#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef int /*<<< orphan*/ pid_t;

/* Variables and functions */
int /*<<< orphan*/ EXIT_FAILURE;
int /*<<< orphan*/ PTRACE_PEEKDATA;
int /*<<< orphan*/ assert(int);
int /*<<< orphan*/ err(int /*<<< orphan*/, char *);
scalar_t__ errno;
int /*<<< orphan*/ errx(int /*<<< orphan*/, char *);
scalar_t__ get_heap_range(int /*<<< orphan*/, void **, void **);
int /*<<< orphan*/ printf(char *, size_t, double);
long ptrace(int /*<<< orphan*/, int /*<<< orphan*/, void *, int /*<<< orphan*/);
void scan_heap(pid_t pid, unsigned value, unsigned **map, size_t *length,
               size_t max_length) {
  long ret;
  void *addr, *addr_end;
  if (get_heap_range(pid, &addr, &addr_end) < 0)
    errx(EXIT_FAILURE, "Failed to get heap range\n");
  printf("Heap: 0x%016zx %.02f MiB\n", (size_t)addr,
         (double)(addr_end - addr) / 1024 / 1024);
  assert(sizeof(long) == 8);
  while (addr < addr_end) {
    errno = 0;
    ret = ptrace(PTRACE_PEEKDATA, pid, addr, 0);
    if (errno) {
      err(EXIT_FAILURE, "ptrace (PEEKDATA)");
    } else {
      if (((ret >> 0) & 0x00000000ffffffff) == value)
        map[(*length)++] = addr + 0;
      if (*length >= max_length)
        errx(EXIT_FAILURE, "Max. length exceeded\n");
      if (((ret >> 4) & 0x00000000ffffffff) == value)
        map[(*length)++] = addr + 4;
      if (*length >= max_length)
        errx(EXIT_FAILURE, "Max. length exceeded\n");
    }
    addr += sizeof(long);
  }
}


x86 assembly (clang, -O0):
<scan_heap>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %edi,-0x4(%rbp)
mov    %esi,-0x8(%rbp)
mov    %rdx,-0x10(%rbp)
mov    %rcx,-0x18(%rbp)
mov    %r8,-0x20(%rbp)
mov    -0x4(%rbp),%edi
lea    -0x30(%rbp),%rsi
lea    -0x38(%rbp),%rdx
call   1030 <get_heap_range@plt>
cmp    $0x0,%rax
jge    11a9 <scan_heap+0x49>
mov    0x2e3d(%rip),%rax
mov    (%rax),%edi
lea    0xe64(%rip),%rsi
call   1040 <errx@plt>
mov    -0x30(%rbp),%rsi
mov    -0x38(%rbp),%rax
mov    -0x30(%rbp),%rcx
sub    %rcx,%rax
cvtsi2sd %rax,%xmm0
movsd  0xe3b(%rip),%xmm1
divsd  %xmm1,%xmm0
movsd  0xe2f(%rip),%xmm1
divsd  %xmm1,%xmm0
lea    0xe46(%rip),%rdi
call   1050 <printf@plt>
mov    $0x1,%edi
call   1060 <assert@plt>
mov    -0x30(%rbp),%rax
cmp    -0x38(%rbp),%rax
jae    132f <scan_heap+0x1cf>
mov    0x2de0(%rip),%rax
movq   $0x0,(%rax)
mov    0x2dc2(%rip),%rax
mov    (%rax),%edi
mov    -0x4(%rbp),%esi
mov    -0x30(%rbp),%rdx
xor    %ecx,%ecx
call   1080 <ptrace@plt>
mov    %rax,-0x28(%rbp)
mov    0x2db7(%rip),%rax
cmpq   $0x0,(%rax)
je     124d <scan_heap+0xed>
mov    0x2d9e(%rip),%rax
mov    (%rax),%edi
lea    0xdf9(%rip),%rsi
call   1070 <err@plt>
jmp    131e <scan_heap+0x1be>
