#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  while (__nondet()) {
    y = malloc(sizeof(*y));
    y->next = x;
    x = y;
  }
  struct T *z = NULL;
  while (x != NULL) {
    if (__nondet()) {
      if (z)
        z->next = x->next;
      else
        y = y->next;
      free(x);
      break;
    }
    z = x;
    x = x->next;
  }
  while (y != NULL) {
    x = y;
    y = y->next;
    free(x);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     1186 <main+0x56>
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    114f <main+0x1f>
movq   $0x0,-0x20(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     11f9 <main+0xc9>
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     11e1 <main+0xb1>
cmpq   $0x0,-0x20(%rbp)
je     11c8 <main+0x98>
mov    -0x10(%rbp),%rax
mov    (%rax),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
jmp    11d3 <main+0xa3>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
jmp    11f9 <main+0xc9>
mov    -0x10(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x10(%rbp)
jmp    118e <main+0x5e>
jmp    11fe <main+0xce>
cmpq   $0x0,-0x18(%rbp)
je     122a <main+0xfa>
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
jmp    11fe <main+0xce>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     11e4 <main+0xb4>
xor    %ebx,%ebx
nopl   0x0(%rax,%rax,1)
mov    $0x8,%edi
call   1050 <malloc@plt>
mov    %rax,%r13
mov    %rbx,(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r13,%rbx
test   %rax,%rax
jne    1150 <main+0x20>
xor    %r15d,%r15d
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     1183 <main+0x53>
mov    %r13,%r14
jmp    11ab <main+0x7b>
mov    %r13,%r12
cs nopw 0x0(%rax,%rax,1)
mov    (%r12),%r14
test   %r14,%r14
je     11c4 <main+0x94>
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r12,%r15
mov    %r14,%r12
test   %rax,%rax
je     1190 <main+0x60>
test   %r15,%r15
je     11b8 <main+0x88>
mov    (%r14),%rax
mov    %rax,(%r15)
jmp    11bc <main+0x8c>
mov    0x0(%r13),%r13
mov    %r14,%rdi
call   1030 <free@plt>
test   %r13,%r13
je     11e4 <main+0xb4>
nopl   0x0(%rax)
mov    0x0(%r13),%rbx
mov    %r13,%rdi
call   1030 <free@plt>
mov    %rbx,%r13
test   %rbx,%rbx
jne    11d0 <main+0xa0>
xor    %eax,%eax
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
br label %5
5: ; preds = %8, %0
%6 = call i64 (...) @__nondet()
%7 = icmp ne i64 %6, 0
br i1 %7, label %8, label %15
8: ; preds = %5
%9 = call %struct.T.0* @malloc(i32 8)
%10 = bitcast %struct.T.0* %9 to %struct.T*
store %struct.T* %10, %struct.T** %3
%11 = load %struct.T*, %struct.T** %2
%12 = load %struct.T*, %struct.T** %3
%13 = getelementptr inbounds %struct.T, %struct.T* %12, i32 0, i32 0
store %struct.T* %11, %struct.T** %13
%14 = load %struct.T*, %struct.T** %3
store %struct.T* %14, %struct.T** %2
br label %5
15: ; preds = %5
store %struct.T* null, %struct.T** %4
br label %16
16: ; preds = %39, %15
%17 = load %struct.T*, %struct.T** %2
%18 = icmp ne %struct.T* %17, null
br i1 %18, label %19, label %44
19: ; preds = %16
%20 = call i64 (...) @__nondet()
%21 = icmp ne i64 %20, 0
br i1 %21, label %22, label %39
22: ; preds = %19
%23 = load %struct.T*, %struct.T** %4
%24 = icmp ne %struct.T* %23, null
br i1 %24, label %25, label %31
25: ; preds = %22
%26 = load %struct.T*, %struct.T** %2
%27 = getelementptr inbounds %struct.T, %struct.T* %26, i32 0, i32 0
%28 = load %struct.T*, %struct.T** %27
%29 = load %struct.T*, %struct.T** %4
%30 = getelementptr inbounds %struct.T, %struct.T* %29, i32 0, i32 0
