int main() {
  struct TreeNode {
    struct TreeNode *left;
    struct TreeNode *right;
  };
  struct StackItem {
    struct StackItem *next;
    struct TreeNode *node;
  };
  struct TreeNode *root = malloc(sizeof(*root)), *n;
  root->left = ((void *)0);
  root->right = ((void *)0);
  while (__VERIFIER_nondet_int()) {
    n = root;
    while (n->left && n->right) {
      if (__VERIFIER_nondet_int())
        n = n->left;
      else
        n = n->right;
    }
    if (!n->left && __VERIFIER_nondet_int()) {
      n->left = malloc(sizeof(*n));
      n->left->left = ((void *)0);
      n->left->right = ((void *)0);
    }
    if (!n->right && __VERIFIER_nondet_int()) {
      n->right = malloc(sizeof(*n));
      n->right->left = ((void *)0);
      n->right->right = ((void *)0);
    }
  }
  n = ((void *)0);
  struct StackItem *s = malloc(sizeof(*s)), *st;
  s->next = ((void *)0);
  s->node = root;
  while (s != ((void *)0)) {
    st = s;
    s = s->next;
    n = st->node;
    free(st);
    if (n->left) {
      st = malloc(sizeof(*st));
      st->next = s;
      st->node = n->left;
      s = st;
    }
    if (n->right) {
      st = malloc(sizeof(*st));
      st->next = s;
      st->node = n->right;
      s = st;
    }
    free(n);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x10(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%eax
je     1286 <main+0x156>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rcx
xor    %eax,%eax
cmpq   $0x0,(%rcx)
mov    %al,-0x29(%rbp)
je     119e <main+0x6e>
mov    -0x18(%rbp),%rax
cmpq   $0x0,0x8(%rax)
setne  %al
mov    %al,-0x29(%rbp)
mov    -0x29(%rbp),%al
test   $0x1,%al
jne    11ae <main+0x7e>
jmp    11df <main+0xaf>
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%eax
je     11ce <main+0x9e>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    11da <main+0xaa>
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    117c <main+0x4c>
mov    -0x18(%rbp),%rax
cmpq   $0x0,(%rax)
jne    122e <main+0xfe>
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%eax
je     122e <main+0xfe>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
movq   $0x0,(%rax)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
movq   $0x0,0x8(%rax)
mov    -0x18(%rbp),%rax
cmpq   $0x0,0x8(%rax)
jne    1281 <main+0x151>
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%eax
je     1281 <main+0x151>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rax
movq   $0x0,(%rax)
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rax
movq   $0x0,0x8(%rax)
jmp    1164 <main+0x34>
movq   $0x0,-0x18(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x10(%rbp),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,0x8(%rax)
cmpq   $0x0,-0x20(%rbp)
je     1372 <main+0x242>
mov    -0x20(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x20(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x20(%rbp)
mov    -0x28(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x28(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
cmpq   $0x0,(%rax)
je     1324 <main+0x1f4>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x20(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    (%rax),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x28(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rax
cmpq   $0x0,0x8(%rax)
je     1364 <main+0x234>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x20(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x28(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    12b3 <main+0x183>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r12
push   %rbx
push   %rax
mov    $0x1,%edi
mov    $0x10,%esi
call   1040 <calloc@plt>
mov    %rax,%r14
xor    %eax,%eax
call   1050 <__VERIFIER_nondet_int@plt>
test   %eax,%eax
je     121c <main+0xdc>
xor    %eax,%eax
nopl   0x0(%rax,%rax,1)
mov    %r14,%r15
test   %rax,%rax
je     11a4 <main+0x64>
mov    %r14,%rbx
nopl   0x0(%rax,%rax,1)
cmpq   $0x0,0x8(%rbx)
je     11e0 <main+0xa0>
add    $0x8,%rbx
xor    %eax,%eax
call   1050 <__VERIFIER_nondet_int@plt>
