#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  while (__nondet()) {
    y = malloc(sizeof(*y));
    y->next = x;
    x = y;
  }
  if (!x)
    return 0;
  struct T *pred, *succ;
  bool sorted = false;
  while (!sorted) {
    sorted = true;
    y = x;
    pred = NULL;
    while (y && y->next) {
      if (__nondet()) {
        succ = y->next;
        if (pred)
          pred->next = succ;
        else
          x = succ;
        y->next = succ->next;
        succ->next = y;
        sorted = false;
      }
      pred = y;
      y = y->next;
    }
  }
  while (x != NULL) {
    y = x;
    x = x->next;
    free(y);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     1186 <main+0x56>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    114f <main+0x1f>
cmpq   $0x0,-0x10(%rbp)
jne    119d <main+0x6d>
movl   $0x0,-0x4(%rbp)
jmp    12b3 <main+0x183>
movl   $0x0,-0x2c(%rbp)
cmpl   $0x0,-0x2c(%rbp)
setne  %al
xor    $0xff,%al
test   $0x1,%al
jne    11ba <main+0x8a>
jmp    127b <main+0x14b>
movl   $0x1,-0x2c(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
movq   $0x0,-0x20(%rbp)
xor    %eax,%eax
cmpq   $0x0,-0x18(%rbp)
mov    %al,-0x2d(%rbp)
je     11ef <main+0xbf>
mov    -0x18(%rbp),%rax
cmpq   $0x0,(%rax)
setne  %al
mov    %al,-0x2d(%rbp)
mov    -0x2d(%rbp),%al
test   $0x1,%al
jne    11ff <main+0xcf>
jmp    1276 <main+0x146>
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     125e <main+0x12e>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x28(%rbp)
cmpq   $0x0,-0x20(%rbp)
je     1236 <main+0x106>
mov    -0x28(%rbp),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
jmp    123e <main+0x10e>
mov    -0x28(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x28(%rbp),%rax
mov    (%rax),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
movl   $0x0,-0x2c(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    11d1 <main+0xa1>
jmp    11a4 <main+0x74>
jmp    1280 <main+0x150>
cmpq   $0x0,-0x10(%rbp)
je     12ac <main+0x17c>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    1280 <main+0x150>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     1203 <main+0xd3>
xor    %ebx,%ebx
nopl   0x0(%rax)
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
mov    %rbx,(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r14,%rbx
test   %rax,%rax
jne    1150 <main+0x20>
jmp    1185 <main+0x55>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
test   %r15d,%r15d
jne    11e3 <main+0xb3>
test   %r14,%r14
je     1203 <main+0xd3>
mov    $0x1,%r15d
xor    %ebp,%ebp
mov    %r14,%rbx
jmp    11bd <main+0x8d>
nopw   0x0(%rax,%rax,1)
mov    (%rax),%rdx
mov    %rdx,(%rbx)
mov    %rbx,(%rax)
xor    %r15d,%r15d
mov    %rcx,%r14
mov    %rbx,%rbp
mov    (%rbx),%rax
mov    %rax,%rbx
test   %rax,%rax
je     1180 <main+0x50>
cmpq   $0x0,(%rbx)
je     1180 <main+0x50>
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     11af <main+0x7f>
mov    (%rbx),%rax
mov    %rax,%rcx
test   %rbp,%rbp
je     11a0 <main+0x70>
mov    %rax,0x0(%rbp)
mov    %r14,%rcx
jmp    11a0 <main+0x70>
test   %r14,%r14
je     1203 <main+0xd3>
nopl   0x0(%rax,%rax,1)
mov    (%r14),%rbx
mov    %r14,%rdi
call   1030 <free@plt>
mov    %rbx,%r14
test   %rbx,%rbx
