void test_sprintf_chk_range_schar(void) {
  do {
    if (!0 || 188 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(0, 1));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 191 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(0, 127));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 194 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(1024, 1033));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 197 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(1024, 1034));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 200 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi",
                              range_sint(1024, 2035));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 206 == 0) {
      char *d;
      (d) = __builtin_malloc(0);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 207 == 0) {
      char *d;
      (d) = __builtin_malloc(1);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 208 == 0) {
      char *d;
      (d) = __builtin_malloc(2);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 209 == 0) {
      char *d;
      (d) = __builtin_malloc(2);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(-1, 0));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 210 == 0) {
      char *d;
      (d) = __builtin_malloc(2);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(9, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 212 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(-9, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 213 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(-99, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 214 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 215 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i",
                              range_schar(0, 100));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 220 == 0) {
      char *d;
      (d) = __builtin_malloc(3);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i%i",
                              range_schar(1, 10), range_schar(9, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 222 == 0) {
      char *d;
      (d) = __builtin_malloc(4);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i%i",
                              range_schar(10, 11), range_schar(12, 13));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 224 == 0) {
      char *d;
      (d) = __builtin_malloc(5);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i%i",
                              range_schar(-9, 99), range_schar(-9, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 226 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 9), range_schar(0, 9),
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 227 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 9), range_schar(0, 9),
                              range_schar(0, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 228 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 9), range_schar(0, 10),
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 229 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%i_%i_%i",
                              range_schar(0, 10), range_schar(0, 9),
                              range_schar(0, 9));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 230 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%hhi_%hi_%i",
                              range_schar(0, 9), range_schar(0, 10),
                              range_schar(0, 10));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 231 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%3i|%2i/%1i",
                              range_schar(0, 99), range_schar(0, 99),
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 232 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%.3i|%.2i/%i",
                              range_schar(0, 99), range_schar(0, 99),
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 233 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%.3i|%.2i/%i",
                              range_schar(0, 119), range_schar(0, 99),
                              range_schar(0, 99));
      sink(d);
    }
  } while (0);
  do {
    if (!0 || 234 == 0) {
      char *d;
      (d) = __builtin_malloc(6);
      __builtin___sprintf_chk(d, 0, __builtin_object_size(d, 0), "%.3i|%.2i/%i",
                              range_schar(0, 1), range_schar(0, 2),
                              range_schar(0, 3));
      sink(d);
    }
  } while (0);
}


x86 assembly (clang, -O0):
<test_sprintf_chk_range_schar>:
push   %rbp
mov    %rsp,%rbp
sub    $0x210,%rsp
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0xd8(%rbp)
xor    %edi,%edi
mov    $0x1,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0xd8(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xe65(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    11b2 <test_sprintf_chk_range_schar+0x62>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0xe0(%rbp)
xor    %edi,%edi
mov    $0x7f,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0xe0(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xe0e(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x10(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1209 <test_sprintf_chk_range_schar+0xb9>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
mov    %rax,-0xe8(%rbp)
mov    $0x400,%edi
mov    $0x409,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0xe8(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xdb4(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x18(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1263 <test_sprintf_chk_range_schar+0x113>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0xf0(%rbp)
mov    $0x400,%edi
