#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ printf(char *, long long);
int /*<<< orphan*/ scanf(char *, int *);
int main() {
  int t, n, c, i;
  long long int a, b;
  scanf("%d", &t);
  while (t--) {
    scanf("%d", &n);
    for (i = a = b = 0; i < n; ++i) {
      scanf("%d", &c);
      if (c == 2)
        a++;
      else if (c > 2)
        b++;
    }
    printf("%lld\n", (b * a + b * (b - 1) / 2));
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
lea    0xeca(%rip),%rdi
lea    -0x8(%rbp),%rsi
call   1040 <scanf@plt>
mov    -0x8(%rbp),%eax
mov    %eax,%ecx
add    $0xffffffff,%ecx
mov    %ecx,-0x8(%rbp)
cmp    $0x0,%eax
je     1216 <main+0xf6>
lea    0xea6(%rip),%rdi
lea    -0xc(%rbp),%rsi
call   1040 <scanf@plt>
movq   $0x0,-0x28(%rbp)
movq   $0x0,-0x20(%rbp)
movl   $0x0,-0x14(%rbp)
mov    -0x14(%rbp),%eax
cmp    -0xc(%rbp),%eax
jge    11df <main+0xbf>
lea    0xe73(%rip),%rdi
lea    -0x10(%rbp),%rsi
call   1040 <scanf@plt>
cmpl   $0x2,-0x10(%rbp)
jne    11b1 <main+0x91>
mov    -0x20(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x20(%rbp)
jmp    11cc <main+0xac>
cmpl   $0x2,-0x10(%rbp)
jle    11c7 <main+0xa7>
mov    -0x28(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
jmp    11cc <main+0xac>
jmp    11d1 <main+0xb1>
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    117a <main+0x5a>
mov    -0x28(%rbp),%rsi
imul   -0x20(%rbp),%rsi
mov    -0x28(%rbp),%rax
mov    -0x28(%rbp),%rcx
sub    $0x1,%rcx
imul   %rcx,%rax
mov    $0x2,%ecx
cqto
idiv   %rcx
add    %rax,%rsi
lea    0xdf7(%rip),%rdi
call   1030 <printf@plt>
jmp    113f <main+0x1f>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
lea    0xecb(%rip),%rdi
lea    0x10(%rsp),%rsi
call   1040 <scanf@plt>
subl   $0x1,0x10(%rsp)
jae    1157 <main+0x37>
xor    %eax,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
lea    0xea2(%rip),%r13
lea    0x14(%rsp),%r15
lea    0xe99(%rip),%r12
jmp    119f <main+0x7f>
nopl   0x0(%rax)
xor    %ebx,%ebx
xor    %ebp,%ebp
imul   %rbp,%rbx
lea    -0x1(%rbp),%rax
imul   %rbp,%rax
mov    %rax,%rsi
shr    $0x3f,%rsi
add    %rax,%rsi
sar    %rsi
add    %rbx,%rsi
mov    %r12,%rdi
call   1030 <printf@plt>
subl   $0x1,0x10(%rsp)
jb     1146 <main+0x26>
mov    %r13,%rdi
lea    0xc(%rsp),%rsi
call   1040 <scanf@plt>
cmpl   $0x0,0xc(%rsp)
jle    1170 <main+0x50>
xor    %ebp,%ebp
xor    %ebx,%ebx
xor    %r14d,%r14d
nopw   0x0(%rax,%rax,1)
mov    %r13,%rdi
mov    %r15,%rsi
call   1040 <scanf@plt>
mov    0x14(%rsp),%eax
xor    %ecx,%ecx
xor    %edx,%edx
cmp    $0x2,%eax
sete   %cl
setg   %dl
add    %rcx,%rbx
add    %rdx,%rbp
add    $0x1,%r14d
cmp    0xc(%rsp),%r14d
jl     11c0 <main+0xa0>
jmp    1174 <main+0x54>

LLVM IR (-O0):
@.str = [3 x i8] c"%d\00"
@.str.1 = [6 x i8] c"%lld\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
%6 = alloca i64
%7 = alloca i64
store i32 0, i32* %1
%8 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32* %2)
br label %9
9: ; preds = %37, %0
%10 = load i32, i32* %2
