#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
    struct T *prev;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  while (__nondet()) {
    y = malloc(sizeof(struct T));
    y->next = x;
    y->prev = NULL;
    if (x)
      x->prev = y;
    x = y;
  }
  struct T *sorted = NULL;
  struct T *pred = NULL;
  struct T *z = NULL;
  while (x) {
    y = x;
    x = x->next;
    if (x)
      x->prev = NULL;
    z = sorted;
    pred = NULL;
    while (z && __nondet()) {
      pred = z;
      z = z->next;
    }
    y->next = z;
    if (z)
      z->prev = y;
    y->prev = pred;
    if (pred)
      pred->next = y;
    else
      sorted = y;
  }
  while (sorted != NULL) {
    y = sorted;
    sorted = sorted->next;
    free(y);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x40,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     11a9 <main+0x79>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
movq   $0x0,0x8(%rax)
cmpq   $0x0,-0x10(%rbp)
je     119c <main+0x6c>
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    114f <main+0x1f>
movq   $0x0,-0x20(%rbp)
movq   $0x0,-0x28(%rbp)
movq   $0x0,-0x30(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     12a5 <main+0x175>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x10(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     11f6 <main+0xc6>
mov    -0x10(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x20(%rbp),%rax
mov    %rax,-0x30(%rbp)
movq   $0x0,-0x28(%rbp)
xor    %eax,%eax
cmpq   $0x0,-0x30(%rbp)
mov    %al,-0x31(%rbp)
je     1227 <main+0xf7>
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
setne  %al
mov    %al,-0x31(%rbp)
mov    -0x31(%rbp),%al
test   $0x1,%al
jne    1237 <main+0x107>
jmp    124f <main+0x11f>
mov    -0x30(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x30(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x30(%rbp)
jmp    1206 <main+0xd6>
mov    -0x30(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
cmpq   $0x0,-0x30(%rbp)
je     1271 <main+0x141>
mov    -0x18(%rbp),%rcx
mov    -0x30(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x28(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,0x8(%rax)
cmpq   $0x0,-0x28(%rbp)
je     1298 <main+0x168>
mov    -0x18(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
jmp    12a0 <main+0x170>
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
jmp    11c1 <main+0x91>
jmp    12aa <main+0x17a>
cmpq   $0x0,-0x20(%rbp)
je     12d6 <main+0x1a6>
mov    -0x20(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x20(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    12aa <main+0x17a>
xor    %eax,%eax
add    $0x40,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     1243 <main+0x113>
xor    %ebx,%ebx
jmp    115f <main+0x2f>
nopl   (%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r12,%rbx
test   %rax,%rax
je     1182 <main+0x52>
mov    $0x10,%edi
call   1050 <malloc@plt>
mov    %rax,%r12
mov    %rbx,(%rax)
movq   $0x0,0x8(%rax)
test   %rbx,%rbx
je     1150 <main+0x20>
mov    %r12,0x8(%rbx)
jmp    1150 <main+0x20>
xor    %r14d,%r14d
jmp    11a0 <main+0x70>
nopw   0x0(%rax,%rax,1)
mov    %r12,0x0(%r13)
mov    %r15,%r12
test   %r15,%r15
je     1224 <main+0xf4>
mov    (%r12),%r15
test   %r15,%r15
je     11b1 <main+0x81>
movq   $0x0,0x8(%r15)
test   %r14,%r14
je     11f0 <main+0xc0>
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r14,%rbx
test   %rax,%rax
je     1200 <main+0xd0>
cs nopw 0x0(%rax,%rax,1)
nop
mov    %rbx,%r13
mov    (%rbx),%rbx
test   %rbx,%rbx
je     11f3 <main+0xc3>
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
jne    11d0 <main+0xa0>
jmp    1206 <main+0xd6>
nopl   0x0(%rax)
xor    %r13d,%r13d
movq   $0x0,(%r12)
jmp    120e <main+0xde>
nopl   (%rax)
mov    %r14,%rbx
xor    %r13d,%r13d
mov    %rbx,(%r12)
mov    %r12,0x8(%rbx)
mov    %r13,0x8(%r12)
test   %r13,%r13
jne    1190 <main+0x60>
mov    %r12,%r14
jmp    1194 <main+0x64>
test   %r14,%r14
je     1243 <main+0x113>
nopl   0x0(%rax)
mov    (%r14),%rbx
mov    %r14,%rdi