mov    -0x28(%rbp),%rax
sar    $0x0,%rax
movabs $0xffffffff,%rcx
and    %rcx,%rax
mov    -0x8(%rbp),%ecx
cmp    %rcx,%rax
jne    128b <scan_heap+0x12b>
mov    -0x30(%rbp),%rdx
mov    -0x10(%rbp),%rax
mov    -0x18(%rbp),%rsi
mov    (%rsi),%rcx
mov    %rcx,%rdi
add    $0x1,%rdi
mov    %rdi,(%rsi)
mov    %rdx,(%rax,%rcx,8)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
cmp    -0x20(%rbp),%rax
jb     12b1 <scan_heap+0x151>
mov    0x2d35(%rip),%rax
mov    (%rax),%edi
lea    0xda2(%rip),%rsi
call   1040 <errx@plt>
mov    -0x28(%rbp),%rax
sar    $0x4,%rax
movabs $0xffffffff,%rcx
and    %rcx,%rax
mov    -0x8(%rbp),%ecx
cmp    %rcx,%rax
jne    12f3 <scan_heap+0x193>
mov    -0x30(%rbp),%rdx
add    $0x4,%rdx
mov    -0x10(%rbp),%rax
mov    -0x18(%rbp),%rsi
mov    (%rsi),%rcx
mov    %rcx,%rdi
add    $0x1,%rdi
mov    %rdi,(%rsi)
mov    %rdx,(%rax,%rcx,8)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
cmp    -0x20(%rbp),%rax
jb     1319 <scan_heap+0x1b9>
mov    0x2ccd(%rip),%rax
mov    (%rax),%edi
lea    0xd3a(%rip),%rsi
call   1040 <errx@plt>
jmp    131e <scan_heap+0x1be>
mov    -0x30(%rbp),%rax
add    $0x8,%rax
mov    %rax,-0x30(%rbp)
jmp    11eb <scan_heap+0x8b>
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<scan_heap>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %r8,%r14
mov    %rcx,%rbx
mov    %rdx,0x10(%rsp)
mov    %esi,%r12d
mov    %edi,%ebp
mov    %rsp,%rsi
lea    0x8(%rsp),%rdx
call   1030 <get_heap_range@plt>
test   %rax,%rax
jns    11a5 <scan_heap+0x45>
mov    0x2e41(%rip),%rax
mov    (%rax),%edi
lea    0xe68(%rip),%rsi
call   1040 <errx@plt>
mov    (%rsp),%rsi
mov    0x8(%rsp),%rax
sub    %rsi,%rax
cvtsi2sd %rax,%xmm0
movsd  0xe42(%rip),%xmm1
mulsd  %xmm1,%xmm0
mulsd  %xmm1,%xmm0
lea    0xe55(%rip),%rdi
call   1050 <printf@plt>
mov    $0x1,%edi
call   1060 <assert@plt>
mov    (%rsp),%rdx
cmp    0x8(%rsp),%rdx
jae    12eb <scan_heap+0x18b>
mov    %r12d,%r15d
mov    0x2deb(%rip),%r13
jmp    122c <scan_heap+0xcc>
nopw   0x0(%rax,%rax,1)
mov    0x2dd1(%rip),%rax
mov    (%rax),%edi
lea    0xe2c(%rip),%rsi
call   1070 <err@plt>
mov    (%rsp),%rdx
add    $0x8,%rdx
mov    %rdx,(%rsp)
cmp    0x8(%rsp),%rdx
jae    12eb <scan_heap+0x18b>
movq   $0x0,0x0(%r13)
mov    0x2d95(%rip),%rax
mov    (%rax),%edi
mov    %ebp,%esi
xor    %ecx,%ecx
call   1080 <ptrace@plt>
cmpq   $0x0,0x0(%r13)
jne    1200 <scan_heap+0xa0>
mov    %rax,%r12
mov    %r12d,%eax
cmp    %r15,%rax
jne    1276 <scan_heap+0x116>
mov    (%rsp),%rcx
mov    (%rbx),%rdx
lea    0x1(%rdx),%rax
mov    %rax,(%rbx)
mov    0x10(%rsp),%rsi
mov    %rcx,(%rsi,%rdx,8)
cmp    %r14,%rax
jae    127e <scan_heap+0x11e>
jmp    1293 <scan_heap+0x133>
mov    (%rbx),%rax
