#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __VERIFIER_nondet_int();
int /*<<< orphan*/ free(struct TreeNode *);
void *malloc(int);
int main() {
  struct TreeNode {
    struct TreeNode *left;
    struct TreeNode *right;
  };
  struct TreeNode *root = malloc(sizeof(*root)), *n;
  root->left = NULL;
  root->right = NULL;
  int c = 0;
  while (c < 2 && __VERIFIER_nondet_int()) {
    c++;
    n = root;
    while (n->left && n->right) {
      if (__VERIFIER_nondet_int())
        n = n->left;
      else
        n = n->right;
    }
    if (!n->left && __VERIFIER_nondet_int()) {
      n->left = malloc(sizeof(*n));
      n->left->left = NULL;
      n->left->right = NULL;
    }
    if (!n->right && __VERIFIER_nondet_int()) {
      n->right = malloc(sizeof(*n));
      n->right->left = NULL;
      n->right->right = NULL;
    }
  }
  n = NULL;
  struct TreeNode *pred;
  while (root) {
    pred = NULL;
    n = root;
    while (n->left || n->right) {
      pred = n;
      if (n->left)
        n = n->left;
      else
        n = n->right;
    }
    if (pred) {
      if (n == pred->left)
        pred->left = NULL;
      else
        pred->right = NULL;
    } else
      root = NULL;
    free(n);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x10(%rbp),%rax
movq   $0x0,0x8(%rax)
movl   $0x0,-0x1c(%rbp)
xor    %eax,%eax
cmpl   $0x2,-0x1c(%rbp)
mov    %al,-0x29(%rbp)
jge    118b <main+0x5b>
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%rax
setne  %al
mov    %al,-0x29(%rbp)
mov    -0x29(%rbp),%al
test   $0x1,%al
jne    119b <main+0x6b>
jmp    12b9 <main+0x189>
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rcx
xor    %eax,%eax
cmpq   $0x0,(%rcx)
mov    %al,-0x2a(%rbp)
je     11ce <main+0x9e>
mov    -0x18(%rbp),%rax
cmpq   $0x0,0x8(%rax)
setne  %al
mov    %al,-0x2a(%rbp)
mov    -0x2a(%rbp),%al
test   $0x1,%al
jne    11de <main+0xae>
jmp    1210 <main+0xe0>
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%rax
je     11ff <main+0xcf>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    120b <main+0xdb>
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    11ac <main+0x7c>
mov    -0x18(%rbp),%rax
cmpq   $0x0,(%rax)
jne    1260 <main+0x130>
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%rax
je     1260 <main+0x130>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
movq   $0x0,(%rax)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
movq   $0x0,0x8(%rax)
mov    -0x18(%rbp),%rax
cmpq   $0x0,0x8(%rax)
jne    12b4 <main+0x184>
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%rax
je     12b4 <main+0x184>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rax
movq   $0x0,(%rax)
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rax
movq   $0x0,0x8(%rax)
jmp    116b <main+0x3b>
movq   $0x0,-0x18(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     1398 <main+0x268>
movq   $0x0,-0x28(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rcx
mov    $0x1,%al
cmpq   $0x0,(%rcx)
mov    %al,-0x2b(%rbp)
jne    12fe <main+0x1ce>
mov    -0x18(%rbp),%rax
cmpq   $0x0,0x8(%rax)
setne  %al
mov    %al,-0x2b(%rbp)
mov    -0x2b(%rbp),%al
test   $0x1,%al
jne    130e <main+0x1de>
jmp    1345 <main+0x215>
mov    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x18(%rbp),%rax
cmpq   $0x0,(%rax)
je     1334 <main+0x204>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    1340 <main+0x210>
mov    -0x18(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    12dc <main+0x1ac>
cmpq   $0x0,-0x28(%rbp)
je     1382 <main+0x252>
mov    -0x18(%rbp),%rax
mov    -0x28(%rbp),%rcx
cmp    (%rcx),%rax
jne    1371 <main+0x241>
mov    -0x28(%rbp),%rax
movq   $0x0,(%rax)
jmp    137d <main+0x24d>
mov    -0x28(%rbp),%rax
movq   $0x0,0x8(%rax)
jmp    138a <main+0x25a>
movq   $0x0,-0x10(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    12c1 <main+0x191>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r12
push   %rbx
push   %rax
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r12
