#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(char *);
char *malloc(unsigned int);
int /*<<< orphan*/ memset(char *, int, unsigned int);
int /*<<< orphan*/ printf(char *);
int main(int argc, char *argv[]) {
  char *dummy0;
  char *dummy1;
  char *fill_info_table1;
  char *over_top;
  unsigned int over_top_size = 0x3000;
  char *over_top_dup;
  unsigned int over_top_dup_size = 0x7000;
  char *x;
  unsigned int i;
  dummy0 = malloc(0x3fa000);
  dummy1 = malloc(0x3fa000);
  fill_info_table1 = malloc(0x3000);
  x = malloc(0x1000);
  free(x);
  over_top = malloc(over_top_size);
  over_top_dup = malloc(over_top_dup_size);
  memset(over_top, 0, over_top_size);
  memset(over_top_dup, 1, over_top_dup_size);
  for (i = 0; i < over_top_size; ++i)
    if (over_top[i] != 0) {
      printf("FAIL: malloc expands info table\n");
      return 0;
    }
  for (i = 0; i < over_top_dup_size; ++i)
    if (over_top_dup[i] != 1) {
      printf("FAIL: malloc expands info table\n");
      return 0;
    }
  printf("PASS: malloc expands info table\n");
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
movl   $0x3000,-0x34(%rbp)
movl   $0x7000,-0x44(%rbp)
mov    $0x3fa000,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    $0x3fa000,%edi
call   1060 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    $0x3000,%edi
call   1060 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    $0x1000,%edi
call   1060 <malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x34(%rbp),%edi
call   1060 <malloc@plt>
mov    %rax,-0x30(%rbp)
mov    -0x44(%rbp),%edi
call   1060 <malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x30(%rbp),%rdi
mov    -0x34(%rbp),%edx
xor    %esi,%esi
call   1050 <memset@plt>
mov    -0x40(%rbp),%rdi
mov    -0x44(%rbp),%edx
mov    $0x1,%esi
call   1050 <memset@plt>
movl   $0x0,-0x54(%rbp)
mov    -0x54(%rbp),%eax
cmp    -0x34(%rbp),%eax
jae    122e <main+0xee>
mov    -0x30(%rbp),%rax
mov    -0x54(%rbp),%ecx
movsbl (%rax,%rcx,1),%eax
cmp    $0x0,%eax
je     121b <main+0xdb>
lea    0xdf6(%rip),%rdi
call   1040 <printf@plt>
movl   $0x0,-0x4(%rbp)
jmp    1293 <main+0x153>
jmp    1220 <main+0xe0>
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    11e3 <main+0xa3>
movl   $0x0,-0x54(%rbp)
mov    -0x54(%rbp),%eax
cmp    -0x44(%rbp),%eax
jae    1280 <main+0x140>
mov    -0x40(%rbp),%rax
mov    -0x54(%rbp),%ecx
movsbl (%rax,%rcx,1),%eax
cmp    $0x1,%eax
je     126d <main+0x12d>
lea    0xda4(%rip),%rdi
call   1040 <printf@plt>
movl   $0x0,-0x4(%rbp)
jmp    1293 <main+0x153>
jmp    1272 <main+0x132>
mov    -0x54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x54(%rbp)
jmp    1235 <main+0xf5>
lea    0xd9a(%rip),%rdi
call   1040 <printf@plt>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    $0x1000,%edi
call   1060 <malloc@plt>
mov    %rax,%rdi
call   1030 <free@plt>
mov    $0x3000,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x7000,%edi
call   1060 <malloc@plt>
mov    %rax,%r14
mov    %rbx,%rdi
xor    %esi,%esi
mov    $0x3000,%edx
call   1050 <memset@plt>
mov    %r14,%rdi
mov    $0x1,%esi
mov    $0x7000,%edx
call   1050 <memset@plt>
mov    $0x5,%eax
lea    0xe83(%rip),%rdi
nopl   (%rax)
cmpb   $0x0,-0x5(%rbx,%rax,1)
jne    121f <main+0xdf>
cmpb   $0x0,-0x4(%rbx,%rax,1)
jne    121f <main+0xdf>