cmp    %r14,%rax
jb     1293 <scan_heap+0x133>
mov    0x2d53(%rip),%rax
mov    (%rax),%edi
lea    0xdc0(%rip),%rsi
call   1040 <errx@plt>
shr    $0x4,%r12
mov    %r12d,%eax
cmp    %r15,%rax
jne    12c5 <scan_heap+0x165>
mov    (%rsp),%rcx
add    $0x4,%rcx
mov    (%rbx),%rdx
lea    0x1(%rdx),%rax
mov    %rax,(%rbx)
mov    0x10(%rsp),%rsi
mov    %rcx,(%rsi,%rdx,8)
cmp    %r14,%rax
jb     1215 <scan_heap+0xb5>
jmp    12d1 <scan_heap+0x171>
mov    (%rbx),%rax
cmp    %r14,%rax
jb     1215 <scan_heap+0xb5>
mov    0x2d00(%rip),%rax
mov    (%rax),%edi
lea    0xd6d(%rip),%rsi
call   1040 <errx@plt>
jmp    1215 <scan_heap+0xb5>
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@EXIT_FAILURE = global i32 0
@.str = [26 x i8] c"Failed to get heap range\0A\00"
@.str.1 = [26 x i8] c"Heap: 0x%016zx %.02f MiB\0A\00"
@errno = global i64 0
@PTRACE_PEEKDATA = global i32 0
@.str.2 = [18 x i8] c"ptrace (PEEKDATA)\00"
@.str.3 = [22 x i8] c"Max. length exceeded\0A\00"
define void @scan_heap(i32 %0, i32 %1, i32** %2, i64* %3, i64 %4) {
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32**
%9 = alloca i64*
%10 = alloca i64
%11 = alloca i64
%12 = alloca i8*
%13 = alloca i8*
store i32 %0, i32* %6
store i32 %1, i32* %7
store i32** %2, i32*** %8
store i64* %3, i64** %9
store i64 %4, i64* %10
%14 = load i32, i32* %6
%15 = call i64 @get_heap_range(i32 %14, i8** %12, i8** %13)
%16 = icmp slt i64 %15, 0
br i1 %16, label %17, label %20
17: ; preds = %5
%18 = load i32, i32* @EXIT_FAILURE
%19 = call i32 @errx(i32 %18, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0))
br label %20
20: ; preds = %17, %5
%21 = load i8*, i8** %12
%22 = ptrtoint i8* %21 to i64
%23 = load i8*, i8** %13
%24 = load i8*, i8** %12
%25 = ptrtoint i8* %23 to i64
%26 = ptrtoint i8* %24 to i64
%27 = sub i64 %25, %26
%28 = sitofp i64 %27 to double
%29 = fdiv double %28, 1.024000e+03
%30 = fdiv double %29, 1.024000e+03
%31 = call i32 @printf(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.1, i64 0, i64 0), i64 %22, double %30)
%32 = call i32 @assert(i32 1)
br label %33
33: ; preds = %96, %20
%34 = load i8*, i8** %12
%35 = load i8*, i8** %13
%36 = icmp ult i8* %34, %35
br i1 %36, label %37, label %99
37: ; preds = %33
store i64 0, i64* @errno
%38 = load i32, i32* @PTRACE_PEEKDATA
%39 = load i32, i32* %6
%40 = load i8*, i8** %12
%41 = call i64 @ptrace(i32 %38, i32 %39, i8* %40, i32 0)
store i64 %41, i64* %11
%42 = load i64, i64* @errno
%43 = icmp ne i64 %42, 0
br i1 %43, label %44, label %47
44: ; preds = %37
%45 = load i32, i32* @EXIT_FAILURE
%46 = call i32 @err(i32 %45, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.2, i64 0, i64 0))
br label %96
47: ; preds = %37
