#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int MAP_ANONYMOUS;
int MAP_PRIVATE;
int PROT_EXEC;
int PROT_READ;
int PROT_WRITE;
int /*<<< orphan*/ abort();
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ memset(char *, int /*<<< orphan*/, int);
unsigned char *mmap(int /*<<< orphan*/ *, int, int, int, int,
                    int /*<<< orphan*/);
int /*<<< orphan*/ printf(char *);
int main(int argc, char *argv[]) {
  volatile unsigned char *a;
  a = mmap(NULL, 0x4c, PROT_READ | PROT_WRITE | PROT_EXEC,
           MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  if (a == NULL || a == (unsigned char *)-1)
    abort();
  a[0] = 0xbe;
  a[8191] = 0xef;
  memset((char *)a + 1, 0, 8190);
  if (a[0] != 0xbe || a[8191] != 0xef)
    abort();
  printf("pass\n");
  exit(0);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    0x2e8b(%rip),%rax
mov    (%rax),%edx
mov    0x2e52(%rip),%rax
or     (%rax),%edx
mov    0x2e59(%rip),%rax
or     (%rax),%edx
mov    0x2e38(%rip),%rax
mov    (%rax),%ecx
mov    0x2e4f(%rip),%rax
or     (%rax),%ecx
xor    %eax,%eax
mov    %eax,%edi
mov    $0x4c,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1040 <mmap@plt>
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     11ca <main+0x7a>
mov    $0xffffffffffffffff,%rax
cmp    %rax,-0x18(%rbp)
jne    11d1 <main+0x81>
mov    $0x0,%al
call   1030 <abort@plt>
mov    -0x18(%rbp),%rax
movb   $0xbe,(%rax)
mov    -0x18(%rbp),%rax
movb   $0xef,0x1fff(%rax)
mov    -0x18(%rbp),%rdi
add    $0x1,%rdi
xor    %esi,%esi
mov    $0x1ffe,%edx
call   1060 <memset@plt>
mov    -0x18(%rbp),%rax
mov    (%rax),%al
movzbl %al,%eax
cmp    $0xbe,%eax
jne    1223 <main+0xd3>
mov    -0x18(%rbp),%rax
mov    0x1fff(%rax),%al
movzbl %al,%eax
cmp    $0xef,%eax
je     122a <main+0xda>
mov    $0x0,%al
call   1030 <abort@plt>
lea    0xdcf(%rip),%rdi
call   1050 <printf@plt>
xor    %edi,%edi
call   1070 <exit@plt>

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    0x2ea0(%rip),%rax
mov    0x2e69(%rip),%rcx
mov    (%rcx),%edx
or     (%rax),%edx
mov    0x2e6e(%rip),%rax
or     (%rax),%edx
mov    0x2e4d(%rip),%rax
mov    0x2e66(%rip),%rcx
mov    (%rcx),%ecx
or     (%rax),%ecx
xor    %edi,%edi
mov    $0x4c,%esi
mov    $0xffffffff,%r8d
xor    %r9d,%r9d
call   1050 <mmap@plt>
lea    0x1(%rax),%rdi
cmp    $0x1,%rdi
jbe    11d9 <main+0x89>
mov    %rax,%rbx
movb   $0xbe,(%rax)
movb   $0xef,0x1fff(%rax)
xor    %esi,%esi
mov    $0x1ffe,%edx
call   1060 <memset@plt>
mov    (%rbx),%al
cmp    $0xbe,%al
jne    11d9 <main+0x89>
mov    0x1fff(%rbx),%al
cmp    $0xef,%al
jne    11d9 <main+0x89>
lea    0xe33(%rip),%rdi
call   1040 <puts@plt>
xor    %edi,%edi
call   1070 <exit@plt>
xor    %eax,%eax
call   1030 <abort@plt>