test   %eax,%eax
cmove  %rbx,%r15
mov    (%r15),%r15
cmpq   $0x0,(%r15)
mov    %r15,%rbx
jne    1180 <main+0x40>
xor    %eax,%eax
call   1050 <__VERIFIER_nondet_int@plt>
test   %eax,%eax
je     11ce <main+0x8e>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,(%r15)
movq   $0x0,(%rax)
mov    (%r15),%rax
movq   $0x0,0x8(%rax)
cmpq   $0x0,0x8(%r15)
jne    1209 <main+0xc9>
jmp    11ea <main+0xaa>
nopw   0x0(%rax,%rax,1)
mov    %rbx,%r15
cmpq   $0x0,0x8(%r15)
jne    1209 <main+0xc9>
xor    %eax,%eax
call   1050 <__VERIFIER_nondet_int@plt>
test   %eax,%eax
je     1209 <main+0xc9>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,0x8(%r15)
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
xor    %eax,%eax
call   1050 <__VERIFIER_nondet_int@plt>
test   %eax,%eax
je     121c <main+0xdc>
mov    (%r14),%rax
jmp    1170 <main+0x30>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,%rdi
movq   $0x0,(%rax)
mov    %r14,0x8(%rax)
xor    %r15d,%r15d
jmp    1269 <main+0x129>
nopl   0x0(%rax)
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %r15,(%rax)
mov    %r12,0x8(%rax)
mov    %r14,%rdi
call   1030 <free@plt>
mov    %rbx,%r15
mov    %r15,%rdi
mov    (%r15),%r15
mov    0x8(%rdi),%r14
call   1030 <free@plt>
mov    (%r14),%rbx
test   %rbx,%rbx
je     128a <main+0x14a>
mov    $0x10,%edi
call   1060 <malloc@plt>
mov    %r15,(%rax)
mov    %rbx,0x8(%rax)
mov    %rax,%r15
mov    0x8(%r14),%r12
test   %r12,%r12
jne    1240 <main+0x100>
mov    %r14,%rdi
call   1030 <free@plt>
test   %r15,%r15
jne    125f <main+0x11f>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.TreeNode = type { %struct.TreeNode*, %struct.TreeNode* }
%struct.StackItem = type { %struct.StackItem*, %struct.TreeNode* }
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.TreeNode*
%3 = alloca %struct.TreeNode*
%4 = alloca %struct.StackItem*
%5 = alloca %struct.StackItem*
store i32 0, i32* %1
%6 = call i8* @malloc(i64 16)
%7 = bitcast i8* %6 to %struct.TreeNode*
store %struct.TreeNode* %7, %struct.TreeNode** %2
%8 = load %struct.TreeNode*, %struct.TreeNode** %2
%9 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %8, i32 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %9
%10 = load %struct.TreeNode*, %struct.TreeNode** %2
%11 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %10, i32 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %11
br label %12
12: ; preds = %83, %0
%13 = call i32 (...) @__VERIFIER_nondet_int()
%14 = icmp ne i32 %13, 0
br i1 %14, label %15, label %84
15: ; preds = %12
%16 = load %struct.TreeNode*, %struct.TreeNode** %2
store %struct.TreeNode* %16, %struct.TreeNode** %3
br label %17
17: ; preds = %40, %15
%18 = load %struct.TreeNode*, %struct.TreeNode** %3
%19 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %18, i32 0, i32 0
%20 = load %struct.TreeNode*, %struct.TreeNode** %19
%21 = icmp ne %struct.TreeNode* %20, null
br i1 %21, label %22, label %27
22: ; preds = %17
%23 = load %struct.TreeNode*, %struct.TreeNode** %3
%24 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %23, i32 0, i32 1
%25 = load %struct.TreeNode*, %struct.TreeNode** %24
%26 = icmp ne %struct.TreeNode* %25, null
br label %27
27: ; preds = %22, %17
%28 = phi i1 [ false, %17 ], [ %26, %22 ]
br i1 %28, label %29, label %41
29: ; preds = %27
%30 = call i32 (...) @__VERIFIER_nondet_int()
%31 = icmp ne i32 %30, 0
br i1 %31, label %32, label %36
32: ; preds = %29
%33 = load %struct.TreeNode*, %struct.TreeNode** %3
%34 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %33, i32 0, i32 0
%35 = load %struct.TreeNode*, %struct.TreeNode** %34
store %struct.TreeNode* %35, %struct.TreeNode** %3
br label %40
36: ; preds = %29
%37 = load %struct.TreeNode*, %struct.TreeNode** %3
%38 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %37, i32 0, i32 1
%39 = load %struct.TreeNode*, %struct.TreeNode** %38
store %struct.TreeNode* %39, %struct.TreeNode** %3
br label %40
40: ; preds = %36, %32
br label %17
41: ; preds = %27
%42 = load %struct.TreeNode*, %struct.TreeNode** %3