%48 = load i64, i64* %11
%49 = ashr i64 %48, 0
%50 = and i64 %49, 4294967295
%51 = load i32, i32* %7
%52 = zext i32 %51 to i64
%53 = icmp eq i64 %50, %52
br i1 %53, label %54, label %63
54: ; preds = %47
%55 = load i8*, i8** %12
%56 = getelementptr i8, i8* %55, i64 0
%57 = bitcast i8* %56 to i32*
%58 = load i32**, i32*** %8
%59 = load i64*, i64** %9
%60 = load i64, i64* %59
%61 = add i64 %60, 1
store i64 %61, i64* %59
%62 = getelementptr inbounds i32*, i32** %58, i64 %60
store i32* %57, i32** %62
br label %63
63: ; preds = %54, %47
%64 = load i64*, i64** %9
%65 = load i64, i64* %64
%66 = load i64, i64* %10
%67 = icmp uge i64 %65, %66
br i1 %67, label %68, label %71
68: ; preds = %63
%69 = load i32, i32* @EXIT_FAILURE
%70 = call i32 @errx(i32 %69, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.3, i64 0, i64 0))
br label %71
71: ; preds = %68, %63
%72 = load i64, i64* %11
%73 = ashr i64 %72, 4
%74 = and i64 %73, 4294967295
%75 = load i32, i32* %7
%76 = zext i32 %75 to i64
%77 = icmp eq i64 %74, %76
br i1 %77, label %78, label %87
78: ; preds = %71
%79 = load i8*, i8** %12
%80 = getelementptr i8, i8* %79, i64 4
%81 = bitcast i8* %80 to i32*
%82 = load i32**, i32*** %8
%83 = load i64*, i64** %9
%84 = load i64, i64* %83
%85 = add i64 %84, 1
store i64 %85, i64* %83
%86 = getelementptr inbounds i32*, i32** %82, i64 %84
store i32* %81, i32** %86
br label %87
87: ; preds = %78, %71
%88 = load i64*, i64** %9
%89 = load i64, i64* %88
%90 = load i64, i64* %10
%91 = icmp uge i64 %89, %90
br i1 %91, label %92, label %95
92: ; preds = %87
%93 = load i32, i32* @EXIT_FAILURE
%94 = call i32 @errx(i32 %93, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.3, i64 0, i64 0))
br label %95
95: ; preds = %92, %87
br label %96
96: ; preds = %95, %44
%97 = load i8*, i8** %12
%98 = getelementptr i8, i8* %97, i64 8
store i8* %98, i8** %12
br label %33
99: ; preds = %33
ret void
}

LLVM IR (-O2):
@EXIT_FAILURE = global i32 0
@.str = [26 x i8] c"Failed to get heap range\0A\00"
@.str.1 = [26 x i8] c"Heap: 0x%016zx %.02f MiB\0A\00"
@errno = global i64 0
@PTRACE_PEEKDATA = global i32 0
@.str.2 = [18 x i8] c"ptrace (PEEKDATA)\00"
@.str.3 = [22 x i8] c"Max. length exceeded\0A\00"
define void @scan_heap(i32 %0, i32 %1, i32** nocapture writeonly %2, i64* nocapture %3, i64 %4) {
%6 = alloca i8*
%7 = alloca i8*
%8 = bitcast i8** %6 to i8*
%9 = bitcast i8** %7 to i8*
%10 = call i64 @get_heap_range(i32 %0, i8** %6, i8** %7)
%11 = icmp slt i64 %10, 0
br i1 %11, label %12, label %15
12: ; preds = %5
%13 = load i32, i32* @EXIT_FAILURE
%14 = call i32 @errx(i32 %13, i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str, i64 0, i64 0))
br label %15
