#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int __VERIFIER_nondet_int();
int main() {
  int a, x, max;
  a = __VERIFIER_nondet_int();
  x = __VERIFIER_nondet_int();
  max = __VERIFIER_nondet_int();
  if (max > 0) {
    a = 0;
    x = 1;
    while (x <= max) {
      if (__VERIFIER_nondet_int() != 0) {
        a = a + 1;
      } else {
        a = a - 1;
      }
      x = x + 1;
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x8(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %eax,-0xc(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x10(%rbp)
cmpl   $0x0,-0x10(%rbp)
jle    119b <main+0x8b>
movl   $0x0,-0x8(%rbp)
movl   $0x1,-0xc(%rbp)
mov    -0xc(%rbp),%eax
cmp    -0x10(%rbp),%eax
jg     1196 <main+0x86>
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%eax
je     117f <main+0x6f>
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x8(%rbp)
jmp    1188 <main+0x78>
mov    -0x8(%rbp),%eax
sub    $0x1,%eax
mov    %eax,-0x8(%rbp)
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    1155 <main+0x45>
jmp    119b <main+0x8b>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
test   %eax,%eax
jle    113c <main+0x2c>
mov    %eax,%ebx
nopl   0x0(%rax)
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
add    $0xffffffff,%ebx
jne    1130 <main+0x20>
xor    %eax,%eax
pop    %rbx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i32
%4 = alloca i32
store i32 0, i32* %1
%5 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %5, i32* %2
%6 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %6, i32* %3
%7 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %7, i32* %4
%8 = load i32, i32* %4
%9 = icmp sgt i32 %8, 0
br i1 %9, label %10, label %28
10: ; preds = %0
store i32 0, i32* %2
store i32 1, i32* %3
br label %11
11: ; preds = %24, %10
%12 = load i32, i32* %3
%13 = load i32, i32* %4
%14 = icmp sle i32 %12, %13
br i1 %14, label %15, label %27
15: ; preds = %11
%16 = call i32 (...) @__VERIFIER_nondet_int()
%17 = icmp ne i32 %16, 0
br i1 %17, label %18, label %21
18: ; preds = %15
%19 = load i32, i32* %2
%20 = add nsw i32 %19, 1
store i32 %20, i32* %2
br label %24
21: ; preds = %15
%22 = load i32, i32* %2
%23 = sub nsw i32 %22, 1
store i32 %23, i32* %2
br label %24
24: ; preds = %21, %18
%25 = load i32, i32* %3
%26 = add nsw i32 %25, 1
store i32 %26, i32* %3
br label %11
27: ; preds = %11
br label %28
28: ; preds = %27, %0
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32 (...) @__VERIFIER_nondet_int()
%2 = tail call i32 (...) @__VERIFIER_nondet_int()
%3 = tail call i32 (...) @__VERIFIER_nondet_int()
%4 = icmp slt i32 %3, 1
br i1 %4, label %10, label %5
5: ; preds = %0, %5
%6 = phi i32 [ %8, %5 ], [ 1, %0 ]
%7 = tail call i32 (...) @__VERIFIER_nondet_int()
%8 = add nuw i32 %6, 1
%9 = icmp eq i32 %6, %3
br i1 %9, label %10, label %5
10: ; preds = %5, %0
ret i32 0
}