#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int random_unsigned_value();
int /*<<< orphan*/ sink(char *);
int /*<<< orphan*/ strncat(char *, char *, int);
void test_strncat_range(void) {
  char buf[5] = "";
  (strncat(
       (buf),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (0)),
   sink((buf)));
  (strncat(
       (buf),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (1)),
   sink((buf)));
  (strncat(
       (buf),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (2)),
   sink((buf)));
  (strncat(
       (buf),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (3)),
   sink((buf)));
  (strncat(
       (buf),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (4)),
   sink((buf)));
  (strncat(
       (buf + 5),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (0)),
   sink((buf + 5)));
  (strncat(
       (buf + 5),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (1)),
   sink((buf + 5)));
  (strncat(
       (buf + 5),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (1)),
   sink((buf + 5)));
  (strncat(
       (buf),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (5)),
   sink((buf)));
  (strncat(
       (buf),
       ((0 == random_unsigned_value() ? "0123456789" + 10 - 0 : "0123456789")),
       (6)),
   sink((buf)));
  (strncat(
       (buf),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (0)),
   sink((buf)));
  (strncat(
       (buf),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (1)),
   sink((buf)));
  (strncat(
       (buf),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (2)),
   sink((buf)));
  (strncat(
       (buf),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (3)),
   sink((buf)));
  (strncat(
       (buf),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (4)),
   sink((buf)));
  (strncat(
       (buf),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (5)),
   sink((buf)));
  (strncat(
       (buf),
       ((1 == random_unsigned_value() ? "0123456789" + 10 - 1 : "0123456789")),
       (6)),
   sink((buf)));
  (strncat(
       (buf),
       ((2 == random_unsigned_value() ? "0123456789" + 10 - 2 : "0123456789")),
       (6)),
   sink((buf)));
  (strncat(
       (buf),
       ((5 == random_unsigned_value() ? "0123456789" + 10 - 5 : "0123456789")),
       (6)),
   sink((buf)));
  (strncat(
       (buf),
       ((7 == random_unsigned_value() ? "0123456789" + 10 - 7 : "0123456789")),
       (6)),
   sink((buf)));
  {
    char buf2[5] = "12";
    (strncat((buf2),
             ((4 == random_unsigned_value() ? "0123456789" + 10 - 4
                                            : "0123456789")),
             (4)),
     sink((buf2)));
  }
}


x86 assembly (clang, -O0):
<test_strncat_range>:
push   %rbp
mov    %rsp,%rbp
sub    $0xc0,%rsp
lea    -0x5(%rbp),%rdi
xor    %esi,%esi
mov    $0x5,%edx
call   1030 <memset@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0xb8(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0xb8(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xe81(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
xor    %edx,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0xb0(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0xb0(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xe40(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x1,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0xa8(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0xa8(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xdfc(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x2,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0xa0(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0xa0(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xdb8(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x3,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x98(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x98(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xd74(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x4,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
add    $0x5,%rax
mov    %rax,-0x90(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x90(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xd2c(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
xor    %edx,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
add    $0x5,%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
add    $0x5,%rax
mov    %rax,-0x88(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x88(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xce3(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x1,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
add    $0x5,%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
add    $0x5,%rax
mov    %rax,-0x80(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x80(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xc9a(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x1,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
