#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(void *);
void *malloc(int);
int /*<<< orphan*/ memset(void *, int /*<<< orphan*/, int);
int /*<<< orphan*/ printf(char *, int);
int random();
int /*<<< orphan*/ srandom(int);
void test1(void) {
  void **ptrs;
  int i, j;
  int size;
  srandom(0x19730929);
  ptrs = malloc(1000 * sizeof(void *));
  for (i = 0; i < 1000; i++) {
    ptrs[i] = malloc((random() % 0x10000));
  }
  for (i = 0; i < 10000; i++) {
    j = (random() % 1000);
    free(ptrs[j]);
    size = (random() % 0x10000);
    ptrs[j] = malloc(size);
    if (!ptrs[j]) {
      printf("malloc failed! %d\n", i);
    }
    memset(ptrs[j], 0, size);
  }
  for (i = 0; i < 1000; i++) {
    free(ptrs[i]);
  }
}


x86 assembly (clang, -O0):
<test1>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    $0x19730929,%edi
call   1040 <srandom@plt>
mov    $0x1f40,%edi
call   1080 <malloc@plt>
mov    %rax,-0x8(%rbp)
movl   $0x0,-0xc(%rbp)
cmpl   $0x3e8,-0xc(%rbp)
jge    11c7 <test1+0x67>
mov    $0x0,%al
call   1070 <random@plt>
mov    $0x10000,%ecx
cltd
idiv   %ecx
mov    %edx,%edi
call   1080 <malloc@plt>
mov    %rax,%rdx
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    1187 <test1+0x27>
movl   $0x0,-0xc(%rbp)
cmpl   $0x2710,-0xc(%rbp)
jge    126d <test1+0x10d>
mov    $0x0,%al
call   1070 <random@plt>
mov    $0x3e8,%ecx
cltd
idiv   %ecx
mov    %edx,-0x10(%rbp)
mov    -0x8(%rbp),%rax
movslq -0x10(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
call   1030 <free@plt>
mov    $0x0,%al
call   1070 <random@plt>
mov    $0x10000,%ecx
cltd
idiv   %ecx
mov    %edx,-0x14(%rbp)
mov    -0x14(%rbp),%edi
call   1080 <malloc@plt>
mov    %rax,%rdx
mov    -0x8(%rbp),%rax
movslq -0x10(%rbp),%rcx
mov    %rdx,(%rax,%rcx,8)
mov    -0x8(%rbp),%rax
movslq -0x10(%rbp),%rcx
cmpq   $0x0,(%rax,%rcx,8)
jne    1249 <test1+0xe9>
mov    -0xc(%rbp),%esi
lea    0xdbc(%rip),%rdi
call   1050 <printf@plt>
mov    -0x8(%rbp),%rax
movslq -0x10(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
mov    -0x14(%rbp),%edx
xor    %esi,%esi
call   1060 <memset@plt>
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    11ce <test1+0x6e>
movl   $0x0,-0xc(%rbp)
cmpl   $0x3e8,-0xc(%rbp)
jge    12a0 <test1+0x140>
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
call   1030 <free@plt>
mov    -0xc(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0xc(%rbp)
jmp    1274 <test1+0x114>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test1>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    $0x19730929,%edi
call   1040 <srandom@plt>
mov    $0x1f40,%edi
call   1080 <malloc@plt>
mov    %rax,%r15
xor    %ebx,%ebx
cs nopw 0x0(%rax,%rax,1)
xchg   %ax,%ax
xor    %eax,%eax
call   1070 <random@plt>
lea    0xffff(%rax),%ecx
