#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
    struct T *prev;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  y = malloc(sizeof(*y));
  y->next = x;
  x = y;
  y = malloc(sizeof(*y));
  y->next = x;
  x->prev = y;
  x = y;
  while (__nondet()) {
    y = malloc(sizeof(*y));
    y->next = x;
    x->prev = y;
    x = y;
    y = malloc(sizeof(*y));
    y->next = x;
    x->prev = y;
    x = y;
  }
  while (y != NULL) {
    x = y;
    y = y->next;
    free(x);
    x = y;
    y = y->next;
    free(x);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     120d <main+0xdd>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    119d <main+0x6d>
jmp    1212 <main+0xe2>
cmpq   $0x0,-0x18(%rbp)
je     125a <main+0x12a>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
jmp    1212 <main+0xe2>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
movq   $0x0,(%rax)
nopl   0x0(%rax,%rax,1)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    %r14,(%rax)
mov    %rax,0x8(%r14)
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     1190 <main+0x60>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
mov    %rbx,(%rax)
mov    %rax,0x8(%rbx)
jmp    1150 <main+0x20>
cs nopw 0x0(%rax,%rax,1)
mov    (%rbx),%r14
mov    %rbx,%rdi
call   1030 <free@plt>
mov    (%r14),%rbx
mov    %r14,%rdi
call   1030 <free@plt>
test   %rbx,%rbx
jne    1190 <main+0x60>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
%struct.T = type { %struct.T*, %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
%4 = call %struct.T.0* @malloc(i32 16)
%5 = bitcast %struct.T.0* %4 to %struct.T*
store %struct.T* %5, %struct.T** %3
%6 = load %struct.T*, %struct.T** %2
%7 = load %struct.T*, %struct.T** %3
%8 = getelementptr inbounds %struct.T, %struct.T* %7, i32 0, i32 0
store %struct.T* %6, %struct.T** %8
%9 = load %struct.T*, %struct.T** %3
store %struct.T* %9, %struct.T** %2
%10 = call %struct.T.0* @malloc(i32 16)
%11 = bitcast %struct.T.0* %10 to %struct.T*
store %struct.T* %11, %struct.T** %3
%12 = load %struct.T*, %struct.T** %2
%13 = load %struct.T*, %struct.T** %3
%14 = getelementptr inbounds %struct.T, %struct.T* %13, i32 0, i32 0
store %struct.T* %12, %struct.T** %14
%15 = load %struct.T*, %struct.T** %3
%16 = load %struct.T*, %struct.T** %2
%17 = getelementptr inbounds %struct.T, %struct.T* %16, i32 0, i32 1
store %struct.T* %15, %struct.T** %17
%18 = load %struct.T*, %struct.T** %3
store %struct.T* %18, %struct.T** %2
br label %19
19: ; preds = %22, %0
%20 = call i64 (...) @__nondet()
%21 = icmp ne i64 %20, 0
br i1 %21, label %22, label %41
22: ; preds = %19
%23 = call %struct.T.0* @malloc(i32 16)
%24 = bitcast %struct.T.0* %23 to %struct.T*
store %struct.T* %24, %struct.T** %3
%25 = load %struct.T*, %struct.T** %2
%26 = load %struct.T*, %struct.T** %3
%27 = getelementptr inbounds %struct.T, %struct.T* %26, i32 0, i32 0
store %struct.T* %25, %struct.T** %27
%28 = load %struct.T*, %struct.T** %3
%29 = load %struct.T*, %struct.T** %2
%30 = getelementptr inbounds %struct.T, %struct.T* %29, i32 0, i32 1
store %struct.T* %28, %struct.T** %30
%31 = load %struct.T*, %struct.T** %3
store %struct.T* %31, %struct.T** %2
%32 = call %struct.T.0* @malloc(i32 16)
%33 = bitcast %struct.T.0* %32 to %struct.T*
store %struct.T* %33, %struct.T** %3
%34 = load %struct.T*, %struct.T** %2
%35 = load %struct.T*, %struct.T** %3
%36 = getelementptr inbounds %struct.T, %struct.T* %35, i32 0, i32 0