mov    $0x40a,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0xf0(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xd5a(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x20(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    12bd <test_sprintf_chk_range_schar+0x16d>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0xf8(%rbp)
mov    $0x400,%edi
mov    $0x7f3,%esi
mov    $0x0,%al
call   1050 <range_sint@plt>
mov    -0xf8(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xd00(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x28(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1317 <test_sprintf_chk_range_schar+0x1c7>
xor    %eax,%eax
mov    %eax,%edi
call   1060 <malloc@plt>
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rax
mov    %rax,-0x100(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x100(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xcde(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x30(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    136e <test_sprintf_chk_range_schar+0x21e>
mov    $0x1,%edi
call   1060 <malloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rax
mov    %rax,-0x108(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x108(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xc86(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x38(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    13c6 <test_sprintf_chk_range_schar+0x276>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rax
mov    %rax,-0x110(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x110(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xc2e(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x40(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    141e <test_sprintf_chk_range_schar+0x2ce>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,-0x48(%rbp)
mov    -0x48(%rbp),%rax
mov    %rax,-0x118(%rbp)
mov    $0xffffffff,%edi
xor    %esi,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x118(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xbd6(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x48(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1476 <test_sprintf_chk_range_schar+0x326>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rax
mov    %rax,-0x120(%rbp)
mov    $0x9,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x120(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xb7b(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x50(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    14d1 <test_sprintf_chk_range_schar+0x381>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x58(%rbp)
mov    -0x58(%rbp),%rax
mov    %rax,-0x128(%rbp)
mov    $0xfffffff7,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x128(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xb20(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x58(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    152c <test_sprintf_chk_range_schar+0x3dc>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x60(%rbp)
mov    -0x60(%rbp),%rax
mov    %rax,-0x130(%rbp)
mov    $0xffffff9d,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x130(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xac5(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x60(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1587 <test_sprintf_chk_range_schar+0x437>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x68(%rbp)
mov    -0x68(%rbp),%rax
mov    %rax,-0x138(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x138(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xa6d(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x68(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    15df <test_sprintf_chk_range_schar+0x48f>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x70(%rbp)
mov    -0x70(%rbp),%rax
mov    %rax,-0x140(%rbp)
xor    %edi,%edi
mov    $0x64,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x140(%rbp),%rdi
mov    %eax,%r8d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0xa15(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x70(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1637 <test_sprintf_chk_range_schar+0x4e7>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,-0x78(%rbp)
mov    -0x78(%rbp),%rax
mov    %rax,-0x150(%rbp)
mov    $0x1,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x144(%rbp)
mov    $0x9,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x150(%rbp),%rdi
mov    -0x144(%rbp),%r8d
mov    %eax,%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x96c(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x78(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    16b0 <test_sprintf_chk_range_schar+0x560>
mov    $0x4,%edi
call   1060 <malloc@plt>
mov    %rax,-0x80(%rbp)
mov    -0x80(%rbp),%rax
mov    %rax,-0x160(%rbp)
mov    $0xa,%edi
mov    $0xb,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x154(%rbp)
mov    $0xc,%edi
mov    $0xd,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x160(%rbp),%rdi
mov    -0x154(%rbp),%r8d
mov    %eax,%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x8f3(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x80(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1729 <test_sprintf_chk_range_schar+0x5d9>
mov    $0x5,%edi
call   1060 <malloc@plt>
mov    %rax,-0x88(%rbp)
mov    -0x88(%rbp),%rax
mov    %rax,-0x170(%rbp)
mov    $0xfffffff7,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x164(%rbp)
mov    $0xfffffff7,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x170(%rbp),%rdi
mov    -0x164(%rbp),%r8d
mov    %eax,%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x874(%rip),%rcx
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x88(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    17ab <test_sprintf_chk_range_schar+0x65b>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0x90(%rbp)
mov    -0x90(%rbp),%rax
