#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  while (__nondet()) {
    y = malloc(sizeof(*y));
    y->next = x;
    x = y;
  }
  struct T *sorted = NULL;
  struct T *pred = NULL;
  struct T *z = NULL;
  while (x) {
    y = x;
    x = x->next;
    pred = NULL;
    z = sorted;
    while (z && __nondet()) {
      pred = z;
      z = z->next;
    }
    y->next = z;
    if (pred)
      pred->next = y;
    else
      sorted = y;
  }
  while (sorted != NULL) {
    x = sorted;
    sorted = sorted->next;
    free(x);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     1186 <main+0x56>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    114f <main+0x1f>
movq   $0x0,-0x20(%rbp)
movq   $0x0,-0x28(%rbp)
movq   $0x0,-0x30(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     1248 <main+0x118>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x10(%rbp)
movq   $0x0,-0x28(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x30(%rbp)
xor    %eax,%eax
cmpq   $0x0,-0x30(%rbp)
mov    %al,-0x31(%rbp)
je     11ed <main+0xbd>
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
setne  %al
mov    %al,-0x31(%rbp)
mov    -0x31(%rbp),%al
test   $0x1,%al
jne    11fd <main+0xcd>
jmp    1215 <main+0xe5>
mov    -0x30(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x30(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x30(%rbp)
jmp    11cc <main+0x9c>
mov    -0x30(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
cmpq   $0x0,-0x28(%rbp)
je     123b <main+0x10b>
mov    -0x18(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
jmp    1243 <main+0x113>
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
jmp    119e <main+0x6e>
jmp    124d <main+0x11d>
cmpq   $0x0,-0x20(%rbp)
je     1279 <main+0x149>
mov    -0x20(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x20(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x20(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
jmp    124d <main+0x11d>
xor    %eax,%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     1213 <main+0xe3>
xor    %ebx,%ebx
nopl   0x0(%rax,%rax,1)
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,%r12
mov    %rbx,(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r12,%rbx
test   %rax,%rax
jne    1150 <main+0x20>
xor    %r14d,%r14d
jmp    119f <main+0x6f>
movq   $0x0,(%r15)
mov    %r15,0x0(%r13)
test   %r12,%r12
jne    119f <main+0x6f>
jmp    11f0 <main+0xc0>
cs nopw 0x0(%rax,%rax,1)
movq   $0x0,(%r15)
mov    %r15,%r14
test   %r12,%r12
je     11f0 <main+0xc0>
mov    %r12,%r15
mov    (%r12),%r12
test   %r14,%r14
je     1190 <main+0x60>
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r14,%rbx
test   %rax,%rax
je     11e0 <main+0xb0>
nopw   0x0(%rax,%rax,1)
mov    %rbx,%r13
mov    (%rbx),%rbx
test   %rbx,%rbx
je     1174 <main+0x44>
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
jne    11c0 <main+0x90>
jmp    11e6 <main+0xb6>
nopl   0x0(%rax)
mov    %r14,%rbx
xor    %r13d,%r13d
mov    %rbx,(%r15)
test   %r13,%r13
jne    117b <main+0x4b>
jmp    1197 <main+0x67>
test   %r14,%r14
je     1213 <main+0xe3>
cs nopw 0x0(%rax,%rax,1)
nop
mov    (%r14),%rbx
mov    %r14,%rdi
call   1030 <free@plt>
mov    %rbx,%r14
test   %rbx,%rbx
jne    1200 <main+0xd0>
xor    %eax,%eax
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
%5 = alloca %struct.T*
%6 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
br label %7
7: ; preds = %10, %0
%8 = call i64 (...) @__nondet()
%9 = icmp ne i64 %8, 0
br i1 %9, label %10, label %17
10: ; preds = %7
%11 = call %struct.T.0* @malloc(i32 8)
%12 = bitcast %struct.T.0* %11 to %struct.T*
store %struct.T* %12, %struct.T** %3
%13 = load %struct.T*, %struct.T** %2
%14 = load %struct.T*, %struct.T** %3
%15 = getelementptr inbounds %struct.T, %struct.T* %14, i32 0, i32 0
store %struct.T* %13, %struct.T** %15
%16 = load %struct.T*, %struct.T** %3
store %struct.T* %16, %struct.T** %2
br label %7
17: ; preds = %7
store %struct.T* null, %struct.T** %4
store %struct.T* null, %struct.T** %5
store %struct.T* null, %struct.T** %6
br label %18
18: ; preds = %52, %17
%19 = load %struct.T*, %struct.T** %2
%20 = icmp ne %struct.T* %19, null
br i1 %20, label %21, label %53
21: ; preds = %18
%22 = load %struct.T*, %struct.T** %2
store %struct.T* %22, %struct.T** %3
%23 = load %struct.T*, %struct.T** %2
%24 = getelementptr inbounds %struct.T, %struct.T* %23, i32 0, i32 0
%25 = load %struct.T*, %struct.T** %24
store %struct.T* %25, %struct.T** %2
