#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ __CPROVER_assume(int);
int /*<<< orphan*/ assert(int);
int binsearch(int *, int, int);
int nondet_int();
int /*<<< orphan*/ printf(char *, int, ...);
int main() {
  int a[10];
  int i;
  for (i = 0; i < 10; i++) {
    a[i] = nondet_int();
    printf("STATE: a[%d] = %d\n", i, a[i]);
    __CPROVER_assume(a[i] >= 0);
    __CPROVER_assume(a[i] <= 10);
    __CPROVER_assume((i == 0) || (a[i] >= a[i - 1]));
  }
  int s = nondet_int();
  printf("STATE: s = %d\n", s);
  int r = binsearch(a, 10, s);
  printf("STATE: r = %d\n", r);
  assert((r == -1) || (a[r] == s));
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x0,-0x34(%rbp)
cmpl   $0xa,-0x34(%rbp)
jge    120b <main+0xbb>
mov    $0x0,%al
call   1030 <nondet_int@plt>
mov    %eax,%ecx
movslq -0x34(%rbp),%rax
mov    %ecx,-0x30(%rbp,%rax,4)
mov    -0x34(%rbp),%esi
movslq -0x34(%rbp),%rax
mov    -0x30(%rbp,%rax,4),%edx
lea    0xe6d(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
movslq -0x34(%rbp),%rax
cmpl   $0x0,-0x30(%rbp,%rax,4)
setge  %al
and    $0x1,%al
movzbl %al,%edi
call   1050 <__CPROVER_assume@plt>
movslq -0x34(%rbp),%rax
cmpl   $0xa,-0x30(%rbp,%rax,4)
setle  %al
and    $0x1,%al
movzbl %al,%edi
call   1050 <__CPROVER_assume@plt>
mov    $0x1,%al
cmpl   $0x0,-0x34(%rbp)
mov    %al,-0x3d(%rbp)
je     11f0 <main+0xa0>
movslq -0x34(%rbp),%rax
mov    -0x30(%rbp,%rax,4),%eax
mov    -0x34(%rbp),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
cmp    -0x30(%rbp,%rcx,4),%eax
setge  %al
mov    %al,-0x3d(%rbp)
mov    -0x3d(%rbp),%al
and    $0x1,%al
movzbl %al,%edi
call   1050 <__CPROVER_assume@plt>
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x34(%rbp)
jmp    1166 <main+0x16>
mov    $0x0,%al
call   1030 <nondet_int@plt>
mov    %eax,-0x38(%rbp)
mov    -0x38(%rbp),%esi
lea    0xdf4(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
lea    -0x30(%rbp),%rdi
mov    -0x38(%rbp),%edx
mov    $0xa,%esi
call   1040 <binsearch@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x3c(%rbp),%esi
lea    0xdde(%rip),%rdi
mov    $0x0,%al
call   1060 <printf@plt>
mov    $0x1,%al
cmpl   $0xffffffff,-0x3c(%rbp)
mov    %al,-0x3e(%rbp)
je     126b <main+0x11b>
movslq -0x3c(%rbp),%rax
mov    -0x30(%rbp,%rax,4),%eax
cmp    -0x38(%rbp),%eax
sete   %al
mov    %al,-0x3e(%rbp)
mov    -0x3e(%rbp),%al
and    $0x1,%al
movzbl %al,%edi
call   1070 <assert@plt>
mov    -0x4(%rbp),%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r14
push   %rbx
sub    $0x30,%rsp
xor    %eax,%eax
call   1030 <nondet_int@plt>
mov    %eax,%ebx
mov    %eax,(%rsp)
lea    0xe95(%rip),%r14
mov    %r14,%rdi
xor    %esi,%esi
mov    %eax,%edx
xor    %eax,%eax
call   1060 <printf@plt>
mov    %ebx,%edi
not    %edi
shr    $0x1f,%edi
call   1050 <__CPROVER_assume@plt>
xor    %edi,%edi
cmp    $0xb,%ebx
setl   %dil
call   1050 <__CPROVER_assume@plt>
mov    $0x1,%edi
call   1050 <__CPROVER_assume@plt>
mov    $0x1,%ebx
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
xor    %eax,%eax
call   1030 <nondet_int@plt>
mov    %eax,%ebp
mov    %eax,(%rsp,%rbx,4)
mov    %r14,%rdi
mov    %ebx,%esi
mov    %eax,%edx