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     124e <main+0x11e>
xor    %r14d,%r14d
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     1181 <main+0x51>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
mov    %rax,(%r12)
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
xor    %r15d,%r15d
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     11a8 <main+0x78>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r15
mov    %rax,0x8(%r12)
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     124e <main+0x11e>
mov    %r12,%rbx
test   %r14,%r14
je     11f7 <main+0xc7>
test   %r15,%r15
je     1222 <main+0xf2>
mov    %r12,%r14
nopl   0x0(%rax,%rax,1)
add    $0x8,%rbx
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
cmovne %r14,%rbx
mov    (%rbx),%rbx
cmpq   $0x0,(%rbx)
je     11f7 <main+0xc7>
cmpq   $0x0,0x8(%rbx)
mov    %rbx,%r14
jne    11d0 <main+0xa0>
jmp    1222 <main+0xf2>
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     1222 <main+0xf2>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,(%rbx)
movq   $0x0,(%rax)
mov    (%rbx),%rax
movq   $0x0,0x8(%rax)
cmpq   $0x0,0x8(%rbx)
jne    1249 <main+0x119>
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     1249 <main+0x119>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,0x8(%rbx)
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
test   %r12,%r12
je     12a5 <main+0x175>
xor    %edi,%edi
mov    %r12,%rcx
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    %rdi,%rax
mov    %rcx,%rdi
mov    (%rcx),%rcx
test   %rcx,%rcx
jne    1260 <main+0x130>
mov    0x8(%rdi),%rcx
test   %rcx,%rcx
jne    1260 <main+0x130>
test   %rax,%rax
je     12a0 <main+0x170>
xor    %ecx,%ecx
cmp    (%rax),%rdi
setne  %cl
movq   $0x0,(%rax,%rcx,8)
call   1030 <free@plt>
mov    %r12,%rcx
mov    $0x0,%edi
test   %r12,%r12
jne    1260 <main+0x130>
jmp    12a5 <main+0x175>
call   1030 <free@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.TreeNode = type { %struct.TreeNode*, %struct.TreeNode* }
%struct.TreeNode.0 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.TreeNode*
%3 = alloca %struct.TreeNode*
%4 = alloca i32
%5 = alloca %struct.TreeNode*
store i32 0, i32* %1
%6 = call i8* @malloc(i32 16)
%7 = bitcast i8* %6 to %struct.TreeNode*
store %struct.TreeNode* %7, %struct.TreeNode** %2
%8 = load %struct.TreeNode*, %struct.TreeNode** %2
%9 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %8, i32 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %9
%10 = load %struct.TreeNode*, %struct.TreeNode** %2
%11 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %10, i32 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %11
store i32 0, i32* %4
br label %12
12: ; preds = %90, %0
%13 = load i32, i32* %4
%14 = icmp slt i32 %13, 2
br i1 %14, label %15, label %18
15: ; preds = %12
%16 = call i64 (...) @__VERIFIER_nondet_int()
%17 = icmp ne i64 %16, 0
br label %18
18: ; preds = %15, %12
%19 = phi i1 [ false, %12 ], [ %17, %15 ]
br i1 %19, label %20, label %91
20: ; preds = %18
%21 = load i32, i32* %4
%22 = add nsw i32 %21, 1
store i32 %22, i32* %4
%23 = load %struct.TreeNode*, %struct.TreeNode** %2
store %struct.TreeNode* %23, %struct.TreeNode** %3
br label %24
24: ; preds = %47, %20
%25 = load %struct.TreeNode*, %struct.TreeNode** %3
%26 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %25, i32 0, i32 0
%27 = load %struct.TreeNode*, %struct.TreeNode** %26
%28 = icmp ne %struct.TreeNode* %27, null
br i1 %28, label %29, label %34
29: ; preds = %24
%30 = load %struct.TreeNode*, %struct.TreeNode** %3
%31 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %30, i32 0, i32 1
%32 = load %struct.TreeNode*, %struct.TreeNode** %31
%33 = icmp ne %struct.TreeNode* %32, null
br label %34
34: ; preds = %29, %24
%35 = phi i1 [ false, %24 ], [ %33, %29 ]
br i1 %35, label %36, label %48
36: ; preds = %34
%37 = call i64 (...) @__VERIFIER_nondet_int()
%38 = icmp ne i64 %37, 0
br i1 %38, label %39, label %43
39: ; preds = %36
