#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ __CRAB_assert(int);
scalar_t__ malloc(int);
scalar_t__ nd_int();
int main() {
  volatile int *a = (int *)malloc(sizeof(int));
  volatile int *p, *q;
  if (nd_int()) {
    p = a;
  } else {
    q = a;
  }
  if (nd_int()) {
    *p = 5;
  } else {
    *q = 10;
  }
  __CRAB_assert(*a < 5);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    $0x0,%al
call   1050 <nd_int@plt>
cmp    $0x0,%rax
je     116b <main+0x3b>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
jmp    1173 <main+0x43>
mov    -0x10(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    $0x0,%al
call   1050 <nd_int@plt>
cmp    $0x0,%rax
je     1193 <main+0x63>
mov    -0x18(%rbp),%rax
movl   $0x5,(%rax)
jmp    119d <main+0x6d>
mov    -0x20(%rbp),%rax
movl   $0xa,(%rax)
mov    -0x10(%rbp),%rax
mov    (%rax),%eax
cmp    $0x5,%eax
setl   %al
and    $0x1,%al
movzbl %al,%edi
call   1030 <__CRAB_assert@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,%rbx
xor    %eax,%eax
call   1050 <nd_int@plt>
xor    %eax,%eax
call   1050 <nd_int@plt>
xor    %ecx,%ecx
test   %rax,%rax
sete   %cl
lea    (%rcx,%rcx,4),%eax
add    $0x5,%eax
mov    %eax,(%rbx)
mov    (%rbx),%eax
xor    %edi,%edi
cmp    $0x5,%eax
setl   %dil
call   1030 <__CRAB_assert@plt>
xor    %eax,%eax
pop    %rbx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32*
%4 = alloca i32*
store i32 0, i32* %1
%5 = call i64 @malloc(i32 4)
%6 = inttoptr i64 %5 to i32*
store i32* %6, i32** %2
%7 = call i64 (...) @nd_int()
%8 = icmp ne i64 %7, 0
br i1 %8, label %9, label %11
9: ; preds = %0
%10 = load i32*, i32** %2
store i32* %10, i32** %3
br label %13
11: ; preds = %0
%12 = load i32*, i32** %2
store i32* %12, i32** %4
br label %13
13: ; preds = %11, %9
%14 = call i64 (...) @nd_int()
%15 = icmp ne i64 %14, 0
br i1 %15, label %16, label %18
16: ; preds = %13
%17 = load i32*, i32** %3
store volatile i32 5, i32* %17
br label %20
18: ; preds = %13
%19 = load i32*, i32** %4
store volatile i32 10, i32* %19
br label %20
20: ; preds = %18, %16
%21 = load i32*, i32** %2
%22 = load volatile i32, i32* %21
%23 = icmp slt i32 %22, 5
%24 = zext i1 %23 to i32
%25 = call i32 @__CRAB_assert(i32 %24)
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i64 @malloc(i32 4)
%2 = inttoptr i64 %1 to i32*
%3 = tail call i64 (...) @nd_int()
%4 = tail call i64 (...) @nd_int()
%5 = icmp eq i64 %4, 0
%6 = select i1 %5, i32 10, i32 5
store volatile i32 %6, i32* %2
%7 = load volatile i32, i32* %2
%8 = icmp slt i32 %7, 5
%9 = zext i1 %8 to i32
%10 = tail call i32 @__CRAB_assert(i32 %9)
ret i32 0
}