int main(int argc, char *argv[]) {
  void *p1 = sbrk(0);
  char *ptr = malloc(0), *p = 0;
  printf("malloc (0) = %p, %lu\n", ptr, (unsigned long)ptr / 8);
  int n = 0, i = 0;
  for (i = 1; 1; i *= 2) {
    p = realloc(ptr, i);
    if (p != ptr) {
      printf("base address changed %p != %p, size = %d\n", p, ptr, i);
      ptr = p;
      if (n++ > 3)
        break;
    }
    ptr = p;
  }
  p = realloc(ptr, 1);
  ptr = p;
  printf("after shrink %p, %lu\n", ptr, (unsigned long)ptr / 8);
  free(ptr);
  struct abc {
    int a;
    double b;
    char c[128];
  } * pabc;
  pabc = calloc(sizeof(struct abc), 10);
  free(pabc);
  void *p2 = sbrk(0);
  printf("p1 = %p, p2 = %p\n", p1, p2);
  char *p3 = alloc(100);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
movl   $0x0,-0x4(%rbp)
mov    %edi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
xor    %edi,%edi
mov    $0x0,%al
call   1050 <sbrk@plt>
cltq
mov    %rax,-0x18(%rbp)
xor    %eax,%eax
mov    %eax,%edi
call   1070 <malloc@plt>
mov    %rax,-0x20(%rbp)
movq   $0x0,-0x28(%rbp)
mov    -0x20(%rbp),%rsi
mov    -0x20(%rbp),%rdx
shr    $0x3,%rdx
lea    0xe43(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
movl   $0x0,-0x2c(%rbp)
movl   $0x0,-0x30(%rbp)
movl   $0x1,-0x30(%rbp)
mov    $0x1,%al
test   $0x1,%al
jne    11e8 <main+0x78>
jmp    125c <main+0xec>
mov    -0x20(%rbp),%rdi
movslq -0x30(%rbp),%rsi
call   1090 <realloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
cmp    -0x20(%rbp),%rax
je     1246 <main+0xd6>
mov    -0x28(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x30(%rbp),%ecx
lea    0xdfd(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x28(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x2c(%rbp),%eax
mov    %eax,%ecx
add    $0x1,%ecx
mov    %ecx,-0x2c(%rbp)
cmp    $0x3,%eax
jle    1241 <main+0xd1>
jmp    125c <main+0xec>
jmp    1246 <main+0xd6>
mov    -0x28(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x30(%rbp),%eax
shl    $0x1,%eax
mov    %eax,-0x30(%rbp)
jmp    11d9 <main+0x69>
mov    -0x20(%rbp),%rdi
mov    $0x1,%esi
call   1090 <realloc@plt>
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rsi
mov    -0x20(%rbp),%rdx
shr    $0x3,%rdx
lea    0xdb7(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    -0x20(%rbp),%rdi
call   1030 <free@plt>
mov    $0x90,%edi
mov    $0xa,%esi
call   1060 <calloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rdi
call   1030 <free@plt>
xor    %edi,%edi
mov    $0x0,%al
call   1050 <sbrk@plt>
cltq
mov    %rax,-0x40(%rbp)
mov    -0x18(%rbp),%rsi
mov    -0x40(%rbp),%rdx
lea    0xd83(%rip),%rdi
mov    $0x0,%al
call   1040 <printf@plt>
mov    $0x64,%edi
mov    $0x0,%al
call   1080 <alloc@plt>
cltq
mov    %rax,-0x48(%rbp)
xor    %eax,%eax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
xor    %edi,%edi
xor    %eax,%eax
call   1050 <sbrk@plt>
mov    %eax,%r14d
xor    %edi,%edi
call   1060 <malloc@plt>
mov    %rax,%rbp
mov    %rax,%rdx
shr    $0x3,%rdx