xor    %eax,%eax
call   1060 <printf@plt>
mov    %ebp,%edi
not    %edi
shr    $0x1f,%edi
call   1050 <__CPROVER_assume@plt>
xor    %edi,%edi
cmp    $0xb,%ebp
setl   %dil
call   1050 <__CPROVER_assume@plt>
xor    %edi,%edi
cmp    -0x4(%rsp,%rbx,4),%ebp
setge  %dil
call   1050 <__CPROVER_assume@plt>
add    $0x1,%rbx
cmp    $0xa,%rbx
jne    11b0 <main+0x60>
xor    %eax,%eax
call   1030 <nondet_int@plt>
mov    %eax,%ebx
lea    0xe06(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1060 <printf@plt>
mov    %rsp,%rdi
mov    $0xa,%esi
mov    %ebx,%edx
call   1040 <binsearch@plt>
mov    %eax,%ebp
lea    0xdf4(%rip),%rdi
mov    %eax,%esi
xor    %eax,%eax
call   1060 <printf@plt>
cmp    $0xffffffff,%ebp
je     124a <main+0xfa>
movslq %ebp,%rax
xor    %edi,%edi
cmp    %ebx,(%rsp,%rax,4)
sete   %dil
jmp    124f <main+0xff>
mov    $0x1,%edi
call   1070 <assert@plt>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbx
pop    %r14
pop    %rbp
ret

LLVM IR (-O0):
@.str = [19 x i8] c"STATE: a[%d] = %d\0A\00"
@.str.1 = [15 x i8] c"STATE: s = %d\0A\00"
@.str.2 = [15 x i8] c"STATE: r = %d\0A\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca [10 x i32]
%3 = alloca i32
%4 = alloca i32
%5 = alloca i32
store i32 0, i32* %1
store i32 0, i32* %3
br label %6
6: ; preds = %51, %0
%7 = load i32, i32* %3
%8 = icmp slt i32 %7, 10
br i1 %8, label %9, label %54
9: ; preds = %6
%10 = call i32 (...) @nondet_int()
%11 = load i32, i32* %3
%12 = sext i32 %11 to i64
%13 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 %12
store i32 %10, i32* %13
%14 = load i32, i32* %3
%15 = load i32, i32* %3
%16 = sext i32 %15 to i64
%17 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 %16
%18 = load i32, i32* %17
%19 = call i32 (i8*, i32, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i32 %14, i32 %18)
%20 = load i32, i32* %3
%21 = sext i32 %20 to i64
%22 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 %21
%23 = load i32, i32* %22
%24 = icmp sge i32 %23, 0
%25 = zext i1 %24 to i32
%26 = call i32 @__CPROVER_assume(i32 %25)
%27 = load i32, i32* %3
%28 = sext i32 %27 to i64
%29 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 %28
%30 = load i32, i32* %29
%31 = icmp sle i32 %30, 10
%32 = zext i1 %31 to i32
%33 = call i32 @__CPROVER_assume(i32 %32)
%34 = load i32, i32* %3
%35 = icmp eq i32 %34, 0
br i1 %35, label %47, label %36
36: ; preds = %9
%37 = load i32, i32* %3
%38 = sext i32 %37 to i64
%39 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 %38
%40 = load i32, i32* %39
%41 = load i32, i32* %3
%42 = sub nsw i32 %41, 1
%43 = sext i32 %42 to i64
%44 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 %43
%45 = load i32, i32* %44
%46 = icmp sge i32 %40, %45
br label %47
47: ; preds = %36, %9
%48 = phi i1 [ true, %9 ], [ %46, %36 ]
%49 = zext i1 %48 to i32
%50 = call i32 @__CPROVER_assume(i32 %49)
br label %51
51: ; preds = %47
%52 = load i32, i32* %3
%53 = add nsw i32 %52, 1
store i32 %53, i32* %3
br label %6
54: ; preds = %6
%55 = call i32 (...) @nondet_int()
store i32 %55, i32* %4
%56 = load i32, i32* %4
%57 = call i32 (i8*, i32, ...) @printf(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %56)
