#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
    struct T *prev;
    int data;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  x = malloc(sizeof(struct T));
  x->next = x;
  x->prev = x;
  x->data = 0;
  while (__nondet()) {
    y = malloc(sizeof(struct T));
    y->next = x->next;
    y->next->prev = y;
    y->prev = x;
    y->data = 0;
    x->next = y;
    y = NULL;
  }
  y = x->next;
  while (y != x) {
    struct T *z = y;
    y = y->next;
    free(z);
  }
  free(x);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x10(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x10(%rbp),%rax
movl   $0x0,0x10(%rax)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     11ea <main+0xba>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rcx,0x8(%rax)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
movl   $0x0,0x10(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,(%rax)
movq   $0x0,-0x18(%rbp)
jmp    117f <main+0x4f>
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
cmp    -0x10(%rbp),%rax
je     1224 <main+0xf4>
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
jmp    11f5 <main+0xc5>
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
mov    %rax,(%rax)
mov    %rax,0x8(%rax)
movl   $0x0,0x10(%rax)
nop
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     1180 <main+0x50>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    (%r14),%rcx
mov    %rcx,(%rax)
mov    %rax,0x8(%rcx)
mov    %r14,0x8(%rax)
movl   $0x0,0x10(%rax)
mov    %rax,(%r14)
jmp    1150 <main+0x20>
mov    (%r14),%rdi
cmp    %r14,%rdi
je     11a0 <main+0x70>
nopl   0x0(%rax,%rax,1)
mov    (%rdi),%rbx
call   1030 <free@plt>
mov    %rbx,%rdi
cmp    %r14,%rbx
jne    1190 <main+0x60>
mov    %r14,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
%5 = call %struct.T.0* @malloc(i32 24)
%6 = bitcast %struct.T.0* %5 to %struct.T*
store %struct.T* %6, %struct.T** %2
%7 = load %struct.T*, %struct.T** %2
%8 = load %struct.T*, %struct.T** %2
%9 = getelementptr inbounds %struct.T, %struct.T* %8, i32 0, i32 0
store %struct.T* %7, %struct.T** %9
%10 = load %struct.T*, %struct.T** %2
%11 = load %struct.T*, %struct.T** %2
%12 = getelementptr inbounds %struct.T, %struct.T* %11, i32 0, i32 1
store %struct.T* %10, %struct.T** %12
%13 = load %struct.T*, %struct.T** %2
%14 = getelementptr inbounds %struct.T, %struct.T* %13, i32 0, i32 2
store i32 0, i32* %14
br label %15
15: ; preds = %18, %0
%16 = call i64 (...) @__nondet()
%17 = icmp ne i64 %16, 0
br i1 %17, label %18, label %39
18: ; preds = %15
%19 = call %struct.T.0* @malloc(i32 24)
%20 = bitcast %struct.T.0* %19 to %struct.T*
store %struct.T* %20, %struct.T** %3
%21 = load %struct.T*, %struct.T** %2
%22 = getelementptr inbounds %struct.T, %struct.T* %21, i32 0, i32 0
%23 = load %struct.T*, %struct.T** %22
%24 = load %struct.T*, %struct.T** %3
%25 = getelementptr inbounds %struct.T, %struct.T* %24, i32 0, i32 0
store %struct.T* %23, %struct.T** %25
%26 = load %struct.T*, %struct.T** %3
%27 = load %struct.T*, %struct.T** %3
%28 = getelementptr inbounds %struct.T, %struct.T* %27, i32 0, i32 0
%29 = load %struct.T*, %struct.T** %28
%30 = getelementptr inbounds %struct.T, %struct.T* %29, i32 0, i32 1
store %struct.T* %26, %struct.T** %30
%31 = load %struct.T*, %struct.T** %2
%32 = load %struct.T*, %struct.T** %3