%43 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %42, i32 0, i32 0
%44 = load %struct.TreeNode*, %struct.TreeNode** %43
%45 = icmp ne %struct.TreeNode* %44, null
br i1 %45, label %62, label %46
46: ; preds = %41
%47 = call i32 (...) @__VERIFIER_nondet_int()
%48 = icmp ne i32 %47, 0
br i1 %48, label %49, label %62
49: ; preds = %46
%50 = call i8* @malloc(i64 16)
%51 = bitcast i8* %50 to %struct.TreeNode*
%52 = load %struct.TreeNode*, %struct.TreeNode** %3
%53 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %52, i32 0, i32 0
store %struct.TreeNode* %51, %struct.TreeNode** %53
%54 = load %struct.TreeNode*, %struct.TreeNode** %3
%55 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %54, i32 0, i32 0
%56 = load %struct.TreeNode*, %struct.TreeNode** %55
%57 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %56, i32 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %57
%58 = load %struct.TreeNode*, %struct.TreeNode** %3
%59 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %58, i32 0, i32 0
%60 = load %struct.TreeNode*, %struct.TreeNode** %59
%61 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %60, i32 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %61
br label %62
62: ; preds = %49, %46, %41
%63 = load %struct.TreeNode*, %struct.TreeNode** %3
%64 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %63, i32 0, i32 1
%65 = load %struct.TreeNode*, %struct.TreeNode** %64
%66 = icmp ne %struct.TreeNode* %65, null
br i1 %66, label %83, label %67
67: ; preds = %62
%68 = call i32 (...) @__VERIFIER_nondet_int()
%69 = icmp ne i32 %68, 0
br i1 %69, label %70, label %83
70: ; preds = %67
%71 = call i8* @malloc(i64 16)
%72 = bitcast i8* %71 to %struct.TreeNode*
%73 = load %struct.TreeNode*, %struct.TreeNode** %3
%74 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %73, i32 0, i32 1
store %struct.TreeNode* %72, %struct.TreeNode** %74
%75 = load %struct.TreeNode*, %struct.TreeNode** %3
%76 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %75, i32 0, i32 1
%77 = load %struct.TreeNode*, %struct.TreeNode** %76
%78 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %77, i32 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %78
%79 = load %struct.TreeNode*, %struct.TreeNode** %3
%80 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %79, i32 0, i32 1
%81 = load %struct.TreeNode*, %struct.TreeNode** %80
%82 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %81, i32 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %82
br label %83
83: ; preds = %70, %67, %62
br label %12
84: ; preds = %12
store %struct.TreeNode* null, %struct.TreeNode** %3
%85 = call i8* @malloc(i64 16)
%86 = bitcast i8* %85 to %struct.StackItem*
store %struct.StackItem* %86, %struct.StackItem** %4
%87 = load %struct.StackItem*, %struct.StackItem** %4
%88 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %87, i32 0, i32 0
store %struct.StackItem* null, %struct.StackItem** %88
%89 = load %struct.TreeNode*, %struct.TreeNode** %2
%90 = load %struct.StackItem*, %struct.StackItem** %4
%91 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %90, i32 0, i32 1
store %struct.TreeNode* %89, %struct.TreeNode** %91
br label %92
92: ; preds = %138, %84
%93 = load %struct.StackItem*, %struct.StackItem** %4
%94 = icmp ne %struct.StackItem* %93, null
br i1 %94, label %95, label %141
95: ; preds = %92
%96 = load %struct.StackItem*, %struct.StackItem** %4
store %struct.StackItem* %96, %struct.StackItem** %5
%97 = load %struct.StackItem*, %struct.StackItem** %4
%98 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %97, i32 0, i32 0
%99 = load %struct.StackItem*, %struct.StackItem** %98
store %struct.StackItem* %99, %struct.StackItem** %4
%100 = load %struct.StackItem*, %struct.StackItem** %5
%101 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %100, i32 0, i32 1
%102 = load %struct.TreeNode*, %struct.TreeNode** %101
store %struct.TreeNode* %102, %struct.TreeNode** %3
%103 = load %struct.StackItem*, %struct.StackItem** %5