%58 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 0
%59 = load i32, i32* %4
%60 = call i32 @binsearch(i32* %58, i32 10, i32 %59)
store i32 %60, i32* %5
%61 = load i32, i32* %5
%62 = call i32 (i8*, i32, ...) @printf(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.2, i64 0, i64 0), i32 %61)
%63 = load i32, i32* %5
%64 = icmp eq i32 %63, -1
br i1 %64, label %72, label %65
65: ; preds = %54
%66 = load i32, i32* %5
%67 = sext i32 %66 to i64
%68 = getelementptr inbounds [10 x i32], [10 x i32]* %2, i64 0, i64 %67
%69 = load i32, i32* %68
%70 = load i32, i32* %4
%71 = icmp eq i32 %69, %70
br label %72
72: ; preds = %65, %54
%73 = phi i1 [ true, %54 ], [ %71, %65 ]
%74 = zext i1 %73 to i32
%75 = call i32 @assert(i32 %74)
%76 = load i32, i32* %1
ret i32 %76
}

LLVM IR (-O2):
@.str = [19 x i8] c"STATE: a[%d] = %d\0A\00"
@.str.1 = [15 x i8] c"STATE: s = %d\0A\00"
@.str.2 = [15 x i8] c"STATE: r = %d\0A\00"
define i32 @main() {
%1 = alloca [10 x i32]
%2 = bitcast [10 x i32]* %1 to i8*
%3 = tail call i32 (...) @nondet_int()
%4 = getelementptr inbounds [10 x i32], [10 x i32]* %1, i64 0, i64 0
store i32 %3, i32* %4
%5 = tail call i32 (i8*, i32, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i32 0, i32 %3)
%6 = xor i32 %3, -1
%7 = lshr i32 %6, 31
%8 = tail call i32 @__CPROVER_assume(i32 %7)
%9 = icmp slt i32 %3, 11
%10 = zext i1 %9 to i32
%11 = tail call i32 @__CPROVER_assume(i32 %10)
%12 = tail call i32 @__CPROVER_assume(i32 1)
br label %13
13: ; preds = %0, %13
%14 = phi i64 [ 1, %0 ], [ %32, %13 ]
%15 = tail call i32 (...) @nondet_int()
%16 = getelementptr inbounds [10 x i32], [10 x i32]* %1, i64 0, i64 %14
store i32 %15, i32* %16
%17 = trunc i64 %14 to i32
%18 = tail call i32 (i8*, i32, ...) @printf(i8* getelementptr inbounds ([19 x i8], [19 x i8]* @.str, i64 0, i64 0), i32 %17, i32 %15)
%19 = xor i32 %15, -1
%20 = lshr i32 %19, 31
%21 = tail call i32 @__CPROVER_assume(i32 %20)
%22 = icmp slt i32 %15, 11
%23 = zext i1 %22 to i32
%24 = tail call i32 @__CPROVER_assume(i32 %23)
%25 = add nuw i64 %14, 4294967295
%26 = and i64 %25, 4294967295
%27 = getelementptr inbounds [10 x i32], [10 x i32]* %1, i64 0, i64 %26
%28 = load i32, i32* %27
%29 = icmp sge i32 %15, %28
%30 = zext i1 %29 to i32
%31 = tail call i32 @__CPROVER_assume(i32 %30)
%32 = add nuw nsw i64 %14, 1
%33 = icmp eq i64 %32, 10
br i1 %33, label %34, label %13
34: ; preds = %13
%35 = tail call i32 (...) @nondet_int()
%36 = tail call i32 (i8*, i32, ...) @printf(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.1, i64 0, i64 0), i32 %35)
%37 = call i32 @binsearch(i32* %4, i32 10, i32 %35)
%38 = call i32 (i8*, i32, ...) @printf(i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str.2, i64 0, i64 0), i32 %37)
%39 = icmp eq i32 %37, -1
br i1 %39, label %46, label %40
40: ; preds = %34
%41 = sext i32 %37 to i64
%42 = getelementptr inbounds [10 x i32], [10 x i32]* %1, i64 0, i64 %41
%43 = load i32, i32* %42
%44 = icmp eq i32 %43, %35
%45 = zext i1 %44 to i32
br label %46
46: ; preds = %40, %34
%47 = phi i32 [ 1, %34 ], [ %45, %40 ]
%48 = call i32 @assert(i32 %47)
ret i32 0
}