#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ do_something_then_free_ptr(int, char *);
int /*<<< orphan*/ free(char *);
scalar_t__ malloc(int);
void double_free() {
  char *p = (char *)malloc(4);
  p[0] = 'b';
  p[1] = 'e';
  p[2] = 'a';
  p[3] = 'f';
  free(p);
  do_something_then_free_ptr(2, p);
  p[0] = 'd';
  p[1] = 'e';
  p[2] = 'a';
  p[3] = 'd';
}


x86 assembly (clang, -O0):
<double_free>:
push   %rbp
mov    %rsp,%rbp
sub    $0x10,%rsp
mov    $0x4,%edi
call   1050 <malloc@plt>
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
movb   $0x62,(%rax)
mov    -0x8(%rbp),%rax
movb   $0x65,0x1(%rax)
mov    -0x8(%rbp),%rax
movb   $0x61,0x2(%rax)
mov    -0x8(%rbp),%rax
movb   $0x66,0x3(%rax)
mov    -0x8(%rbp),%rdi
call   1030 <free@plt>
mov    -0x8(%rbp),%rsi
mov    $0x2,%edi
call   1040 <do_something_then_free_ptr@plt>
mov    -0x8(%rbp),%rax
movb   $0x64,(%rax)
mov    -0x8(%rbp),%rax
movb   $0x65,0x1(%rax)
mov    -0x8(%rbp),%rax
movb   $0x61,0x2(%rax)
mov    -0x8(%rbp),%rax
movb   $0x64,0x3(%rax)
add    $0x10,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<double_free>:
push   %rbx
mov    $0x4,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
movl   $0x66616562,(%rax)
mov    %rax,%rdi
call   1030 <free@plt>
mov    $0x2,%edi
mov    %rbx,%rsi
call   1040 <do_something_then_free_ptr@plt>
movl   $0x64616564,(%rbx)
pop    %rbx
ret

LLVM IR (-O0):
define void @double_free() {
%1 = alloca i8*
%2 = call i64 @malloc(i32 4)
%3 = inttoptr i64 %2 to i8*
store i8* %3, i8** %1
%4 = load i8*, i8** %1
%5 = getelementptr inbounds i8, i8* %4, i64 0
store i8 98, i8* %5
%6 = load i8*, i8** %1
%7 = getelementptr inbounds i8, i8* %6, i64 1
store i8 101, i8* %7
%8 = load i8*, i8** %1
%9 = getelementptr inbounds i8, i8* %8, i64 2
store i8 97, i8* %9
%10 = load i8*, i8** %1
%11 = getelementptr inbounds i8, i8* %10, i64 3
store i8 102, i8* %11
%12 = load i8*, i8** %1
%13 = call i32 @free(i8* %12)
%14 = load i8*, i8** %1
%15 = call i32 @do_something_then_free_ptr(i32 2, i8* %14)
%16 = load i8*, i8** %1
%17 = getelementptr inbounds i8, i8* %16, i64 0
store i8 100, i8* %17
%18 = load i8*, i8** %1
%19 = getelementptr inbounds i8, i8* %18, i64 1
store i8 101, i8* %19
%20 = load i8*, i8** %1
%21 = getelementptr inbounds i8, i8* %20, i64 2
store i8 97, i8* %21
%22 = load i8*, i8** %1
%23 = getelementptr inbounds i8, i8* %22, i64 3
store i8 100, i8* %23
ret void
}

LLVM IR (-O2):
define void @double_free() {
%1 = tail call i64 @malloc(i32 4)
%2 = inttoptr i64 %1 to i8*
store i8 98, i8* %2
%3 = getelementptr inbounds i8, i8* %2, i64 1
store i8 101, i8* %3
%4 = getelementptr inbounds i8, i8* %2, i64 2
store i8 97, i8* %4
%5 = getelementptr inbounds i8, i8* %2, i64 3
store i8 102, i8* %5
%6 = tail call i32 @free(i8* %2)
%7 = tail call i32 @do_something_then_free_ptr(i32 2, i8* %2)
store i8 100, i8* %2
store i8 101, i8* %3
store i8 97, i8* %4
store i8 100, i8* %5
ret void
}