attributes #0 = { nofree nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #1 = { nofree nounwind "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #2 = { mustprogress nofree nounwind willreturn allockind("alloc,uninitialized") allocsize(0) memory(inaccessiblemem: readwrite) "alloc-family"="malloc" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #3 = { nounwind uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cmov,+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" }
attributes #4 = { cold nounwind }
attributes #5 = { nounwind allocsize(0) }

!llvm.module.flags = !{!0, !1, !2, !3}
!llvm.ident = !{!4}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 8, !"PIC Level", i32 2}
!2 = !{i32 7, !"PIE Level", i32 2}
!3 = !{i32 7, !"uwtable", i32 2}
!4 = !{!"clang version 19.1.0 (git@github.com:llvm/llvm-project.git a4bf6cd7cfb1a1421ba92bca9d017b49936c55e4)"}
!5 = !{!6, !6, i64 0}
!6 = !{!"any pointer", !7, i64 0}
!7 = !{!"omnipotent char", !8, i64 0}
!8 = !{!"Simple C/C++ TBAA"}
!9 = !{!10, !10, i64 0}
!10 = !{!"long", !7, i64 0}
!11 = !{!12, !13, i64 192}
!12 = !{!"_IO_FILE", !13, i64 0, !6, i64 8, !6, i64 16, !6, i64 24, !6, i64 32, !6, i64 40, !6, i64 48, !6, i64 56, !6, i64 64, !6, i64 72, !6, i64 80, !6, i64 88, !6, i64 96, !6, i64 104, !13, i64 112, !13, i64 116, !10, i64 120, !14, i64 128, !7, i64 130, !7, i64 131, !6, i64 136, !10, i64 144, !6, i64 152, !6, i64 160, !6, i64 168, !6, i64 176, !10, i64 184, !13, i64 192, !7, i64 196}
!13 = !{!"int", !7, i64 0}
!14 = !{!"short", !7, i64 0}
!15 = !{!12, !6, i64 32}
!16 = !{!12, !6, i64 40}


; Effective O3 passes: BDCEPass,DSEPass,EarlyCSEPass,GVNPass,GlobalOptPass,InferFunctionAttrsPass,InstCombinePass,PostOrderFunctionAttrsPass,SROAPass,TailCallElimPass