#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ csolve_assert(int);
scalar_t__ malloc(int);
scalar_t__ nondet();
int main() {
  int *r;
  int y;
  r = (int *)malloc(4);
  if (nondet()) {
    *r = -10;
  }
  *r = 0;
  while (nondet()) {
    *r = *r + 1;
  }
  y = *r;
  csolve_assert(y >= 0);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    $0x0,%al
call   1030 <nondet@plt>
cmp    $0x0,%rax
je     1168 <main+0x38>
mov    -0x10(%rbp),%rax
movl   $0xfffffff6,(%rax)
mov    -0x10(%rbp),%rax
movl   $0x0,(%rax)
mov    $0x0,%al
call   1030 <nondet@plt>
cmp    $0x0,%rax
je     1197 <main+0x67>
mov    -0x10(%rbp),%rax
mov    (%rax),%ecx
add    $0x1,%ecx
mov    -0x10(%rbp),%rax
mov    %ecx,(%rax)
jmp    1172 <main+0x42>
mov    -0x10(%rbp),%rax
mov    (%rax),%eax
mov    %eax,-0x14(%rbp)
cmpl   $0x0,-0x14(%rbp)
setge  %al
and    $0x1,%al
movzbl %al,%edi
call   1050 <csolve_assert@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,%rbx
xor    %eax,%eax
call   1030 <nondet@plt>
movl   $0x0,(%rbx)
nopl   0x0(%rax,%rax,1)
xor    %eax,%eax
call   1030 <nondet@plt>
test   %rax,%rax
je     1161 <main+0x31>
addl   $0x1,(%rbx)
jmp    1150 <main+0x20>
mov    (%rbx),%edi
not    %edi
shr    $0x1f,%edi
call   1050 <csolve_assert@plt>
xor    %eax,%eax
pop    %rbx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32
store i32 0, i32* %1
%4 = call i64 @malloc(i32 4)
%5 = inttoptr i64 %4 to i32*
store i32* %5, i32** %2
%6 = call i64 (...) @nondet()
%7 = icmp ne i64 %6, 0
br i1 %7, label %8, label %10
8: ; preds = %0
%9 = load i32*, i32** %2
store i32 -10, i32* %9
br label %10
10: ; preds = %8, %0
%11 = load i32*, i32** %2
store i32 0, i32* %11
br label %12
12: ; preds = %15, %10
%13 = call i64 (...) @nondet()
%14 = icmp ne i64 %13, 0
br i1 %14, label %15, label %20
15: ; preds = %12
%16 = load i32*, i32** %2
%17 = load i32, i32* %16
%18 = add nsw i32 %17, 1
%19 = load i32*, i32** %2
store i32 %18, i32* %19
br label %12
20: ; preds = %12
%21 = load i32*, i32** %2
%22 = load i32, i32* %21
store i32 %22, i32* %3
%23 = load i32, i32* %3
%24 = icmp sge i32 %23, 0
%25 = zext i1 %24 to i32
%26 = call i32 @csolve_assert(i32 %25)
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i64 @malloc(i32 4)
%2 = inttoptr i64 %1 to i32*
%3 = tail call i64 (...) @nondet()
store i32 0, i32* %2
%4 = tail call i64 (...) @nondet()
%5 = icmp eq i64 %4, 0
br i1 %5, label %11, label %6
6: ; preds = %0, %6
%7 = load i32, i32* %2
%8 = add nsw i32 %7, 1
store i32 %8, i32* %2
%9 = tail call i64 (...) @nondet()
%10 = icmp eq i64 %9, 0
br i1 %10, label %11, label %6
11: ; preds = %6, %0
%12 = load i32, i32* %2
%13 = xor i32 %12, -1
%14 = lshr i32 %13, 31
%15 = tail call i32 @csolve_assert(i32 %14)
ret i32 0
}