#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ pid_t;

/* Variables and functions */
scalar_t__ WIFEXITED(int);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
scalar_t__ fork();
char *malloc(int);
void stub1();
void stub2();
int /*<<< orphan*/ waitpid(scalar_t__, int *, int /*<<< orphan*/);
int nx_test(void) {
  pid_t pid;
  int s1, s2;
  char stackvar[] = {'\x90', '\xc3'};
  char *mallocvar = NULL;
  if ((pid = fork()) < 0)
    return -0x10;
  else if (!pid) {
    ((void (*)(void))stackvar)();
    exit(0);
  }
  waitpid(pid, &s1, 0);
  mallocvar = malloc(2);
  if (mallocvar == NULL)
    return -0x11;
  mallocvar[0] = '\x90';
  mallocvar[1] = '\xc3';
  if ((pid = fork()) < 0)
    return -0x10;
  else if (!pid) {
    ((void (*)(void))mallocvar)();
    exit(0);
  }
  waitpid(pid, &s2, 0);
  return (WIFEXITED(s1) || WIFEXITED(s2)) ? 0 : 0x2;
}


x86 assembly (clang, -O0):
<nx_test>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    0xea1(%rip),%ax
mov    %ax,-0x1a(%rbp)
movq   $0x0,-0x28(%rbp)
mov    $0x0,%al
call   1070 <fork@plt>
mov    %rax,-0x10(%rbp)
cmp    $0x0,%rax
jge    118c <nx_test+0x3c>
movl   $0xfffffff0,-0x4(%rbp)
jmp    1275 <nx_test+0x125>
cmpq   $0x0,-0x10(%rbp)
jne    11a4 <nx_test+0x54>
lea    -0x1a(%rbp),%rax
call   *%rax
xor    %edi,%edi
call   1060 <exit@plt>
jmp    11a9 <nx_test+0x59>
mov    -0x10(%rbp),%rdi
lea    -0x14(%rbp),%rsi
xor    %edx,%edx
call   1040 <waitpid@plt>
mov    $0x2,%edi
call   1030 <malloc@plt>
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x28(%rbp)
jne    11dd <nx_test+0x8d>
movl   $0xffffffef,-0x4(%rbp)
jmp    1275 <nx_test+0x125>
mov    -0x28(%rbp),%rax
movb   $0x90,(%rax)
mov    -0x28(%rbp),%rax
movb   $0xc3,0x1(%rax)
mov    $0x0,%al
call   1070 <fork@plt>
mov    %rax,-0x10(%rbp)
cmp    $0x0,%rax
jge    120d <nx_test+0xbd>
movl   $0xfffffff0,-0x4(%rbp)
jmp    1275 <nx_test+0x125>
cmpq   $0x0,-0x10(%rbp)
jne    1222 <nx_test+0xd2>
call   *-0x28(%rbp)
xor    %edi,%edi
call   1060 <exit@plt>
jmp    1227 <nx_test+0xd7>
mov    -0x10(%rbp),%rdi
lea    -0x18(%rbp),%rsi
xor    %edx,%edx
call   1040 <waitpid@plt>
mov    -0x14(%rbp),%edi
call   1050 <WIFEXITED@plt>
mov    %rax,%rcx
mov    $0x1,%al
cmp    $0x0,%rcx
mov    %al,-0x29(%rbp)
jne    1262 <nx_test+0x112>
mov    -0x18(%rbp),%edi
call   1050 <WIFEXITED@plt>
cmp    $0x0,%rax
setne  %al
mov    %al,-0x29(%rbp)
mov    -0x29(%rbp),%dl
mov    $0x2,%eax
xor    %ecx,%ecx
test   $0x1,%dl
cmovne %ecx,%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<nx_test>:
push   %rbp
push   %rbx
push   %rax
xor    %eax,%eax
call   1070 <fork@plt>
mov    $0xfffffff0,%ebp
test   %rax,%rax
js     11d1 <nx_test+0x81>
je     11da <nx_test+0x8a>
lea    0x4(%rsp),%rsi
mov    %rax,%rdi
xor    %edx,%edx
call   1040 <waitpid@plt>
mov    $0x2,%edi
call   1030 <malloc@plt>
test   %rax,%rax
je     11cc <nx_test+0x7c>
mov    %rax,%rbx
movw   $0xc390,(%rax)
xor    %eax,%eax
call   1070 <fork@plt>
test   %rax,%rax
js     11d1 <nx_test+0x81>
je     11e6 <nx_test+0x96>
mov    %rsp,%rsi
xor    %ebp,%ebp
mov    %rax,%rdi
xor    %edx,%edx
call   1040 <waitpid@plt>
mov    0x4(%rsp),%edi
call   1050 <WIFEXITED@plt>
test   %rax,%rax
jne    11d1 <nx_test+0x81>
mov    (%rsp),%edi
call   1050 <WIFEXITED@plt>
xor    %ebp,%ebp
test   %rax,%rax
sete   %bpl
add    %ebp,%ebp
jmp    11d1 <nx_test+0x81>
mov    $0xffffffef,%ebp
mov    %ebp,%eax
add    $0x8,%rsp
pop    %rbx
pop    %rbp
ret
call   2000 <_fini+0xe10>
xor    %edi,%edi
call   1060 <exit@plt>
call   *%rbx
xor    %edi,%edi
call   1060 <exit@plt>