lea    0xe71(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
mov    $0x1,%r12d
lea    0xe70(%rip),%r15
xor    %r13d,%r13d
jmp    11b6 <main+0x56>
nopl   0x0(%rax,%rax,1)
add    %r12d,%r12d
mov    %rbx,%rbp
mov    %r12d,%esi
mov    %rbp,%rdi
call   1080 <realloc@plt>
mov    %rax,%rbx
cmp    %rbp,%rax
je     11b0 <main+0x50>
mov    %r15,%rdi
mov    %rbx,%rsi
mov    %rbp,%rdx
mov    %r12d,%ecx
xor    %eax,%eax
call   1040 <printf@plt>
cmp    $0x3,%r13d
jg     11e8 <main+0x88>
add    $0x1,%r13d
jmp    11b0 <main+0x50>
movslq %r14d,%rbp
mov    $0x1,%esi
mov    %rbx,%rdi
call   1080 <realloc@plt>
mov    %rax,%rbx
mov    %rax,%rdx
shr    $0x3,%rdx
lea    0xe37(%rip),%rdi
mov    %rax,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xor    %edi,%edi
xor    %eax,%eax
call   1050 <sbrk@plt>
movslq %eax,%rdx
lea    0xe28(%rip),%rdi
mov    %rbp,%rsi
xor    %eax,%eax
call   1040 <printf@plt>
mov    $0x64,%edi
xor    %eax,%eax
call   1070 <alloc@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
%struct.abc = type { i32, double, [128 x i8] }
@.str = [22 x i8] c"malloc (0) = %p, %lu\0A\00"
@.str.1 = [42 x i8] c"base address changed %p != %p, size = %d\0A\00"
@.str.2 = [22 x i8] c"after shrink %p, %lu\0A\00"
@.str.3 = [18 x i8] c"p1 = %p, p2 = %p\0A\00"
define i32 @main(i32 %0, i8** %1) {
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8**
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i32
%11 = alloca %struct.abc*
%12 = alloca i8*
%13 = alloca i8*
store i32 0, i32* %3
store i32 %0, i32* %4
store i8** %1, i8*** %5
%14 = call i32 (i32, ...) bitcast (i32 (...)* @sbrk to i32 (i32, ...)*)(i32 0)
%15 = sext i32 %14 to i64
%16 = inttoptr i64 %15 to i8*
store i8* %16, i8** %6
%17 = call i8* @malloc(i64 0)
store i8* %17, i8** %7
store i8* null, i8** %8
%18 = load i8*, i8** %7
%19 = load i8*, i8** %7
%20 = ptrtoint i8* %19 to i64
%21 = udiv i64 %20, 8
%22 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0), i8* %18, i64 %21)
store i32 0, i32* %9
store i32 0, i32* %10
store i32 1, i32* %10
br label %23
23: ; preds = %45, %2
br i1 true, label %24, label %48
24: ; preds = %23
%25 = load i8*, i8** %7
%26 = load i32, i32* %10
%27 = sext i32 %26 to i64
%28 = call i8* @realloc(i8* %25, i64 %27)
store i8* %28, i8** %8
%29 = load i8*, i8** %8
%30 = load i8*, i8** %7
%31 = icmp ne i8* %29, %30
br i1 %31, label %32, label %43
32: ; preds = %24
%33 = load i8*, i8** %8
%34 = load i8*, i8** %7
%35 = load i32, i32* %10
%36 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([42 x i8], [42 x i8]* @.str.1, i64 0, i64 0), i8* %33, i8* %34, i32 %35)
%37 = load i8*, i8** %8
store i8* %37, i8** %7
%38 = load i32, i32* %9
%39 = add nsw i32 %38, 1
store i32 %39, i32* %9
%40 = icmp sgt i32 %38, 3
br i1 %40, label %41, label %42
41: ; preds = %32
br label %48
42: ; preds = %32
br label %43
43: ; preds = %42, %24
%44 = load i8*, i8** %8
store i8* %44, i8** %7
br label %45
45: ; preds = %43
%46 = load i32, i32* %10