%104 = bitcast %struct.StackItem* %103 to i8*
%105 = load %struct.TreeNode*, %struct.TreeNode** %3
%106 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %105, i32 0, i32 0
%107 = load %struct.TreeNode*, %struct.TreeNode** %106
%108 = icmp ne %struct.TreeNode* %107, null
br i1 %108, label %109, label %121
109: ; preds = %95
%110 = call i8* @malloc(i64 16)
%111 = bitcast i8* %110 to %struct.StackItem*
store %struct.StackItem* %111, %struct.StackItem** %5
%112 = load %struct.StackItem*, %struct.StackItem** %4
%113 = load %struct.StackItem*, %struct.StackItem** %5
%114 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %113, i32 0, i32 0
store %struct.StackItem* %112, %struct.StackItem** %114
%115 = load %struct.TreeNode*, %struct.TreeNode** %3
%116 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %115, i32 0, i32 0
%117 = load %struct.TreeNode*, %struct.TreeNode** %116
%118 = load %struct.StackItem*, %struct.StackItem** %5
%119 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %118, i32 0, i32 1
store %struct.TreeNode* %117, %struct.TreeNode** %119
%120 = load %struct.StackItem*, %struct.StackItem** %5
store %struct.StackItem* %120, %struct.StackItem** %4
br label %121
121: ; preds = %109, %95
%122 = load %struct.TreeNode*, %struct.TreeNode** %3
%123 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %122, i32 0, i32 1
%124 = load %struct.TreeNode*, %struct.TreeNode** %123
%125 = icmp ne %struct.TreeNode* %124, null
br i1 %125, label %126, label %138
126: ; preds = %121
%127 = call i8* @malloc(i64 16)
%128 = bitcast i8* %127 to %struct.StackItem*
store %struct.StackItem* %128, %struct.StackItem** %5
%129 = load %struct.StackItem*, %struct.StackItem** %4
%130 = load %struct.StackItem*, %struct.StackItem** %5
%131 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %130, i32 0, i32 0
store %struct.StackItem* %129, %struct.StackItem** %131
%132 = load %struct.TreeNode*, %struct.TreeNode** %3
%133 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %132, i32 0, i32 1
%134 = load %struct.TreeNode*, %struct.TreeNode** %133
%135 = load %struct.StackItem*, %struct.StackItem** %5
%136 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %135, i32 0, i32 1
store %struct.TreeNode* %134, %struct.TreeNode** %136
%137 = load %struct.StackItem*, %struct.StackItem** %5
store %struct.StackItem* %137, %struct.StackItem** %4
br label %138
138: ; preds = %126, %121
%139 = load %struct.TreeNode*, %struct.TreeNode** %3
%140 = bitcast %struct.TreeNode* %139 to i8*
br label %92
141: ; preds = %92
ret i32 0
}

LLVM IR (-O2):
%struct.TreeNode = type { %struct.TreeNode*, %struct.TreeNode* }
%struct.StackItem = type { %struct.StackItem*, %struct.TreeNode* }
define i32 @main() {
%1 = call dereferenceable_or_null(16) i8* @calloc(i64 1, i64 16)
%2 = bitcast i8* %1 to %struct.TreeNode*
%3 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %2, i64 0, i32 0
%4 = tail call i32 (...) @__VERIFIER_nondet_int()
%5 = icmp eq i32 %4, 0
br i1 %5, label %51, label %6
6: ; preds = %0, %49
%7 = phi %struct.TreeNode* [ %50, %49 ], [ null, %0 ]
%8 = icmp eq %struct.TreeNode* %7, null
br i1 %8, label %23, label %9
9: ; preds = %6, %15
%10 = phi %struct.TreeNode** [ %20, %15 ], [ %3, %6 ]
%11 = phi %struct.TreeNode* [ %19, %15 ], [ %2, %6 ]
%12 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %11, i64 0, i32 1
%13 = load %struct.TreeNode*, %struct.TreeNode** %12
%14 = icmp eq %struct.TreeNode* %13, null
br i1 %14, label %35, label %15
15: ; preds = %9
%16 = tail call i32 (...) @__VERIFIER_nondet_int()
%17 = icmp eq i32 %16, 0
%18 = select i1 %17, %struct.TreeNode** %12, %struct.TreeNode** %10
%19 = load %struct.TreeNode*, %struct.TreeNode** %18
%20 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %19, i64 0, i32 0
%21 = load %struct.TreeNode*, %struct.TreeNode** %20
%22 = icmp eq %struct.TreeNode* %21, null
br i1 %22, label %23, label %9
23: ; preds = %15, %6
%24 = phi %struct.TreeNode* [ %2, %6 ], [ %19, %15 ]
%25 = phi %struct.TreeNode** [ %3, %6 ], [ %20, %15 ]
