#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct dm_pool {
  int dummy;
};

/* Variables and functions */
char *dm_pool_alloc(struct dm_pool *, int);
struct dm_pool *dm_pool_create(char *, int);
int /*<<< orphan*/ dm_pool_destroy(struct dm_pool *);
int /*<<< orphan*/ dm_pool_free(struct dm_pool *, char *);
int /*<<< orphan*/ printf(char *);
void check_free() {
  int i;
  char *blocks[10];
  struct dm_pool *p = dm_pool_create("blah", 1024);
  for (i = 0; i < 10; i++)
    blocks[i] = dm_pool_alloc(p, 37);
  blocks[10 - 1][0] = 'E';
  if (blocks[10 - 1][0] == 'E')
    printf("first branch worked (as expected)\n");
  dm_pool_free(p, blocks[5]);
  if (blocks[10 - 1][0] == 'E')
    printf("second branch worked (valgrind should have flagged this as an "
           "error)\n");
  dm_pool_destroy(p);
}


x86 assembly (clang, -O0):
<check_free>:
push   %rbp
mov    %rsp,%rbp
sub    $0x70,%rsp
lea    0xea1(%rip),%rdi
mov    $0x400,%esi
call   1050 <dm_pool_create@plt>
mov    %rax,-0x68(%rbp)
movl   $0x0,-0x4(%rbp)
cmpl   $0xa,-0x4(%rbp)
jge    11a6 <check_free+0x56>
mov    -0x68(%rbp),%rdi
mov    $0x25,%esi
call   1030 <dm_pool_alloc@plt>
mov    %rax,%rcx
movslq -0x4(%rbp),%rax
mov    %rcx,-0x60(%rbp,%rax,8)
mov    -0x4(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x4(%rbp)
jmp    1174 <check_free+0x24>
mov    -0x18(%rbp),%rax
movb   $0x45,(%rax)
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x45,%eax
jne    11c9 <check_free+0x79>
lea    0xe41(%rip),%rdi
call   1040 <printf@plt>
mov    -0x68(%rbp),%rdi
mov    -0x38(%rbp),%rsi
call   1070 <dm_pool_free@plt>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x45,%eax
jne    11f2 <check_free+0xa2>
lea    0xe3b(%rip),%rdi
call   1040 <printf@plt>
mov    -0x68(%rbp),%rdi
call   1060 <dm_pool_destroy@plt>
add    $0x70,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<check_free>:
push   %r15
push   %r14
push   %rbx
lea    0xea4(%rip),%rdi
mov    $0x400,%esi
call   1050 <dm_pool_create@plt>
mov    %rax,%rbx
mov    %rax,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rax,%r14
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rbx,%rdi
mov    $0x25,%esi
call   1040 <dm_pool_alloc@plt>
mov    %rax,%r15
movb   $0x45,(%rax)
lea    0xe4f(%rip),%rdi
call   1030 <puts@plt>
mov    %rbx,%rdi
mov    %r14,%rsi
call   1070 <dm_pool_free@plt>
cmpb   $0x45,(%r15)
jne    121d <check_free+0xcd>
lea    0xded(%rip),%rdi
call   1030 <puts@plt>
mov    %rbx,%rdi
pop    %rbx
pop    %r14
pop    %r15
jmp    1060 <dm_pool_destroy@plt>