test   %eax,%eax
cmovns %eax,%ecx
and    $0xffff0000,%ecx
sub    %ecx,%eax
mov    %eax,%edi
call   1080 <malloc@plt>
mov    %rax,(%r15,%rbx,8)
add    $0x1,%rbx
cmp    $0x3e8,%rbx
jne    1190 <test1+0x30>
lea    0xe37(%rip),%r14
xor    %r12d,%r12d
jmp    11e9 <test1+0x89>
xchg   %ax,%ax
mov    %rbp,%rdi
xor    %esi,%esi
mov    %ebx,%edx
call   1060 <memset@plt>
add    $0x1,%r12d
cmp    $0x2710,%r12d
je     1258 <test1+0xf8>
xor    %eax,%eax
call   1070 <random@plt>
cltq
imul   $0x10624dd3,%rax,%rcx
mov    %rcx,%rdx
shr    $0x3f,%rdx
sar    $0x26,%rcx
add    %edx,%ecx
imul   $0x3e8,%ecx,%ecx
sub    %ecx,%eax
movslq %eax,%r13
mov    (%r15,%r13,8),%rdi
call   1030 <free@plt>
xor    %eax,%eax
call   1070 <random@plt>
mov    %eax,%ebx
lea    0xffff(%rbx),%eax
test   %ebx,%ebx
cmovns %ebx,%eax
and    $0xffff0000,%eax
sub    %eax,%ebx
mov    %ebx,%edi
call   1080 <malloc@plt>
mov    %rax,%rbp
mov    %rax,(%r15,%r13,8)
test   %rax,%rax
jne    11d0 <test1+0x70>
mov    %r14,%rdi
mov    %r12d,%esi
call   1050 <printf@plt>
jmp    11d0 <test1+0x70>
xor    %ebx,%ebx
nopw   0x0(%rax,%rax,1)
mov    (%r15,%rbx,8),%rdi
call   1030 <free@plt>
add    $0x1,%rbx
cmp    $0x3e8,%rbx
jne    1260 <test1+0x100>
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [19 x i8] c"malloc failed! %d\0A\00"
define void @test1() {
%1 = alloca i8**
%2 = alloca i32
%3 = alloca i32
%4 = alloca i32
%5 = call i32 @srandom(i32 426969385)
%6 = call i8* @malloc(i32 8000)
%7 = bitcast i8* %6 to i8**
store i8** %7, i8*** %1
store i32 0, i32* %2
br label %8
8: ; preds = %19, %0
%9 = load i32, i32* %2
%10 = icmp slt i32 %9, 1000
br i1 %10, label %11, label %22
11: ; preds = %8
%12 = call i32 (...) @random()
%13 = srem i32 %12, 65536
%14 = call i8* @malloc(i32 %13)
%15 = load i8**, i8*** %1
%16 = load i32, i32* %2
%17 = sext i32 %16 to i64
%18 = getelementptr inbounds i8*, i8** %15, i64 %17
store i8* %14, i8** %18
br label %19
19: ; preds = %11
%20 = load i32, i32* %2
%21 = add nsw i32 %20, 1
store i32 %21, i32* %2
br label %8
22: ; preds = %8
store i32 0, i32* %2
br label %23
23: ; preds = %60, %22
%24 = load i32, i32* %2
%25 = icmp slt i32 %24, 10000
br i1 %25, label %26, label %63
26: ; preds = %23
%27 = call i32 (...) @random()
%28 = srem i32 %27, 1000
store i32 %28, i32* %3
%29 = load i8**, i8*** %1
%30 = load i32, i32* %3
%31 = sext i32 %30 to i64
%32 = getelementptr inbounds i8*, i8** %29, i64 %31
%33 = load i8*, i8** %32
%34 = call i32 @free(i8* %33)
%35 = call i32 (...) @random()
%36 = srem i32 %35, 65536
store i32 %36, i32* %4
%37 = load i32, i32* %4
%38 = call i8* @malloc(i32 %37)
%39 = load i8**, i8*** %1
%40 = load i32, i32* %3
%41 = sext i32 %40 to i64
%42 = getelementptr inbounds i8*, i8** %39, i64 %41
store i8* %38, i8** %42
