char *strchr(const char *s, int c) {
  int size;
  int nondet;
  int offset;
  nondet = __infer_nondet_int();
  offset = __infer_nondet_int();
  size = __get_array_size(s);
  if (nondet)
    return 0;
  if (offset < 0 || offset >= size)
    while (1)
      ;
  return (void *)s + offset;
}


x86 assembly (clang, -O0):
<strchr>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x10(%rbp)
mov    %esi,-0x14(%rbp)
mov    $0x0,%al
call   1030 <__infer_nondet_int@plt>
mov    %eax,-0x1c(%rbp)
mov    $0x0,%al
call   1030 <__infer_nondet_int@plt>
mov    %eax,-0x20(%rbp)
mov    -0x10(%rbp),%rdi
mov    $0x0,%al
call   1040 <__get_array_size@plt>
mov    %eax,-0x18(%rbp)
cmpl   $0x0,-0x1c(%rbp)
je     1168 <strchr+0x48>
movq   $0x0,-0x8(%rbp)
jmp    1197 <strchr+0x77>
cmpl   $0x0,-0x20(%rbp)
jl     117e <strchr+0x5e>
mov    -0x20(%rbp),%eax
cmp    -0x18(%rbp),%eax
jl     1188 <strchr+0x68>
jmp    1183 <strchr+0x63>
jmp    1183 <strchr+0x63>
mov    -0x10(%rbp),%rax
movslq -0x20(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<strchr>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %rdi,%r15
xor    %r14d,%r14d
xor    %eax,%eax
call   1030 <__infer_nondet_int@plt>
mov    %eax,%ebx
xor    %eax,%eax
call   1030 <__infer_nondet_int@plt>
mov    %eax,%ebp
mov    %r15,%rdi
xor    %eax,%eax
call   1040 <__get_array_size@plt>
test   %ebx,%ebx
jne    115d <strchr+0x3d>
test   %ebp,%ebp
js     1170 <strchr+0x50>
cmp    %eax,%ebp
jge    1170 <strchr+0x50>
mov    %ebp,%eax
add    %rax,%r15
mov    %r15,%r14
mov    %r14,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
nopl   0x0(%rax,%rax,1)
jmp    1170 <strchr+0x50>

LLVM IR (-O0):
define i8* @strchr(i8* %0, i32 %1) {
%3 = alloca i8*
%4 = alloca i8*
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
%8 = alloca i32
store i8* %0, i8** %4
store i32 %1, i32* %5
%9 = call i32 (...) @__infer_nondet_int()
store i32 %9, i32* %7
%10 = call i32 (...) @__infer_nondet_int()
store i32 %10, i32* %8
%11 = load i8*, i8** %4
%12 = call i32 (i8*, ...) bitcast (i32 (...)* @__get_array_size to i32 (i8*, ...)*)(i8* %11)
store i32 %12, i32* %6
%13 = load i32, i32* %7
%14 = icmp ne i32 %13, 0
br i1 %14, label %15, label %16
15: ; preds = %2
store i8* null, i8** %3
br label %30
16: ; preds = %2
%17 = load i32, i32* %8
%18 = icmp slt i32 %17, 0
br i1 %18, label %23, label %19
19: ; preds = %16
%20 = load i32, i32* %8
%21 = load i32, i32* %6
%22 = icmp sge i32 %20, %21
br i1 %22, label %23, label %25
23: ; preds = %19, %16
br label %24
24: ; preds = %23, %24
br label %24
25: ; preds = %19
%26 = load i8*, i8** %4
%27 = load i32, i32* %8
%28 = sext i32 %27 to i64
%29 = getelementptr i8, i8* %26, i64 %28
store i8* %29, i8** %3
br label %30
30: ; preds = %25, %15
%31 = load i8*, i8** %3
ret i8* %31
}

LLVM IR (-O2):
define i8* @strchr(i8* %0, i32 %1) {
%3 = tail call i32 (...) @__infer_nondet_int()
%4 = tail call i32 (...) @__infer_nondet_int()
%5 = tail call i32 (i8*, ...) bitcast (i32 (...)* @__get_array_size to i32 (i8*, ...)*)(i8* %0)
%6 = icmp eq i32 %3, 0
br i1 %6, label %7, label %15
7: ; preds = %2
%8 = icmp sgt i32 %4, -1
%9 = icmp slt i32 %4, %5
%10 = select i1 %8, i1 %9, i1 false
br i1 %10, label %12, label %11
11: ; preds = %7, %11
br label %11
12: ; preds = %7
%13 = zext i32 %4 to i64
%14 = getelementptr i8, i8* %0, i64 %13
br label %15
15: ; preds = %2, %12
%16 = phi i8* [ %14, %12 ], [ null, %2 ]
ret i8* %16
}