LLVM IR (-O0):
@__const.nx_test.stackvar = [2 x i8] c"\90\C3"
define i32 @nx_test() {
%1 = alloca i32
%2 = alloca i64
%3 = alloca i32
%4 = alloca i32
%5 = alloca [2 x i8]
%6 = alloca i8*
%7 = bitcast [2 x i8]* %5 to i8*
store i8* null, i8** %6
%8 = call i64 (...) @fork()
store i64 %8, i64* %2
%9 = icmp slt i64 %8, 0
br i1 %9, label %10, label %11
10: ; preds = %0
store i32 -16, i32* %1
br label %56
11: ; preds = %0
%12 = load i64, i64* %2
%13 = icmp ne i64 %12, 0
br i1 %13, label %18, label %14
14: ; preds = %11
%15 = getelementptr inbounds [2 x i8], [2 x i8]* %5, i64 0, i64 0
%16 = bitcast i8* %15 to void ()*
%17 = call i32 @exit(i32 0)
unreachable
18: ; preds = %11
br label %19
19: ; preds = %18
%20 = load i64, i64* %2
%21 = call i32 @waitpid(i64 %20, i32* %3, i32 0)
%22 = call i8* @malloc(i32 2)
store i8* %22, i8** %6
%23 = load i8*, i8** %6
%24 = icmp eq i8* %23, null
br i1 %24, label %25, label %26
25: ; preds = %19
store i32 -17, i32* %1
br label %56
26: ; preds = %19
%27 = load i8*, i8** %6
%28 = getelementptr inbounds i8, i8* %27, i64 0
store i8 -112, i8* %28
%29 = load i8*, i8** %6
%30 = getelementptr inbounds i8, i8* %29, i64 1
store i8 -61, i8* %30
%31 = call i64 (...) @fork()
store i64 %31, i64* %2
%32 = icmp slt i64 %31, 0
br i1 %32, label %33, label %34
33: ; preds = %26
store i32 -16, i32* %1
br label %56
34: ; preds = %26
%35 = load i64, i64* %2
%36 = icmp ne i64 %35, 0
br i1 %36, label %41, label %37
37: ; preds = %34
%38 = load i8*, i8** %6
%39 = bitcast i8* %38 to void ()*
%40 = call i32 @exit(i32 0)
unreachable
41: ; preds = %34
br label %42
42: ; preds = %41
%43 = load i64, i64* %2
%44 = call i32 @waitpid(i64 %43, i32* %4, i32 0)
%45 = load i32, i32* %3
%46 = call i64 @WIFEXITED(i32 %45)
%47 = icmp ne i64 %46, 0
br i1 %47, label %52, label %48
48: ; preds = %42
%49 = load i32, i32* %4
%50 = call i64 @WIFEXITED(i32 %49)
%51 = icmp ne i64 %50, 0
br label %52
52: ; preds = %48, %42
%53 = phi i1 [ true, %42 ], [ %51, %48 ]
%54 = zext i1 %53 to i64
%55 = select i1 %53, i32 0, i32 2
store i32 %55, i32* %1
br label %56
56: ; preds = %52, %33, %25, %10
%57 = load i32, i32* %1
ret i32 %57
}

LLVM IR (-O2):
@__const.nx_test.stackvar = [2 x i8] c"\90\C3"
define i32 @nx_test() {
%1 = alloca i32
%2 = alloca i32
%3 = bitcast i32* %1 to i8*
%4 = bitcast i32* %2 to i8*
%5 = tail call i64 (...) @fork()
%6 = icmp slt i64 %5, 0
br i1 %6, label %34, label %7
7: ; preds = %0
%8 = icmp eq i64 %5, 0
br i1 %8, label %9, label %11
9: ; preds = %7
tail call void bitcast ([2 x i8]* @__const.nx_test.stackvar to void ()*)()
%10 = tail call i32 @exit(i32 0)
unreachable
11: ; preds = %7
%12 = call i32 @waitpid(i64 %5, i32* %1, i32 0)
%13 = call dereferenceable_or_null(2) i8* @malloc(i32 2)
%14 = icmp eq i8* %13, null
br i1 %14, label %34, label %15
15: ; preds = %11
store i8 -112, i8* %13
%16 = getelementptr inbounds i8, i8* %13, i64 1
store i8 -61, i8* %16
%17 = call i64 (...) @fork()
%18 = icmp slt i64 %17, 0
br i1 %18, label %34, label %19
19: ; preds = %15
%20 = icmp eq i64 %17, 0
br i1 %20, label %21, label %24
21: ; preds = %19
%22 = bitcast i8* %13 to void ()*
%23 = call i32 @exit(i32 0)
unreachable
24: ; preds = %19
%25 = call i32 @waitpid(i64 %17, i32* %2, i32 0)
%26 = load i32, i32* %1
%27 = call i64 @WIFEXITED(i32 %26)
%28 = icmp eq i64 %27, 0
br i1 %28, label %29, label %34
29: ; preds = %24
%30 = load i32, i32* %2
%31 = call i64 @WIFEXITED(i32 %30)
%32 = icmp eq i64 %31, 0
%33 = select i1 %32, i32 2, i32 0
br label %34
34: ; preds = %24, %29, %15, %11, %0
%35 = phi i32 [ -16, %0 ], [ -17, %11 ], [ -16, %15 ], [ 0, %24 ], [ %33, %29 ]
ret i32 %35
}