#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ __ESBMC_assume(char *);
int /*<<< orphan*/ free(char *);
scalar_t__ malloc(int);
int main(void) {
  char *chptr;
  char *chptr1;
  int i = 1;
  chptr = (char *)malloc(12);
  __ESBMC_assume(chptr);
  chptr1 = (char *)malloc(12);
  __ESBMC_assume(chptr1);
  for (i; i <= 13; i++) {
    chptr[i] = '?';
    chptr1[i] = chptr[i];
  }
  free(chptr1);
  free(chptr);
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x1c(%rbp)
mov    $0xc,%edi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
call   1040 <__ESBMC_assume@plt>
mov    $0xc,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
call   1040 <__ESBMC_assume@plt>
cmpl   $0xd,-0x1c(%rbp)
jg     11ae <main+0x7e>
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
movb   $0x3f,(%rax,%rcx,1)
mov    -0x10(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    (%rax,%rcx,1),%dl
mov    -0x18(%rbp),%rax
movslq -0x1c(%rbp),%rcx
mov    %dl,(%rax,%rcx,1)
mov    -0x1c(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1c(%rbp)
jmp    1174 <main+0x44>
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
mov    -0x4(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
mov    $0xc,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
mov    %rax,%rdi
call   1040 <__ESBMC_assume@plt>
mov    $0xc,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
call   1040 <__ESBMC_assume@plt>
movb   $0x3f,0x1(%r14)
movb   $0x3f,0x1(%rbx)
movb   $0x3f,0x2(%r14)
movb   $0x3f,0x2(%rbx)
movb   $0x3f,0x3(%r14)
movb   $0x3f,0x3(%rbx)
movb   $0x3f,0x4(%r14)
movb   $0x3f,0x4(%rbx)
movb   $0x3f,0x5(%r14)
movb   $0x3f,0x5(%rbx)
movb   $0x3f,0x6(%r14)
movb   $0x3f,0x6(%rbx)
movb   $0x3f,0x7(%r14)
movb   $0x3f,0x7(%rbx)
movb   $0x3f,0x8(%r14)
movb   $0x3f,0x8(%rbx)
movb   $0x3f,0x9(%r14)
movb   $0x3f,0x9(%rbx)
movb   $0x3f,0xa(%r14)
movb   $0x3f,0xa(%rbx)
movb   $0x3f,0xb(%r14)
movb   $0x3f,0xb(%rbx)
movb   $0x3f,0xc(%r14)
movb   $0x3f,0xc(%rbx)
movb   $0x3f,0xd(%r14)
movb   $0x3f,0xd(%rbx)
mov    %rbx,%rdi
call   1030 <free@plt>
mov    %r14,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i32
store i32 0, i32* %1
store i32 1, i32* %4
%5 = call i64 @malloc(i32 12)
%6 = inttoptr i64 %5 to i8*
store i8* %6, i8** %2
%7 = load i8*, i8** %2
%8 = call i32 @__ESBMC_assume(i8* %7)
%9 = call i64 @malloc(i32 12)
%10 = inttoptr i64 %9 to i8*
store i8* %10, i8** %3
%11 = load i8*, i8** %3
%12 = call i32 @__ESBMC_assume(i8* %11)
%13 = load i32, i32* %4
br label %14
14: ; preds = %31, %0
%15 = load i32, i32* %4
%16 = icmp sle i32 %15, 13
br i1 %16, label %17, label %34
17: ; preds = %14
%18 = load i8*, i8** %2
%19 = load i32, i32* %4
%20 = sext i32 %19 to i64
%21 = getelementptr inbounds i8, i8* %18, i64 %20
store i8 63, i8* %21
%22 = load i8*, i8** %2
%23 = load i32, i32* %4
%24 = sext i32 %23 to i64
%25 = getelementptr inbounds i8, i8* %22, i64 %24
%26 = load i8, i8* %25
%27 = load i8*, i8** %3
%28 = load i32, i32* %4
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %27, i64 %29
store i8 %26, i8* %30
br label %31
31: ; preds = %17
%32 = load i32, i32* %4
%33 = add nsw i32 %32, 1
store i32 %33, i32* %4
br label %14
34: ; preds = %14
%35 = load i8*, i8** %3
%36 = call i32 @free(i8* %35)
%37 = load i8*, i8** %2
%38 = call i32 @free(i8* %37)
%39 = load i32, i32* %1
ret i32 %39
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i64 @malloc(i32 12)
%2 = inttoptr i64 %1 to i8*
%3 = tail call i32 @__ESBMC_assume(i8* %2)
%4 = tail call i64 @malloc(i32 12)
%5 = inttoptr i64 %4 to i8*
%6 = tail call i32 @__ESBMC_assume(i8* %5)
%7 = getelementptr inbounds i8, i8* %2, i64 1
store i8 63, i8* %7
%8 = getelementptr inbounds i8, i8* %5, i64 1
store i8 63, i8* %8
%9 = getelementptr inbounds i8, i8* %2, i64 2
store i8 63, i8* %9
%10 = getelementptr inbounds i8, i8* %5, i64 2
store i8 63, i8* %10
%11 = getelementptr inbounds i8, i8* %2, i64 3
store i8 63, i8* %11
%12 = getelementptr inbounds i8, i8* %5, i64 3
store i8 63, i8* %12
%13 = getelementptr inbounds i8, i8* %2, i64 4
store i8 63, i8* %13
%14 = getelementptr inbounds i8, i8* %5, i64 4
store i8 63, i8* %14
%15 = getelementptr inbounds i8, i8* %2, i64 5
store i8 63, i8* %15
%16 = getelementptr inbounds i8, i8* %5, i64 5
store i8 63, i8* %16
%17 = getelementptr inbounds i8, i8* %2, i64 6
store i8 63, i8* %17
%18 = getelementptr inbounds i8, i8* %5, i64 6
store i8 63, i8* %18
%19 = getelementptr inbounds i8, i8* %2, i64 7
store i8 63, i8* %19
%20 = getelementptr inbounds i8, i8* %5, i64 7
store i8 63, i8* %20
%21 = getelementptr inbounds i8, i8* %2, i64 8
store i8 63, i8* %21
%22 = getelementptr inbounds i8, i8* %5, i64 8
store i8 63, i8* %22
%23 = getelementptr inbounds i8, i8* %2, i64 9
store i8 63, i8* %23
%24 = getelementptr inbounds i8, i8* %5, i64 9
store i8 63, i8* %24
%25 = getelementptr inbounds i8, i8* %2, i64 10
store i8 63, i8* %25
%26 = getelementptr inbounds i8, i8* %5, i64 10
store i8 63, i8* %26
%27 = getelementptr inbounds i8, i8* %2, i64 11
store i8 63, i8* %27
%28 = getelementptr inbounds i8, i8* %5, i64 11
store i8 63, i8* %28
%29 = getelementptr inbounds i8, i8* %2, i64 12
store i8 63, i8* %29
%30 = getelementptr inbounds i8, i8* %5, i64 12
store i8 63, i8* %30
%31 = getelementptr inbounds i8, i8* %2, i64 13
store i8 63, i8* %31
%32 = getelementptr inbounds i8, i8* %5, i64 13
store i8 63, i8* %32
%33 = tail call i32 @free(i8* %5)
%34 = tail call i32 @free(i8* %2)
ret i32 0
}