#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(int *);
int *malloc(int);
int /*<<< orphan*/ read_element(int *, int);
int main() {
  int *free_twice = malloc(sizeof(int));
  int *use_after_free = malloc(sizeof(int));
  int *never_free = malloc(sizeof(int));
  int array1[100];
  int *array2 = malloc(100 * sizeof(int));
  read_element(array1, -1);
  read_element(array1, 100);
  read_element(array2, -1);
  read_element(array2, 100);
  free(use_after_free);
  *use_after_free = 17;
  *never_free = 17;
  free(never_free);
  free(free_twice);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1c0,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    $0x190,%edi
call   1040 <malloc@plt>
mov    %rax,-0x1b8(%rbp)
lea    -0x1b0(%rbp),%rdi
mov    $0xffffffff,%esi
call   1050 <read_element@plt>
lea    -0x1b0(%rbp),%rdi
mov    $0x64,%esi
call   1050 <read_element@plt>
mov    -0x1b8(%rbp),%rdi
mov    $0xffffffff,%esi
call   1050 <read_element@plt>
mov    -0x1b8(%rbp),%rdi
mov    $0x64,%esi
call   1050 <read_element@plt>
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
movl   $0x11,(%rax)
mov    -0x20(%rbp),%rax
movl   $0x11,(%rax)
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x1c0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x190,%rsp
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,%r14
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,%r15
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,%r12
mov    $0x190,%edi
call   1040 <malloc@plt>
mov    %rax,%rbx
mov    %rsp,%r13
mov    %r13,%rdi
mov    $0xffffffff,%esi
call   1050 <read_element@plt>
mov    %r13,%rdi
mov    $0x64,%esi
call   1050 <read_element@plt>
mov    %rbx,%rdi
mov    $0xffffffff,%esi
call   1050 <read_element@plt>
mov    %rbx,%rdi
mov    $0x64,%esi
call   1050 <read_element@plt>
mov    %r15,%rdi
call   1030 <free@plt>
movl   $0x11,(%r12)
mov    %r12,%rdi
call   1030 <free@plt>
mov    %r14,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x190,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32*
%4 = alloca i32*
%5 = alloca [100 x i32]
%6 = alloca i32*
store i32 0, i32* %1
%7 = call i32* @malloc(i32 4)
store i32* %7, i32** %2
%8 = call i32* @malloc(i32 4)
store i32* %8, i32** %3
%9 = call i32* @malloc(i32 4)
store i32* %9, i32** %4
%10 = call i32* @malloc(i32 400)
store i32* %10, i32** %6
%11 = getelementptr inbounds [100 x i32], [100 x i32]* %5, i64 0, i64 0
%12 = call i32 @read_element(i32* %11, i32 -1)
%13 = getelementptr inbounds [100 x i32], [100 x i32]* %5, i64 0, i64 0
%14 = call i32 @read_element(i32* %13, i32 100)
%15 = load i32*, i32** %6
%16 = call i32 @read_element(i32* %15, i32 -1)
%17 = load i32*, i32** %6
%18 = call i32 @read_element(i32* %17, i32 100)
%19 = load i32*, i32** %3
%20 = call i32 @free(i32* %19)
%21 = load i32*, i32** %3
store i32 17, i32* %21
%22 = load i32*, i32** %4
store i32 17, i32* %22
%23 = load i32*, i32** %4
%24 = call i32 @free(i32* %23)
%25 = load i32*, i32** %2
%26 = call i32 @free(i32* %25)
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = alloca [100 x i32]
%2 = tail call i32* @malloc(i32 4)
%3 = tail call i32* @malloc(i32 4)
%4 = tail call i32* @malloc(i32 4)
%5 = bitcast [100 x i32]* %1 to i8*
%6 = tail call i32* @malloc(i32 400)
%7 = getelementptr inbounds [100 x i32], [100 x i32]* %1, i64 0, i64 0
%8 = call i32 @read_element(i32* %7, i32 -1)
%9 = call i32 @read_element(i32* %7, i32 100)
%10 = call i32 @read_element(i32* %6, i32 -1)
%11 = call i32 @read_element(i32* %6, i32 100)
%12 = call i32 @free(i32* %3)
store i32 17, i32* %4
%13 = call i32 @free(i32* %4)
%14 = call i32 @free(i32* %2)
ret i32 0
}