#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int __get_array_size(void const *);
int __infer_nondet_int();
void *bsearch(const void *key, const void *base, size_t nmemb, size_t size,
              int (*compar)(const void *, const void *)) {
  int base_size;
  int nondet;
  int offset;
  nondet = __infer_nondet_int();
  offset = __infer_nondet_int();
  base_size = __get_array_size(base);
  if (nmemb > base_size)
    while (1)
      ;
  if (nondet)
    return 0;
  if (offset < 0 || offset >= nmemb)
    while (1)
      ;
  return (void *)base + offset;
}


x86 assembly (clang, -O0):
<bsearch>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %rcx,-0x28(%rbp)
mov    %r8,-0x30(%rbp)
mov    $0x0,%al
call   1030 <__infer_nondet_int@plt>
mov    %eax,-0x38(%rbp)
mov    $0x0,%al
call   1030 <__infer_nondet_int@plt>
mov    %eax,-0x3c(%rbp)
mov    -0x18(%rbp),%rdi
call   1040 <__get_array_size@plt>
mov    %eax,-0x34(%rbp)
mov    -0x20(%rbp),%rax
movslq -0x34(%rbp),%rcx
cmp    %rcx,%rax
jbe    1177 <bsearch+0x57>
jmp    1172 <bsearch+0x52>
jmp    1172 <bsearch+0x52>
cmpl   $0x0,-0x38(%rbp)
je     118e <bsearch+0x6e>
movq   $0x0,-0x8(%rbp)
jmp    11bf <bsearch+0x9f>
cmpl   $0x0,-0x3c(%rbp)
jl     11a6 <bsearch+0x86>
movslq -0x3c(%rbp),%rax
cmp    -0x20(%rbp),%rax
jb     11b0 <bsearch+0x90>
jmp    11ab <bsearch+0x8b>
jmp    11ab <bsearch+0x8b>
mov    -0x18(%rbp),%rax
movslq -0x3c(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<bsearch>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %rdx,%r14
mov    %rsi,%rbx
xor    %eax,%eax
call   1030 <__infer_nondet_int@plt>
mov    %eax,%ebp
xor    %eax,%eax
call   1030 <__infer_nondet_int@plt>
mov    %eax,%r15d
mov    %rbx,%rdi
call   1040 <__get_array_size@plt>
cltq
cmp    %r14,%rax
jae    1152 <bsearch+0x32>
nop
jmp    1150 <bsearch+0x30>
test   %ebp,%ebp
je     1166 <bsearch+0x46>
xor    %ebx,%ebx
mov    %rbx,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
test   %r15d,%r15d
js     1180 <bsearch+0x60>
mov    %r15d,%eax
cmp    %r14,%rax
jae    1180 <bsearch+0x60>
add    %rax,%rbx
jmp    1158 <bsearch+0x38>
nopl   0x0(%rax,%rax,1)
jmp    1180 <bsearch+0x60>

LLVM IR (-O0):
define i8* @bsearch(i8* %0, i8* %1, i64 %2, i64 %3, i32 (i8*, i8*)* %4) {
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i64
%10 = alloca i64
%11 = alloca i32 (i8*, i8*)*
%12 = alloca i32
%13 = alloca i32
%14 = alloca i32
store i8* %0, i8** %7
store i8* %1, i8** %8
store i64 %2, i64* %9
store i64 %3, i64* %10
store i32 (i8*, i8*)* %4, i32 (i8*, i8*)** %11
%15 = call i32 (...) @__infer_nondet_int()
store i32 %15, i32* %13
%16 = call i32 (...) @__infer_nondet_int()
store i32 %16, i32* %14
%17 = load i8*, i8** %8
%18 = call i32 @__get_array_size(i8* %17)
store i32 %18, i32* %12
%19 = load i64, i64* %9
%20 = load i32, i32* %12
%21 = sext i32 %20 to i64
%22 = icmp ugt i64 %19, %21
br i1 %22, label %23, label %25
23: ; preds = %5
br label %24
24: ; preds = %23, %24
br label %24
25: ; preds = %5
%26 = load i32, i32* %13
%27 = icmp ne i32 %26, 0
br i1 %27, label %28, label %29
28: ; preds = %25
store i8* null, i8** %6
br label %44
29: ; preds = %25
%30 = load i32, i32* %14
%31 = icmp slt i32 %30, 0
br i1 %31, label %37, label %32
32: ; preds = %29
%33 = load i32, i32* %14
%34 = sext i32 %33 to i64
%35 = load i64, i64* %9
%36 = icmp uge i64 %34, %35
br i1 %36, label %37, label %39
37: ; preds = %32, %29
br label %38
38: ; preds = %37, %38
br label %38
39: ; preds = %32
%40 = load i8*, i8** %8
%41 = load i32, i32* %14
%42 = sext i32 %41 to i64
%43 = getelementptr i8, i8* %40, i64 %42
store i8* %43, i8** %6
br label %44
44: ; preds = %39, %28
%45 = load i8*, i8** %6
ret i8* %45
}

LLVM IR (-O2):
define i8* @bsearch(i8* nocapture readnone %0, i8* %1, i64 %2, i64 %3, i32 (i8*, i8*)* nocapture readnone %4) {
%6 = tail call i32 (...) @__infer_nondet_int()
%7 = tail call i32 (...) @__infer_nondet_int()
%8 = tail call i32 @__get_array_size(i8* %1)
%9 = sext i32 %8 to i64
%10 = icmp ult i64 %9, %2
br i1 %10, label %11, label %12
11: ; preds = %5, %11
br label %11
12: ; preds = %5
%13 = icmp eq i32 %6, 0
br i1 %13, label %14, label %23
14: ; preds = %12
%15 = icmp slt i32 %7, 0
br i1 %15, label %19, label %16
16: ; preds = %14
%17 = zext i32 %7 to i64
%18 = icmp ult i64 %17, %2
br i1 %18, label %21, label %19
19: ; preds = %16, %14
br label %20
20: ; preds = %19, %20
br label %20
21: ; preds = %16
%22 = getelementptr i8, i8* %1, i64 %17
br label %23
23: ; preds = %12, %21
%24 = phi i8* [ %22, %21 ], [ null, %12 ]
ret i8* %24
}