#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int __get_array_size(char const *);
int __infer_nondet_int();
char *strstr(const char *s1, const char *s2) {
  int size1, size2;
  int nondet;
  int offset;
  nondet = __infer_nondet_int();
  offset = __infer_nondet_int();
  size1 = __get_array_size(s1);
  size2 = __get_array_size(s2);
  if (nondet)
    return 0;
  if (offset < 0 || offset >= size1)
    while (1)
      ;
  return (char *)s1 + offset;
}


x86 assembly (clang, -O0):
<strstr>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    $0x0,%al
call   1030 <__infer_nondet_int@plt>
mov    %eax,-0x24(%rbp)
mov    $0x0,%al
call   1030 <__infer_nondet_int@plt>
mov    %eax,-0x28(%rbp)
mov    -0x10(%rbp),%rdi
call   1040 <__get_array_size@plt>
mov    %eax,-0x1c(%rbp)
mov    -0x18(%rbp),%rdi
call   1040 <__get_array_size@plt>
mov    %eax,-0x20(%rbp)
cmpl   $0x0,-0x24(%rbp)
je     1173 <strstr+0x53>
movq   $0x0,-0x8(%rbp)
jmp    11a2 <strstr+0x82>
cmpl   $0x0,-0x28(%rbp)
jl     1189 <strstr+0x69>
mov    -0x28(%rbp),%eax
cmp    -0x1c(%rbp),%eax
jl     1193 <strstr+0x73>
jmp    118e <strstr+0x6e>
jmp    118e <strstr+0x6e>
mov    -0x10(%rbp),%rax
movslq -0x28(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<strstr>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rsi,%rbp
mov    %rdi,%r13
xor    %r14d,%r14d
xor    %eax,%eax
call   1030 <__infer_nondet_int@plt>
mov    %eax,%ebx
xor    %eax,%eax
call   1030 <__infer_nondet_int@plt>
mov    %eax,%r12d
mov    %r13,%rdi
call   1040 <__get_array_size@plt>
mov    %eax,%r15d
mov    %rbp,%rdi
call   1040 <__get_array_size@plt>
test   %ebx,%ebx
jne    1171 <strstr+0x51>
test   %r12d,%r12d
js     1190 <strstr+0x70>
cmp    %r15d,%r12d
jge    1190 <strstr+0x70>
mov    %r12d,%eax
add    %rax,%r13
mov    %r13,%r14
mov    %r14,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
jmp    1190 <strstr+0x70>

LLVM IR (-O0):
define i8* @strstr(i8* %0, i8* %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
%9 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
%10 = call i32 (...) @__infer_nondet_int()
store i32 %10, i32* %8
%11 = call i32 (...) @__infer_nondet_int()
store i32 %11, i32* %9
%12 = load i8*, i8** %4
%13 = call i32 @__get_array_size(i8* %12)
store i32 %13, i32* %6
%14 = load i8*, i8** %5
%15 = call i32 @__get_array_size(i8* %14)
store i32 %15, i32* %7
%16 = load i32, i32* %8
%17 = icmp ne i32 %16, 0
br i1 %17, label %18, label %19
18: ; preds = %2
store i8* null, i8** %3
br label %33
19: ; preds = %2
%20 = load i32, i32* %9
%21 = icmp slt i32 %20, 0
br i1 %21, label %26, label %22
22: ; preds = %19
%23 = load i32, i32* %9
%24 = load i32, i32* %6
%25 = icmp sge i32 %23, %24
br i1 %25, label %26, label %28
26: ; preds = %22, %19
br label %27
27: ; preds = %26, %27
br label %27
28: ; preds = %22
%29 = load i8*, i8** %4
%30 = load i32, i32* %9
%31 = sext i32 %30 to i64
%32 = getelementptr inbounds i8, i8* %29, i64 %31
store i8* %32, i8** %3
br label %33
33: ; preds = %28, %18
%34 = load i8*, i8** %3
ret i8* %34
}

LLVM IR (-O2):
define i8* @strstr(i8* %0, i8* %1) {
%3 = tail call i32 (...) @__infer_nondet_int()
%4 = tail call i32 (...) @__infer_nondet_int()
%5 = tail call i32 @__get_array_size(i8* %0)
%6 = tail call i32 @__get_array_size(i8* %1)
%7 = icmp eq i32 %3, 0
br i1 %7, label %8, label %16
8: ; preds = %2
%9 = icmp sgt i32 %4, -1
%10 = icmp slt i32 %4, %5
%11 = select i1 %9, i1 %10, i1 false
br i1 %11, label %13, label %12
12: ; preds = %8, %12
br label %12
13: ; preds = %8
%14 = zext i32 %4 to i64
%15 = getelementptr inbounds i8, i8* %0, i64 %14
br label %16
16: ; preds = %2, %13
%17 = phi i8* [ %15, %13 ], [ null, %2 ]
ret i8* %17
}