%40 = load %struct.TreeNode*, %struct.TreeNode** %3
%41 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %40, i32 0, i32 0
%42 = load %struct.TreeNode*, %struct.TreeNode** %41
store %struct.TreeNode* %42, %struct.TreeNode** %3
br label %47
43: ; preds = %36
%44 = load %struct.TreeNode*, %struct.TreeNode** %3
%45 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %44, i32 0, i32 1
%46 = load %struct.TreeNode*, %struct.TreeNode** %45
store %struct.TreeNode* %46, %struct.TreeNode** %3
br label %47
47: ; preds = %43, %39
br label %24
48: ; preds = %34
%49 = load %struct.TreeNode*, %struct.TreeNode** %3
%50 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %49, i32 0, i32 0
%51 = load %struct.TreeNode*, %struct.TreeNode** %50
%52 = icmp ne %struct.TreeNode* %51, null
br i1 %52, label %69, label %53
53: ; preds = %48
%54 = call i64 (...) @__VERIFIER_nondet_int()
%55 = icmp ne i64 %54, 0
br i1 %55, label %56, label %69
56: ; preds = %53
%57 = call i8* @malloc(i32 16)
%58 = bitcast i8* %57 to %struct.TreeNode*
%59 = load %struct.TreeNode*, %struct.TreeNode** %3
%60 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %59, i32 0, i32 0
store %struct.TreeNode* %58, %struct.TreeNode** %60
%61 = load %struct.TreeNode*, %struct.TreeNode** %3
%62 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %61, i32 0, i32 0
%63 = load %struct.TreeNode*, %struct.TreeNode** %62
%64 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %63, i32 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %64
%65 = load %struct.TreeNode*, %struct.TreeNode** %3
%66 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %65, i32 0, i32 0
%67 = load %struct.TreeNode*, %struct.TreeNode** %66
%68 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %67, i32 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %68
br label %69
69: ; preds = %56, %53, %48
%70 = load %struct.TreeNode*, %struct.TreeNode** %3
%71 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %70, i32 0, i32 1
%72 = load %struct.TreeNode*, %struct.TreeNode** %71
%73 = icmp ne %struct.TreeNode* %72, null
br i1 %73, label %90, label %74
74: ; preds = %69
%75 = call i64 (...) @__VERIFIER_nondet_int()
%76 = icmp ne i64 %75, 0
br i1 %76, label %77, label %90
77: ; preds = %74
%78 = call i8* @malloc(i32 16)
%79 = bitcast i8* %78 to %struct.TreeNode*
%80 = load %struct.TreeNode*, %struct.TreeNode** %3
%81 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %80, i32 0, i32 1
store %struct.TreeNode* %79, %struct.TreeNode** %81
%82 = load %struct.TreeNode*, %struct.TreeNode** %3
%83 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %82, i32 0, i32 1
%84 = load %struct.TreeNode*, %struct.TreeNode** %83
%85 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %84, i32 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %85
%86 = load %struct.TreeNode*, %struct.TreeNode** %3
%87 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %86, i32 0, i32 1
%88 = load %struct.TreeNode*, %struct.TreeNode** %87
%89 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %88, i32 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %89
br label %90
90: ; preds = %77, %74, %69
br label %12
91: ; preds = %18
store %struct.TreeNode* null, %struct.TreeNode** %3
br label %92
92: ; preds = %141, %91
%93 = load %struct.TreeNode*, %struct.TreeNode** %2
%94 = icmp ne %struct.TreeNode* %93, null
br i1 %94, label %95, label %145
95: ; preds = %92
store %struct.TreeNode* null, %struct.TreeNode** %5
%96 = load %struct.TreeNode*, %struct.TreeNode** %2
store %struct.TreeNode* %96, %struct.TreeNode** %3
br label %97
97: ; preds = %123, %95
%98 = load %struct.TreeNode*, %struct.TreeNode** %3
%99 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %98, i32 0, i32 0
%100 = load %struct.TreeNode*, %struct.TreeNode** %99
%101 = icmp ne %struct.TreeNode* %100, null
br i1 %101, label %107, label %102
102: ; preds = %97
%103 = load %struct.TreeNode*, %struct.TreeNode** %3
%104 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %103, i32 0, i32 1
