#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __VERIFIER_nondet_int();
int *malloc(int);
int main() {
  int *p = malloc(1048 * sizeof(int));
  int *q = p;
  while (*q >= 0 && q < p + 1048) {
    if (__VERIFIER_nondet_int()) {
      q++;
    } else {
      (*q)--;
    }
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x1060,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rcx
xor    %eax,%eax
cmpl   $0x0,(%rcx)
mov    %al,-0x19(%rbp)
jl     116f <main+0x4f>
mov    -0x18(%rbp),%rax
mov    -0x10(%rbp),%rcx
add    $0x1060,%rcx
cmp    %rcx,%rax
setb   %al
mov    %al,-0x19(%rbp)
mov    -0x19(%rbp),%al
test   $0x1,%al
jne    117f <main+0x5f>
jmp    11b1 <main+0x91>
mov    $0x0,%al
call   1030 <__VERIFIER_nondet_int@plt>
cmp    $0x0,%rax
je     11a1 <main+0x81>
mov    -0x18(%rbp),%rax
add    $0x4,%rax
mov    %rax,-0x18(%rbp)
jmp    11ac <main+0x8c>
mov    -0x18(%rbp),%rax
mov    (%rax),%ecx
add    $0xffffffff,%ecx
mov    %ecx,(%rax)
jmp    1145 <main+0x25>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    $0x1060,%edi
call   1040 <malloc@plt>
mov    (%rax),%ebp
test   %ebp,%ebp
js     117a <main+0x5a>
mov    %rax,%r14
mov    %rax,%rbx
xor    %r15d,%r15d
xor    %eax,%eax
call   1030 <__VERIFIER_nondet_int@plt>
test   %rax,%rax
je     1160 <main+0x40>
add    $0x1,%r15
jmp    1165 <main+0x45>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax)
add    $0xffffffff,%ebp
mov    %ebp,(%rbx)
mov    (%r14,%r15,4),%ebp
test   %ebp,%ebp
js     117a <main+0x5a>
lea    (%r14,%r15,4),%rbx
cmp    $0x418,%r15
jl     1140 <main+0x20>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32*
store i32 0, i32* %1
%4 = call i32* @malloc(i32 4192)
store i32* %4, i32** %2
%5 = load i32*, i32** %2
store i32* %5, i32** %3
br label %6
6: ; preds = %27, %0
%7 = load i32*, i32** %3
%8 = load i32, i32* %7
%9 = icmp sge i32 %8, 0
br i1 %9, label %10, label %15
10: ; preds = %6
%11 = load i32*, i32** %3
%12 = load i32*, i32** %2
%13 = getelementptr inbounds i32, i32* %12, i64 1048
%14 = icmp ult i32* %11, %13
br label %15
15: ; preds = %10, %6
%16 = phi i1 [ false, %6 ], [ %14, %10 ]
br i1 %16, label %17, label %28
17: ; preds = %15
%18 = call i64 (...) @__VERIFIER_nondet_int()
%19 = icmp ne i64 %18, 0
br i1 %19, label %20, label %23
20: ; preds = %17
%21 = load i32*, i32** %3
%22 = getelementptr inbounds i32, i32* %21, i32 1
store i32* %22, i32** %3
br label %27
23: ; preds = %17
%24 = load i32*, i32** %3
%25 = load i32, i32* %24
%26 = add nsw i32 %25, -1
store i32 %26, i32* %24
br label %27
27: ; preds = %23, %20
br label %6
28: ; preds = %15
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32* @malloc(i32 4192)
%2 = load i32, i32* %1
%3 = icmp sgt i32 %2, -1
br i1 %3, label %4, label %21
4: ; preds = %0, %14
%5 = phi i32 [ %17, %14 ], [ %2, %0 ]
%6 = phi i32* [ %16, %14 ], [ %1, %0 ]
%7 = phi i64 [ %15, %14 ], [ 0, %0 ]
%8 = tail call i64 (...) @__VERIFIER_nondet_int()
%9 = icmp eq i64 %8, 0
br i1 %9, label %12, label %10
10: ; preds = %4
%11 = add nsw i64 %7, 1
br label %14
12: ; preds = %4
%13 = add nsw i32 %5, -1
store i32 %13, i32* %6
br label %14
14: ; preds = %12, %10
%15 = phi i64 [ %11, %10 ], [ %7, %12 ]
%16 = getelementptr inbounds i32, i32* %1, i64 %15
%17 = load i32, i32* %16
%18 = icmp sgt i32 %17, -1
%19 = icmp slt i64 %15, 1048
%20 = select i1 %18, i1 %19, i1 false
br i1 %20, label %4, label %21
21: ; preds = %14, %0
ret i32 0
}