15: ; preds = %12, %5
%16 = load i8*, i8** %6
%17 = ptrtoint i8* %16 to i64
%18 = load i8*, i8** %7
%19 = ptrtoint i8* %18 to i64
%20 = sub i64 %19, %17
%21 = sitofp i64 %20 to double
%22 = fmul double %21, 0x3F50000000000000
%23 = fmul double %22, 0x3F50000000000000
%24 = call i32 @printf(i8* getelementptr inbounds ([26 x i8], [26 x i8]* @.str.1, i64 0, i64 0), i64 %17, double %23)
%25 = call i32 @assert(i32 1)
%26 = load i8*, i8** %6
%27 = load i8*, i8** %7
%28 = icmp ult i8* %26, %27
br i1 %28, label %29, label %81
29: ; preds = %15
%30 = zext i32 %1 to i64
%31 = bitcast i8** %6 to i32**
br label %32
32: ; preds = %29, %76
%33 = phi i8* [ %26, %29 ], [ %78, %76 ]
store i64 0, i64* @errno
%34 = load i32, i32* @PTRACE_PEEKDATA
%35 = call i64 @ptrace(i32 %34, i32 %0, i8* %33, i32 0)
%36 = load i64, i64* @errno
%37 = icmp eq i64 %36, 0
br i1 %37, label %41, label %38
38: ; preds = %32
%39 = load i32, i32* @EXIT_FAILURE
%40 = call i32 @err(i32 %39, i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.2, i64 0, i64 0))
br label %76
41: ; preds = %32
%42 = and i64 %35, 4294967295
%43 = icmp eq i64 %42, %30
br i1 %43, label %46, label %44
44: ; preds = %41
%45 = load i64, i64* %3
br label %51
46: ; preds = %41
%47 = load i32*, i32** %31
%48 = load i64, i64* %3
%49 = add i64 %48, 1
store i64 %49, i64* %3
%50 = getelementptr inbounds i32*, i32** %2, i64 %48
store i32* %47, i32** %50
br label %51
51: ; preds = %44, %46
%52 = phi i64 [ %45, %44 ], [ %49, %46 ]
%53 = icmp ult i64 %52, %4
br i1 %53, label %57, label %54
54: ; preds = %51
%55 = load i32, i32* @EXIT_FAILURE
%56 = call i32 @errx(i32 %55, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.3, i64 0, i64 0))
br label %57
57: ; preds = %54, %51
%58 = lshr i64 %35, 4
%59 = and i64 %58, 4294967295
%60 = icmp eq i64 %59, %30
br i1 %60, label %63, label %61
61: ; preds = %57
%62 = load i64, i64* %3
br label %70
63: ; preds = %57
%64 = load i8*, i8** %6
%65 = getelementptr i8, i8* %64, i64 4
%66 = load i64, i64* %3
%67 = add i64 %66, 1
store i64 %67, i64* %3
%68 = getelementptr inbounds i32*, i32** %2, i64 %66
%69 = bitcast i32** %68 to i8**
store i8* %65, i8** %69
br label %70
70: ; preds = %61, %63
%71 = phi i64 [ %62, %61 ], [ %67, %63 ]
%72 = icmp ult i64 %71, %4
br i1 %72, label %76, label %73
73: ; preds = %70
%74 = load i32, i32* @EXIT_FAILURE
%75 = call i32 @errx(i32 %74, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.3, i64 0, i64 0))
br label %76
76: ; preds = %70, %73, %38
%77 = load i8*, i8** %6
%78 = getelementptr i8, i8* %77, i64 8
store i8* %78, i8** %6
%79 = load i8*, i8** %7
%80 = icmp ult i8* %78, %79
br i1 %80, label %32, label %81
81: ; preds = %76, %15
ret void
}