%105 = load %struct.TreeNode*, %struct.TreeNode** %104
%106 = icmp ne %struct.TreeNode* %105, null
br label %107
107: ; preds = %102, %97
%108 = phi i1 [ true, %97 ], [ %106, %102 ]
br i1 %108, label %109, label %124
109: ; preds = %107
%110 = load %struct.TreeNode*, %struct.TreeNode** %3
store %struct.TreeNode* %110, %struct.TreeNode** %5
%111 = load %struct.TreeNode*, %struct.TreeNode** %3
%112 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %111, i32 0, i32 0
%113 = load %struct.TreeNode*, %struct.TreeNode** %112
%114 = icmp ne %struct.TreeNode* %113, null
br i1 %114, label %115, label %119
115: ; preds = %109
%116 = load %struct.TreeNode*, %struct.TreeNode** %3
%117 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %116, i32 0, i32 0
%118 = load %struct.TreeNode*, %struct.TreeNode** %117
store %struct.TreeNode* %118, %struct.TreeNode** %3
br label %123
119: ; preds = %109
%120 = load %struct.TreeNode*, %struct.TreeNode** %3
%121 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %120, i32 0, i32 1
%122 = load %struct.TreeNode*, %struct.TreeNode** %121
store %struct.TreeNode* %122, %struct.TreeNode** %3
br label %123
123: ; preds = %119, %115
br label %97
124: ; preds = %107
%125 = load %struct.TreeNode*, %struct.TreeNode** %5
%126 = icmp ne %struct.TreeNode* %125, null
br i1 %126, label %127, label %140
127: ; preds = %124
%128 = load %struct.TreeNode*, %struct.TreeNode** %3
%129 = load %struct.TreeNode*, %struct.TreeNode** %5
%130 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %129, i32 0, i32 0
%131 = load %struct.TreeNode*, %struct.TreeNode** %130
%132 = icmp eq %struct.TreeNode* %128, %131
br i1 %132, label %133, label %136
133: ; preds = %127
%134 = load %struct.TreeNode*, %struct.TreeNode** %5
%135 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %134, i32 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %135
br label %139
136: ; preds = %127
%137 = load %struct.TreeNode*, %struct.TreeNode** %5
%138 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %137, i32 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %138
br label %139
139: ; preds = %136, %133
br label %141
140: ; preds = %124
store %struct.TreeNode* null, %struct.TreeNode** %2
br label %141
141: ; preds = %140, %139
%142 = load %struct.TreeNode*, %struct.TreeNode** %3
%143 = bitcast %struct.TreeNode* %142 to %struct.TreeNode.0*
%144 = call i32 @free(%struct.TreeNode.0* %143)
br label %92
145: ; preds = %92
ret i32 0
}

LLVM IR (-O2):
%struct.TreeNode = type { %struct.TreeNode*, %struct.TreeNode* }
%struct.TreeNode.0 = type opaque
define i32 @main() {
%1 = tail call dereferenceable_or_null(16) i8* @malloc(i32 16)
%2 = bitcast i8* %1 to %struct.TreeNode*
%3 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %2, i64 0, i32 0
%4 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %2, i64 0, i32 1
%5 = tail call i64 (...) @__VERIFIER_nondet_int()
%6 = icmp eq i64 %5, 0
br i1 %6, label %70, label %7
7: ; preds = %0
%8 = tail call i64 (...) @__VERIFIER_nondet_int()
%9 = icmp eq i64 %8, 0
br i1 %9, label %14, label %10
10: ; preds = %7
%11 = tail call dereferenceable_or_null(16) i8* @malloc(i32 16)
%12 = bitcast i8* %11 to %struct.TreeNode*
%13 = bitcast i8* %1 to i8**
store i8* %11, i8** %13
br label %14
14: ; preds = %7, %10
%15 = phi %struct.TreeNode* [ %12, %10 ], [ null, %7 ]
%16 = tail call i64 (...) @__VERIFIER_nondet_int()
%17 = icmp eq i64 %16, 0
br i1 %17, label %22, label %18
18: ; preds = %14
%19 = tail call dereferenceable_or_null(16) i8* @malloc(i32 16)
%20 = bitcast i8* %19 to %struct.TreeNode*
%21 = bitcast %struct.TreeNode** %4 to i8**
store i8* %19, i8** %21
br label %22
22: ; preds = %18, %14
%23 = phi %struct.TreeNode* [ %20, %18 ], [ null, %14 ]
%24 = tail call i64 (...) @__VERIFIER_nondet_int()
%25 = icmp eq i64 %24, 0
br i1 %25, label %70, label %26
26: ; preds = %22
%27 = icmp eq %struct.TreeNode* %15, null
br i1 %27, label %45, label %28