store %struct.T* null, %struct.T** %5
%26 = load %struct.T*, %struct.T** %4
store %struct.T* %26, %struct.T** %6
br label %27
27: ; preds = %35, %21
%28 = load %struct.T*, %struct.T** %6
%29 = icmp ne %struct.T* %28, null
br i1 %29, label %30, label %33
30: ; preds = %27
%31 = call i64 (...) @__nondet()
%32 = icmp ne i64 %31, 0
br label %33
33: ; preds = %30, %27
%34 = phi i1 [ false, %27 ], [ %32, %30 ]
br i1 %34, label %35, label %40
35: ; preds = %33
%36 = load %struct.T*, %struct.T** %6
store %struct.T* %36, %struct.T** %5
%37 = load %struct.T*, %struct.T** %6
%38 = getelementptr inbounds %struct.T, %struct.T* %37, i32 0, i32 0
%39 = load %struct.T*, %struct.T** %38
store %struct.T* %39, %struct.T** %6
br label %27
40: ; preds = %33
%41 = load %struct.T*, %struct.T** %6
%42 = load %struct.T*, %struct.T** %3
%43 = getelementptr inbounds %struct.T, %struct.T* %42, i32 0, i32 0
store %struct.T* %41, %struct.T** %43
%44 = load %struct.T*, %struct.T** %5
%45 = icmp ne %struct.T* %44, null
br i1 %45, label %46, label %50
46: ; preds = %40
%47 = load %struct.T*, %struct.T** %3
%48 = load %struct.T*, %struct.T** %5
%49 = getelementptr inbounds %struct.T, %struct.T* %48, i32 0, i32 0
store %struct.T* %47, %struct.T** %49
br label %52
50: ; preds = %40
%51 = load %struct.T*, %struct.T** %3
store %struct.T* %51, %struct.T** %4
br label %52
52: ; preds = %50, %46
br label %18
53: ; preds = %18
br label %54
54: ; preds = %57, %53
%55 = load %struct.T*, %struct.T** %4
%56 = icmp ne %struct.T* %55, null
br i1 %56, label %57, label %65
57: ; preds = %54
%58 = load %struct.T*, %struct.T** %4
store %struct.T* %58, %struct.T** %2
%59 = load %struct.T*, %struct.T** %4
%60 = getelementptr inbounds %struct.T, %struct.T* %59, i32 0, i32 0
%61 = load %struct.T*, %struct.T** %60
store %struct.T* %61, %struct.T** %4
%62 = load %struct.T*, %struct.T** %2
%63 = bitcast %struct.T* %62 to %struct.T.1*
%64 = call i32 @free(%struct.T.1* %63)
br label %54
65: ; preds = %54
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call i64 (...) @__nondet()
%2 = icmp eq i64 %1, 0
br i1 %2, label %50, label %5
3: ; preds = %5
%4 = bitcast %struct.T.0* %7 to %struct.T*
br label %14
5: ; preds = %0, %5
%6 = phi %struct.T* [ %8, %5 ], [ null, %0 ]
%7 = tail call %struct.T.0* @malloc(i32 8)
%8 = bitcast %struct.T.0* %7 to %struct.T*
%9 = bitcast %struct.T.0* %7 to %struct.T**
store %struct.T* %6, %struct.T** %9
%10 = tail call i64 (...) @__nondet()
%11 = icmp eq i64 %10, 0
br i1 %11, label %3, label %5
12: ; preds = %40
%13 = icmp eq %struct.T* %41, null
br i1 %13, label %50, label %43
14: ; preds = %3, %40
%15 = phi %struct.T* [ %41, %40 ], [ null, %3 ]
%16 = phi %struct.T* [ %18, %40 ], [ %4, %3 ]
%17 = getelementptr inbounds %struct.T, %struct.T* %16, i64 0, i32 0
%18 = load %struct.T*, %struct.T** %17
%19 = icmp eq %struct.T* %15, null
br i1 %19, label %23, label %20
20: ; preds = %14
%21 = tail call i64 (...) @__nondet()
%22 = icmp eq i64 %21, 0
br i1 %22, label %33, label %27
23: ; preds = %14
store %struct.T* null, %struct.T** %17
br label %40
24: ; preds = %27
%25 = tail call i64 (...) @__nondet()
%26 = icmp eq i64 %25, 0
br i1 %26, label %33, label %27
27: ; preds = %20, %24
%28 = phi %struct.T* [ %30, %24 ], [ %15, %20 ]
%29 = getelementptr inbounds %struct.T, %struct.T* %28, i64 0, i32 0
%30 = load %struct.T*, %struct.T** %29
%31 = icmp eq %struct.T* %30, null
br i1 %31, label %32, label %24
32: ; preds = %27
store %struct.T* null, %struct.T** %17
br label %37
33: ; preds = %24, %20
%34 = phi %struct.T* [ %15, %20 ], [ %30, %24 ]
%35 = phi %struct.T* [ null, %20 ], [ %28, %24 ]
store %struct.T* %34, %struct.T** %17
%36 = icmp eq %struct.T* %35, null
br i1 %36, label %40, label %37
37: ; preds = %32, %33
%38 = phi %struct.T* [ %28, %32 ], [ %35, %33 ]
%39 = getelementptr inbounds %struct.T, %struct.T* %38, i64 0, i32 0
store %struct.T* %16, %struct.T** %39
br label %40
40: ; preds = %23, %33, %37
%41 = phi %struct.T* [ %15, %37 ], [ %16, %33 ], [ %16, %23 ]
%42 = icmp eq %struct.T* %18, null
br i1 %42, label %12, label %14
43: ; preds = %12, %43
%44 = phi %struct.T* [ %46, %43 ], [ %41, %12 ]
%45 = getelementptr inbounds %struct.T, %struct.T* %44, i64 0, i32 0
%46 = load %struct.T*, %struct.T** %45
%47 = bitcast %struct.T* %44 to %struct.T.1*
%48 = tail call i32 @free(%struct.T.1* %47)
%49 = icmp eq %struct.T* %46, null
br i1 %49, label %50, label %43
50: ; preds = %43, %0, %12
ret i32 0
}