#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ free(void *);
void *malloc(int);
int /*<<< orphan*/ printf(char *, void *, void *);
int main() {
  void *A, *B, *C;
  A = malloc(0x100 - 8);
  B = malloc(0x100 - 8);
  C = malloc(0x80 - 8);
  printf("C chunk: %p -> %p\n", C, C + 0x80 - 8);
  free(B);
  *(char *)(A + 0x100 - 8) = 0x81;
  B = malloc(0x100 + 0x80 - 8);
  printf("new B chunk: %p -> %p\n", B, B + 0x100 + 0x80 - 8);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0xf8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    $0xf8,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    $0x78,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rsi
mov    -0x20(%rbp),%rdx
add    $0x80,%rdx
add    $0xfffffffffffffff8,%rdx
lea    0xe7d(%rip),%rdi
call   1040 <printf@plt>
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
mov    -0x10(%rbp),%rax
movb   $0x81,0xf8(%rax)
mov    $0x178,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rsi
mov    -0x18(%rbp),%rdx
add    $0x100,%rdx
add    $0x80,%rdx
add    $0xfffffffffffffff8,%rdx
lea    0xe48(%rip),%rdi
call   1040 <printf@plt>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    $0xf8,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    $0x78,%edi
call   1050 <malloc@plt>
lea    0x78(%rax),%rdx
lea    0xead(%rip),%rdi
mov    %rax,%rsi
call   1040 <printf@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
mov    $0x178,%edi
call   1050 <malloc@plt>
lea    0x178(%rax),%rdx
lea    0xe98(%rip),%rdi
mov    %rax,%rsi
call   1040 <printf@plt>
xor    %eax,%eax
pop    %rbx
ret

LLVM IR (-O0):
@.str = [19 x i8] c"C chunk: %p -> %p\0A\00"
@.str.1 = [23 x i8] c"new B chunk: %p -> %p\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i8*
store i32 0, i32* %1
%5 = call i8* @malloc(i32 248)
store i8* %5, i8** %2
%6 = call i8* @malloc(i32 248)
store i8* %6, i8** %3
%7 = call i8* @malloc(i32 120)
store i8* %7, i8** %4
%8 = load i8*, i8** %4
%9 = load i8*, i8** %4
%10 = getelementptr i8, i8* %9, i64 128
%11 = getelementptr i8, i8* %10, i64 -8
%12 = call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i8* %8, i8* %11)
%13 = load i8*, i8** %3
%14 = call i32 @free(i8* %13)
%15 = load i8*, i8** %2
%16 = getelementptr i8, i8* %15, i64 256
%17 = getelementptr i8, i8* %16, i64 -8
store i8 -127, i8* %17
%18 = call i8* @malloc(i32 376)
store i8* %18, i8** %3
%19 = load i8*, i8** %3
%20 = load i8*, i8** %3
%21 = getelementptr i8, i8* %20, i64 256
%22 = getelementptr i8, i8* %21, i64 128
%23 = getelementptr i8, i8* %22, i64 -8
%24 = call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0), i8* %19, i8* %23)
ret i32 0
}

LLVM IR (-O2):
@.str = [19 x i8] c"C chunk: %p -> %p\0A\00"
@.str.1 = [23 x i8] c"new B chunk: %p -> %p\0A\00"
define i32 @main() {
%1 = tail call dereferenceable_or_null(248) i8* @malloc(i32 248)
%2 = tail call dereferenceable_or_null(120) i8* @malloc(i32 120)
%3 = getelementptr i8, i8* %2, i64 120
%4 = tail call i32 @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i8* %2, i8* %3)
%5 = tail call i32 @free(i8* %1)
%6 = tail call dereferenceable_or_null(376) i8* @malloc(i32 376)
%7 = getelementptr i8, i8* %6, i64 376
%8 = tail call i32 @printf(i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0), i8* %6, i8* %7)
ret i32 0
}