call   1030 <free@plt>
mov    %rbx,%r14
test   %rbx,%rbx
jne    1230 <main+0x100>
xor    %eax,%eax
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.T = type { %struct.T*, %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
%5 = alloca %struct.T*
%6 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
br label %7
7: ; preds = %24, %0
%8 = call i64 (...) @__nondet()
%9 = icmp ne i64 %8, 0
br i1 %9, label %10, label %26
10: ; preds = %7
%11 = call %struct.T.0* @malloc(i32 16)
%12 = bitcast %struct.T.0* %11 to %struct.T*
store %struct.T* %12, %struct.T** %3
%13 = load %struct.T*, %struct.T** %2
%14 = load %struct.T*, %struct.T** %3
%15 = getelementptr inbounds %struct.T, %struct.T* %14, i32 0, i32 0
store %struct.T* %13, %struct.T** %15
%16 = load %struct.T*, %struct.T** %3
%17 = getelementptr inbounds %struct.T, %struct.T* %16, i32 0, i32 1
store %struct.T* null, %struct.T** %17
%18 = load %struct.T*, %struct.T** %2
%19 = icmp ne %struct.T* %18, null
br i1 %19, label %20, label %24
20: ; preds = %10
%21 = load %struct.T*, %struct.T** %3
%22 = load %struct.T*, %struct.T** %2
%23 = getelementptr inbounds %struct.T, %struct.T* %22, i32 0, i32 1
store %struct.T* %21, %struct.T** %23
br label %24
24: ; preds = %20, %10
%25 = load %struct.T*, %struct.T** %3
store %struct.T* %25, %struct.T** %2
br label %7
26: ; preds = %7
store %struct.T* null, %struct.T** %4
store %struct.T* null, %struct.T** %5
store %struct.T* null, %struct.T** %6
br label %27
27: ; preds = %77, %26
%28 = load %struct.T*, %struct.T** %2
%29 = icmp ne %struct.T* %28, null
br i1 %29, label %30, label %78
30: ; preds = %27
%31 = load %struct.T*, %struct.T** %2
store %struct.T* %31, %struct.T** %3
%32 = load %struct.T*, %struct.T** %2
%33 = getelementptr inbounds %struct.T, %struct.T* %32, i32 0, i32 0
%34 = load %struct.T*, %struct.T** %33
store %struct.T* %34, %struct.T** %2
%35 = load %struct.T*, %struct.T** %2
%36 = icmp ne %struct.T* %35, null
br i1 %36, label %37, label %40
37: ; preds = %30
%38 = load %struct.T*, %struct.T** %2
%39 = getelementptr inbounds %struct.T, %struct.T* %38, i32 0, i32 1
store %struct.T* null, %struct.T** %39
br label %40
40: ; preds = %37, %30
%41 = load %struct.T*, %struct.T** %4
store %struct.T* %41, %struct.T** %6
store %struct.T* null, %struct.T** %5
br label %42
42: ; preds = %50, %40
%43 = load %struct.T*, %struct.T** %6
%44 = icmp ne %struct.T* %43, null
br i1 %44, label %45, label %48
45: ; preds = %42
%46 = call i64 (...) @__nondet()
%47 = icmp ne i64 %46, 0
br label %48
48: ; preds = %45, %42
%49 = phi i1 [ false, %42 ], [ %47, %45 ]
br i1 %49, label %50, label %55
50: ; preds = %48
%51 = load %struct.T*, %struct.T** %6
store %struct.T* %51, %struct.T** %5
%52 = load %struct.T*, %struct.T** %6
%53 = getelementptr inbounds %struct.T, %struct.T* %52, i32 0, i32 0
%54 = load %struct.T*, %struct.T** %53
store %struct.T* %54, %struct.T** %6
br label %42
55: ; preds = %48
%56 = load %struct.T*, %struct.T** %6
%57 = load %struct.T*, %struct.T** %3
%58 = getelementptr inbounds %struct.T, %struct.T* %57, i32 0, i32 0
store %struct.T* %56, %struct.T** %58
%59 = load %struct.T*, %struct.T** %6
%60 = icmp ne %struct.T* %59, null
br i1 %60, label %61, label %65
61: ; preds = %55
%62 = load %struct.T*, %struct.T** %3
%63 = load %struct.T*, %struct.T** %6
%64 = getelementptr inbounds %struct.T, %struct.T* %63, i32 0, i32 1
store %struct.T* %62, %struct.T** %64
br label %65
65: ; preds = %61, %55
%66 = load %struct.T*, %struct.T** %5
%67 = load %struct.T*, %struct.T** %3
%68 = getelementptr inbounds %struct.T, %struct.T* %67, i32 0, i32 1
store %struct.T* %66, %struct.T** %68
%69 = load %struct.T*, %struct.T** %5
%70 = icmp ne %struct.T* %69, null
br i1 %70, label %71, label %75
71: ; preds = %65
%72 = load %struct.T*, %struct.T** %3
%73 = load %struct.T*, %struct.T** %5
%74 = getelementptr inbounds %struct.T, %struct.T* %73, i32 0, i32 0
store %struct.T* %72, %struct.T** %74
br label %77
75: ; preds = %65
%76 = load %struct.T*, %struct.T** %3
