#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
    struct T *prev;
    int data;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  while (__nondet()) {
    y = malloc(sizeof(struct T));
    y->next = x;
    y->prev = NULL;
    y->data = 0;
    if (x)
      x->prev = y;
    x = y;
  }
  y = x;
  while (y != NULL) {
    if (__nondet()) {
      struct T *z = malloc(sizeof(struct T));
      z->next = y->next;
      z->prev = y;
      y->next = z;
      if (z->next)
        z->next->prev = z;
      break;
    }
    y = y->next;
  }
  while (x != NULL) {
    y = x;
    x = x->next;
    free(y);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     11b4 <main+0x84>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x18(%rbp),%rax
movl   $0x0,0x10(%rax)
cmpq   $0x0,-0x10(%rbp)
je     11a7 <main+0x77>
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    114f <main+0x1f>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     123d <main+0x10d>
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     122d <main+0xfd>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x20(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x20(%rbp),%rax
cmpq   $0x0,(%rax)
je     1228 <main+0xf8>
mov    -0x20(%rbp),%rcx
mov    -0x20(%rbp),%rax
mov    (%rax),%rax
mov    %rcx,0x8(%rax)
jmp    123d <main+0x10d>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    11bc <main+0x8c>
jmp    1242 <main+0x112>
cmpq   $0x0,-0x10(%rbp)
je     126e <main+0x13e>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    1242 <main+0x112>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %rbx
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     11e3 <main+0xb3>
xor    %ebx,%ebx
jmp    115f <main+0x2f>
nopl   0x0(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %r15,%rbx
test   %rax,%rax
je     1189 <main+0x59>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,%r15
mov    %rbx,(%rax)
movq   $0x0,0x8(%rax)
movl   $0x0,0x10(%rax)
test   %rbx,%rbx
je     1150 <main+0x20>
mov    %r15,0x8(%rbx)
jmp    1150 <main+0x20>
mov    %r15,%r14
nopl   0x0(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
jne    11a6 <main+0x76>
mov    (%r14),%r14
test   %r14,%r14
jne    1190 <main+0x60>
jmp    11d0 <main+0xa0>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    (%r14),%rcx
mov    %rcx,(%rax)
mov    %r14,0x8(%rax)
mov    %rax,(%r14)
mov    (%rax),%rcx
test   %rcx,%rcx
je     11d0 <main+0xa0>
mov    %rax,0x8(%rcx)
nopl   0x0(%rax)
mov    (%r15),%rbx
mov    %r15,%rdi
call   1030 <free@plt>
mov    %rbx,%r15
test   %rbx,%rbx
jne    11d0 <main+0xa0>
xor    %eax,%eax
pop    %rbx
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
br label %5
5: ; preds = %24, %0
%6 = call i64 (...) @__nondet()
%7 = icmp ne i64 %6, 0
br i1 %7, label %8, label %26
8: ; preds = %5
%9 = call %struct.T.0* @malloc(i32 24)
%10 = bitcast %struct.T.0* %9 to %struct.T*
store %struct.T* %10, %struct.T** %3
%11 = load %struct.T*, %struct.T** %2
%12 = load %struct.T*, %struct.T** %3
%13 = getelementptr inbounds %struct.T, %struct.T* %12, i32 0, i32 0
store %struct.T* %11, %struct.T** %13
%14 = load %struct.T*, %struct.T** %3
%15 = getelementptr inbounds %struct.T, %struct.T* %14, i32 0, i32 1
store %struct.T* null, %struct.T** %15
%16 = load %struct.T*, %struct.T** %3
%17 = getelementptr inbounds %struct.T, %struct.T* %16, i32 0, i32 2
store i32 0, i32* %17
%18 = load %struct.T*, %struct.T** %2
%19 = icmp ne %struct.T* %18, null
br i1 %19, label %20, label %24
20: ; preds = %8
%21 = load %struct.T*, %struct.T** %3
%22 = load %struct.T*, %struct.T** %2
%23 = getelementptr inbounds %struct.T, %struct.T* %22, i32 0, i32 1
store %struct.T* %21, %struct.T** %23
br label %24
24: ; preds = %20, %8
%25 = load %struct.T*, %struct.T** %3
store %struct.T* %25, %struct.T** %2
br label %5
26: ; preds = %5
%27 = load %struct.T*, %struct.T** %2
store %struct.T* %27, %struct.T** %3
br label %28
28: ; preds = %59, %26
%29 = load %struct.T*, %struct.T** %3
%30 = icmp ne %struct.T* %29, null
br i1 %30, label %31, label %63
31: ; preds = %28
%32 = call i64 (...) @__nondet()
%33 = icmp ne i64 %32, 0
br i1 %33, label %34, label %59
34: ; preds = %31
%35 = call %struct.T.0* @malloc(i32 24)
%36 = bitcast %struct.T.0* %35 to %struct.T*
store %struct.T* %36, %struct.T** %4
%37 = load %struct.T*, %struct.T** %3
%38 = getelementptr inbounds %struct.T, %struct.T* %37, i32 0, i32 0
%39 = load %struct.T*, %struct.T** %38