add    $0x5,%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x78(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x78(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xc58(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x5,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x70(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x70(%rbp),%rdi
mov    %eax,%edx
xor    %ecx,%ecx
lea    0xc1a(%rip),%rsi
mov    %rsi,%rax
add    $0xa,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x6,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x68(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x68(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xbd9(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
xor    %edx,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x60(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x60(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xb9b(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x1,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x58(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x58(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xb5a(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x2,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x50(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xb19(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x3,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x48(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xad8(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x4,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x40(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xa97(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x5,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x38(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x38(%rbp),%rdi
mov    %eax,%edx
mov    $0x1,%ecx
lea    0xa56(%rip),%rsi
mov    %rsi,%rax
add    $0x9,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x6,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x30(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x30(%rbp),%rdi
mov    %eax,%edx
mov    $0x2,%ecx
lea    0xa15(%rip),%rsi
mov    %rsi,%rax
add    $0x8,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x6,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x28(%rbp),%rdi
mov    %eax,%edx
mov    $0x5,%ecx
lea    0x9d4(%rip),%rsi
mov    %rsi,%rax
add    $0x5,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x6,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
lea    -0x5(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x20(%rbp),%rdi
mov    %eax,%edx
mov    $0x7,%ecx
lea    0x993(%rip),%rsi
mov    %rsi,%rax
add    $0x3,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x6,%edx
call   1040 <strncat@plt>
lea    -0x5(%rbp),%rdi
call   1050 <sink@plt>
mov    0x978(%rip),%eax
mov    %eax,-0xa(%rbp)
mov    0x973(%rip),%al
mov    %al,-0x6(%rbp)
lea    -0xa(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    $0x0,%al
call   1060 <random_unsigned_value@plt>
mov    -0x18(%rbp),%rdi
mov    %eax,%edx
mov    $0x4,%ecx
lea    0x940(%rip),%rsi
mov    %rsi,%rax
add    $0x6,%rax
cmp    %edx,%ecx
cmove  %rax,%rsi
mov    $0x4,%edx
call   1040 <strncat@plt>
lea    -0xa(%rbp),%rdi
call   1050 <sink@plt>
add    $0xc0,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_strncat_range>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x10,%rsp
movb   $0x0,0x4(%rsp)
movl   $0x0,(%rsp)
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
lea    0xeb1(%rip),%rbx
lea    0xea0(%rip),%r13
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %rsp,%r14
mov    %r14,%rdi
xor    %edx,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %r14,%rdi
mov    $0x1,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %r14,%rdi
mov    $0x2,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %r14,%rdi
mov    $0x3,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %r14,%rdi
mov    $0x4,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
lea    0x5(%rsp),%r12
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %r12,%rdi
xor    %edx,%edx
call   1030 <strncat@plt>
mov    %r12,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %r12,%rdi
mov    $0x1,%edx
call   1030 <strncat@plt>
mov    %r12,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
lea    0xd9c(%rip),%r15
mov    %r13,%rsi
cmove  %r15,%rsi
mov    %r12,%rdi
mov    $0x1,%edx
call   1030 <strncat@plt>
mov    %r12,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
mov    %r13,%rsi
cmove  %rbx,%rsi
mov    %r14,%rdi
mov    $0x5,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
test   %eax,%eax
cmovne %r13,%rbx
mov    %r14,%rdi
mov    %rbx,%rsi
mov    $0x6,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
mov    %r13,%rsi
cmove  %r15,%rsi
mov    %r14,%rdi
xor    %edx,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
mov    %r13,%rsi
cmove  %r15,%rsi
mov    %r14,%rdi
mov    $0x1,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
mov    %r13,%rsi
cmove  %r15,%rsi
mov    %r14,%rdi
mov    $0x2,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
mov    %r13,%rsi