store %struct.T* %28, %struct.T** %30
br label %35
31: ; preds = %22
%32 = load %struct.T*, %struct.T** %3
%33 = getelementptr inbounds %struct.T, %struct.T* %32, i32 0, i32 0
%34 = load %struct.T*, %struct.T** %33
store %struct.T* %34, %struct.T** %3
br label %35
35: ; preds = %31, %25
%36 = load %struct.T*, %struct.T** %2
%37 = bitcast %struct.T* %36 to %struct.T.1*
%38 = call i32 @free(%struct.T.1* %37)
br label %44
39: ; preds = %19
%40 = load %struct.T*, %struct.T** %2
store %struct.T* %40, %struct.T** %4
%41 = load %struct.T*, %struct.T** %2
%42 = getelementptr inbounds %struct.T, %struct.T* %41, i32 0, i32 0
%43 = load %struct.T*, %struct.T** %42
store %struct.T* %43, %struct.T** %2
br label %16
44: ; preds = %35, %16
br label %45
45: ; preds = %48, %44
%46 = load %struct.T*, %struct.T** %3
%47 = icmp ne %struct.T* %46, null
br i1 %47, label %48, label %56
48: ; preds = %45
%49 = load %struct.T*, %struct.T** %3
store %struct.T* %49, %struct.T** %2
%50 = load %struct.T*, %struct.T** %3
%51 = getelementptr inbounds %struct.T, %struct.T* %50, i32 0, i32 0
%52 = load %struct.T*, %struct.T** %51
store %struct.T* %52, %struct.T** %3
%53 = load %struct.T*, %struct.T** %2
%54 = bitcast %struct.T* %53 to %struct.T.1*
%55 = call i32 @free(%struct.T.1* %54)
br label %45
56: ; preds = %45
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call i64 (...) @__nondet()
%2 = icmp eq i64 %1, 0
br i1 %2, label %47, label %7
3: ; preds = %7
%4 = bitcast %struct.T.0* %9 to %struct.T*
%5 = tail call i64 (...) @__nondet()
%6 = icmp eq i64 %5, 0
br i1 %6, label %32, label %17
7: ; preds = %0, %7
%8 = phi %struct.T* [ %10, %7 ], [ null, %0 ]
%9 = tail call %struct.T.0* @malloc(i32 8)
%10 = bitcast %struct.T.0* %9 to %struct.T*
%11 = bitcast %struct.T.0* %9 to %struct.T**
store %struct.T* %8, %struct.T** %11
%12 = tail call i64 (...) @__nondet()
%13 = icmp eq i64 %12, 0
br i1 %13, label %3, label %7
14: ; preds = %32
%15 = tail call i64 (...) @__nondet()
%16 = icmp eq i64 %15, 0
br i1 %16, label %32, label %17
17: ; preds = %14, %3
%18 = phi %struct.T* [ null, %3 ], [ %33, %14 ]
%19 = phi %struct.T* [ %4, %3 ], [ %35, %14 ]
%20 = icmp eq %struct.T* %18, null
br i1 %20, label %25, label %21
21: ; preds = %17
%22 = getelementptr inbounds %struct.T, %struct.T* %19, i64 0, i32 0
%23 = load %struct.T*, %struct.T** %22
%24 = getelementptr inbounds %struct.T, %struct.T* %18, i64 0, i32 0
store %struct.T* %23, %struct.T** %24
br label %28
25: ; preds = %17
%26 = bitcast %struct.T.0* %9 to %struct.T**
%27 = load %struct.T*, %struct.T** %26
br label %28
28: ; preds = %25, %21
%29 = phi %struct.T* [ %4, %21 ], [ %27, %25 ]
%30 = bitcast %struct.T* %19 to %struct.T.1*
%31 = tail call i32 @free(%struct.T.1* %30)
br label %37
32: ; preds = %3, %14
%33 = phi %struct.T* [ %35, %14 ], [ %4, %3 ]
%34 = getelementptr inbounds %struct.T, %struct.T* %33, i64 0, i32 0
%35 = load %struct.T*, %struct.T** %34
%36 = icmp eq %struct.T* %35, null
br i1 %36, label %37, label %14
37: ; preds = %32, %28
%38 = phi %struct.T* [ %29, %28 ], [ %4, %32 ]
%39 = icmp eq %struct.T* %38, null
br i1 %39, label %47, label %40
40: ; preds = %37, %40
%41 = phi %struct.T* [ %43, %40 ], [ %38, %37 ]
%42 = getelementptr inbounds %struct.T, %struct.T* %41, i64 0, i32 0
%43 = load %struct.T*, %struct.T** %42
%44 = bitcast %struct.T* %41 to %struct.T.1*
%45 = tail call i32 @free(%struct.T.1* %44)
%46 = icmp eq %struct.T* %43, null
br i1 %46, label %47, label %40
47: ; preds = %40, %0, %37
ret i32 0
}