#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ __ESBMC_assume(char *);
int /*<<< orphan*/ free(char *);
int /*<<< orphan*/ get_mem();
scalar_t__ malloc(int);
int main(void) {
  int i;
  char *ptr1, *ptr2;
  ptr1 = (char *)malloc(512);
  __ESBMC_assume(ptr1);
  ptr2 = (char *)malloc(512);
  __ESBMC_assume(ptr2);
  ptr2 = ptr1;
  free(ptr2);
  free(ptr1);
  for (i = 0; i < 512; i++) {
    get_mem();
  }
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x200,%edi
call   1060 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
call   1040 <__ESBMC_assume@plt>
mov    $0x200,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
call   1040 <__ESBMC_assume@plt>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
movl   $0x0,-0x8(%rbp)
cmpl   $0x200,-0x8(%rbp)
jge    11c0 <main+0x80>
mov    $0x0,%al
call   1050 <get_mem@plt>
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x8(%rbp)
jmp    119e <main+0x5e>
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %rbx
push   %rax
mov    $0x200,%ebp
mov    $0x200,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
call   1040 <__ESBMC_assume@plt>
mov    $0x200,%edi
call   1060 <malloc@plt>
mov    %rax,%rdi
call   1040 <__ESBMC_assume@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
nop
xor    %eax,%eax
call   1050 <get_mem@plt>
add    $0xffffffff,%ebp
jne    1180 <main+0x40>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %rbp
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i8*
store i32 0, i32* %1
%5 = call i64 @malloc(i32 512)
%6 = inttoptr i64 %5 to i8*
store i8* %6, i8** %3
%7 = load i8*, i8** %3
%8 = call i32 @__ESBMC_assume(i8* %7)
%9 = call i64 @malloc(i32 512)
%10 = inttoptr i64 %9 to i8*
store i8* %10, i8** %4
%11 = load i8*, i8** %4
%12 = call i32 @__ESBMC_assume(i8* %11)
%13 = load i8*, i8** %3
store i8* %13, i8** %4
%14 = load i8*, i8** %4
%15 = call i32 @free(i8* %14)
%16 = load i8*, i8** %3
%17 = call i32 @free(i8* %16)
store i32 0, i32* %2
br label %18
18: ; preds = %23, %0
%19 = load i32, i32* %2
%20 = icmp slt i32 %19, 512
br i1 %20, label %21, label %26
21: ; preds = %18
%22 = call i32 (...) @get_mem()
br label %23
23: ; preds = %21
%24 = load i32, i32* %2
%25 = add nsw i32 %24, 1
store i32 %25, i32* %2
br label %18
26: ; preds = %18
%27 = load i32, i32* %1
ret i32 %27
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i64 @malloc(i32 512)
%2 = inttoptr i64 %1 to i8*
%3 = tail call i32 @__ESBMC_assume(i8* %2)
%4 = tail call i64 @malloc(i32 512)
%5 = inttoptr i64 %4 to i8*
%6 = tail call i32 @__ESBMC_assume(i8* %5)
%7 = tail call i32 @free(i8* %2)
%8 = tail call i32 @free(i8* %2)
br label %9
9: ; preds = %0, %9
%10 = phi i32 [ 0, %0 ], [ %12, %9 ]
%11 = tail call i32 (...) @get_mem()
%12 = add nuw nsw i32 %10, 1
%13 = icmp eq i32 %12, 512
br i1 %13, label %14, label %9
14: ; preds = %9
ret i32 0
}