cmove  %r15,%rsi
mov    %r14,%rdi
mov    $0x3,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
mov    %r13,%rsi
cmove  %r15,%rsi
mov    %r14,%rdi
mov    $0x4,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
mov    %r13,%rsi
cmove  %r15,%rsi
mov    %r14,%rdi
mov    $0x5,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x1,%eax
cmovne %r13,%r15
mov    %r14,%rdi
mov    %r15,%rsi
mov    $0x6,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x2,%eax
lea    0xc1d(%rip),%rsi
cmovne %r13,%rsi
mov    %r14,%rdi
mov    $0x6,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x5,%eax
lea    0xbf0(%rip),%rsi
cmovne %r13,%rsi
mov    %r14,%rdi
mov    $0x6,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x7,%eax
lea    0xbc4(%rip),%rsi
cmovne %r13,%rsi
mov    %r14,%rdi
mov    $0x6,%edx
call   1030 <strncat@plt>
mov    %r14,%rdi
call   1040 <sink@plt>
movb   $0x0,0xc(%rsp)
movl   $0x3231,0x8(%rsp)
xor    %eax,%eax
call   1050 <random_unsigned_value@plt>
cmp    $0x4,%eax
lea    0xb90(%rip),%rsi
cmovne %r13,%rsi
lea    0x8(%rsp),%rbx
mov    %rbx,%rdi
mov    $0x4,%edx
call   1030 <strncat@plt>
mov    %rbx,%rdi
call   1040 <sink@plt>
add    $0x10,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [11 x i8] c"0123456789\00"
@__const.test_strncat_range.buf2 = [5 x i8] c"12\00\00\00"
define void @test_strncat_range() {
%1 = alloca [5 x i8]
%2 = alloca [5 x i8]
%3 = bitcast [5 x i8]* %1 to i8*
%4 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%5 = call i32 (...) @random_unsigned_value()
%6 = icmp eq i32 0, %5
%7 = zext i1 %6 to i64
%8 = select i1 %6, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%9 = call i32 @strncat(i8* %4, i8* %8, i32 0)
%10 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%11 = call i32 @sink(i8* %10)
%12 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%13 = call i32 (...) @random_unsigned_value()
%14 = icmp eq i32 0, %13
%15 = zext i1 %14 to i64
%16 = select i1 %14, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%17 = call i32 @strncat(i8* %12, i8* %16, i32 1)
%18 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%19 = call i32 @sink(i8* %18)
%20 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%21 = call i32 (...) @random_unsigned_value()
%22 = icmp eq i32 0, %21
%23 = zext i1 %22 to i64
%24 = select i1 %22, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%25 = call i32 @strncat(i8* %20, i8* %24, i32 2)
%26 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%27 = call i32 @sink(i8* %26)
%28 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%29 = call i32 (...) @random_unsigned_value()
%30 = icmp eq i32 0, %29
%31 = zext i1 %30 to i64
%32 = select i1 %30, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%33 = call i32 @strncat(i8* %28, i8* %32, i32 3)
%34 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%35 = call i32 @sink(i8* %34)
%36 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%37 = call i32 (...) @random_unsigned_value()
%38 = icmp eq i32 0, %37
%39 = zext i1 %38 to i64
%40 = select i1 %38, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%41 = call i32 @strncat(i8* %36, i8* %40, i32 4)
%42 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%43 = call i32 @sink(i8* %42)
%44 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%45 = getelementptr inbounds i8, i8* %44, i64 5
%46 = call i32 (...) @random_unsigned_value()
%47 = icmp eq i32 0, %46
%48 = zext i1 %47 to i64
%49 = select i1 %47, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%50 = call i32 @strncat(i8* %45, i8* %49, i32 0)
%51 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%52 = getelementptr inbounds i8, i8* %51, i64 5
%53 = call i32 @sink(i8* %52)
%54 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%55 = getelementptr inbounds i8, i8* %54, i64 5
%56 = call i32 (...) @random_unsigned_value()
%57 = icmp eq i32 0, %56
%58 = zext i1 %57 to i64
%59 = select i1 %57, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%60 = call i32 @strncat(i8* %55, i8* %59, i32 1)
%61 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%62 = getelementptr inbounds i8, i8* %61, i64 5
%63 = call i32 @sink(i8* %62)
%64 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%65 = getelementptr inbounds i8, i8* %64, i64 5
%66 = call i32 (...) @random_unsigned_value()
%67 = icmp eq i32 1, %66
%68 = zext i1 %67 to i64
%69 = select i1 %67, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%70 = call i32 @strncat(i8* %65, i8* %69, i32 1)
%71 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%72 = getelementptr inbounds i8, i8* %71, i64 5
%73 = call i32 @sink(i8* %72)
%74 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%75 = call i32 (...) @random_unsigned_value()
%76 = icmp eq i32 0, %75
%77 = zext i1 %76 to i64
%78 = select i1 %76, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%79 = call i32 @strncat(i8* %74, i8* %78, i32 5)
%80 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%81 = call i32 @sink(i8* %80)
%82 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%83 = call i32 (...) @random_unsigned_value()
