#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __VERIFIER_nondet_int();
int main() {
  int n = 1;
  while (__VERIFIER_nondet_int() && n < 5) {
    n++;
  }
  int array[n];
  int *p = &array[1];
  int ret = p[n - 2];
  return ret;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
movl   $0x1,-0x8(%rbp)
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
mov    %rax,%rcx
xor    %eax,%eax
cmp    $0x0,%rcx
mov    %al,-0x25(%rbp)
je     1149 <main+0x39>
cmpl   $0x5,-0x8(%rbp)
setl   %al
mov    %al,-0x25(%rbp)
mov    -0x25(%rbp),%al
test   $0x1,%al
jne    1159 <main+0x49>
jmp    1167 <main+0x57>
mov    -0x8(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x8(%rbp)
jmp    1126 <main+0x16>
mov    -0x8(%rbp),%eax
mov    %eax,%ecx
mov    %rsp,%rax
mov    %rax,-0x10(%rbp)
lea    0xf(,%rcx,4),%rdx
and    $0xfffffffffffffff0,%rdx
mov    %rsp,%rax
sub    %rdx,%rax
mov    %rax,%rsp
mov    %rcx,-0x18(%rbp)
add    $0x4,%rax
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    -0x8(%rbp),%ecx
sub    $0x2,%ecx
movslq %ecx,%rcx
mov    (%rax,%rcx,4),%eax
mov    %eax,-0x24(%rbp)
mov    -0x24(%rbp),%eax
mov    %eax,-0x4(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,%rsp
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbx
mov    $0x1,%ebx
cs nopw 0x0(%rax,%rax,1)
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     1136 <main+0x26>
lea    0x1(%rbx),%eax
cmp    $0x5,%ebx
mov    %eax,%ebx
jb     1120 <main+0x10>
pop    %rbx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i8*
%4 = alloca i64
%5 = alloca i32*
%6 = alloca i32
store i32 0, i32* %1
store i32 1, i32* %2
br label %7
7: ; preds = %15, %0
%8 = call i64 (...) @__VERIFIER_nondet_int()
%9 = icmp ne i64 %8, 0
br i1 %9, label %10, label %13
10: ; preds = %7
%11 = load i32, i32* %2
%12 = icmp slt i32 %11, 5
br label %13
13: ; preds = %10, %7
%14 = phi i1 [ false, %7 ], [ %12, %10 ]
br i1 %14, label %15, label %18
15: ; preds = %13
%16 = load i32, i32* %2
%17 = add nsw i32 %16, 1
store i32 %17, i32* %2
br label %7
18: ; preds = %13
%19 = load i32, i32* %2
%20 = zext i32 %19 to i64
%21 = call i8* @llvm.stacksave()
store i8* %21, i8** %3
%22 = alloca i32, i64 %20
store i64 %20, i64* %4
%23 = getelementptr inbounds i32, i32* %22, i64 1
store i32* %23, i32** %5
%24 = load i32*, i32** %5
%25 = load i32, i32* %2
%26 = sub nsw i32 %25, 2
%27 = sext i32 %26 to i64
%28 = getelementptr inbounds i32, i32* %24, i64 %27
%29 = load i32, i32* %28
store i32 %29, i32* %6
%30 = load i32, i32* %6
store i32 %30, i32* %1
%31 = load i8*, i8** %3
%32 = load i32, i32* %1
ret i32 %32
}

LLVM IR (-O2):
define i32 @main() {
br label %1
1: ; preds = %1, %0
%2 = phi i32 [ 1, %0 ], [ %7, %1 ]
%3 = tail call i64 (...) @__VERIFIER_nondet_int()
%4 = icmp ne i64 %3, 0
%5 = icmp ult i32 %2, 5
%6 = select i1 %4, i1 %5, i1 false
%7 = add nuw nsw i32 %2, 1
br i1 %6, label %1, label %8
8: ; preds = %1
ret i32 undef
}