int __bound_strlen(const char *s) {
  const char *p;
  int len;
  len = 0;
  for (;;) {
    p = __bound_ptr_indir1((char *)s, len);
    if (p == ((void *)(-2)))
      bound_error("bad pointer in strlen()");
    if (*p == '\0')
      break;
    len++;
  }
  return len;
}


x86 assembly (clang, -O0):
<__bound_strlen>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
movl   $0x0,-0x14(%rbp)
mov    -0x8(%rbp),%rdi
mov    -0x14(%rbp),%esi
mov    $0x0,%al
call   1030 <__bound_ptr_indir1@plt>
cltq
mov    %rax,-0x10(%rbp)
mov    $0xfffffffffffffffe,%rax
cmp    %rax,-0x10(%rbp)
jne    1166 <__bound_strlen+0x46>
lea    0xea1(%rip),%rdi
mov    $0x0,%al
call   1040 <bound_error@plt>
mov    -0x10(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x0,%eax
jne    117b <__bound_strlen+0x5b>
jmp    1189 <__bound_strlen+0x69>
mov    -0x14(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x14(%rbp)
jmp    1133 <__bound_strlen+0x13>
mov    -0x14(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<__bound_strlen>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %rdi,%r14
mov    $0xffffffff,%ebp
lea    0xeca(%rip),%r15
jmp    1145 <__bound_strlen+0x25>
nopl   0x0(%rax,%rax,1)
cmpb   $0x0,(%rbx)
je     1169 <__bound_strlen+0x49>
add    $0x1,%ebp
mov    %r14,%rdi
mov    %ebp,%esi
xor    %eax,%eax
call   1030 <__bound_ptr_indir1@plt>
movslq %eax,%rbx
cmp    $0xfffffffffffffffe,%rbx
jne    1140 <__bound_strlen+0x20>
mov    %r15,%rdi
xor    %eax,%eax
call   1040 <bound_error@plt>
jmp    1140 <__bound_strlen+0x20>
mov    %ebp,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [24 x i8] c"bad pointer in strlen()\00"
define i32 @__bound_strlen(i8* %0) {
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i32
store i8* %0, i8** %2
store i32 0, i32* %4
br label %5
5: ; preds = %21, %1
%6 = load i8*, i8** %2
%7 = load i32, i32* %4
%8 = call i32 (i8*, i32, ...) bitcast (i32 (...)* @__bound_ptr_indir1 to i32 (i8*, i32, ...)*)(i8* %6, i32 %7)
%9 = sext i32 %8 to i64
%10 = inttoptr i64 %9 to i8*
store i8* %10, i8** %3
%11 = load i8*, i8** %3
%12 = icmp eq i8* %11, inttoptr (i64 -2 to i8*)
br i1 %12, label %13, label %15
13: ; preds = %5
%14 = call i32 (i8*, ...) bitcast (i32 (...)* @bound_error to i32 (i8*, ...)*)(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str, i64 0, i64 0))
br label %15
15: ; preds = %13, %5
%16 = load i8*, i8** %3
%17 = load i8, i8* %16
%18 = sext i8 %17 to i32
%19 = icmp eq i32 %18, 0
br i1 %19, label %20, label %21
20: ; preds = %15
br label %24
21: ; preds = %15
%22 = load i32, i32* %4
%23 = add nsw i32 %22, 1
store i32 %23, i32* %4
br label %5
24: ; preds = %20
%25 = load i32, i32* %4
ret i32 %25
}

LLVM IR (-O2):
@.str = [24 x i8] c"bad pointer in strlen()\00"
define i32 @__bound_strlen(i8* %0) {
br label %2
2: ; preds = %10, %1
%3 = phi i32 [ 0, %1 ], [ %13, %10 ]
%4 = tail call i32 (i8*, i32, ...) bitcast (i32 (...)* @__bound_ptr_indir1 to i32 (i8*, i32, ...)*)(i8* %0, i32 %3)
%5 = sext i32 %4 to i64
%6 = inttoptr i64 %5 to i8*
%7 = icmp eq i8* %6, inttoptr (i64 -2 to i8*)
br i1 %7, label %8, label %10
8: ; preds = %2
%9 = tail call i32 (i8*, ...) bitcast (i32 (...)* @bound_error to i32 (i8*, ...)*)(i8* getelementptr inbounds ([24 x i8], [24 x i8]* @.str, i64 0, i64 0))
br label %10
10: ; preds = %8, %2
%11 = load i8, i8* %6
%12 = icmp eq i8 %11, 0
%13 = add nuw nsw i32 %3, 1
br i1 %12, label %14, label %2
14: ; preds = %10
ret i32 %3
}