#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ ___fa_plot(char *);
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
    struct T *prev;
    int data;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  x = malloc(sizeof(struct T));
  x->next = NULL;
  x->prev = NULL;
  while (__nondet()) {
    y = malloc(sizeof(struct T));
    y->next = x;
    x->prev = y;
    y->prev = NULL;
    x = y;
  }
  ___fa_plot("test-f0028-fixpoint");
  while (x) {
    y = x->next;
    free(x);
    x = y;
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x10(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    $0x0,%al
call   1050 <__nondet@plt>
cmp    $0x0,%rax
je     11d3 <main+0x93>
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    1184 <main+0x44>
lea    0xe26(%rip),%rdi
call   1040 <___fa_plot@plt>
cmpq   $0x0,-0x10(%rbp)
je     120b <main+0xcb>
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    11df <main+0x9f>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
xor    %eax,%eax
call   1050 <__nondet@plt>
test   %rax,%rax
je     119e <main+0x5e>
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,%r14
mov    %rbx,(%rax)
mov    %rax,0x8(%rbx)
movq   $0x0,0x8(%rax)
xor    %eax,%eax
call   1050 <__nondet@plt>
mov    %r14,%rbx
test   %rax,%rax
jne    1170 <main+0x30>
mov    %r14,%rbx
lea    0xe5b(%rip),%rdi
call   1040 <___fa_plot@plt>
nopw   0x0(%rax,%rax,1)
mov    (%rbx),%r14
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %r14,%rbx
test   %r14,%r14
jne    11b0 <main+0x70>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
@.str = [20 x i8] c"test-f0028-fixpoint\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
%4 = call %struct.T.0* @malloc(i32 24)
%5 = bitcast %struct.T.0* %4 to %struct.T*
store %struct.T* %5, %struct.T** %2
%6 = load %struct.T*, %struct.T** %2
%7 = getelementptr inbounds %struct.T, %struct.T* %6, i32 0, i32 0
store %struct.T* null, %struct.T** %7
%8 = load %struct.T*, %struct.T** %2
%9 = getelementptr inbounds %struct.T, %struct.T* %8, i32 0, i32 1
store %struct.T* null, %struct.T** %9
br label %10
10: ; preds = %13, %0
%11 = call i64 (...) @__nondet()
%12 = icmp ne i64 %11, 0
br i1 %12, label %13, label %25
13: ; preds = %10
%14 = call %struct.T.0* @malloc(i32 24)
%15 = bitcast %struct.T.0* %14 to %struct.T*
store %struct.T* %15, %struct.T** %3
%16 = load %struct.T*, %struct.T** %2
%17 = load %struct.T*, %struct.T** %3
%18 = getelementptr inbounds %struct.T, %struct.T* %17, i32 0, i32 0
store %struct.T* %16, %struct.T** %18
%19 = load %struct.T*, %struct.T** %3
%20 = load %struct.T*, %struct.T** %2
%21 = getelementptr inbounds %struct.T, %struct.T* %20, i32 0, i32 1
store %struct.T* %19, %struct.T** %21
%22 = load %struct.T*, %struct.T** %3
%23 = getelementptr inbounds %struct.T, %struct.T* %22, i32 0, i32 1
store %struct.T* null, %struct.T** %23
%24 = load %struct.T*, %struct.T** %3
store %struct.T* %24, %struct.T** %2
br label %10
25: ; preds = %10
%26 = call i32 @___fa_plot(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0))
br label %27
27: ; preds = %30, %25
%28 = load %struct.T*, %struct.T** %2
%29 = icmp ne %struct.T* %28, null
br i1 %29, label %30, label %38
30: ; preds = %27
%31 = load %struct.T*, %struct.T** %2
%32 = getelementptr inbounds %struct.T, %struct.T* %31, i32 0, i32 0
%33 = load %struct.T*, %struct.T** %32
store %struct.T* %33, %struct.T** %3
%34 = load %struct.T*, %struct.T** %2
%35 = bitcast %struct.T* %34 to %struct.T.1*
%36 = call i32 @free(%struct.T.1* %35)
%37 = load %struct.T*, %struct.T** %3
store %struct.T* %37, %struct.T** %2
br label %27
38: ; preds = %27
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
@.str = [20 x i8] c"test-f0028-fixpoint\00"
define i32 @main() {
%1 = tail call %struct.T.0* @malloc(i32 24)
%2 = bitcast %struct.T.0* %1 to %struct.T*
%3 = bitcast %struct.T.0* %1 to i8*
%4 = tail call i64 (...) @__nondet()
%5 = icmp eq i64 %4, 0
br i1 %5, label %18, label %6
6: ; preds = %0, %6
%7 = phi %struct.T* [ %9, %6 ], [ %2, %0 ]
%8 = tail call %struct.T.0* @malloc(i32 24)
%9 = bitcast %struct.T.0* %8 to %struct.T*
%10 = bitcast %struct.T.0* %8 to %struct.T**
store %struct.T* %7, %struct.T** %10
%11 = getelementptr inbounds %struct.T, %struct.T* %7, i64 0, i32 1
%12 = bitcast %struct.T** %11 to %struct.T.0**
store %struct.T.0* %8, %struct.T.0** %12
%13 = getelementptr inbounds %struct.T, %struct.T* %9, i64 0, i32 1
store %struct.T* null, %struct.T** %13
%14 = tail call i64 (...) @__nondet()
%15 = icmp eq i64 %14, 0
br i1 %15, label %16, label %6
16: ; preds = %6
%17 = bitcast %struct.T.0* %8 to %struct.T*
br label %18
18: ; preds = %16, %0
%19 = phi %struct.T* [ %2, %0 ], [ %17, %16 ]
%20 = tail call i32 @___fa_plot(i8* getelementptr inbounds ([20 x i8], [20 x i8]* @.str, i64 0, i64 0))
br label %21
21: ; preds = %18, %21
%22 = phi %struct.T* [ %24, %21 ], [ %19, %18 ]
%23 = getelementptr inbounds %struct.T, %struct.T* %22, i64 0, i32 0
%24 = load %struct.T*, %struct.T** %23
%25 = bitcast %struct.T* %22 to %struct.T.1*
%26 = tail call i32 @free(%struct.T.1* %25)
%27 = icmp eq %struct.T* %24, null
br i1 %27, label %28, label %21
28: ; preds = %21
ret i32 0
}