#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int __VERIFIER_nondet_int();
int /*<<< orphan*/ free(int *);
int *malloc(int);
int main() {
  int i = __VERIFIER_nondet_int();
  if (i == 0) {
    int *j = 0;
    *j = 6;
  } else if (i == 1) {
    int *a;
    int *b;
    a = malloc(8);
    b = malloc(8);
    a = b;
    free(a);
  } else if (i == 2) {
    int *a;
    int size = sizeof(int);
    a = malloc(size);
    *a = 5;
  } else if (i == 3) {
    int *ptr;
    free(ptr);
  } else if (i == 4) {
    int *a;
    int *b;
    b = malloc(8);
    a = b;
    free(b);
    free(a);
  }
  return (0);
ERROR:
  return (-1);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x8(%rbp)
cmpl   $0x0,-0x8(%rbp)
jne    116a <main+0x3a>
movq   $0x0,-0x10(%rbp)
mov    -0x10(%rbp),%rax
movl   $0x6,(%rax)
jmp    1230 <main+0x100>
cmpl   $0x1,-0x8(%rbp)
jne    11a6 <main+0x76>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    122b <main+0xfb>
cmpl   $0x2,-0x8(%rbp)
jne    11d2 <main+0xa2>
movl   $0x4,-0x2c(%rbp)
mov    -0x2c(%rbp),%edi
call   1050 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
movl   $0x5,(%rax)
jmp    1226 <main+0xf6>
cmpl   $0x3,-0x8(%rbp)
jne    11ea <main+0xba>
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
jmp    1221 <main+0xf1>
cmpl   $0x4,-0x8(%rbp)
jne    121c <main+0xec>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x48(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,-0x40(%rbp)
mov    -0x48(%rbp),%rdi
call   1030 <free@plt>
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
jmp    1221 <main+0xf1>
jmp    1226 <main+0xf6>
jmp    122b <main+0xfb>
jmp    1230 <main+0x100>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
add    $0xffffffff,%eax
cmp    $0x3,%eax
ja     119a <main+0x6a>
lea    0xeb9(%rip),%rcx
movslq (%rcx,%rax,4),%rax
add    %rcx,%rax
jmp    *%rax
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,%rdi
jmp    1195 <main+0x65>
mov    $0x4,%edi
call   1050 <malloc@plt>
movl   $0x5,(%rax)
jmp    119a <main+0x6a>
jmp    1195 <main+0x65>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
call   1030 <free@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xor    %eax,%eax
pop    %rbx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i32*
%4 = alloca i32*
%5 = alloca i32*
%6 = alloca i32*
%7 = alloca i32
%8 = alloca i32*
%9 = alloca i32*
%10 = alloca i32*
store i32 0, i32* %1
%11 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %11, i32* %2
%12 = load i32, i32* %2
%13 = icmp eq i32 %12, 0
br i1 %13, label %14, label %16
14: ; preds = %0
store i32* null, i32** %3
%15 = load i32*, i32** %3
store i32 6, i32* %15
br label %52
16: ; preds = %0
%17 = load i32, i32* %2
%18 = icmp eq i32 %17, 1
br i1 %18, label %19, label %25
19: ; preds = %16
%20 = call i32* @malloc(i32 8)
store i32* %20, i32** %4
%21 = call i32* @malloc(i32 8)
store i32* %21, i32** %5
%22 = load i32*, i32** %5
store i32* %22, i32** %4
%23 = load i32*, i32** %4
%24 = call i32 @free(i32* %23)
br label %51
25: ; preds = %16
%26 = load i32, i32* %2
%27 = icmp eq i32 %26, 2
br i1 %27, label %28, label %32
28: ; preds = %25
store i32 4, i32* %7
%29 = load i32, i32* %7
%30 = call i32* @malloc(i32 %29)
store i32* %30, i32** %6
%31 = load i32*, i32** %6
store i32 5, i32* %31
br label %50
32: ; preds = %25
%33 = load i32, i32* %2
%34 = icmp eq i32 %33, 3
br i1 %34, label %35, label %38
35: ; preds = %32
%36 = load i32*, i32** %8
%37 = call i32 @free(i32* %36)
br label %49
38: ; preds = %32
%39 = load i32, i32* %2
%40 = icmp eq i32 %39, 4
br i1 %40, label %41, label %48
41: ; preds = %38
%42 = call i32* @malloc(i32 8)
store i32* %42, i32** %10
%43 = load i32*, i32** %10
store i32* %43, i32** %9
%44 = load i32*, i32** %10
%45 = call i32 @free(i32* %44)
%46 = load i32*, i32** %9
%47 = call i32 @free(i32* %46)
br label %48
48: ; preds = %41, %38
br label %49
49: ; preds = %48, %35
br label %50
50: ; preds = %49, %28
br label %51
51: ; preds = %50, %19
br label %52
52: ; preds = %51, %14
store i32 0, i32* %1
br label %54
53: ; No predecessors!
store i32 -1, i32* %1
br label %54
54: ; preds = %53, %52
%55 = load i32, i32* %1
ret i32 %55
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32 (...) @__VERIFIER_nondet_int()
%2 = icmp ne i32 %1, 0
tail call void @llvm.assume(i1 %2)
switch i32 %1, label %15 [
i32 1, label %3
i32 2, label %7
i32 3, label %9
i32 4, label %11
]
3: ; preds = %0
%4 = tail call i32* @malloc(i32 8)
%5 = tail call i32* @malloc(i32 8)
%6 = tail call i32 @free(i32* %5)
br label %15
7: ; preds = %0
%8 = tail call i32* @malloc(i32 4)
store i32 5, i32* %8
br label %15
9: ; preds = %0
%10 = tail call i32 @free(i32* undef)
br label %15
11: ; preds = %0
%12 = tail call i32* @malloc(i32 8)
%13 = tail call i32 @free(i32* %12)
%14 = tail call i32 @free(i32* %12)
br label %15
15: ; preds = %0, %3, %9, %11, %7
ret i32 0
}