#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  while (__nondet()) {
    y = malloc(sizeof(struct T));
    y->next = x;
    x = y;
  }
  struct T *z = NULL;
  while (x != NULL) {
    y = x;
    x = x->next;
    y->next = z;
    z = y;
  }
  while (y != NULL) {
    x = y;
    y = y->next;
    free(x);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     1186 <main+0x56>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    114f <main+0x1f>
movq   $0x0,-0x20(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     11c4 <main+0x94>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x10(%rbp)
mov    -0x20(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
jmp    118e <main+0x5e>
jmp    11c9 <main+0x99>
cmpq   $0x0,-0x18(%rbp)
je     11f5 <main+0xc5>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
jmp    11c9 <main+0x99>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     11b0 <main+0x80>
xor    %r14d,%r14d
cs nopw 0x0(%rax,%rax,1)
nopl   (%rax)
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    %r14,(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %rbx,%r14
test   %rax,%rax
jne    1150 <main+0x20>
xor    %eax,%eax
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    %rbx,%rdi
mov    (%rbx),%rbx
mov    %rax,(%rdi)
mov    %rdi,%rax
test   %rbx,%rbx
jne    1180 <main+0x50>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    (%rdi),%rbx
call   1030 <free@plt>
mov    %rbx,%rdi
test   %rbx,%rbx
jne    11a0 <main+0x70>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
br label %5
5: ; preds = %8, %0
%6 = call i64 (...) @__nondet()
%7 = icmp ne i64 %6, 0
br i1 %7, label %8, label %15
8: ; preds = %5
%9 = call %struct.T.0* @malloc(i32 8)
%10 = bitcast %struct.T.0* %9 to %struct.T*
store %struct.T* %10, %struct.T** %3
%11 = load %struct.T*, %struct.T** %2
%12 = load %struct.T*, %struct.T** %3
%13 = getelementptr inbounds %struct.T, %struct.T* %12, i32 0, i32 0
store %struct.T* %11, %struct.T** %13
%14 = load %struct.T*, %struct.T** %3
store %struct.T* %14, %struct.T** %2
br label %5
15: ; preds = %5
store %struct.T* null, %struct.T** %4
br label %16
16: ; preds = %19, %15
%17 = load %struct.T*, %struct.T** %2
%18 = icmp ne %struct.T* %17, null
br i1 %18, label %19, label %28
19: ; preds = %16
%20 = load %struct.T*, %struct.T** %2
store %struct.T* %20, %struct.T** %3
%21 = load %struct.T*, %struct.T** %2
%22 = getelementptr inbounds %struct.T, %struct.T* %21, i32 0, i32 0
%23 = load %struct.T*, %struct.T** %22
store %struct.T* %23, %struct.T** %2
%24 = load %struct.T*, %struct.T** %4
%25 = load %struct.T*, %struct.T** %3
%26 = getelementptr inbounds %struct.T, %struct.T* %25, i32 0, i32 0
store %struct.T* %24, %struct.T** %26
%27 = load %struct.T*, %struct.T** %3
store %struct.T* %27, %struct.T** %4
br label %16
28: ; preds = %16
br label %29
29: ; preds = %32, %28
%30 = load %struct.T*, %struct.T** %3
%31 = icmp ne %struct.T* %30, null
br i1 %31, label %32, label %40
32: ; preds = %29
%33 = load %struct.T*, %struct.T** %3
store %struct.T* %33, %struct.T** %2
%34 = load %struct.T*, %struct.T** %3
%35 = getelementptr inbounds %struct.T, %struct.T* %34, i32 0, i32 0
%36 = load %struct.T*, %struct.T** %35
store %struct.T* %36, %struct.T** %3
%37 = load %struct.T*, %struct.T** %2
%38 = bitcast %struct.T* %37 to %struct.T.1*
%39 = call i32 @free(%struct.T.1* %38)
br label %29
40: ; preds = %29
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call i64 (...) @__nondet()
%2 = icmp eq i64 %1, 0
br i1 %2, label %25, label %5
3: ; preds = %5
%4 = bitcast %struct.T.0* %7 to %struct.T*
br label %12
5: ; preds = %0, %5
%6 = phi %struct.T* [ %8, %5 ], [ null, %0 ]
%7 = tail call %struct.T.0* @malloc(i32 8)
%8 = bitcast %struct.T.0* %7 to %struct.T*
%9 = bitcast %struct.T.0* %7 to %struct.T**
store %struct.T* %6, %struct.T** %9
%10 = tail call i64 (...) @__nondet()
%11 = icmp eq i64 %10, 0
br i1 %11, label %3, label %5
12: ; preds = %3, %12
%13 = phi %struct.T* [ %14, %12 ], [ null, %3 ]
%14 = phi %struct.T* [ %16, %12 ], [ %4, %3 ]
%15 = getelementptr inbounds %struct.T, %struct.T* %14, i64 0, i32 0
%16 = load %struct.T*, %struct.T** %15
store %struct.T* %13, %struct.T** %15
%17 = icmp eq %struct.T* %16, null
br i1 %17, label %18, label %12
18: ; preds = %12, %18
%19 = phi %struct.T* [ %21, %18 ], [ %14, %12 ]
%20 = getelementptr inbounds %struct.T, %struct.T* %19, i64 0, i32 0
%21 = load %struct.T*, %struct.T** %20
%22 = bitcast %struct.T* %19 to %struct.T.1*
%23 = tail call i32 @free(%struct.T.1* %22)
%24 = icmp eq %struct.T* %21, null
br i1 %24, label %25, label %18
25: ; preds = %18, %0
ret i32 0
}