int main() {
  int *a;
  int k = nondet_int();
  int i;
  __ESBMC_assume(k > 0 && (k < 0x1FFFFFFF));
  a = malloc(k * sizeof(int));
  __ESBMC_assume(a);
  for (i = 0; i != k; i++)
    if (a[i])
      return 1;
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x0,%al
call   1030 <nondet_int@plt>
mov    %eax,-0x14(%rbp)
xor    %eax,%eax
cmpl   $0x0,-0x14(%rbp)
mov    %al,-0x19(%rbp)
jle    1165 <main+0x35>
cmpl   $0x1fffffff,-0x14(%rbp)
setl   %al
mov    %al,-0x19(%rbp)
mov    -0x19(%rbp),%al
and    $0x1,%al
movzbl %al,%edi
mov    $0x0,%al
call   1040 <__ESBMC_assume@plt>
movslq -0x14(%rbp),%rdi
shl    $0x2,%rdi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
mov    $0x0,%al
call   1040 <__ESBMC_assume@plt>
movl   $0x0,-0x18(%rbp)
mov    -0x18(%rbp),%eax
cmp    -0x14(%rbp),%eax
je     11d4 <main+0xa4>
mov    -0x10(%rbp),%rax
movslq -0x18(%rbp),%rcx
cmpl   $0x0,(%rax,%rcx,4)
je     11c1 <main+0x91>
movl   $0x1,-0x4(%rbp)
jmp    11db <main+0xab>
jmp    11c6 <main+0x96>
mov    -0x18(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x18(%rbp)
jmp    1197 <main+0x67>
movl   $0x0,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
xor    %r14d,%r14d
xor    %eax,%eax
call   1030 <nondet_int@plt>
mov    %eax,%r15d
lea    -0x1(%r15),%eax
xor    %edi,%edi
cmp    $0x1ffffffe,%eax
setb   %dil
xor    %eax,%eax
call   1040 <__ESBMC_assume@plt>
movslq %r15d,%rbx
lea    0x0(,%rbx,4),%rdi
call   1050 <malloc@plt>
mov    %rax,%rbp
mov    %rax,%rdi
xor    %eax,%eax
call   1040 <__ESBMC_assume@plt>
cmp    $0x1,%ebx
jb     11ab <main+0x7b>
mov    %r15d,%eax
xor    %ecx,%ecx
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
cmpl   $0x0,0x0(%rbp,%rcx,4)
jne    11a5 <main+0x75>
add    $0x1,%rcx
cmp    %rcx,%rax
jne    1190 <main+0x60>
xor    %r14d,%r14d
jmp    11ab <main+0x7b>
mov    $0x1,%r14d
mov    %r14d,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32
%4 = alloca i32
store i32 0, i32* %1
%5 = call i32 (...) @nondet_int()
store i32 %5, i32* %3
%6 = load i32, i32* %3
%7 = icmp sgt i32 %6, 0
br i1 %7, label %8, label %11
8: ; preds = %0
%9 = load i32, i32* %3
%10 = icmp slt i32 %9, 536870911
br label %11
11: ; preds = %8, %0
%12 = phi i1 [ false, %0 ], [ %10, %8 ]
%13 = zext i1 %12 to i32
%14 = call i32 (i32, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32, ...)*)(i32 %13)
%15 = load i32, i32* %3
%16 = sext i32 %15 to i64
%17 = mul i64 %16, 4
%18 = call i8* @malloc(i64 %17)
%19 = bitcast i8* %18 to i32*
store i32* %19, i32** %2
%20 = load i32*, i32** %2
%21 = call i32 (i32*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32*, ...)*)(i32* %20)
store i32 0, i32* %4
br label %22
22: ; preds = %35, %11
%23 = load i32, i32* %4
%24 = load i32, i32* %3
%25 = icmp ne i32 %23, %24
br i1 %25, label %26, label %38
26: ; preds = %22
%27 = load i32*, i32** %2
%28 = load i32, i32* %4
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i32, i32* %27, i64 %29
%31 = load i32, i32* %30
%32 = icmp ne i32 %31, 0
br i1 %32, label %33, label %34
33: ; preds = %26
store i32 1, i32* %1
br label %39
34: ; preds = %26
br label %35
35: ; preds = %34
%36 = load i32, i32* %4
%37 = add nsw i32 %36, 1
store i32 %37, i32* %4
br label %22
38: ; preds = %22
store i32 0, i32* %1
br label %39
39: ; preds = %38, %33
%40 = load i32, i32* %1
ret i32 %40
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32 (...) @nondet_int()
%2 = add i32 %1, -1
%3 = icmp ult i32 %2, 536870910
%4 = zext i1 %3 to i32
%5 = tail call i32 (i32, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32, ...)*)(i32 %4)
%6 = sext i32 %1 to i64
%7 = shl nsw i64 %6, 2
%8 = tail call i8* @malloc(i64 %7)
%9 = bitcast i8* %8 to i32*
%10 = tail call i32 (i32*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32*, ...)*)(i32* %9)
%11 = icmp eq i32 %1, 0
br i1 %11, label %22, label %12
12: ; preds = %0
%13 = zext i32 %1 to i64
br label %16
14: ; preds = %16
%15 = icmp eq i64 %21, %13
br i1 %15, label %22, label %16
16: ; preds = %12, %14
%17 = phi i64 [ 0, %12 ], [ %21, %14 ]
%18 = getelementptr inbounds i32, i32* %9, i64 %17
%19 = load i32, i32* %18
%20 = icmp eq i32 %19, 0
%21 = add nuw nsw i64 %17, 1
br i1 %20, label %14, label %22
22: ; preds = %16, %14, %0
%23 = phi i32 [ 0, %0 ], [ 0, %14 ], [ 1, %16 ]
ret i32 %23
}