%84 = icmp eq i32 0, %83
%85 = zext i1 %84 to i64
%86 = select i1 %84, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%87 = call i32 @strncat(i8* %82, i8* %86, i32 6)
%88 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%89 = call i32 @sink(i8* %88)
%90 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%91 = call i32 (...) @random_unsigned_value()
%92 = icmp eq i32 1, %91
%93 = zext i1 %92 to i64
%94 = select i1 %92, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%95 = call i32 @strncat(i8* %90, i8* %94, i32 0)
%96 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%97 = call i32 @sink(i8* %96)
%98 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%99 = call i32 (...) @random_unsigned_value()
%100 = icmp eq i32 1, %99
%101 = zext i1 %100 to i64
%102 = select i1 %100, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%103 = call i32 @strncat(i8* %98, i8* %102, i32 1)
%104 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%105 = call i32 @sink(i8* %104)
%106 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%107 = call i32 (...) @random_unsigned_value()
%108 = icmp eq i32 1, %107
%109 = zext i1 %108 to i64
%110 = select i1 %108, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%111 = call i32 @strncat(i8* %106, i8* %110, i32 2)
%112 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%113 = call i32 @sink(i8* %112)
%114 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%115 = call i32 (...) @random_unsigned_value()
%116 = icmp eq i32 1, %115
%117 = zext i1 %116 to i64
%118 = select i1 %116, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%119 = call i32 @strncat(i8* %114, i8* %118, i32 3)
%120 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%121 = call i32 @sink(i8* %120)
%122 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%123 = call i32 (...) @random_unsigned_value()
%124 = icmp eq i32 1, %123
%125 = zext i1 %124 to i64
%126 = select i1 %124, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%127 = call i32 @strncat(i8* %122, i8* %126, i32 4)
%128 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%129 = call i32 @sink(i8* %128)
%130 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%131 = call i32 (...) @random_unsigned_value()
%132 = icmp eq i32 1, %131
%133 = zext i1 %132 to i64
%134 = select i1 %132, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%135 = call i32 @strncat(i8* %130, i8* %134, i32 5)
%136 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%137 = call i32 @sink(i8* %136)
%138 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%139 = call i32 (...) @random_unsigned_value()
%140 = icmp eq i32 1, %139
%141 = zext i1 %140 to i64
%142 = select i1 %140, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%143 = call i32 @strncat(i8* %138, i8* %142, i32 6)
%144 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%145 = call i32 @sink(i8* %144)
%146 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%147 = call i32 (...) @random_unsigned_value()
%148 = icmp eq i32 2, %147
%149 = zext i1 %148 to i64
%150 = select i1 %148, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 8), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%151 = call i32 @strncat(i8* %146, i8* %150, i32 6)
%152 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%153 = call i32 @sink(i8* %152)
%154 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%155 = call i32 (...) @random_unsigned_value()
%156 = icmp eq i32 5, %155
%157 = zext i1 %156 to i64
%158 = select i1 %156, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 5), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%159 = call i32 @strncat(i8* %154, i8* %158, i32 6)
%160 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%161 = call i32 @sink(i8* %160)
%162 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%163 = call i32 (...) @random_unsigned_value()
%164 = icmp eq i32 7, %163
%165 = zext i1 %164 to i64
%166 = select i1 %164, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 3), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%167 = call i32 @strncat(i8* %162, i8* %166, i32 6)
%168 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%169 = call i32 @sink(i8* %168)
%170 = bitcast [5 x i8]* %2 to i8*
%171 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 0
%172 = call i32 (...) @random_unsigned_value()
%173 = icmp eq i32 4, %172
%174 = zext i1 %173 to i64
%175 = select i1 %173, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 6), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%176 = call i32 @strncat(i8* %171, i8* %175, i32 4)
%177 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 0
%178 = call i32 @sink(i8* %177)
ret void
}

LLVM IR (-O2):
@.str = [11 x i8] c"0123456789\00"
@__const.test_strncat_range.buf2 = [5 x i8] c"12\00\00\00"
define void @test_strncat_range() {
%1 = alloca [5 x i8]
%2 = alloca [5 x i8]
%3 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 0
%4 = tail call i32 (...) @random_unsigned_value()
%5 = icmp eq i32 %4, 0