cmpb   $0x0,-0x3(%rbx,%rax,1)
jne    121f <main+0xdf>
cmpb   $0x0,-0x2(%rbx,%rax,1)
jne    121f <main+0xdf>
cmpb   $0x0,-0x1(%rbx,%rax,1)
jne    121f <main+0xdf>
cmpb   $0x0,(%rbx,%rax,1)
jne    121f <main+0xdf>
add    $0x6,%rax
cmp    $0x3005,%rax
jne    11a0 <main+0x60>
mov    $0x3,%ecx
lea    0xe1f(%rip),%rax
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
cmpb   $0x1,-0x3(%r14,%rcx,1)
jne    121f <main+0xdf>
cmpb   $0x1,-0x2(%r14,%rcx,1)
jne    121f <main+0xdf>
cmpb   $0x1,-0x1(%r14,%rcx,1)
jne    121f <main+0xdf>
cmpb   $0x1,(%r14,%rcx,1)
jne    121f <main+0xdf>
add    $0x4,%rcx
cmp    $0x7003,%rcx
jne    11f0 <main+0xb0>
mov    %rax,%rdi
call   1040 <puts@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [33 x i8] c"FAIL: malloc expands info table\0A\00"
@.str.1 = [33 x i8] c"PASS: malloc expands info table\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i8*
%12 = alloca i32
%13 = alloca i8*
%14 = alloca i32
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
store i32 12288, i32* %10
store i32 28672, i32* %12
%15 = call i8* @malloc(i32 4169728)
store i8* %15, i8** %6
%16 = call i8* @malloc(i32 4169728)
store i8* %16, i8** %7
%17 = call i8* @malloc(i32 12288)
store i8* %17, i8** %8
%18 = call i8* @malloc(i32 4096)
store i8* %18, i8** %13
%19 = load i8*, i8** %13
%20 = call i32 @free(i8* %19)
%21 = load i32, i32* %10
%22 = call i8* @malloc(i32 %21)
store i8* %22, i8** %9
%23 = load i32, i32* %12
%24 = call i8* @malloc(i32 %23)
store i8* %24, i8** %11
%25 = load i8*, i8** %9
%26 = load i32, i32* %10
%27 = call i32 @memset(i8* %25, i32 0, i32 %26)
%28 = load i8*, i8** %11
%29 = load i32, i32* %12
%30 = call i32 @memset(i8* %28, i32 1, i32 %29)
store i32 0, i32* %14
br label %31
31: ; preds = %46, %2
%32 = load i32, i32* %14
%33 = load i32, i32* %10
%34 = icmp ult i32 %32, %33
br i1 %34, label %35, label %49
35: ; preds = %31
%36 = load i8*, i8** %9
%37 = load i32, i32* %14
%38 = zext i32 %37 to i64
%39 = getelementptr inbounds i8, i8* %36, i64 %38
%40 = load i8, i8* %39
%41 = sext i8 %40 to i32
%42 = icmp ne i32 %41, 0
br i1 %42, label %43, label %45
43: ; preds = %35
%44 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str, i64 0, i64 0))
store i32 0, i32* %3
br label %70
45: ; preds = %35
br label %46
46: ; preds = %45
%47 = load i32, i32* %14
%48 = add i32 %47, 1
store i32 %48, i32* %14
br label %31
49: ; preds = %31
store i32 0, i32* %14
br label %50
50: ; preds = %65, %49
%51 = load i32, i32* %14
%52 = load i32, i32* %12
%53 = icmp ult i32 %51, %52
br i1 %53, label %54, label %68
54: ; preds = %50
%55 = load i8*, i8** %11
%56 = load i32, i32* %14
%57 = zext i32 %56 to i64
%58 = getelementptr inbounds i8, i8* %55, i64 %57
%59 = load i8, i8* %58
%60 = sext i8 %59 to i32
%61 = icmp ne i32 %60, 1
br i1 %61, label %62, label %64
62: ; preds = %54
%63 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str, i64 0, i64 0))
store i32 0, i32* %3
br label %70
64: ; preds = %54
br label %65
65: ; preds = %64
%66 = load i32, i32* %14
%67 = add i32 %66, 1
store i32 %67, i32* %14
br label %50
68: ; preds = %50
%69 = call i32 @printf(i8* getelementptr inbounds ([33 x i8], [33 x i8]* @.str.1, i64 0, i64 0))
store i32 0, i32* %3
br label %70
70: ; preds = %68, %62, %43
%71 = load i32, i32* %3
ret i32 %71
}

LLVM IR (-O2):