%33 = getelementptr inbounds %struct.T, %struct.T* %32, i32 0, i32 1
store %struct.T* %31, %struct.T** %33
%34 = load %struct.T*, %struct.T** %3
%35 = getelementptr inbounds %struct.T, %struct.T* %34, i32 0, i32 2
store i32 0, i32* %35
%36 = load %struct.T*, %struct.T** %3
%37 = load %struct.T*, %struct.T** %2
%38 = getelementptr inbounds %struct.T, %struct.T* %37, i32 0, i32 0
store %struct.T* %36, %struct.T** %38
store %struct.T* null, %struct.T** %3
br label %15
39: ; preds = %15
%40 = load %struct.T*, %struct.T** %2
%41 = getelementptr inbounds %struct.T, %struct.T* %40, i32 0, i32 0
%42 = load %struct.T*, %struct.T** %41
store %struct.T* %42, %struct.T** %3
br label %43
43: ; preds = %47, %39
%44 = load %struct.T*, %struct.T** %3
%45 = load %struct.T*, %struct.T** %2
%46 = icmp ne %struct.T* %44, %45
br i1 %46, label %47, label %55
47: ; preds = %43
%48 = load %struct.T*, %struct.T** %3
store %struct.T* %48, %struct.T** %4
%49 = load %struct.T*, %struct.T** %3
%50 = getelementptr inbounds %struct.T, %struct.T* %49, i32 0, i32 0
%51 = load %struct.T*, %struct.T** %50
store %struct.T* %51, %struct.T** %3
%52 = load %struct.T*, %struct.T** %4
%53 = bitcast %struct.T* %52 to %struct.T.1*
%54 = call i32 @free(%struct.T.1* %53)
br label %43
55: ; preds = %43
%56 = load %struct.T*, %struct.T** %2
%57 = bitcast %struct.T* %56 to %struct.T.1*
%58 = call i32 @free(%struct.T.1* %57)
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call %struct.T.0* @malloc(i32 24)
%2 = bitcast %struct.T.0* %1 to %struct.T*
%3 = bitcast %struct.T.0* %1 to %struct.T**
%4 = bitcast %struct.T.0* %1 to %struct.T.0**
store %struct.T.0* %1, %struct.T.0** %4
%5 = getelementptr inbounds %struct.T, %struct.T* %2, i64 0, i32 1
%6 = bitcast %struct.T** %5 to %struct.T.0**
store %struct.T.0* %1, %struct.T.0** %6
%7 = getelementptr inbounds %struct.T, %struct.T* %2, i64 0, i32 2
store i32 0, i32* %7
%8 = tail call i64 (...) @__nondet()
%9 = icmp eq i64 %8, 0
br i1 %9, label %22, label %10
10: ; preds = %0, %10
%11 = tail call %struct.T.0* @malloc(i32 24)
%12 = bitcast %struct.T.0* %11 to %struct.T*
%13 = load %struct.T*, %struct.T** %3
%14 = bitcast %struct.T.0* %11 to %struct.T**
store %struct.T* %13, %struct.T** %14
%15 = getelementptr inbounds %struct.T, %struct.T* %13, i64 0, i32 1
%16 = bitcast %struct.T** %15 to %struct.T.0**
store %struct.T.0* %11, %struct.T.0** %16
%17 = getelementptr inbounds %struct.T, %struct.T* %12, i64 0, i32 1
%18 = bitcast %struct.T** %17 to %struct.T.0**
store %struct.T.0* %1, %struct.T.0** %18
%19 = getelementptr inbounds %struct.T, %struct.T* %12, i64 0, i32 2
store i32 0, i32* %19
store %struct.T.0* %11, %struct.T.0** %4
%20 = tail call i64 (...) @__nondet()
%21 = icmp eq i64 %20, 0
br i1 %21, label %22, label %10
22: ; preds = %10, %0
%23 = load %struct.T*, %struct.T** %3
%24 = icmp eq %struct.T* %23, %2
br i1 %24, label %32, label %25
25: ; preds = %22, %25
%26 = phi %struct.T* [ %28, %25 ], [ %23, %22 ]
%27 = getelementptr inbounds %struct.T, %struct.T* %26, i64 0, i32 0
%28 = load %struct.T*, %struct.T** %27
%29 = bitcast %struct.T* %26 to %struct.T.1*
%30 = tail call i32 @free(%struct.T.1* %29)
%31 = icmp eq %struct.T* %28, %2
br i1 %31, label %32, label %25
32: ; preds = %25, %22
%33 = bitcast %struct.T.0* %1 to %struct.T.1*
%34 = tail call i32 @free(%struct.T.1* %33)
ret i32 0
}