%6 = select i1 %5, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%7 = call i32 @strncat(i8* %3, i8* %6, i32 0)
%8 = call i32 @sink(i8* %3)
%9 = call i32 (...) @random_unsigned_value()
%10 = icmp eq i32 %9, 0
%11 = select i1 %10, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%12 = call i32 @strncat(i8* %3, i8* %11, i32 1)
%13 = call i32 @sink(i8* %3)
%14 = call i32 (...) @random_unsigned_value()
%15 = icmp eq i32 %14, 0
%16 = select i1 %15, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%17 = call i32 @strncat(i8* %3, i8* %16, i32 2)
%18 = call i32 @sink(i8* %3)
%19 = call i32 (...) @random_unsigned_value()
%20 = icmp eq i32 %19, 0
%21 = select i1 %20, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%22 = call i32 @strncat(i8* %3, i8* %21, i32 3)
%23 = call i32 @sink(i8* %3)
%24 = call i32 (...) @random_unsigned_value()
%25 = icmp eq i32 %24, 0
%26 = select i1 %25, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%27 = call i32 @strncat(i8* %3, i8* %26, i32 4)
%28 = call i32 @sink(i8* %3)
%29 = getelementptr inbounds [5 x i8], [5 x i8]* %1, i64 0, i64 5
%30 = call i32 (...) @random_unsigned_value()
%31 = icmp eq i32 %30, 0
%32 = select i1 %31, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%33 = call i32 @strncat(i8* %29, i8* %32, i32 0)
%34 = call i32 @sink(i8* %29)
%35 = call i32 (...) @random_unsigned_value()
%36 = icmp eq i32 %35, 0
%37 = select i1 %36, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%38 = call i32 @strncat(i8* %29, i8* %37, i32 1)
%39 = call i32 @sink(i8* %29)
%40 = call i32 (...) @random_unsigned_value()
%41 = icmp eq i32 %40, 1
%42 = select i1 %41, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%43 = call i32 @strncat(i8* %29, i8* %42, i32 1)
%44 = call i32 @sink(i8* %29)
%45 = call i32 (...) @random_unsigned_value()
%46 = icmp eq i32 %45, 0
%47 = select i1 %46, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%48 = call i32 @strncat(i8* %3, i8* %47, i32 5)
%49 = call i32 @sink(i8* %3)
%50 = call i32 (...) @random_unsigned_value()
%51 = icmp eq i32 %50, 0
%52 = select i1 %51, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 10), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%53 = call i32 @strncat(i8* %3, i8* %52, i32 6)
%54 = call i32 @sink(i8* %3)
%55 = call i32 (...) @random_unsigned_value()
%56 = icmp eq i32 %55, 1
%57 = select i1 %56, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%58 = call i32 @strncat(i8* %3, i8* %57, i32 0)
%59 = call i32 @sink(i8* %3)
%60 = call i32 (...) @random_unsigned_value()
%61 = icmp eq i32 %60, 1
%62 = select i1 %61, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%63 = call i32 @strncat(i8* %3, i8* %62, i32 1)
%64 = call i32 @sink(i8* %3)
%65 = call i32 (...) @random_unsigned_value()
%66 = icmp eq i32 %65, 1
%67 = select i1 %66, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%68 = call i32 @strncat(i8* %3, i8* %67, i32 2)
%69 = call i32 @sink(i8* %3)
%70 = call i32 (...) @random_unsigned_value()
%71 = icmp eq i32 %70, 1
%72 = select i1 %71, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%73 = call i32 @strncat(i8* %3, i8* %72, i32 3)
%74 = call i32 @sink(i8* %3)
%75 = call i32 (...) @random_unsigned_value()
%76 = icmp eq i32 %75, 1
%77 = select i1 %76, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%78 = call i32 @strncat(i8* %3, i8* %77, i32 4)
%79 = call i32 @sink(i8* %3)
%80 = call i32 (...) @random_unsigned_value()
%81 = icmp eq i32 %80, 1
%82 = select i1 %81, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%83 = call i32 @strncat(i8* %3, i8* %82, i32 5)
%84 = call i32 @sink(i8* %3)
%85 = call i32 (...) @random_unsigned_value()
%86 = icmp eq i32 %85, 1
%87 = select i1 %86, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 9), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%88 = call i32 @strncat(i8* %3, i8* %87, i32 6)
%89 = call i32 @sink(i8* %3)
%90 = call i32 (...) @random_unsigned_value()
%91 = icmp eq i32 %90, 2
%92 = select i1 %91, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 8), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%93 = call i32 @strncat(i8* %3, i8* %92, i32 6)
%94 = call i32 @sink(i8* %3)
%95 = call i32 (...) @random_unsigned_value()
%96 = icmp eq i32 %95, 5
%97 = select i1 %96, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 5), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%98 = call i32 @strncat(i8* %3, i8* %97, i32 6)
%99 = call i32 @sink(i8* %3)
%100 = call i32 (...) @random_unsigned_value()
%101 = icmp eq i32 %100, 7
%102 = select i1 %101, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 3), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%103 = call i32 @strncat(i8* %3, i8* %102, i32 6)
%104 = call i32 @sink(i8* %3)
%105 = getelementptr inbounds [5 x i8], [5 x i8]* %2, i64 0, i64 0
%106 = call i32 (...) @random_unsigned_value()
%107 = icmp eq i32 %106, 4
%108 = select i1 %107, i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 6), i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str, i64 0, i64 0)
%109 = call i32 @strncat(i8* %105, i8* %108, i32 4)
%110 = call i32 @sink(i8* %105)
ret void
}