jne    11f0 <main+0xc0>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
%5 = alloca %struct.T*
%6 = alloca i32
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
br label %7
7: ; preds = %10, %0
%8 = call i64 (...) @__nondet()
%9 = icmp ne i64 %8, 0
br i1 %9, label %10, label %17
10: ; preds = %7
%11 = call %struct.T.0* @malloc(i32 8)
%12 = bitcast %struct.T.0* %11 to %struct.T*
store %struct.T* %12, %struct.T** %3
%13 = load %struct.T*, %struct.T** %2
%14 = load %struct.T*, %struct.T** %3
%15 = getelementptr inbounds %struct.T, %struct.T* %14, i32 0, i32 0
store %struct.T* %13, %struct.T** %15
%16 = load %struct.T*, %struct.T** %3
store %struct.T* %16, %struct.T** %2
br label %7
17: ; preds = %7
%18 = load %struct.T*, %struct.T** %2
%19 = icmp ne %struct.T* %18, null
br i1 %19, label %21, label %20
20: ; preds = %17
store i32 0, i32* %1
br label %81
21: ; preds = %17
store i32 0, i32* %6
br label %22
22: ; preds = %67, %21
%23 = load i32, i32* %6
%24 = icmp ne i32 %23, 0
%25 = xor i1 %24, true
br i1 %25, label %26, label %68
26: ; preds = %22
store i32 1, i32* %6
%27 = load %struct.T*, %struct.T** %2
store %struct.T* %27, %struct.T** %3
store %struct.T* null, %struct.T** %4
br label %28
28: ; preds = %62, %26
%29 = load %struct.T*, %struct.T** %3
%30 = icmp ne %struct.T* %29, null
br i1 %30, label %31, label %36
31: ; preds = %28
%32 = load %struct.T*, %struct.T** %3
%33 = getelementptr inbounds %struct.T, %struct.T* %32, i32 0, i32 0
%34 = load %struct.T*, %struct.T** %33
%35 = icmp ne %struct.T* %34, null
br label %36
36: ; preds = %31, %28
%37 = phi i1 [ false, %28 ], [ %35, %31 ]
br i1 %37, label %38, label %67
38: ; preds = %36
%39 = call i64 (...) @__nondet()
%40 = icmp ne i64 %39, 0
br i1 %40, label %41, label %62
41: ; preds = %38
%42 = load %struct.T*, %struct.T** %3
%43 = getelementptr inbounds %struct.T, %struct.T* %42, i32 0, i32 0
%44 = load %struct.T*, %struct.T** %43
store %struct.T* %44, %struct.T** %5
%45 = load %struct.T*, %struct.T** %4
%46 = icmp ne %struct.T* %45, null
br i1 %46, label %47, label %51
47: ; preds = %41
%48 = load %struct.T*, %struct.T** %5
%49 = load %struct.T*, %struct.T** %4
%50 = getelementptr inbounds %struct.T, %struct.T* %49, i32 0, i32 0
store %struct.T* %48, %struct.T** %50
br label %53
51: ; preds = %41
%52 = load %struct.T*, %struct.T** %5
store %struct.T* %52, %struct.T** %2
br label %53
53: ; preds = %51, %47
%54 = load %struct.T*, %struct.T** %5
%55 = getelementptr inbounds %struct.T, %struct.T* %54, i32 0, i32 0
%56 = load %struct.T*, %struct.T** %55
%57 = load %struct.T*, %struct.T** %3
%58 = getelementptr inbounds %struct.T, %struct.T* %57, i32 0, i32 0
store %struct.T* %56, %struct.T** %58
%59 = load %struct.T*, %struct.T** %3
%60 = load %struct.T*, %struct.T** %5
%61 = getelementptr inbounds %struct.T, %struct.T* %60, i32 0, i32 0
store %struct.T* %59, %struct.T** %61
store i32 0, i32* %6
br label %62
62: ; preds = %53, %38
%63 = load %struct.T*, %struct.T** %3
store %struct.T* %63, %struct.T** %4
%64 = load %struct.T*, %struct.T** %3
%65 = getelementptr inbounds %struct.T, %struct.T* %64, i32 0, i32 0
%66 = load %struct.T*, %struct.T** %65
store %struct.T* %66, %struct.T** %3
br label %28
67: ; preds = %36
br label %22
68: ; preds = %22