store %struct.T* %76, %struct.T** %4
br label %77
77: ; preds = %75, %71
br label %27
78: ; preds = %27
br label %79
79: ; preds = %82, %78
%80 = load %struct.T*, %struct.T** %4
%81 = icmp ne %struct.T* %80, null
br i1 %81, label %82, label %90
82: ; preds = %79
%83 = load %struct.T*, %struct.T** %4
store %struct.T* %83, %struct.T** %3
%84 = load %struct.T*, %struct.T** %4
%85 = getelementptr inbounds %struct.T, %struct.T* %84, i32 0, i32 0
%86 = load %struct.T*, %struct.T** %85
store %struct.T* %86, %struct.T** %4
%87 = load %struct.T*, %struct.T** %3
%88 = bitcast %struct.T* %87 to %struct.T.1*
%89 = call i32 @free(%struct.T.1* %88)
br label %79
90: ; preds = %79
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T*, %struct.T* }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call i64 (...) @__nondet()
%2 = icmp eq i64 %1, 0
br i1 %2, label %62, label %5
3: ; preds = %15
%4 = bitcast %struct.T.0* %7 to %struct.T*
br label %20
5: ; preds = %0, %15
%6 = phi %struct.T* [ %8, %15 ], [ null, %0 ]
%7 = tail call %struct.T.0* @malloc(i32 16)
%8 = bitcast %struct.T.0* %7 to %struct.T*
%9 = bitcast %struct.T.0* %7 to %struct.T**
store %struct.T* %6, %struct.T** %9
%10 = getelementptr inbounds %struct.T, %struct.T* %8, i64 0, i32 1
store %struct.T* null, %struct.T** %10
%11 = icmp eq %struct.T* %6, null
br i1 %11, label %15, label %12
12: ; preds = %5
%13 = getelementptr inbounds %struct.T, %struct.T* %6, i64 0, i32 1
%14 = bitcast %struct.T** %13 to %struct.T.0**
store %struct.T.0* %7, %struct.T.0** %14
br label %15
15: ; preds = %12, %5
%16 = tail call i64 (...) @__nondet()
%17 = icmp eq i64 %16, 0
br i1 %17, label %3, label %5
18: ; preds = %53
%19 = icmp eq %struct.T* %54, null
br i1 %19, label %62, label %55
20: ; preds = %3, %53
%21 = phi %struct.T* [ %54, %53 ], [ null, %3 ]
%22 = phi %struct.T* [ %24, %53 ], [ %4, %3 ]
%23 = getelementptr inbounds %struct.T, %struct.T* %22, i64 0, i32 0
%24 = load %struct.T*, %struct.T** %23
%25 = icmp eq %struct.T* %24, null
br i1 %25, label %28, label %26
26: ; preds = %20
%27 = getelementptr inbounds %struct.T, %struct.T* %24, i64 0, i32 1
store %struct.T* null, %struct.T** %27
br label %28
28: ; preds = %26, %20
%29 = icmp eq %struct.T* %21, null
br i1 %29, label %45, label %30
30: ; preds = %28
%31 = tail call i64 (...) @__nondet()
%32 = icmp eq i64 %31, 0
br i1 %32, label %41, label %36
33: ; preds = %36
%34 = tail call i64 (...) @__nondet()
%35 = icmp eq i64 %34, 0
br i1 %35, label %41, label %36
36: ; preds = %30, %33
%37 = phi %struct.T* [ %39, %33 ], [ %21, %30 ]
%38 = getelementptr inbounds %struct.T, %struct.T* %37, i64 0, i32 0
%39 = load %struct.T*, %struct.T** %38
%40 = icmp eq %struct.T* %39, null
br i1 %40, label %45, label %33
41: ; preds = %33, %30
%42 = phi %struct.T* [ %21, %30 ], [ %39, %33 ]
%43 = phi %struct.T* [ null, %30 ], [ %37, %33 ]
store %struct.T* %42, %struct.T** %23
%44 = getelementptr inbounds %struct.T, %struct.T* %42, i64 0, i32 1
store %struct.T* %22, %struct.T** %44
br label %47
45: ; preds = %36, %28
%46 = phi %struct.T* [ null, %28 ], [ %37, %36 ]
store %struct.T* null, %struct.T** %23
br label %47
47: ; preds = %45, %41
%48 = phi %struct.T* [ %46, %45 ], [ %43, %41 ]
%49 = getelementptr inbounds %struct.T, %struct.T* %22, i64 0, i32 1
store %struct.T* %48, %struct.T** %49
%50 = icmp eq %struct.T* %48, null
br i1 %50, label %53, label %51
51: ; preds = %47
%52 = getelementptr inbounds %struct.T, %struct.T* %48, i64 0, i32 0
store %struct.T* %22, %struct.T** %52
br label %53
53: ; preds = %47, %51
%54 = phi %struct.T* [ %21, %51 ], [ %22, %47 ]
br i1 %25, label %18, label %20
55: ; preds = %18, %55
%56 = phi %struct.T* [ %58, %55 ], [ %54, %18 ]
%57 = getelementptr inbounds %struct.T, %struct.T* %56, i64 0, i32 0
%58 = load %struct.T*, %struct.T** %57
%59 = bitcast %struct.T* %56 to %struct.T.1*
%60 = tail call i32 @free(%struct.T.1* %59)
%61 = icmp eq %struct.T* %58, null
br i1 %61, label %62, label %55
62: ; preds = %55, %0, %18
ret i32 0
}