%40 = load %struct.T*, %struct.T** %4
%41 = getelementptr inbounds %struct.T, %struct.T* %40, i32 0, i32 0
store %struct.T* %39, %struct.T** %41
%42 = load %struct.T*, %struct.T** %3
%43 = load %struct.T*, %struct.T** %4
%44 = getelementptr inbounds %struct.T, %struct.T* %43, i32 0, i32 1
store %struct.T* %42, %struct.T** %44
%45 = load %struct.T*, %struct.T** %4
%46 = load %struct.T*, %struct.T** %3
%47 = getelementptr inbounds %struct.T, %struct.T* %46, i32 0, i32 0
store %struct.T* %45, %struct.T** %47
%48 = load %struct.T*, %struct.T** %4
%49 = getelementptr inbounds %struct.T, %struct.T* %48, i32 0, i32 0
%50 = load %struct.T*, %struct.T** %49
%51 = icmp ne %struct.T* %50, null
br i1 %51, label %52, label %58
52: ; preds = %34
%53 = load %struct.T*, %struct.T** %4
%54 = load %struct.T*, %struct.T** %4
%55 = getelementptr inbounds %struct.T, %struct.T* %54, i32 0, i32 0
%56 = load %struct.T*, %struct.T** %55
%57 = getelementptr inbounds %struct.T, %struct.T* %56, i32 0, i32 1
store %struct.T* %53, %struct.T** %57
br label %58
58: ; preds = %52, %34
br label %63
59: ; preds = %31
%60 = load %struct.T*, %struct.T** %3
%61 = getelementptr inbounds %struct.T, %struct.T* %60, i32 0, i32 0
%62 = load %struct.T*, %struct.T** %61
store %struct.T* %62, %struct.T** %3
br label %28
63: ; preds = %58, %28
br label %64
64: ; preds = %67, %63
%65 = load %struct.T*, %struct.T** %2
%66 = icmp ne %struct.T* %65, null
br i1 %66, label %67, label %75
67: ; preds = %64
%68 = load %struct.T*, %struct.T** %2
store %struct.T* %68, %struct.T** %3
%69 = load %struct.T*, %struct.T** %2
%70 = getelementptr inbounds %struct.T, %struct.T* %69, i32 0, i32 0
%71 = load %struct.T*, %struct.T** %70
store %struct.T* %71, %struct.T** %2
%72 = load %struct.T*, %struct.T** %3
%73 = bitcast %struct.T* %72 to %struct.T.1*
%74 = call i32 @free(%struct.T.1* %73)
br label %64
75: ; preds = %64
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call i64 (...) @__nondet()
%2 = icmp eq i64 %1, 0
br i1 %2, label %48, label %5
3: ; preds = %16
%4 = bitcast %struct.T.0* %7 to %struct.T*
br label %19
5: ; preds = %0, %16
%6 = phi %struct.T* [ %8, %16 ], [ null, %0 ]
%7 = tail call %struct.T.0* @malloc(i32 24)
%8 = bitcast %struct.T.0* %7 to %struct.T*
%9 = bitcast %struct.T.0* %7 to %struct.T**
store %struct.T* %6, %struct.T** %9
%10 = getelementptr inbounds %struct.T, %struct.T* %8, i64 0, i32 1
store %struct.T* null, %struct.T** %10
%11 = getelementptr inbounds %struct.T, %struct.T* %8, i64 0, i32 2
store i32 0, i32* %11
%12 = icmp eq %struct.T* %6, null
br i1 %12, label %16, label %13
13: ; preds = %5
%14 = getelementptr inbounds %struct.T, %struct.T* %6, i64 0, i32 1
%15 = bitcast %struct.T** %14 to %struct.T.0**
store %struct.T.0* %7, %struct.T.0** %15
br label %16
16: ; preds = %13, %5
%17 = tail call i64 (...) @__nondet()
%18 = icmp eq i64 %17, 0
br i1 %18, label %3, label %5
19: ; preds = %3, %36
%20 = phi %struct.T* [ %38, %36 ], [ %4, %3 ]
%21 = tail call i64 (...) @__nondet()
%22 = icmp eq i64 %21, 0
br i1 %22, label %36, label %23
23: ; preds = %19
%24 = tail call %struct.T.0* @malloc(i32 24)
%25 = bitcast %struct.T.0* %24 to %struct.T*
%26 = getelementptr inbounds %struct.T, %struct.T* %20, i64 0, i32 0
%27 = load %struct.T*, %struct.T** %26
%28 = bitcast %struct.T.0* %24 to %struct.T**
store %struct.T* %27, %struct.T** %28
%29 = getelementptr inbounds %struct.T, %struct.T* %25, i64 0, i32 1
store %struct.T* %20, %struct.T** %29
%30 = bitcast %struct.T* %20 to %struct.T.0**
store %struct.T.0* %24, %struct.T.0** %30
%31 = load %struct.T*, %struct.T** %28
%32 = icmp eq %struct.T* %31, null
br i1 %32, label %40, label %33
33: ; preds = %23
%34 = getelementptr inbounds %struct.T, %struct.T* %31, i64 0, i32 1
%35 = bitcast %struct.T** %34 to %struct.T.0**
store %struct.T.0* %24, %struct.T.0** %35
br label %40
36: ; preds = %19
%37 = getelementptr inbounds %struct.T, %struct.T* %20, i64 0, i32 0
%38 = load %struct.T*, %struct.T** %37
%39 = icmp eq %struct.T* %38, null
br i1 %39, label %40, label %19
40: ; preds = %36, %33, %23
br label %41
41: ; preds = %40, %41
%42 = phi %struct.T* [ %44, %41 ], [ %4, %40 ]
%43 = getelementptr inbounds %struct.T, %struct.T* %42, i64 0, i32 0
%44 = load %struct.T*, %struct.T** %43
%45 = bitcast %struct.T* %42 to %struct.T.1*
%46 = tail call i32 @free(%struct.T.1* %45)
%47 = icmp eq %struct.T* %44, null
br i1 %47, label %48, label %41
48: ; preds = %41, %0
ret i32 0
}