LLVM IR (-O0):
%struct.dm_pool = type { i32 }
@.str = [5 x i8] c"blah\00"
@.str.1 = [35 x i8] c"first branch worked (as expected)\0A\00"
@.str.2 = [70 x i8] c"second branch worked (valgrind should have flagged this as an error)\0A\00"
define void @check_free() {
%1 = alloca i32
%2 = alloca [10 x i8*]
%3 = alloca %struct.dm_pool*
%4 = call %struct.dm_pool* @dm_pool_create(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 1024)
store %struct.dm_pool* %4, %struct.dm_pool** %3
store i32 0, i32* %1
br label %5
5: ; preds = %14, %0
%6 = load i32, i32* %1
%7 = icmp slt i32 %6, 10
br i1 %7, label %8, label %17
8: ; preds = %5
%9 = load %struct.dm_pool*, %struct.dm_pool** %3
%10 = call i8* @dm_pool_alloc(%struct.dm_pool* %9, i32 37)
%11 = load i32, i32* %1
%12 = sext i32 %11 to i64
%13 = getelementptr inbounds [10 x i8*], [10 x i8*]* %2, i64 0, i64 %12
store i8* %10, i8** %13
br label %14
14: ; preds = %8
%15 = load i32, i32* %1
%16 = add nsw i32 %15, 1
store i32 %16, i32* %1
br label %5
17: ; preds = %5
%18 = getelementptr inbounds [10 x i8*], [10 x i8*]* %2, i64 0, i64 9
%19 = load i8*, i8** %18
%20 = getelementptr inbounds i8, i8* %19, i64 0
store i8 69, i8* %20
%21 = getelementptr inbounds [10 x i8*], [10 x i8*]* %2, i64 0, i64 9
%22 = load i8*, i8** %21
%23 = getelementptr inbounds i8, i8* %22, i64 0
%24 = load i8, i8* %23
%25 = sext i8 %24 to i32
%26 = icmp eq i32 %25, 69
br i1 %26, label %27, label %29
27: ; preds = %17
%28 = call i32 @printf(i8* getelementptr inbounds ([35 x i8], [35 x i8]* @.str.1, i64 0, i64 0))
br label %29
29: ; preds = %27, %17
%30 = load %struct.dm_pool*, %struct.dm_pool** %3
%31 = getelementptr inbounds [10 x i8*], [10 x i8*]* %2, i64 0, i64 5
%32 = load i8*, i8** %31
%33 = call i32 @dm_pool_free(%struct.dm_pool* %30, i8* %32)
%34 = getelementptr inbounds [10 x i8*], [10 x i8*]* %2, i64 0, i64 9
%35 = load i8*, i8** %34
%36 = getelementptr inbounds i8, i8* %35, i64 0
%37 = load i8, i8* %36
%38 = sext i8 %37 to i32
%39 = icmp eq i32 %38, 69
br i1 %39, label %40, label %42
40: ; preds = %29
%41 = call i32 @printf(i8* getelementptr inbounds ([70 x i8], [70 x i8]* @.str.2, i64 0, i64 0))
br label %42
42: ; preds = %40, %29
%43 = load %struct.dm_pool*, %struct.dm_pool** %3
%44 = call i32 @dm_pool_destroy(%struct.dm_pool* %43)
ret void
}

LLVM IR (-O2):
%struct.dm_pool = type { i32 }
@.str = [5 x i8] c"blah\00"
@str = [69 x i8] c"second branch worked (valgrind should have flagged this as an error)\00"
@str.3 = [34 x i8] c"first branch worked (as expected)\00"
define void @check_free() {
%1 = tail call %struct.dm_pool* @dm_pool_create(i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 1024)
%2 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%3 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%4 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%5 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%6 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%7 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%8 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%9 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%10 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
%11 = tail call i8* @dm_pool_alloc(%struct.dm_pool* %1, i32 37)
store i8 69, i8* %11
%12 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([34 x i8], [34 x i8]* @str.3, i64 0, i64 0))
%13 = tail call i32 @dm_pool_free(%struct.dm_pool* %1, i8* %7)
%14 = load i8, i8* %11
%15 = icmp eq i8 %14, 69
br i1 %15, label %16, label %18
16: ; preds = %0
%17 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([69 x i8], [69 x i8]* @str, i64 0, i64 0))
br label %18
18: ; preds = %16, %0
%19 = tail call i32 @dm_pool_destroy(%struct.dm_pool* %1)
ret void
}