28: ; preds = %26
%29 = icmp eq %struct.TreeNode* %23, null
br i1 %29, label %57, label %30
30: ; preds = %28, %41
%31 = phi %struct.TreeNode* [ %37, %41 ], [ %2, %28 ]
%32 = phi %struct.TreeNode** [ %38, %41 ], [ %3, %28 ]
%33 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %31, i64 0, i32 1
%34 = tail call i64 (...) @__VERIFIER_nondet_int()
%35 = icmp eq i64 %34, 0
%36 = select i1 %35, %struct.TreeNode** %33, %struct.TreeNode** %32
%37 = load %struct.TreeNode*, %struct.TreeNode** %36
%38 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %37, i64 0, i32 0
%39 = load %struct.TreeNode*, %struct.TreeNode** %38
%40 = icmp eq %struct.TreeNode* %39, null
br i1 %40, label %45, label %41
41: ; preds = %30
%42 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %37, i64 0, i32 1
%43 = load %struct.TreeNode*, %struct.TreeNode** %42
%44 = icmp eq %struct.TreeNode* %43, null
br i1 %44, label %57, label %30
45: ; preds = %30, %26
%46 = phi %struct.TreeNode* [ %2, %26 ], [ %37, %30 ]
%47 = phi %struct.TreeNode** [ %3, %26 ], [ %38, %30 ]
%48 = tail call i64 (...) @__VERIFIER_nondet_int()
%49 = icmp eq i64 %48, 0
br i1 %49, label %57, label %50
50: ; preds = %45
%51 = tail call dereferenceable_or_null(16) i8* @malloc(i32 16)
%52 = bitcast i8* %51 to %struct.TreeNode*
%53 = bitcast %struct.TreeNode* %46 to i8**
store i8* %51, i8** %53
%54 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %52, i64 0, i32 0
store %struct.TreeNode* null, %struct.TreeNode** %54
%55 = load %struct.TreeNode*, %struct.TreeNode** %47
%56 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %55, i64 0, i32 1
store %struct.TreeNode* null, %struct.TreeNode** %56
br label %57
57: ; preds = %41, %28, %50, %45
%58 = phi %struct.TreeNode* [ %46, %50 ], [ %46, %45 ], [ %2, %28 ], [ %37, %41 ]
%59 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %58, i64 0, i32 1
%60 = load %struct.TreeNode*, %struct.TreeNode** %59
%61 = icmp eq %struct.TreeNode* %60, null
br i1 %61, label %62, label %68
62: ; preds = %57
%63 = tail call i64 (...) @__VERIFIER_nondet_int()
%64 = icmp eq i64 %63, 0
br i1 %64, label %68, label %65
65: ; preds = %62
%66 = tail call dereferenceable_or_null(16) i8* @malloc(i32 16)
%67 = bitcast %struct.TreeNode** %59 to i8**
store i8* %66, i8** %67
br label %68
68: ; preds = %57, %62, %65
%69 = icmp eq i8* %1, null
br i1 %69, label %98, label %70
70: ; preds = %0, %22, %68
%71 = icmp eq i8* %1, null
br label %72
72: ; preds = %95, %70
%73 = phi %struct.TreeNode* [ %2, %70 ], [ %96, %95 ]
%74 = phi %struct.TreeNode* [ null, %70 ], [ %97, %95 ]
%75 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %73, i64 0, i32 0
%76 = load %struct.TreeNode*, %struct.TreeNode** %75
%77 = icmp eq %struct.TreeNode* %76, null
br i1 %77, label %78, label %95
78: ; preds = %72
%79 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %73, i64 0, i32 1
%80 = load %struct.TreeNode*, %struct.TreeNode** %79
%81 = icmp eq %struct.TreeNode* %80, null
br i1 %81, label %82, label %95
82: ; preds = %78
%83 = icmp eq %struct.TreeNode* %74, null
br i1 %83, label %84, label %87
84: ; preds = %82
%85 = bitcast %struct.TreeNode* %73 to %struct.TreeNode.0*
%86 = tail call i32 @free(%struct.TreeNode.0* %85)
br label %98
87: ; preds = %82
%88 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %74, i64 0, i32 0
%89 = load %struct.TreeNode*, %struct.TreeNode** %88
%90 = icmp eq %struct.TreeNode* %73, %89
%91 = getelementptr inbounds %struct.TreeNode, %struct.TreeNode* %74, i64 0, i32 1
%92 = select i1 %90, %struct.TreeNode** %88, %struct.TreeNode** %91
store %struct.TreeNode* null, %struct.TreeNode** %92
%93 = bitcast %struct.TreeNode* %73 to %struct.TreeNode.0*
%94 = tail call i32 @free(%struct.TreeNode.0* %93)
br i1 %71, label %98, label %95
95: ; preds = %87, %78, %72
%96 = phi %struct.TreeNode* [ %2, %87 ], [ %76, %72 ], [ %80, %78 ]
%97 = phi %struct.TreeNode* [ null, %87 ], [ %73, %72 ], [ %73, %78 ]
br label %72
98: ; preds = %87, %84, %68
ret i32 0
}