%43 = load i8**, i8*** %1
%44 = load i32, i32* %3
%45 = sext i32 %44 to i64
%46 = getelementptr inbounds i8*, i8** %43, i64 %45
%47 = load i8*, i8** %46
%48 = icmp ne i8* %47, null
br i1 %48, label %52, label %49
49: ; preds = %26
%50 = load i32, i32* %2
%51 = call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i32 %50)
br label %52
52: ; preds = %49, %26
%53 = load i8**, i8*** %1
%54 = load i32, i32* %3
%55 = sext i32 %54 to i64
%56 = getelementptr inbounds i8*, i8** %53, i64 %55
%57 = load i8*, i8** %56
%58 = load i32, i32* %4
%59 = call i32 @memset(i8* %57, i32 0, i32 %58)
br label %60
60: ; preds = %52
%61 = load i32, i32* %2
%62 = add nsw i32 %61, 1
store i32 %62, i32* %2
br label %23
63: ; preds = %23
store i32 0, i32* %2
br label %64
64: ; preds = %74, %63
%65 = load i32, i32* %2
%66 = icmp slt i32 %65, 1000
br i1 %66, label %67, label %77
67: ; preds = %64
%68 = load i8**, i8*** %1
%69 = load i32, i32* %2
%70 = sext i32 %69 to i64
%71 = getelementptr inbounds i8*, i8** %68, i64 %70
%72 = load i8*, i8** %71
%73 = call i32 @free(i8* %72)
br label %74
74: ; preds = %67
%75 = load i32, i32* %2
%76 = add nsw i32 %75, 1
store i32 %76, i32* %2
br label %64
77: ; preds = %64
ret void
}

LLVM IR (-O2):
@.str = [19 x i8] c"malloc failed! %d\0A\00"
define void @test1() {
%1 = tail call i32 @srandom(i32 426969385)
%2 = tail call dereferenceable_or_null(8000) i8* @malloc(i32 8000)
%3 = bitcast i8* %2 to i8**
br label %4
4: ; preds = %0, %4
%5 = phi i64 [ 0, %0 ], [ %10, %4 ]
%6 = tail call i32 (...) @random()
%7 = srem i32 %6, 65536
%8 = tail call i8* @malloc(i32 %7)
%9 = getelementptr inbounds i8*, i8** %3, i64 %5
store i8* %8, i8** %9
%10 = add nuw nsw i64 %5, 1
%11 = icmp eq i64 %10, 1000
br i1 %11, label %12, label %4
12: ; preds = %4, %26
%13 = phi i32 [ %28, %26 ], [ 0, %4 ]
%14 = tail call i32 (...) @random()
%15 = srem i32 %14, 1000
%16 = sext i32 %15 to i64
%17 = getelementptr inbounds i8*, i8** %3, i64 %16
%18 = load i8*, i8** %17
%19 = tail call i32 @free(i8* %18)
%20 = tail call i32 (...) @random()
%21 = srem i32 %20, 65536
%22 = tail call i8* @malloc(i32 %21)
store i8* %22, i8** %17
%23 = icmp eq i8* %22, null
br i1 %23, label %24, label %26
24: ; preds = %12
%25 = tail call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i32 %13)
br label %26
26: ; preds = %24, %12
%27 = tail call i32 @memset(i8* %22, i32 0, i32 %21)
%28 = add nuw nsw i32 %13, 1
%29 = icmp eq i32 %28, 10000
br i1 %29, label %30, label %12
30: ; preds = %26, %30
%31 = phi i64 [ %35, %30 ], [ 0, %26 ]
%32 = getelementptr inbounds i8*, i8** %3, i64 %31
%33 = load i8*, i8** %32
%34 = tail call i32 @free(i8* %33)
%35 = add nuw nsw i64 %31, 1
%36 = icmp eq i64 %35, 1000
br i1 %36, label %37, label %30
37: ; preds = %30
ret void
}