br label %69
69: ; preds = %72, %68
%70 = load %struct.T*, %struct.T** %2
%71 = icmp ne %struct.T* %70, null
br i1 %71, label %72, label %80
72: ; preds = %69
%73 = load %struct.T*, %struct.T** %2
store %struct.T* %73, %struct.T** %3
%74 = load %struct.T*, %struct.T** %2
%75 = getelementptr inbounds %struct.T, %struct.T* %74, i32 0, i32 0
%76 = load %struct.T*, %struct.T** %75
store %struct.T* %76, %struct.T** %2
%77 = load %struct.T*, %struct.T** %3
%78 = bitcast %struct.T* %77 to %struct.T.1*
%79 = call i32 @free(%struct.T.1* %78)
br label %69
80: ; preds = %69
store i32 0, i32* %1
br label %81
81: ; preds = %80, %20
%82 = load i32, i32* %1
ret i32 %82
}

LLVM IR (-O2):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call i64 (...) @__nondet()
%2 = icmp eq i64 %1, 0
br i1 %2, label %53, label %3
3: ; preds = %0, %3
%4 = phi %struct.T* [ %6, %3 ], [ null, %0 ]
%5 = tail call %struct.T.0* @malloc(i32 8)
%6 = bitcast %struct.T.0* %5 to %struct.T*
%7 = bitcast %struct.T.0* %5 to %struct.T**
store %struct.T* %4, %struct.T** %7
%8 = tail call i64 (...) @__nondet()
%9 = icmp eq i64 %8, 0
br i1 %9, label %10, label %3
10: ; preds = %3
%11 = bitcast %struct.T.0* %5 to %struct.T*
br label %12
12: ; preds = %10, %42
%13 = phi %struct.T* [ %43, %42 ], [ %11, %10 ]
%14 = icmp eq %struct.T* %13, null
br i1 %14, label %53, label %17
15: ; preds = %42
%16 = icmp eq %struct.T* %43, null
br i1 %16, label %53, label %46
17: ; preds = %12, %37
%18 = phi i32 [ %39, %37 ], [ 1, %12 ]
%19 = phi %struct.T* [ %20, %37 ], [ null, %12 ]
%20 = phi %struct.T* [ %40, %37 ], [ %13, %12 ]
%21 = phi %struct.T* [ %38, %37 ], [ %13, %12 ]
%22 = getelementptr inbounds %struct.T, %struct.T* %20, i64 0, i32 0
%23 = load %struct.T*, %struct.T** %22
%24 = icmp eq %struct.T* %23, null
br i1 %24, label %42, label %25
25: ; preds = %17
%26 = tail call i64 (...) @__nondet()
%27 = icmp eq i64 %26, 0
br i1 %27, label %37, label %28
28: ; preds = %25
%29 = load %struct.T*, %struct.T** %22
%30 = icmp eq %struct.T* %19, null
br i1 %30, label %33, label %31
31: ; preds = %28
%32 = getelementptr inbounds %struct.T, %struct.T* %19, i64 0, i32 0
store %struct.T* %29, %struct.T** %32
br label %33
33: ; preds = %28, %31
%34 = phi %struct.T* [ %21, %31 ], [ %29, %28 ]
%35 = getelementptr inbounds %struct.T, %struct.T* %29, i64 0, i32 0
%36 = load %struct.T*, %struct.T** %35
store %struct.T* %36, %struct.T** %22
store %struct.T* %20, %struct.T** %35
br label %37
37: ; preds = %33, %25
%38 = phi %struct.T* [ %34, %33 ], [ %21, %25 ]
%39 = phi i32 [ 0, %33 ], [ %18, %25 ]
%40 = load %struct.T*, %struct.T** %22
%41 = icmp eq %struct.T* %40, null
br i1 %41, label %42, label %17
42: ; preds = %17, %37
%43 = phi %struct.T* [ %21, %17 ], [ %38, %37 ]
%44 = phi i32 [ %18, %17 ], [ %39, %37 ]
%45 = icmp eq i32 %44, 0
br i1 %45, label %12, label %15
46: ; preds = %15, %46
%47 = phi %struct.T* [ %49, %46 ], [ %43, %15 ]
%48 = getelementptr inbounds %struct.T, %struct.T* %47, i64 0, i32 0
%49 = load %struct.T*, %struct.T** %48
%50 = bitcast %struct.T* %47 to %struct.T.1*
%51 = tail call i32 @free(%struct.T.1* %50)
%52 = icmp eq %struct.T* %49, null
br i1 %52, label %53, label %46
53: ; preds = %12, %46, %0, %15
ret i32 0
}