void null_operand(int *a) {
start:
  clang_analyzer_eval(&&start != 0);
  clang_analyzer_eval(&&start >= 0);
  clang_analyzer_eval(&&start > 0);
  clang_analyzer_eval((&&start - 0) != 0);
  clang_analyzer_eval(&a != 0);
  clang_analyzer_eval(&a >= 0);
  clang_analyzer_eval(&a > 0);
  clang_analyzer_eval((&a - 0) != 0);
  clang_analyzer_eval(0 != &a);
  clang_analyzer_eval(0 <= &a);
  clang_analyzer_eval(0 < &a);
  clang_analyzer_eval(a != 0);
  clang_analyzer_eval(a >= 0);
  clang_analyzer_eval(a <= 0);
  clang_analyzer_eval((a - 0) != 0);
  clang_analyzer_eval(0 != a);
  clang_analyzer_eval(0 <= a);
  clang_analyzer_eval(0 < a);
}


x86 assembly (clang, -O0):
<null_operand>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    %rdi,-0x8(%rbp)
mov    $0x1,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
lea    -0x1f(%rip),%rax
test   %rax,%rax
setne  %al
movzbl %al,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
lea    -0x8(%rbp),%rax
cmp    $0x0,%rax
setne  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
lea    -0x8(%rbp),%rax
cmp    $0x0,%rax
setae  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
lea    -0x8(%rbp),%rax
cmp    $0x0,%rax
seta   %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
lea    -0x8(%rbp),%rax
cmp    $0x0,%rax
setne  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
xor    %eax,%eax
lea    -0x8(%rbp),%rcx
cmp    %rcx,%rax
setne  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
xor    %eax,%eax
lea    -0x8(%rbp),%rcx
cmp    %rcx,%rax
setbe  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
xor    %eax,%eax
lea    -0x8(%rbp),%rcx
cmp    %rcx,%rax
setb   %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
cmpq   $0x0,-0x8(%rbp)
setne  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
cmpq   $0x0,-0x8(%rbp)
setae  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
cmpq   $0x0,-0x8(%rbp)
setbe  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
mov    -0x8(%rbp),%rax
cmp    $0x0,%rax
setne  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
xor    %eax,%eax
cmp    -0x8(%rbp),%rax
setne  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
xor    %eax,%eax
cmp    -0x8(%rbp),%rax
setbe  %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
xor    %eax,%eax
cmp    -0x8(%rbp),%rax
setb   %al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1030 <clang_analyzer_eval@plt>
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<null_operand>:
push   %rbp
push   %r14
push   %rbx
mov    %rdi,%r14
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
lea    -0x26(%rip),%rax
xor    %edi,%edi
test   %rax,%rax
setne  %dil
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
xor    %ebp,%ebp
xor    %ebx,%ebx
test   %r14,%r14
setne  %bpl
sete   %bl
mov    %ebp,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    %ebx,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    %ebp,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    %ebp,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    $0x1,%edi
xor    %eax,%eax
call   1030 <clang_analyzer_eval@plt>
mov    %ebp,%edi
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %rbp
jmp    1030 <clang_analyzer_eval@plt>

LLVM IR (-O0):
define void @null_operand(i32* %0) {
%2 = alloca i32*
store i32* %0, i32** %2
br label %3
3: ; preds = %59, %59, %59, %59, %1
%4 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%5 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%6 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 zext (i1 icmp ugt (i8* blockaddress(@null_operand, %3), i8* null) to i32))
%7 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%8 = icmp ne i32** %2, null
%9 = zext i1 %8 to i32
%10 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %9)
%11 = icmp uge i32** %2, null
%12 = zext i1 %11 to i32
%13 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %12)
%14 = icmp ugt i32** %2, null
%15 = zext i1 %14 to i32
%16 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %15)
%17 = getelementptr inbounds i32*, i32** %2, i64 0
%18 = icmp ne i32** %17, null
%19 = zext i1 %18 to i32
%20 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %19)
%21 = icmp ne i32** null, %2
%22 = zext i1 %21 to i32
%23 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %22)
%24 = icmp ule i32** null, %2
%25 = zext i1 %24 to i32
%26 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %25)
%27 = icmp ult i32** null, %2
%28 = zext i1 %27 to i32
%29 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %28)
%30 = load i32*, i32** %2
%31 = icmp ne i32* %30, null
%32 = zext i1 %31 to i32
%33 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %32)
%34 = load i32*, i32** %2
%35 = icmp uge i32* %34, null
%36 = zext i1 %35 to i32
%37 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %36)
%38 = load i32*, i32** %2
%39 = icmp ule i32* %38, null
%40 = zext i1 %39 to i32
%41 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %40)
%42 = load i32*, i32** %2
%43 = getelementptr inbounds i32, i32* %42, i64 0
%44 = icmp ne i32* %43, null
%45 = zext i1 %44 to i32
%46 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %45)
%47 = load i32*, i32** %2
%48 = icmp ne i32* null, %47
%49 = zext i1 %48 to i32
%50 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %49)
%51 = load i32*, i32** %2
%52 = icmp ule i32* null, %51
%53 = zext i1 %52 to i32
%54 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %53)
%55 = load i32*, i32** %2
%56 = icmp ult i32* null, %55
%57 = zext i1 %56 to i32
%58 = call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %57)
ret void
59: ; No predecessors!
indirectbr i8* undef, [label %3, label %3, label %3, label %3]
}

LLVM IR (-O2):
define void @null_operand(i32* readnone %0) {
br label %2
2: ; preds = %1
%3 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%4 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%5 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 zext (i1 icmp ugt (i8* blockaddress(@null_operand, %2), i8* null) to i32))
%6 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%7 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%8 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%9 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%10 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%11 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%12 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%13 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%14 = icmp ne i32* %0, null
%15 = zext i1 %14 to i32
%16 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %15)
%17 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%18 = icmp eq i32* %0, null
%19 = zext i1 %18 to i32
%20 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %19)
%21 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %15)
%22 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %15)
%23 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 1)
%24 = tail call i32 (i32, ...) bitcast (i32 (...)* @clang_analyzer_eval to i32 (i32, ...)*)(i32 %15)
ret void
}