@str = [32 x i8] c"PASS: malloc expands info table\00"
@str.3 = [32 x i8] c"FAIL: malloc expands info table\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = tail call dereferenceable_or_null(4096) i8* @malloc(i32 4096)
%4 = tail call i32 @free(i8* %3)
%5 = tail call dereferenceable_or_null(12288) i8* @malloc(i32 12288)
%6 = tail call dereferenceable_or_null(28672) i8* @malloc(i32 28672)
%7 = tail call i32 @memset(i8* %5, i32 0, i32 12288)
%8 = tail call i32 @memset(i8* %6, i32 1, i32 28672)
br label %37
9: ; preds = %37
%10 = or i64 %38, 1
%11 = getelementptr inbounds i8, i8* %5, i64 %10
%12 = load i8, i8* %11
%13 = icmp eq i8 %12, 0
br i1 %13, label %14, label %65
14: ; preds = %9
%15 = add nuw nsw i64 %38, 2
%16 = getelementptr inbounds i8, i8* %5, i64 %15
%17 = load i8, i8* %16
%18 = icmp eq i8 %17, 0
br i1 %18, label %19, label %65
19: ; preds = %14
%20 = add nuw nsw i64 %38, 3
%21 = getelementptr inbounds i8, i8* %5, i64 %20
%22 = load i8, i8* %21
%23 = icmp eq i8 %22, 0
br i1 %23, label %24, label %65
24: ; preds = %19
%25 = add nuw nsw i64 %38, 4
%26 = getelementptr inbounds i8, i8* %5, i64 %25
%27 = load i8, i8* %26
%28 = icmp eq i8 %27, 0
br i1 %28, label %29, label %65
29: ; preds = %24
%30 = add nuw nsw i64 %38, 5
%31 = getelementptr inbounds i8, i8* %5, i64 %30
%32 = load i8, i8* %31
%33 = icmp eq i8 %32, 0
br i1 %33, label %34, label %65
34: ; preds = %29
%35 = add nuw nsw i64 %38, 6
%36 = icmp eq i64 %35, 12288
br i1 %36, label %60, label %37
37: ; preds = %34, %2
%38 = phi i64 [ 0, %2 ], [ %35, %34 ]
%39 = getelementptr inbounds i8, i8* %5, i64 %38
%40 = load i8, i8* %39
%41 = icmp eq i8 %40, 0
br i1 %41, label %9, label %65
42: ; preds = %60
%43 = or i64 %61, 1
%44 = getelementptr inbounds i8, i8* %6, i64 %43
%45 = load i8, i8* %44
%46 = icmp eq i8 %45, 1
br i1 %46, label %47, label %65
47: ; preds = %42
%48 = or i64 %61, 2
%49 = getelementptr inbounds i8, i8* %6, i64 %48
%50 = load i8, i8* %49
%51 = icmp eq i8 %50, 1
br i1 %51, label %52, label %65
52: ; preds = %47
%53 = or i64 %61, 3
%54 = getelementptr inbounds i8, i8* %6, i64 %53
%55 = load i8, i8* %54
%56 = icmp eq i8 %55, 1
br i1 %56, label %57, label %65
57: ; preds = %52
%58 = add nuw nsw i64 %61, 4
%59 = icmp eq i64 %58, 28672
br i1 %59, label %65, label %60
60: ; preds = %34, %57
%61 = phi i64 [ %58, %57 ], [ 0, %34 ]
%62 = getelementptr inbounds i8, i8* %6, i64 %61
%63 = load i8, i8* %62
%64 = icmp eq i8 %63, 1
br i1 %64, label %42, label %65
65: ; preds = %37, %9, %14, %19, %24, %29, %60, %42, %47, %52, %57
%66 = phi i8* [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %60 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %42 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %47 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %52 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str, i64 0, i64 0), %57 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %29 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %24 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %19 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %14 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %9 ], [ getelementptr inbounds ([32 x i8], [32 x i8]* @str.3, i64 0, i64 0), %37 ]
%67 = tail call i32 @puts(i8* dereferenceable(1) %66)
ret i32 0
}