mov    %rax,-0x180(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x178(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x174(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x180(%rbp),%rdi
mov    -0x178(%rbp),%r8d
mov    -0x174(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x7e5(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x90(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1842 <test_sprintf_chk_range_schar+0x6f2>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0x98(%rbp)
mov    -0x98(%rbp),%rax
mov    %rax,-0x190(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x188(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x184(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x190(%rbp),%rdi
mov    -0x188(%rbp),%r8d
mov    -0x184(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x74e(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0x98(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    18d9 <test_sprintf_chk_range_schar+0x789>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xa0(%rbp)
mov    -0xa0(%rbp),%rax
mov    %rax,-0x1a0(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x198(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x194(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1a0(%rbp),%rdi
mov    -0x198(%rbp),%r8d
mov    -0x194(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x6b7(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xa0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1970 <test_sprintf_chk_range_schar+0x820>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xa8(%rbp)
mov    -0xa8(%rbp),%rax
mov    %rax,-0x1b0(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1a8(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1a4(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1b0(%rbp),%rdi
mov    -0x1a8(%rbp),%r8d
mov    -0x1a4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x620(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xa8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1a07 <test_sprintf_chk_range_schar+0x8b7>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xb0(%rbp)
mov    -0xb0(%rbp),%rax
mov    %rax,-0x1c0(%rbp)
xor    %edi,%edi
mov    $0x9,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1b8(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1b4(%rbp)
xor    %edi,%edi
mov    $0xa,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1c0(%rbp),%rdi
mov    -0x1b8(%rbp),%r8d
mov    -0x1b4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x592(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xb0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1a9e <test_sprintf_chk_range_schar+0x94e>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xb8(%rbp)
mov    -0xb8(%rbp),%rax
mov    %rax,-0x1d0(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1c8(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1c4(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1d0(%rbp),%rdi
mov    -0x1c8(%rbp),%r8d
mov    -0x1c4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x507(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xb8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1b35 <test_sprintf_chk_range_schar+0x9e5>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xc0(%rbp)
mov    -0xc0(%rbp),%rax
mov    %rax,-0x1e0(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1d8(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1d4(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1e0(%rbp),%rdi
mov    -0x1d8(%rbp),%r8d
mov    -0x1d4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x47c(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xc0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1bcc <test_sprintf_chk_range_schar+0xa7c>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xc8(%rbp)
mov    -0xc8(%rbp),%rax
mov    %rax,-0x1f0(%rbp)
xor    %edi,%edi
mov    $0x77,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1e8(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1e4(%rbp)
xor    %edi,%edi
mov    $0x63,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x1f0(%rbp),%rdi
mov    -0x1e8(%rbp),%r8d
mov    -0x1e4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x3e5(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xc8(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
jmp    1c63 <test_sprintf_chk_range_schar+0xb13>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,-0xd0(%rbp)
mov    -0xd0(%rbp),%rax
mov    %rax,-0x200(%rbp)
xor    %edi,%edi
mov    $0x1,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1f8(%rbp)
xor    %edi,%edi
mov    $0x2,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    %eax,-0x1f4(%rbp)
xor    %edi,%edi
mov    $0x3,%esi
mov    $0x0,%al
call   1030 <range_schar@plt>
mov    -0x200(%rbp),%rdi
mov    -0x1f8(%rbp),%r8d
mov    -0x1f4(%rbp),%r9d
xor    %esi,%esi
mov    $0xffffffffffffffff,%rdx
lea    0x34e(%rip),%rcx
mov    %eax,(%rsp)
mov    $0x0,%al
call   1070 <__sprintf_chk@plt>
mov    -0xd0(%rbp),%rdi
mov    $0x0,%al
call   1040 <sink@plt>
add    $0x210,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test_sprintf_chk_range_schar>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x1,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
lea    0xe8a(%rip),%r14
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x7f,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x400,%edi
mov    $0x409,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x400,%edi
mov    $0x40a,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x400,%edi
mov    $0x7f3,%esi
xor    %eax,%eax
call   1050 <range_sint@plt>
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
lea    0xda1(%rip),%r14
mov    %rbx,%rdi
xor    %esi,%esi
xor    %edx,%edx
