#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(void *);
void *malloc(int);
int /*<<< orphan*/ printf(char *, ...);
int test_heap_torture(void) {
  void *value[300];
  int i, j;
  printf("\ttorture");
  printf(" start: %x", value[0] = malloc(128));
  free(value[0]);
  for (i = 0; i < 1000; i++) {
    for (j = 0; j < 300; j++) {
      value[j] = malloc(j);
    }
    for (j = 0; j < 300; j++) {
      free(value[j]);
    }
  }
  printf(" end: %x", value[0] = malloc(128));
  printf(" passed.\n");
  return 0;
}


x86 assembly (clang, -O0):
<test_heap_torture>:
push   %rbp
mov    %rsp,%rbp
sub    $0x970,%rsp
lea    0xebe(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    $0x80,%edi
call   1050 <malloc@plt>
mov    %rax,%rsi
mov    %rsi,-0x960(%rbp)
lea    0xea5(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x960(%rbp),%rdi
call   1030 <free@plt>
movl   $0x0,-0x964(%rbp)
cmpl   $0x3e8,-0x964(%rbp)
jge    1237 <test_heap_torture+0x107>
movl   $0x0,-0x968(%rbp)
cmpl   $0x12c,-0x968(%rbp)
jge    11dc <test_heap_torture+0xac>
mov    -0x968(%rbp),%edi
call   1050 <malloc@plt>
mov    %rax,%rcx
movslq -0x968(%rbp),%rax
mov    %rcx,-0x960(%rbp,%rax,8)
ff
mov    -0x968(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x968(%rbp)
jmp    119b <test_heap_torture+0x6b>
movl   $0x0,-0x968(%rbp)
cmpl   $0x12c,-0x968(%rbp)
jge    121e <test_heap_torture+0xee>
movslq -0x968(%rbp),%rax
mov    -0x960(%rbp,%rax,8),%rdi
ff
call   1030 <free@plt>
mov    -0x968(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x968(%rbp)
jmp    11e6 <test_heap_torture+0xb6>
jmp    1223 <test_heap_torture+0xf3>
mov    -0x964(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x964(%rbp)
jmp    1181 <test_heap_torture+0x51>
mov    $0x80,%edi
call   1050 <malloc@plt>
mov    %rax,%rsi
mov    %rsi,-0x960(%rbp)
lea    0xdc2(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
lea    0xdbd(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x970,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_heap_torture>:
push   %r14
push   %rbx
sub    $0x968,%rsp
lea    0xeaf(%rip),%rdi
xor    %r14d,%r14d
xor    %eax,%eax
call   1050 <printf@plt>
mov    $0x80,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %rax,(%rsp)
lea    0xe96(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
cs nopw 0x0(%rax,%rax,1)
nop
xor    %ebx,%ebx
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
mov    %ebx,%edi
call   1060 <malloc@plt>
mov    %rax,(%rsp,%rbx,8)
add    $0x1,%rbx
cmp    $0x12c,%rbx
jne    11a0 <test_heap_torture+0x60>
xor    %ebx,%ebx
nopw   0x0(%rax,%rax,1)
mov    (%rsp,%rbx,8),%rdi
call   1030 <free@plt>
add    $0x1,%rbx
cmp    $0x12c,%rbx
jne    11c0 <test_heap_torture+0x80>
add    $0x1,%r14d
cmp    $0x3e8,%r14d
jne    1190 <test_heap_torture+0x50>
mov    $0x80,%edi
call   1060 <malloc@plt>
lea    0xe20(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1050 <printf@plt>
lea    0xe18(%rip),%rdi
call   1040 <puts@plt>
xor    %eax,%eax
add    $0x968,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
@.str = [9 x i8] c"\09torture\00"
@.str.1 = [11 x i8] c" start: %x\00"
@.str.2 = [9 x i8] c" end: %x\00"
@.str.3 = [10 x i8] c" passed.\0A\00"
define i32 @test_heap_torture() {
%1 = alloca [300 x i8*]
%2 = alloca i32
%3 = alloca i32
%4 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
%5 = call i8* @malloc(i32 128)
%6 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 0
store i8* %5, i8** %6