%47 = mul nsw i32 %46, 2
store i32 %47, i32* %10
br label %23
48: ; preds = %41, %23
%49 = load i8*, i8** %7
%50 = call i8* @realloc(i8* %49, i64 1)
store i8* %50, i8** %8
%51 = load i8*, i8** %8
store i8* %51, i8** %7
%52 = load i8*, i8** %7
%53 = load i8*, i8** %7
%54 = ptrtoint i8* %53 to i64
%55 = udiv i64 %54, 8
%56 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0), i8* %52, i64 %55)
%57 = load i8*, i8** %7
%58 = call i8* @calloc(i64 144, i64 10)
%59 = bitcast i8* %58 to %struct.abc*
store %struct.abc* %59, %struct.abc** %11
%60 = load %struct.abc*, %struct.abc** %11
%61 = bitcast %struct.abc* %60 to i8*
%62 = call i32 (i32, ...) bitcast (i32 (...)* @sbrk to i32 (i32, ...)*)(i32 0)
%63 = sext i32 %62 to i64
%64 = inttoptr i64 %63 to i8*
store i8* %64, i8** %12
%65 = load i8*, i8** %6
%66 = load i8*, i8** %12
%67 = call i32 (i8*, ...) @printf(i8* getelementptr inbounds ([18 x i8], [18 x i8]* @.str.3, i64 0, i64 0), i8* %65, i8* %66)
%68 = call i32 (i32, ...) bitcast (i32 (...)* @alloc to i32 (i32, ...)*)(i32 100)
%69 = sext i32 %68 to i64
%70 = inttoptr i64 %69 to i8*
store i8* %70, i8** %13
ret i32 0
}

LLVM IR (-O2):
@.str = [22 x i8] c"malloc (0) = %p, %lu\0A\00"
@.str.1 = [42 x i8] c"base address changed %p != %p, size = %d\0A\00"
@.str.2 = [22 x i8] c"after shrink %p, %lu\0A\00"
@.str.3 = [18 x i8] c"p1 = %p, p2 = %p\0A\00"
define i32 @main(i32 %0, i8** nocapture readnone %1) {
%3 = tail call i32 (i32, ...) bitcast (i32 (...)* @sbrk to i32 (i32, ...)*)(i32 0)
%4 = tail call i8* @malloc(i64 0)
%5 = ptrtoint i8* %4 to i64
%6 = lshr i64 %5, 3
%7 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0), i8* %4, i64 %6)
br label %8
8: ; preds = %19, %2
%9 = phi i32 [ 1, %2 ], [ %21, %19 ]
%10 = phi i32 [ 0, %2 ], [ %20, %19 ]
%11 = phi i8* [ %4, %2 ], [ %13, %19 ]
%12 = zext i32 %9 to i64
%13 = tail call i8* @realloc(i8* %11, i64 %12)
%14 = icmp eq i8* %13, %11
br i1 %14, label %19, label %15
15: ; preds = %8
%16 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([42 x i8], [42 x i8]* @.str.1, i64 0, i64 0), i8* %13, i8* %11, i32 %9)
%17 = add nsw i32 %10, 1
%18 = icmp sgt i32 %10, 3
br i1 %18, label %22, label %19
19: ; preds = %15, %8
%20 = phi i32 [ %17, %15 ], [ %10, %8 ]
%21 = shl nsw i32 %9, 1
br label %8
22: ; preds = %15
%23 = sext i32 %3 to i64
%24 = inttoptr i64 %23 to i8*
%25 = tail call dereferenceable_or_null(1) i8* @realloc(i8* %13, i64 1)
%26 = ptrtoint i8* %25 to i64
%27 = lshr i64 %26, 3
%28 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0), i8* %25, i64 %27)
tail call void @free(i8* %25)
%29 = tail call i32 (i32, ...) bitcast (i32 (...)* @sbrk to i32 (i32, ...)*)(i32 0)
%30 = sext i32 %29 to i64
%31 = inttoptr i64 %30 to i8*
%32 = tail call i32 (i8*, ...) @printf(i8* dereferenceable(1) getelementptr inbounds ([18 x i8], [18 x i8]* @.str.3, i64 0, i64 0), i8* %24, i8* %31)
%33 = tail call i32 (i32, ...) bitcast (i32 (...)* @alloc to i32 (i32, ...)*)(i32 100)
ret i32 0
}