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x1,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x1,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x2,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xffffffff,%edi
xor    %esi,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x2,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x2,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x9,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x2,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xfffffff7,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xffffff9d,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x64,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %eax,%r8d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x3,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0x1,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
mov    $0x9,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
lea    0xb32(%rip),%r14
mov    $0x3,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %ebp,%r8d
mov    %eax,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x4,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xa,%edi
mov    $0xb,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
mov    $0xc,%edi
mov    $0xd,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x4,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %ebp,%r8d
mov    %eax,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x5,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    $0xfffffff7,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
mov    $0xfffffff7,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    $0x5,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %ebp,%r8d
mov    %eax,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0xa23(%rip),%r14
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x9,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r14d
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0xa,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0x899(%rip),%rcx
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r14d
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0x83e(%rip),%rcx
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
lea    0x7e3(%rip),%r14
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x77,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x63,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
call   1040 <sink@plt>
mov    $0x6,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
xor    %edi,%edi
mov    $0x1,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%r15d
xor    %edi,%edi
mov    $0x2,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,%ebp
xor    %edi,%edi
mov    $0x3,%esi
xor    %eax,%eax
call   1030 <range_schar@plt>
mov    %eax,(%rsp)
mov    $0x6,%edx
mov    %rbx,%rdi
xor    %esi,%esi
mov    %r14,%rcx
mov    %r15d,%r8d
mov    %ebp,%r9d
xor    %eax,%eax
call   1070 <__sprintf_chk@plt>
mov    %rbx,%rdi
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
jmp    1040 <sink@plt>

LLVM IR (-O0):
@.str = [5 x i8] c"%hhi\00"
@.str.1 = [3 x i8] c"%i\00"
@.str.2 = [5 x i8] c"%i%i\00"
@.str.3 = [9 x i8] c"%i_%i_%i\00"
@.str.4 = [12 x i8] c"%hhi_%hi_%i\00"
@.str.5 = [12 x i8] c"%3i|%2i/%1i\00"
@.str.6 = [13 x i8] c"%.3i|%.2i/%i\00"
define void @test_sprintf_chk_range_schar() {
%1 = alloca i8*
%2 = alloca i8*
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca i8*
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i8*
%19 = alloca i8*
%20 = alloca i8*
%21 = alloca i8*
%22 = alloca i8*
%23 = alloca i8*
%24 = alloca i8*
%25 = alloca i8*
%26 = alloca i8*
br label %27
27: ; preds = %0
%28 = call i8* @malloc(i64 0)
store i8* %28, i8** %1
%29 = load i8*, i8** %1
%30 = load i8*, i8** %1
%31 = call i64 @llvm.objectsize.i64.p0i8(i8* %30, i1 false, i1 true, i1 false)
%32 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 1)
%33 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %29, i32 0, i64 %31, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %32)
%34 = load i8*, i8** %1
%35 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %34)
br label %36
36: ; preds = %27
br label %37
37: ; preds = %36
%38 = call i8* @malloc(i64 0)
store i8* %38, i8** %2
%39 = load i8*, i8** %2
%40 = load i8*, i8** %2
%41 = call i64 @llvm.objectsize.i64.p0i8(i8* %40, i1 false, i1 true, i1 false)
%42 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 127)
%43 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %39, i32 0, i64 %41, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %42)
%44 = load i8*, i8** %2
%45 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %44)
br label %46
46: ; preds = %37
br label %47
47: ; preds = %46
%48 = call i8* @malloc(i64 0)
store i8* %48, i8** %3
%49 = load i8*, i8** %3
%50 = load i8*, i8** %3
%51 = call i64 @llvm.objectsize.i64.p0i8(i8* %50, i1 false, i1 true, i1 false)
%52 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1033)
%53 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %49, i32 0, i64 %51, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %52)
%54 = load i8*, i8** %3
%55 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %54)
br label %56
56: ; preds = %47
br label %57
57: ; preds = %56
%58 = call i8* @malloc(i64 0)
store i8* %58, i8** %4
%59 = load i8*, i8** %4
%60 = load i8*, i8** %4
%61 = call i64 @llvm.objectsize.i64.p0i8(i8* %60, i1 false, i1 true, i1 false)
%62 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1034)
%63 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %59, i32 0, i64 %61, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %62)
%64 = load i8*, i8** %4
%65 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %64)
br label %66
66: ; preds = %57
br label %67
67: ; preds = %66
%68 = call i8* @malloc(i64 0)
store i8* %68, i8** %5
%69 = load i8*, i8** %5
%70 = load i8*, i8** %5
%71 = call i64 @llvm.objectsize.i64.p0i8(i8* %70, i1 false, i1 true, i1 false)
