int main() {
  int *p;
  unsigned o;
  unsigned int n = nondet_uint();
  __ESBMC_assume(n >= 1);
  __ESBMC_assume(n < 10000000);
  p = malloc(sizeof(int) * n);
  __ESBMC_assume(p);
  o = n - 1;
  p[o] = 0;
  free(p);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    $0x0,%al
call   1050 <nondet_uint@plt>
mov    %eax,-0x10(%rbp)
cmpl   $0x1,-0x10(%rbp)
setae  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1040 <__ESBMC_assume@plt>
cmpl   $0x989680,-0x10(%rbp)
setb   %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1040 <__ESBMC_assume@plt>
mov    -0x10(%rbp),%eax
mov    %eax,%edi
shl    $0x2,%rdi
call   1060 <malloc@plt>
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rdi
mov    $0x0,%al
call   1040 <__ESBMC_assume@plt>
mov    -0x10(%rbp),%eax
sub    $0x1,%eax
mov    %eax,-0xc(%rbp)
mov    -0x8(%rbp),%rax
mov    -0xc(%rbp),%ecx
movl   $0x0,(%rax,%rcx,4)
mov    -0x8(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
xor    %eax,%eax
call   1050 <nondet_uint@plt>
mov    %eax,%ebx
xor    %edi,%edi
test   %eax,%eax
setne  %dil
xor    %eax,%eax
call   1040 <__ESBMC_assume@plt>
xor    %edi,%edi
cmp    $0x989680,%ebx
setb   %dil
xor    %eax,%eax
call   1040 <__ESBMC_assume@plt>
mov    %ebx,%edi
shl    $0x2,%rdi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
xor    %eax,%eax
call   1040 <__ESBMC_assume@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xor    %eax,%eax
pop    %rbx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32*
%2 = alloca i32
%3 = alloca i32
%4 = call i32 (...) @nondet_uint()
store i32 %4, i32* %3
%5 = load i32, i32* %3
%6 = icmp uge i32 %5, 1
%7 = zext i1 %6 to i32
%8 = call i32 (i32, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32, ...)*)(i32 %7)
%9 = load i32, i32* %3
%10 = icmp ult i32 %9, 10000000
%11 = zext i1 %10 to i32
%12 = call i32 (i32, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32, ...)*)(i32 %11)
%13 = load i32, i32* %3
%14 = zext i32 %13 to i64
%15 = mul i64 4, %14
%16 = call i8* @malloc(i64 %15)
%17 = bitcast i8* %16 to i32*
store i32* %17, i32** %1
%18 = load i32*, i32** %1
%19 = call i32 (i32*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32*, ...)*)(i32* %18)
%20 = load i32, i32* %3
%21 = sub i32 %20, 1
store i32 %21, i32* %2
%22 = load i32*, i32** %1
%23 = load i32, i32* %2
%24 = zext i32 %23 to i64
%25 = getelementptr inbounds i32, i32* %22, i64 %24
store i32 0, i32* %25
%26 = load i32*, i32** %1
%27 = bitcast i32* %26 to i8*
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32 (...) @nondet_uint()
%2 = icmp ne i32 %1, 0
%3 = zext i1 %2 to i32
%4 = tail call i32 (i32, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32, ...)*)(i32 %3)
%5 = icmp ult i32 %1, 10000000
%6 = zext i1 %5 to i32
%7 = tail call i32 (i32, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32, ...)*)(i32 %6)
%8 = zext i32 %1 to i64
%9 = shl nuw nsw i64 %8, 2
%10 = tail call i8* @malloc(i64 %9)
%11 = bitcast i8* %10 to i32*
%12 = tail call i32 (i32*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32*, ...)*)(i32* %11)
tail call void @free(i8* %10)
ret i32 0
}