store %struct.T* %34, %struct.T** %36
%37 = load %struct.T*, %struct.T** %3
%38 = load %struct.T*, %struct.T** %2
%39 = getelementptr inbounds %struct.T, %struct.T* %38, i32 0, i32 1
store %struct.T* %37, %struct.T** %39
%40 = load %struct.T*, %struct.T** %3
store %struct.T* %40, %struct.T** %2
br label %19
41: ; preds = %19
br label %42
42: ; preds = %45, %41
%43 = load %struct.T*, %struct.T** %3
%44 = icmp ne %struct.T* %43, null
br i1 %44, label %45, label %60
45: ; preds = %42
%46 = load %struct.T*, %struct.T** %3
store %struct.T* %46, %struct.T** %2
%47 = load %struct.T*, %struct.T** %3
%48 = getelementptr inbounds %struct.T, %struct.T* %47, i32 0, i32 0
%49 = load %struct.T*, %struct.T** %48
store %struct.T* %49, %struct.T** %3
%50 = load %struct.T*, %struct.T** %2
%51 = bitcast %struct.T* %50 to %struct.T.1*
%52 = call i32 @free(%struct.T.1* %51)
%53 = load %struct.T*, %struct.T** %3
store %struct.T* %53, %struct.T** %2
%54 = load %struct.T*, %struct.T** %3
%55 = getelementptr inbounds %struct.T, %struct.T* %54, i32 0, i32 0
%56 = load %struct.T*, %struct.T** %55
store %struct.T* %56, %struct.T** %3
%57 = load %struct.T*, %struct.T** %2
%58 = bitcast %struct.T* %57 to %struct.T.1*
%59 = call i32 @free(%struct.T.1* %58)
br label %42
60: ; preds = %42
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T*, %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call %struct.T.0* @malloc(i32 16)
%2 = bitcast %struct.T.0* %1 to %struct.T*
%3 = bitcast %struct.T.0* %1 to %struct.T**
store %struct.T* null, %struct.T** %3
%4 = tail call %struct.T.0* @malloc(i32 16)
%5 = bitcast %struct.T.0* %4 to %struct.T.0**
store %struct.T.0* %1, %struct.T.0** %5
%6 = getelementptr inbounds %struct.T, %struct.T* %2, i64 0, i32 1
%7 = bitcast %struct.T** %6 to %struct.T.0**
store %struct.T.0* %4, %struct.T.0** %7
%8 = tail call i64 (...) @__nondet()
%9 = icmp eq i64 %8, 0
br i1 %9, label %10, label %13
10: ; preds = %13, %0
%11 = phi %struct.T.0* [ %4, %0 ], [ %21, %13 ]
%12 = bitcast %struct.T.0* %11 to %struct.T*
br label %27
13: ; preds = %0, %13
%14 = phi %struct.T.0* [ %21, %13 ], [ %4, %0 ]
%15 = bitcast %struct.T.0* %14 to %struct.T*
%16 = tail call %struct.T.0* @malloc(i32 16)
%17 = bitcast %struct.T.0* %16 to %struct.T*
%18 = bitcast %struct.T.0* %16 to %struct.T.0**
store %struct.T.0* %14, %struct.T.0** %18
%19 = getelementptr inbounds %struct.T, %struct.T* %15, i64 0, i32 1
%20 = bitcast %struct.T** %19 to %struct.T.0**
store %struct.T.0* %16, %struct.T.0** %20
%21 = tail call %struct.T.0* @malloc(i32 16)
%22 = bitcast %struct.T.0* %21 to %struct.T.0**
store %struct.T.0* %16, %struct.T.0** %22
%23 = getelementptr inbounds %struct.T, %struct.T* %17, i64 0, i32 1
%24 = bitcast %struct.T** %23 to %struct.T.0**
store %struct.T.0* %21, %struct.T.0** %24
%25 = tail call i64 (...) @__nondet()
%26 = icmp eq i64 %25, 0
br i1 %26, label %10, label %13
27: ; preds = %10, %27
%28 = phi %struct.T* [ %34, %27 ], [ %12, %10 ]
%29 = getelementptr inbounds %struct.T, %struct.T* %28, i64 0, i32 0
%30 = load %struct.T*, %struct.T** %29
%31 = bitcast %struct.T* %28 to %struct.T.1*
%32 = tail call i32 @free(%struct.T.1* %31)
%33 = getelementptr inbounds %struct.T, %struct.T* %30, i64 0, i32 0
%34 = load %struct.T*, %struct.T** %33
%35 = bitcast %struct.T* %30 to %struct.T.1*
%36 = tail call i32 @free(%struct.T.1* %35)
%37 = icmp eq %struct.T* %34, null
br i1 %37, label %38, label %27
38: ; preds = %27
ret i32 0
}