%72 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 2035)
%73 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %69, i32 0, i64 %71, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %72)
%74 = load i8*, i8** %5
%75 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %74)
br label %76
76: ; preds = %67
br label %77
77: ; preds = %76
%78 = call i8* @malloc(i64 0)
store i8* %78, i8** %6
%79 = load i8*, i8** %6
%80 = load i8*, i8** %6
%81 = call i64 @llvm.objectsize.i64.p0i8(i8* %80, i1 false, i1 true, i1 false)
%82 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%83 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %79, i32 0, i64 %81, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %82)
%84 = load i8*, i8** %6
%85 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %84)
br label %86
86: ; preds = %77
br label %87
87: ; preds = %86
%88 = call i8* @malloc(i64 1)
store i8* %88, i8** %7
%89 = load i8*, i8** %7
%90 = load i8*, i8** %7
%91 = call i64 @llvm.objectsize.i64.p0i8(i8* %90, i1 false, i1 true, i1 false)
%92 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%93 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %89, i32 0, i64 %91, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %92)
%94 = load i8*, i8** %7
%95 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %94)
br label %96
96: ; preds = %87
br label %97
97: ; preds = %96
%98 = call i8* @malloc(i64 2)
store i8* %98, i8** %8
%99 = load i8*, i8** %8
%100 = load i8*, i8** %8
%101 = call i64 @llvm.objectsize.i64.p0i8(i8* %100, i1 false, i1 true, i1 false)
%102 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%103 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %99, i32 0, i64 %101, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %102)
%104 = load i8*, i8** %8
%105 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %104)
br label %106
106: ; preds = %97
br label %107
107: ; preds = %106
%108 = call i8* @malloc(i64 2)
store i8* %108, i8** %9
%109 = load i8*, i8** %9
%110 = load i8*, i8** %9
%111 = call i64 @llvm.objectsize.i64.p0i8(i8* %110, i1 false, i1 true, i1 false)
%112 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -1, i32 0)
%113 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %109, i32 0, i64 %111, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %112)
%114 = load i8*, i8** %9
%115 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %114)
br label %116
116: ; preds = %107
br label %117
117: ; preds = %116
%118 = call i8* @malloc(i64 2)
store i8* %118, i8** %10
%119 = load i8*, i8** %10
%120 = load i8*, i8** %10
%121 = call i64 @llvm.objectsize.i64.p0i8(i8* %120, i1 false, i1 true, i1 false)
%122 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%123 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %119, i32 0, i64 %121, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %122)
%124 = load i8*, i8** %10
%125 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %124)
br label %126
126: ; preds = %117
br label %127
127: ; preds = %126
%128 = call i8* @malloc(i64 3)
store i8* %128, i8** %11
%129 = load i8*, i8** %11
%130 = load i8*, i8** %11
%131 = call i64 @llvm.objectsize.i64.p0i8(i8* %130, i1 false, i1 true, i1 false)
%132 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 9)
%133 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %129, i32 0, i64 %131, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %132)
%134 = load i8*, i8** %11
%135 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %134)
br label %136
136: ; preds = %127
br label %137
137: ; preds = %136
%138 = call i8* @malloc(i64 3)
store i8* %138, i8** %12
%139 = load i8*, i8** %12
%140 = load i8*, i8** %12
%141 = call i64 @llvm.objectsize.i64.p0i8(i8* %140, i1 false, i1 true, i1 false)
%142 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -99, i32 99)
%143 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %139, i32 0, i64 %141, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %142)
%144 = load i8*, i8** %12
%145 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %144)
br label %146
146: ; preds = %137
br label %147
147: ; preds = %146
%148 = call i8* @malloc(i64 3)
store i8* %148, i8** %13
%149 = load i8*, i8** %13
%150 = load i8*, i8** %13
%151 = call i64 @llvm.objectsize.i64.p0i8(i8* %150, i1 false, i1 true, i1 false)
%152 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%153 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %149, i32 0, i64 %151, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %152)
%154 = load i8*, i8** %13
%155 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %154)
br label %156
156: ; preds = %147
br label %157
157: ; preds = %156
%158 = call i8* @malloc(i64 3)
store i8* %158, i8** %14
%159 = load i8*, i8** %14
%160 = load i8*, i8** %14
%161 = call i64 @llvm.objectsize.i64.p0i8(i8* %160, i1 false, i1 true, i1 false)
%162 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 100)
%163 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %159, i32 0, i64 %161, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %162)
%164 = load i8*, i8** %14
%165 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %164)
br label %166
166: ; preds = %157
br label %167
167: ; preds = %166
%168 = call i8* @malloc(i64 3)
store i8* %168, i8** %15
%169 = load i8*, i8** %15
%170 = load i8*, i8** %15
%171 = call i64 @llvm.objectsize.i64.p0i8(i8* %170, i1 false, i1 true, i1 false)
%172 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 1, i32 10)
%173 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%174 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %169, i32 0, i64 %171, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i32 %172, i32 %173)
%175 = load i8*, i8** %15
%176 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %175)
