void *f6() {
  int **array = malloc(10 * sizeof(int *));
  for (int i = 0; i < 10; i++)
    array[i] = malloc(100 * sizeof(int));
  array[0] = malloc(200 * sizeof(int));
  array[2] = malloc(400 * sizeof(int));
  *array = malloc(300 * sizeof(int));
  int *pos1 = array[2];
  int *pos2 = array[0];
  int *pos3 = *array;
  int j = *pos3;
  int *pos4 = array[j];
  return array;
}


x86 assembly (clang, -O0):
<f6>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    $0x50,%edi
call   1030 <malloc@plt>
mov    %rax,-0x8(%rbp)
movl   $0x0,-0xc(%rbp)
cmpl   $0xa,-0xc(%rbp)
jge    115e <f6+0x4e>
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,%rdx
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    112d <f6+0x1d>
mov    $0x320,%edi
call   1030 <malloc@plt>
mov    %rax,%rcx
mov    -0x8(%rbp),%rax
mov    %rcx,(%rax)
mov    $0x640,%edi
call   1030 <malloc@plt>
mov    %rax,%rcx
mov    -0x8(%rbp),%rax
mov    %rcx,0x10(%rax)
mov    $0x4b0,%edi
call   1030 <malloc@plt>
mov    %rax,%rcx
mov    -0x8(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x8(%rbp),%rax
mov    0x10(%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x8(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x20(%rbp)
mov    -0x8(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    (%rax),%eax
mov    %eax,-0x2c(%rbp)
mov    -0x8(%rbp),%rax
movslq -0x2c(%rbp),%rcx
mov    (%rax,%rcx,8),%rax
mov    %rax,-0x38(%rbp)
mov    -0x8(%rbp),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<f6>:
push   %rbx
mov    $0x50,%edi
call   1030 <malloc@plt>
mov    %rax,%rbx
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x8(%rbx)
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x18(%rbx)
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x20(%rbx)
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x28(%rbx)
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x30(%rbx)
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x38(%rbx)
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x40(%rbx)
mov    $0x190,%edi
call   1030 <malloc@plt>
mov    %rax,0x48(%rbx)
mov    $0x640,%edi
call   1030 <malloc@plt>
mov    %rax,0x10(%rbx)
mov    $0x4b0,%edi
call   1030 <malloc@plt>
mov    %rax,(%rbx)
mov    %rbx,%rax
pop    %rbx
ret

LLVM IR (-O0):
define i8* @f6() {
%1 = alloca i32**
%2 = alloca i32
%3 = alloca i32*
%4 = alloca i32*
%5 = alloca i32*
%6 = alloca i32
%7 = alloca i32*
%8 = call i8* @malloc(i64 80)
%9 = bitcast i8* %8 to i32**
store i32** %9, i32*** %1
store i32 0, i32* %2
br label %10
10: ; preds = %20, %0
%11 = load i32, i32* %2
%12 = icmp slt i32 %11, 10
br i1 %12, label %13, label %23
13: ; preds = %10
%14 = call i8* @malloc(i64 400)
%15 = bitcast i8* %14 to i32*
%16 = load i32**, i32*** %1
%17 = load i32, i32* %2
%18 = sext i32 %17 to i64
%19 = getelementptr inbounds i32*, i32** %16, i64 %18
store i32* %15, i32** %19
br label %20
20: ; preds = %13
%21 = load i32, i32* %2
%22 = add nsw i32 %21, 1
store i32 %22, i32* %2
br label %10
23: ; preds = %10
%24 = call i8* @malloc(i64 800)
%25 = bitcast i8* %24 to i32*
%26 = load i32**, i32*** %1
%27 = getelementptr inbounds i32*, i32** %26, i64 0
store i32* %25, i32** %27
%28 = call i8* @malloc(i64 1600)
%29 = bitcast i8* %28 to i32*
%30 = load i32**, i32*** %1
%31 = getelementptr inbounds i32*, i32** %30, i64 2
store i32* %29, i32** %31
%32 = call i8* @malloc(i64 1200)
%33 = bitcast i8* %32 to i32*
%34 = load i32**, i32*** %1
store i32* %33, i32** %34
%35 = load i32**, i32*** %1
%36 = getelementptr inbounds i32*, i32** %35, i64 2
%37 = load i32*, i32** %36
store i32* %37, i32** %3
%38 = load i32**, i32*** %1
%39 = getelementptr inbounds i32*, i32** %38, i64 0
%40 = load i32*, i32** %39
store i32* %40, i32** %4
%41 = load i32**, i32*** %1
%42 = load i32*, i32** %41
store i32* %42, i32** %5
%43 = load i32*, i32** %5
%44 = load i32, i32* %43
store i32 %44, i32* %6
%45 = load i32**, i32*** %1
%46 = load i32, i32* %6
%47 = sext i32 %46 to i64
%48 = getelementptr inbounds i32*, i32** %45, i64 %47
%49 = load i32*, i32** %48
store i32* %49, i32** %7
%50 = load i32**, i32*** %1
%51 = bitcast i32** %50 to i8*
ret i8* %51
}

LLVM IR (-O2):
define noalias i8* @f6() {
%1 = tail call dereferenceable_or_null(80) i8* @malloc(i64 80)
%2 = bitcast i8* %1 to i32**
%3 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%4 = getelementptr inbounds i32*, i32** %2, i64 1
%5 = bitcast i32** %4 to i8**
store i8* %3, i8** %5
%6 = getelementptr inbounds i32*, i32** %2, i64 2
%7 = bitcast i32** %6 to i8**
%8 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%9 = getelementptr inbounds i32*, i32** %2, i64 3
%10 = bitcast i32** %9 to i8**
store i8* %8, i8** %10
%11 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%12 = getelementptr inbounds i32*, i32** %2, i64 4
%13 = bitcast i32** %12 to i8**
store i8* %11, i8** %13
%14 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%15 = getelementptr inbounds i32*, i32** %2, i64 5
%16 = bitcast i32** %15 to i8**
store i8* %14, i8** %16
%17 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%18 = getelementptr inbounds i32*, i32** %2, i64 6
%19 = bitcast i32** %18 to i8**
store i8* %17, i8** %19
%20 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%21 = getelementptr inbounds i32*, i32** %2, i64 7
%22 = bitcast i32** %21 to i8**
store i8* %20, i8** %22
%23 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%24 = getelementptr inbounds i32*, i32** %2, i64 8
%25 = bitcast i32** %24 to i8**
store i8* %23, i8** %25
%26 = tail call dereferenceable_or_null(400) i8* @malloc(i64 400)
%27 = getelementptr inbounds i32*, i32** %2, i64 9
%28 = bitcast i32** %27 to i8**
store i8* %26, i8** %28
%29 = bitcast i8* %1 to i8**
%30 = tail call dereferenceable_or_null(1600) i8* @malloc(i64 1600)
store i8* %30, i8** %7
%31 = tail call dereferenceable_or_null(1200) i8* @malloc(i64 1200)
store i8* %31, i8** %29
ret i8* %1
}