%7 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([11 x i8], [11 x i8]* @.str.1, i64 0, i64 0), i8* %5)
%8 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 0
%9 = load i8*, i8** %8
%10 = call i32 @free(i8* %9)
store i32 0, i32* %2
br label %11
11: ; preds = %41, %0
%12 = load i32, i32* %2
%13 = icmp slt i32 %12, 1000
br i1 %13, label %14, label %44
14: ; preds = %11
store i32 0, i32* %3
br label %15
15: ; preds = %24, %14
%16 = load i32, i32* %3
%17 = icmp slt i32 %16, 300
br i1 %17, label %18, label %27
18: ; preds = %15
%19 = load i32, i32* %3
%20 = call i8* @malloc(i32 %19)
%21 = load i32, i32* %3
%22 = sext i32 %21 to i64
%23 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 %22
store i8* %20, i8** %23
br label %24
24: ; preds = %18
%25 = load i32, i32* %3
%26 = add nsw i32 %25, 1
store i32 %26, i32* %3
br label %15
27: ; preds = %15
store i32 0, i32* %3
br label %28
28: ; preds = %37, %27
%29 = load i32, i32* %3
%30 = icmp slt i32 %29, 300
br i1 %30, label %31, label %40
31: ; preds = %28
%32 = load i32, i32* %3
%33 = sext i32 %32 to i64
%34 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 %33
%35 = load i8*, i8** %34
%36 = call i32 @free(i8* %35)
br label %37
37: ; preds = %31
%38 = load i32, i32* %3
%39 = add nsw i32 %38, 1
store i32 %39, i32* %3
br label %28
40: ; preds = %28
br label %41
41: ; preds = %40
%42 = load i32, i32* %2
%43 = add nsw i32 %42, 1
store i32 %43, i32* %2
br label %11
44: ; preds = %11
%45 = call i8* @malloc(i32 128)
%46 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 0
store i8* %45, i8** %46
%47 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0), i8* %45)
%48 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([10 x i8], [10 x i8]* @.str.3, i64 0, i64 0))
ret i32 0
}

LLVM IR (-O2):
@.str = [9 x i8] c"\09torture\00"
@.str.1 = [11 x i8] c" start: %x\00"
@.str.2 = [9 x i8] c" end: %x\00"
@str = [9 x i8] c" passed.\00"
define i32 @test_heap_torture() {
%1 = alloca [300 x i8*]
%2 = bitcast [300 x i8*]* %1 to i8*
%3 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str, i64 0, i64 0))
%4 = tail call dereferenceable_or_null(128) i8* @malloc(i32 128)
%5 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 0
store i8* %4, i8** %5
%6 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([11 x i8], [11 x i8]* @.str.1, i64 0, i64 0), i8* %4)
%7 = tail call i32 @free(i8* %4)
br label %8
8: ; preds = %0, %24
%9 = phi i32 [ 0, %0 ], [ %25, %24 ]
br label %10
10: ; preds = %8, %10
%11 = phi i64 [ 0, %8 ], [ %15, %10 ]
%12 = trunc i64 %11 to i32
%13 = tail call i8* @malloc(i32 %12)
%14 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 %11
store i8* %13, i8** %14
%15 = add nuw nsw i64 %11, 1
%16 = icmp eq i64 %15, 300
br i1 %16, label %17, label %10
17: ; preds = %10, %17
%18 = phi i64 [ %22, %17 ], [ 0, %10 ]
%19 = getelementptr inbounds [300 x i8*], [300 x i8*]* %1, i64 0, i64 %18
%20 = load i8*, i8** %19
%21 = tail call i32 @free(i8* %20)
%22 = add nuw nsw i64 %18, 1
%23 = icmp eq i64 %22, 300
br i1 %23, label %24, label %17
24: ; preds = %17
%25 = add nuw nsw i32 %9, 1
%26 = icmp eq i32 %25, 1000
br i1 %26, label %27, label %8
27: ; preds = %24
%28 = tail call dereferenceable_or_null(128) i8* @malloc(i32 128)
%29 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.2, i64 0, i64 0), i8* %28)
%30 = tail call i32 @puts(i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @str, i64 0, i64 0))
ret i32 0
}