br label %177
177: ; preds = %167
br label %178
178: ; preds = %177
%179 = call i8* @malloc(i64 4)
store i8* %179, i8** %16
%180 = load i8*, i8** %16
%181 = load i8*, i8** %16
%182 = call i64 @llvm.objectsize.i64.p0i8(i8* %181, i1 false, i1 true, i1 false)
%183 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 10, i32 11)
%184 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 12, i32 13)
%185 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %180, i32 0, i64 %182, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i32 %183, i32 %184)
%186 = load i8*, i8** %16
%187 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %186)
br label %188
188: ; preds = %178
br label %189
189: ; preds = %188
%190 = call i8* @malloc(i64 5)
store i8* %190, i8** %17
%191 = load i8*, i8** %17
%192 = load i8*, i8** %17
%193 = call i64 @llvm.objectsize.i64.p0i8(i8* %192, i1 false, i1 true, i1 false)
%194 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%195 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%196 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %191, i32 0, i64 %193, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i32 %194, i32 %195)
%197 = load i8*, i8** %17
%198 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %197)
br label %199
199: ; preds = %189
br label %200
200: ; preds = %199
%201 = call i8* @malloc(i64 6)
store i8* %201, i8** %18
%202 = load i8*, i8** %18
%203 = load i8*, i8** %18
%204 = call i64 @llvm.objectsize.i64.p0i8(i8* %203, i1 false, i1 true, i1 false)
%205 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%206 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%207 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%208 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %202, i32 0, i64 %204, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %205, i32 %206, i32 %207)
%209 = load i8*, i8** %18
%210 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %209)
br label %211
211: ; preds = %200
br label %212
212: ; preds = %211
%213 = call i8* @malloc(i64 6)
store i8* %213, i8** %19
%214 = load i8*, i8** %19
%215 = load i8*, i8** %19
%216 = call i64 @llvm.objectsize.i64.p0i8(i8* %215, i1 false, i1 true, i1 false)
%217 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%218 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%219 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%220 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %214, i32 0, i64 %216, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %217, i32 %218, i32 %219)
%221 = load i8*, i8** %19
%222 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %221)
br label %223
223: ; preds = %212
br label %224
224: ; preds = %223
%225 = call i8* @malloc(i64 6)
store i8* %225, i8** %20
%226 = load i8*, i8** %20
%227 = load i8*, i8** %20
%228 = call i64 @llvm.objectsize.i64.p0i8(i8* %227, i1 false, i1 true, i1 false)
%229 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%230 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%231 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%232 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %226, i32 0, i64 %228, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %229, i32 %230, i32 %231)
%233 = load i8*, i8** %20
%234 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %233)
br label %235
235: ; preds = %224
br label %236
236: ; preds = %235
%237 = call i8* @malloc(i64 6)
store i8* %237, i8** %21
%238 = load i8*, i8** %21
%239 = load i8*, i8** %21
%240 = call i64 @llvm.objectsize.i64.p0i8(i8* %239, i1 false, i1 true, i1 false)
%241 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%242 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%243 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%244 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %238, i32 0, i64 %240, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %241, i32 %242, i32 %243)
%245 = load i8*, i8** %21
%246 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %245)
br label %247
247: ; preds = %236
br label %248
248: ; preds = %247
%249 = call i8* @malloc(i64 6)
store i8* %249, i8** %22
%250 = load i8*, i8** %22
%251 = load i8*, i8** %22
%252 = call i64 @llvm.objectsize.i64.p0i8(i8* %251, i1 false, i1 true, i1 false)
%253 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%254 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%255 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%256 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %250, i32 0, i64 %252, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0), i32 %253, i32 %254, i32 %255)
%257 = load i8*, i8** %22
%258 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %257)
br label %259
259: ; preds = %248
br label %260
260: ; preds = %259
%261 = call i8* @malloc(i64 6)
store i8* %261, i8** %23
%262 = load i8*, i8** %23
%263 = load i8*, i8** %23
%264 = call i64 @llvm.objectsize.i64.p0i8(i8* %263, i1 false, i1 true, i1 false)
%265 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%266 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%267 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%268 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %262, i32 0, i64 %264, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i32 %265, i32 %266, i32 %267)
%269 = load i8*, i8** %23
%270 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %269)
br label %271
271: ; preds = %260
br label %272
272: ; preds = %271
%273 = call i8* @malloc(i64 6)
store i8* %273, i8** %24
%274 = load i8*, i8** %24
%275 = load i8*, i8** %24
%276 = call i64 @llvm.objectsize.i64.p0i8(i8* %275, i1 false, i1 true, i1 false)
%277 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%278 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%279 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%280 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %274, i32 0, i64 %276, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %277, i32 %278, i32 %279)
