#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int __VERIFIER_nondet_int();
int main() {
  int x, y, z, n;
  x = __VERIFIER_nondet_int();
  y = __VERIFIER_nondet_int();
  z = __VERIFIER_nondet_int();
  n = __VERIFIER_nondet_int();
  while (x + y >= 0 && x <= n) {
    x = 2 * x + y;
    y = z;
    z = z;
    z = z + 1;
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x8(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %eax,-0xc(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x10(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x14(%rbp)
mov    -0x8(%rbp),%ecx
add    -0xc(%rbp),%ecx
xor    %eax,%eax
cmp    $0x0,%ecx
mov    %al,-0x15(%rbp)
jl     1167 <main+0x57>
mov    -0x8(%rbp),%eax
cmp    -0x14(%rbp),%eax
setle  %al
mov    %al,-0x15(%rbp)
mov    -0x15(%rbp),%al
test   $0x1,%al
jne    1177 <main+0x67>
jmp    119d <main+0x8d>
mov    -0x8(%rbp),%eax
shl    $0x1,%eax
add    -0xc(%rbp),%eax
mov    %eax,-0x8(%rbp)
mov    -0x10(%rbp),%eax
mov    %eax,-0xc(%rbp)
mov    -0x10(%rbp),%eax
mov    %eax,-0x10(%rbp)
mov    -0x10(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x10(%rbp)
jmp    1147 <main+0x37>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rax
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
xor    %eax,%eax
pop    %rcx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
store i32 0, i32* %1
%6 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %6, i32* %2
%7 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %7, i32* %3
%8 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %8, i32* %4
%9 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %9, i32* %5
br label %10
10: ; preds = %21, %0
%11 = load i32, i32* %2
%12 = load i32, i32* %3
%13 = add nsw i32 %11, %12
%14 = icmp sge i32 %13, 0
br i1 %14, label %15, label %19
15: ; preds = %10
%16 = load i32, i32* %2
%17 = load i32, i32* %5
%18 = icmp sle i32 %16, %17
br label %19
19: ; preds = %15, %10
%20 = phi i1 [ false, %10 ], [ %18, %15 ]
br i1 %20, label %21, label %30
21: ; preds = %19
%22 = load i32, i32* %2
%23 = mul nsw i32 2, %22
%24 = load i32, i32* %3
%25 = add nsw i32 %23, %24
store i32 %25, i32* %2
%26 = load i32, i32* %4
store i32 %26, i32* %3
%27 = load i32, i32* %4
store i32 %27, i32* %4
%28 = load i32, i32* %4
%29 = add nsw i32 %28, 1
store i32 %29, i32* %4
br label %10
30: ; preds = %19
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32 (...) @__VERIFIER_nondet_int()
%2 = tail call i32 (...) @__VERIFIER_nondet_int()
%3 = tail call i32 (...) @__VERIFIER_nondet_int()
%4 = tail call i32 (...) @__VERIFIER_nondet_int()
ret i32 0
}