%26 = tail call i32 (...) @__VERIFIER_nondet_int()
%27 = icmp eq i32 %26, 0
br i1 %27, label %35, label %28
28: ; preds = %23
%29 = tail call dereferenceable_or_null(16) i8* @malloc(i64 16)
%30 = bitcast i8* %29 to %struct.TreeNode*
%31 = bitcast %struct.TreeNode* %24 to i8**
store i8* %29, i8** %31
%32 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %30, i64 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %32
%33 = load %struct.TreeNode*, %struct.TreeNode** %25
%34 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %33, i64 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %34
br label %35
35: ; preds = %9, %28, %23
%36 = phi %struct.TreeNode* [ %24, %28 ], [ %24, %23 ], [ %11, %9 ]
%37 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %36, i64 0, i32 1
%38 = load %struct.TreeNode*, %struct.TreeNode** %37
%39 = icmp eq %struct.TreeNode* %38, null
br i1 %39, label %40, label %46
40: ; preds = %35
%41 = tail call i32 (...) @__VERIFIER_nondet_int()
%42 = icmp eq i32 %41, 0
br i1 %42, label %46, label %43
43: ; preds = %40
%44 = tail call dereferenceable_or_null(16) i8* @malloc(i64 16)
%45 = bitcast %struct.TreeNode** %37 to i8**
store i8* %44, i8** %45
br label %46
46: ; preds = %43, %40, %35
%47 = tail call i32 (...) @__VERIFIER_nondet_int()
%48 = icmp eq i32 %47, 0
br i1 %48, label %51, label %49
49: ; preds = %46
%50 = load %struct.TreeNode*, %struct.TreeNode** %3
br label %6
51: ; preds = %46, %0
%52 = tail call dereferenceable_or_null(16) i8* @malloc(i64 16)
%53 = bitcast i8* %52 to %struct.StackItem*
%54 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %53, i64 0, i32 0
store %struct.StackItem* null, %struct.StackItem** %54
%55 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %53, i64 0, i32 1
%56 = bitcast %struct.TreeNode** %55 to i8**
store i8* %1, i8** %56
br label %57
57: ; preds = %84, %51
%58 = phi %struct.TreeNode* [ %89, %84 ], [ %2, %51 ]
%59 = phi %struct.StackItem* [ %87, %84 ], [ null, %51 ]
%60 = phi %struct.StackItem* [ %85, %84 ], [ %53, %51 ]
%61 = bitcast %struct.StackItem* %60 to i8*
tail call void @free(i8* %61)
%62 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %58, i64 0, i32 0
%63 = load %struct.TreeNode*, %struct.TreeNode** %62
%64 = icmp eq %struct.TreeNode* %63, null
br i1 %64, label %70, label %65
65: ; preds = %57
%66 = tail call dereferenceable_or_null(16) i8* @malloc(i64 16)
%67 = bitcast i8* %66 to %struct.StackItem*
%68 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %67, i64 0, i32 0
store %struct.StackItem* %59, %struct.StackItem** %68
%69 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %67, i64 0, i32 1
store %struct.TreeNode* %63, %struct.TreeNode** %69
br label %70
70: ; preds = %65, %57
%71 = phi %struct.StackItem* [ %67, %65 ], [ %59, %57 ]
%72 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %58, i64 0, i32 1
%73 = load %struct.TreeNode*, %struct.TreeNode** %72
%74 = icmp eq %struct.TreeNode* %73, null
br i1 %74, label %81, label %75
75: ; preds = %70
%76 = tail call dereferenceable_or_null(16) i8* @malloc(i64 16)
%77 = bitcast i8* %76 to %struct.StackItem*
%78 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %77, i64 0, i32 0
store %struct.StackItem* %71, %struct.StackItem** %78
%79 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %77, i64 0, i32 1
store %struct.TreeNode* %73, %struct.TreeNode** %79
%80 = bitcast %struct.TreeNode* %58 to i8*
tail call void @free(i8* %80)
br label %84
81: ; preds = %70
%82 = bitcast %struct.TreeNode* %58 to i8*
tail call void @free(i8* %82)
%83 = icmp eq %struct.StackItem* %71, null
br i1 %83, label %90, label %84
84: ; preds = %75, %81
%85 = phi %struct.StackItem* [ %77, %75 ], [ %71, %81 ]
%86 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %85, i64 0, i32 0
%87 = load %struct.StackItem*, %struct.StackItem** %86
%88 = getelementptr inbounds %struct.StackItem, %struct.StackItem* %85, i64 0, i32 1
%89 = load %struct.TreeNode*, %struct.TreeNode** %88
br label %57
90: ; preds = %81
ret i32 0
}