int f9b(unsigned len) {
  ((len > 0)
       ? (void)(0)
       : __assert_fail(
             "len > 0",
             "/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/"
             "2022-01-22/02-19-57/repos/abduld/clreflect/refs/heads/master/"
             "QMOLEDEV/clang-3.1.src/test/Analysis/null-deref-ps.c",
             205, __func__));
  int *p = 0;
  unsigned i;
  for (i = 0; i < len; ++i)
    p = qux(i);
  return *p++;
}


x86 assembly (clang, -O0):
<f9b>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %edi,-0x4(%rbp)
cmpl   $0x0,-0x4(%rbp)
jbe    113a <f9b+0x1a>
jmp    115b <f9b+0x3b>
lea    0xebf(%rip),%rdi
lea    0xec0(%rip),%rsi
mov    $0xcd,%edx
lea    0xf66(%rip),%rcx
mov    $0x0,%al
call   1030 <__assert_fail@plt>
movq   $0x0,-0x10(%rbp)
movl   $0x0,-0x14(%rbp)
mov    -0x14(%rbp),%eax
cmp    -0x4(%rbp),%eax
jae    1194 <f9b+0x74>
mov    -0x14(%rbp),%edi
mov    $0x0,%al
call   1040 <qux@plt>
cltq
mov    %rax,-0x10(%rbp)
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    116a <f9b+0x4a>
mov    -0x10(%rbp),%rax
mov    %rax,%rcx
add    $0x4,%rcx
mov    %rcx,-0x10(%rbp)
mov    (%rax),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<f9b>:
push   %rbp
push   %rbx
push   %rax
mov    %edi,%ebx
test   %edi,%edi
jne    114a <f9b+0x2a>
lea    0xed0(%rip),%rdi
lea    0xed1(%rip),%rsi
lea    0xf7c(%rip),%rcx
mov    $0xcd,%edx
xor    %eax,%eax
call   1030 <__assert_fail@plt>
xor    %ebp,%ebp
nopl   0x0(%rax)
mov    %ebp,%edi
xor    %eax,%eax
call   1040 <qux@plt>
add    $0x1,%ebp
cmp    %ebp,%ebx
jne    1150 <f9b+0x30>
cltq
mov    (%rax),%eax
add    $0x8,%rsp
pop    %rbx
pop    %rbp
ret

LLVM IR (-O0):
@.str = [8 x i8] c"len > 0\00"
@.str.1 = [178 x i8] c"/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/2022-01-22/02-19-57/repos/abduld/clreflect/refs/heads/master/QMOLEDEV/clang-3.1.src/test/Analysis/null-deref-ps.c\00"
@__func__.f9b = [4 x i8] c"f9b\00"
define i32 @f9b(i32 %0) {
%2 = alloca i32
%3 = alloca i32*
%4 = alloca i32
store i32 %0, i32* %2
%5 = load i32, i32* %2
%6 = icmp ugt i32 %5, 0
br i1 %6, label %7, label %8
7: ; preds = %1
br label %10
8: ; preds = %1
%9 = call i32 (i8*, i8*, i32, i8*, ...) bitcast (i32 (...)* @__assert_fail to i32 (i8*, i8*, i32, i8*, ...)*)(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([178 x i8], [178 x i8]* @.str.1, i64 0, i64 0), i32 205, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @__func__.f9b, i64 0, i64 0))
br label %10
10: ; preds = %8, %7
store i32* null, i32** %3
store i32 0, i32* %4
br label %11
11: ; preds = %20, %10
%12 = load i32, i32* %4
%13 = load i32, i32* %2
%14 = icmp ult i32 %12, %13
br i1 %14, label %15, label %23
15: ; preds = %11
%16 = load i32, i32* %4
%17 = call i32 (i32, ...) bitcast (i32 (...)* @qux to i32 (i32, ...)*)(i32 %16)
%18 = sext i32 %17 to i64
%19 = inttoptr i64 %18 to i32*
store i32* %19, i32** %3
br label %20
20: ; preds = %15
%21 = load i32, i32* %4
%22 = add i32 %21, 1
store i32 %22, i32* %4
br label %11
23: ; preds = %11
%24 = load i32*, i32** %3
%25 = getelementptr inbounds i32, i32* %24, i32 1
store i32* %25, i32** %3
%26 = load i32, i32* %24
ret i32 %26
}

LLVM IR (-O2):
@.str = [8 x i8] c"len > 0\00"
@.str.1 = [178 x i8] c"/scratch/repos/new/home/jordi_armengol_estape/c-scraper/outputs/2022-01-22/02-19-57/repos/abduld/clreflect/refs/heads/master/QMOLEDEV/clang-3.1.src/test/Analysis/null-deref-ps.c\00"
@__func__.f9b = [4 x i8] c"f9b\00"
define i32 @f9b(i32 %0) {
%2 = icmp eq i32 %0, 0
br i1 %2, label %3, label %5
3: ; preds = %1
%4 = tail call i32 (i8*, i8*, i32, i8*, ...) bitcast (i32 (...)* @__assert_fail to i32 (i8*, i8*, i32, i8*, ...)*)(i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str, i64 0, i64 0), i8* getelementptr inbounds ([178 x i8], [178 x i8]* @.str.1, i64 0, i64 0), i32 205, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @__func__.f9b, i64 0, i64 0))
br label %5
5: ; preds = %1, %3
%6 = icmp ne i32 %0, 0
br label %7
7: ; preds = %5, %7
%8 = phi i32 [ %10, %7 ], [ 0, %5 ]
%9 = tail call i32 (i32, ...) bitcast (i32 (...)* @qux to i32 (i32, ...)*)(i32 %8)
%10 = add nuw i32 %8, 1
%11 = icmp eq i32 %10, %0
br i1 %11, label %12, label %7
12: ; preds = %7
%13 = sext i32 %9 to i64
%14 = inttoptr i64 %13 to i32*
%15 = load i32, i32* %14
ret i32 %15
}