%11 = add nsw i32 %10, -1
store i32 %11, i32* %2
%12 = icmp ne i32 %10, 0
br i1 %12, label %13, label %48
13: ; preds = %9
%14 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32* %3)
store i64 0, i64* %7
store i64 0, i64* %6
store i32 0, i32* %5
br label %15
15: ; preds = %34, %13
%16 = load i32, i32* %5
%17 = load i32, i32* %3
%18 = icmp slt i32 %16, %17
br i1 %18, label %19, label %37
19: ; preds = %15
%20 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32* %4)
%21 = load i32, i32* %4
%22 = icmp eq i32 %21, 2
br i1 %22, label %23, label %26
23: ; preds = %19
%24 = load i64, i64* %6
%25 = add nsw i64 %24, 1
store i64 %25, i64* %6
br label %33
26: ; preds = %19
%27 = load i32, i32* %4
%28 = icmp sgt i32 %27, 2
br i1 %28, label %29, label %32
29: ; preds = %26
%30 = load i64, i64* %7
%31 = add nsw i64 %30, 1
store i64 %31, i64* %7
br label %32
32: ; preds = %29, %26
br label %33
33: ; preds = %32, %23
br label %34
34: ; preds = %33
%35 = load i32, i32* %5
%36 = add nsw i32 %35, 1
store i32 %36, i32* %5
br label %15
37: ; preds = %15
%38 = load i64, i64* %7
%39 = load i64, i64* %6
%40 = mul nsw i64 %38, %39
%41 = load i64, i64* %7
%42 = load i64, i64* %7
%43 = sub nsw i64 %42, 1
%44 = mul nsw i64 %41, %43
%45 = sdiv i64 %44, 2
%46 = add nsw i64 %40, %45
%47 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i64 %46)
br label %9
48: ; preds = %9
ret i32 0
}

LLVM IR (-O2):
@.str = [3 x i8] c"%d\00"
@.str.1 = [6 x i8] c"%lld\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i32
%4 = bitcast i32* %1 to i8*
%5 = bitcast i32* %2 to i8*
%6 = bitcast i32* %3 to i8*
%7 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32* %1)
%8 = load i32, i32* %1
%9 = add nsw i32 %8, -1
store i32 %9, i32* %1
%10 = icmp eq i32 %8, 0
br i1 %10, label %42, label %11
11: ; preds = %0, %30
%12 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32* %2)
%13 = load i32, i32* %2
%14 = icmp sgt i32 %13, 0
br i1 %14, label %15, label %30
15: ; preds = %11, %15
%16 = phi i64 [ %26, %15 ], [ 0, %11 ]
%17 = phi i64 [ %24, %15 ], [ 0, %11 ]
%18 = phi i32 [ %27, %15 ], [ 0, %11 ]
%19 = call i32 @scanf(i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str, i64 0, i64 0), i32* %3)
%20 = load i32, i32* %3
%21 = icmp eq i32 %20, 2
%22 = icmp sgt i32 %20, 2
%23 = zext i1 %21 to i64
%24 = add nuw nsw i64 %17, %23
%25 = zext i1 %22 to i64
%26 = add nuw nsw i64 %16, %25
%27 = add nuw nsw i32 %18, 1
%28 = load i32, i32* %2
%29 = icmp slt i32 %27, %28
br i1 %29, label %15, label %30
30: ; preds = %15, %11
%31 = phi i64 [ 0, %11 ], [ %24, %15 ]
%32 = phi i64 [ 0, %11 ], [ %26, %15 ]
%33 = mul nsw i64 %32, %31
%34 = add nsw i64 %32, -1
%35 = mul nsw i64 %34, %32
%36 = sdiv i64 %35, 2
%37 = add nsw i64 %36, %33
%38 = call i32 @printf(i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i64 %37)
%39 = load i32, i32* %1
%40 = add nsw i32 %39, -1
store i32 %40, i32* %1
%41 = icmp eq i32 %39, 0
br i1 %41, label %42, label %11
42: ; preds = %30, %0
ret i32 0
}