%281 = load i8*, i8** %24
%282 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %281)
br label %283
283: ; preds = %272
br label %284
284: ; preds = %283
%285 = call i8* @malloc(i64 6)
store i8* %285, i8** %25
%286 = load i8*, i8** %25
%287 = load i8*, i8** %25
%288 = call i64 @llvm.objectsize.i64.p0i8(i8* %287, i1 false, i1 true, i1 false)
%289 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 119)
%290 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%291 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%292 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %286, i32 0, i64 %288, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %289, i32 %290, i32 %291)
%293 = load i8*, i8** %25
%294 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %293)
br label %295
295: ; preds = %284
br label %296
296: ; preds = %295
%297 = call i8* @malloc(i64 6)
store i8* %297, i8** %26
%298 = load i8*, i8** %26
%299 = load i8*, i8** %26
%300 = call i64 @llvm.objectsize.i64.p0i8(i8* %299, i1 false, i1 true, i1 false)
%301 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 1)
%302 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 2)
%303 = call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 3)
%304 = call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %298, i32 0, i64 %300, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %301, i32 %302, i32 %303)
%305 = load i8*, i8** %26
%306 = call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %305)
br label %307
307: ; preds = %296
ret void
}

LLVM IR (-O2):
@.str = [5 x i8] c"%hhi\00"
@.str.1 = [3 x i8] c"%i\00"
@.str.2 = [5 x i8] c"%i%i\00"
@.str.3 = [9 x i8] c"%i_%i_%i\00"
@.str.4 = [12 x i8] c"%hhi_%hi_%i\00"
@.str.5 = [12 x i8] c"%3i|%2i/%1i\00"
@.str.6 = [13 x i8] c"%.3i|%.2i/%i\00"
define void @test_sprintf_chk_range_schar() {
%1 = tail call i8* @malloc(i64 0)
%2 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 1)
%3 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %1, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %2)
%4 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %1)
%5 = tail call i8* @malloc(i64 0)
%6 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 0, i32 127)
%7 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %5, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %6)
%8 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %5)
%9 = tail call i8* @malloc(i64 0)
%10 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1033)
%11 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %9, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %10)
%12 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %9)
%13 = tail call i8* @malloc(i64 0)
%14 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 1034)
%15 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %13, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %14)
%16 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %13)
%17 = tail call i8* @malloc(i64 0)
%18 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_sint to i32 (i32, i32, ...)*)(i32 1024, i32 2035)
%19 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %17, i32 0, i64 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 %18)
%20 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %17)
%21 = tail call i8* @malloc(i64 0)
%22 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%23 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %21, i32 0, i64 0, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %22)
%24 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %21)
%25 = tail call dereferenceable_or_null(1) i8* @malloc(i64 1)
%26 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%27 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %25, i32 0, i64 1, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %26)
%28 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %25)
%29 = tail call dereferenceable_or_null(2) i8* @malloc(i64 2)
%30 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%31 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %29, i32 0, i64 2, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %30)
%32 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %29)
%33 = tail call dereferenceable_or_null(2) i8* @malloc(i64 2)
%34 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -1, i32 0)
%35 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %33, i32 0, i64 2, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %34)
%36 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %33)
%37 = tail call dereferenceable_or_null(2) i8* @malloc(i64 2)
%38 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%39 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %37, i32 0, i64 2, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %38)
%40 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %37)
%41 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%42 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 9)
%43 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %41, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %42)
%44 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %41)
%45 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%46 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -99, i32 99)
%47 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %45, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %46)
%48 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %45)
%49 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%50 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%51 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %49, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %50)