LLVM IR (-O0):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@.str = [6 x i8] c"pass\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%7 = load i32, i32* @PROT_READ
%8 = load i32, i32* @PROT_WRITE
%9 = or i32 %7, %8
%10 = load i32, i32* @PROT_EXEC
%11 = or i32 %9, %10
%12 = load i32, i32* @MAP_PRIVATE
%13 = load i32, i32* @MAP_ANONYMOUS
%14 = or i32 %12, %13
%15 = call i8* @mmap(i32* null, i32 76, i32 %11, i32 %14, i32 -1, i32 0)
store i8* %15, i8** %6
%16 = load i8*, i8** %6
%17 = icmp eq i8* %16, null
br i1 %17, label %21, label %18
18: ; preds = %2
%19 = load i8*, i8** %6
%20 = icmp eq i8* %19, inttoptr (i64 -1 to i8*)
br i1 %20, label %21, label %23
21: ; preds = %18, %2
%22 = call i32 (...) @abort()
unreachable
23: ; preds = %18
%24 = load i8*, i8** %6
%25 = getelementptr inbounds i8, i8* %24, i64 0
store volatile i8 -66, i8* %25
%26 = load i8*, i8** %6
%27 = getelementptr inbounds i8, i8* %26, i64 8191
store volatile i8 -17, i8* %27
%28 = load i8*, i8** %6
%29 = getelementptr inbounds i8, i8* %28, i64 1
%30 = call i32 @memset(i8* %29, i32 0, i32 8190)
%31 = load i8*, i8** %6
%32 = getelementptr inbounds i8, i8* %31, i64 0
%33 = load volatile i8, i8* %32
%34 = zext i8 %33 to i32
%35 = icmp ne i32 %34, 190
br i1 %35, label %42, label %36
36: ; preds = %23
%37 = load i8*, i8** %6
%38 = getelementptr inbounds i8, i8* %37, i64 8191
%39 = load volatile i8, i8* %38
%40 = zext i8 %39 to i32
%41 = icmp ne i32 %40, 239
br i1 %41, label %42, label %44
42: ; preds = %36, %23
%43 = call i32 (...) @abort()
unreachable
44: ; preds = %36
%45 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str, i64 0, i64 0))
%46 = call i32 @exit(i32 0)
unreachable
}

LLVM IR (-O2):
@PROT_READ = global i32 0
@PROT_WRITE = global i32 0
@PROT_EXEC = global i32 0
@MAP_PRIVATE = global i32 0
@MAP_ANONYMOUS = global i32 0
@str = [5 x i8] c"pass\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = load i32, i32* @PROT_READ
%4 = load i32, i32* @PROT_WRITE
%5 = or i32 %4, %3
%6 = load i32, i32* @PROT_EXEC
%7 = or i32 %5, %6
%8 = load i32, i32* @MAP_PRIVATE
%9 = load i32, i32* @MAP_ANONYMOUS
%10 = or i32 %9, %8
%11 = tail call i8* @mmap(i32* null, i32 76, i32 %7, i32 %10, i32 -1, i32 0)
%12 = ptrtoint i8* %11 to i64
switch i64 %12, label %15 [
i64 -1, label %13
i64 0, label %13
]
13: ; preds = %2, %2
%14 = tail call i32 (...) @abort()
unreachable
15: ; preds = %2
store volatile i8 -66, i8* %11
%16 = getelementptr inbounds i8, i8* %11, i64 8191
store volatile i8 -17, i8* %16
%17 = getelementptr inbounds i8, i8* %11, i64 1
%18 = tail call i32 @memset(i8* %17, i32 0, i32 8190)
%19 = load volatile i8, i8* %11
%20 = icmp eq i8 %19, -66
br i1 %20, label %21, label %24
21: ; preds = %15
%22 = load volatile i8, i8* %16
%23 = icmp eq i8 %22, -17
br i1 %23, label %26, label %24
24: ; preds = %21, %15
%25 = tail call i32 (...) @abort()
unreachable
26: ; preds = %21
%27 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @str, i64 0, i64 0))
%28 = tail call i32 @exit(i32 0)
unreachable
}