%52 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %49)
%53 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%54 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 100)
%55 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %53, i32 0, i64 3, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i32 %54)
%56 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %53)
%57 = tail call dereferenceable_or_null(3) i8* @malloc(i64 3)
%58 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 1, i32 10)
%59 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 9, i32 10)
%60 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %57, i32 0, i64 3, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i32 %58, i32 %59)
%61 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %57)
%62 = tail call dereferenceable_or_null(4) i8* @malloc(i64 4)
%63 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 10, i32 11)
%64 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 12, i32 13)
%65 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %62, i32 0, i64 4, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i32 %63, i32 %64)
%66 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %62)
%67 = tail call dereferenceable_or_null(5) i8* @malloc(i64 5)
%68 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%69 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 -9, i32 99)
%70 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %67, i32 0, i64 5, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.2, i64 0, i64 0), i32 %68, i32 %69)
%71 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %67)
%72 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%73 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%74 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%75 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%76 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %72, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %73, i32 %74, i32 %75)
%77 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %72)
%78 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%79 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%80 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%81 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%82 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %78, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %79, i32 %80, i32 %81)
%83 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %78)
%84 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%85 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%86 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%87 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%88 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %84, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %85, i32 %86, i32 %87)
%89 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %84)
%90 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%91 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%92 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%93 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%94 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %90, i32 0, i64 6, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i32 %91, i32 %92, i32 %93)
%95 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %90)
%96 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%97 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 9)
%98 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%99 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 10)
%100 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %96, i32 0, i64 6, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.4, i64 0, i64 0), i32 %97, i32 %98, i32 %99)
%101 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %96)
%102 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%103 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%104 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%105 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%106 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %102, i32 0, i64 6, i8* getelementptr inbounds ([12 x i8], [12 x i8]* @.str.5, i64 0, i64 0), i32 %103, i32 %104, i32 %105)
%107 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %102)
%108 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%109 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%110 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%111 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%112 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %108, i32 0, i64 6, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %109, i32 %110, i32 %111)
%113 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %108)
%114 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%115 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 119)
%116 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%117 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 99)
%118 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %114, i32 0, i64 6, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %115, i32 %116, i32 %117)
%119 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %114)
%120 = tail call dereferenceable_or_null(6) i8* @malloc(i64 6)
%121 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 1)
%122 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 2)
%123 = tail call i32 (i32, i32, ...) bitcast (i32 (...)* @range_schar to i32 (i32, i32, ...)*)(i32 0, i32 3)
%124 = tail call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* %120, i32 0, i64 6, i8* getelementptr inbounds ([13 x i8], [13 x i8]* @.str.6, i64 0, i64 0), i32 %121, i32 %122, i32 %123)
%125 = tail call i32 (i8*, ...) bitcast (i32 (...)* @sink to i32 (i8*, ...)*)(i8* %120)
ret void
}