#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ assert(int);
int *malloc(int);
int main() {
  int *p, *q, *r, **s;
  int havoc1, havoc2;
  p = malloc(sizeof(int));
  q = malloc(sizeof(int));
  if (havoc1) {
    s = &p;
  } else {
    s = &q;
  }
  *p = 1;
  *q = 0;
  if (havoc2) {
    r = q;
  } else {
    r = p;
  }
  *s = q;
  *p = 2;
  *q = 2;
  assert(1 <= *r);
  assert(*r == 2);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x18(%rbp)
cmpl   $0x0,-0x2c(%rbp)
je     1162 <main+0x42>
lea    -0x10(%rbp),%rax
mov    %rax,-0x28(%rbp)
jmp    116a <main+0x4a>
lea    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x10(%rbp),%rax
movl   $0x1,(%rax)
mov    -0x18(%rbp),%rax
movl   $0x0,(%rax)
cmpl   $0x0,-0x30(%rbp)
je     1195 <main+0x75>
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
jmp    119d <main+0x7d>
mov    -0x10(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x10(%rbp),%rax
movl   $0x2,(%rax)
mov    -0x18(%rbp),%rax
movl   $0x2,(%rax)
mov    -0x20(%rbp),%rcx
mov    $0x1,%eax
cmp    (%rcx),%eax
setle  %al
and    $0x1,%al
movzbl %al,%edi
call   1030 <assert@plt>
mov    -0x20(%rbp),%rax
cmpl   $0x2,(%rax)
sete   %al
and    $0x1,%al
movzbl %al,%edi
call   1030 <assert@plt>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %rax
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    $0x1,%edi
call   1030 <assert@plt>
mov    $0x1,%edi
call   1030 <assert@plt>
xor    %eax,%eax
pop    %rcx
ret

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32*
%3 = alloca i32*
%4 = alloca i32*
%5 = alloca i32**
%6 = alloca i32
%7 = alloca i32
store i32 0, i32* %1
%8 = call i32* @malloc(i32 4)
store i32* %8, i32** %2
%9 = call i32* @malloc(i32 4)
store i32* %9, i32** %3
%10 = load i32, i32* %6
%11 = icmp ne i32 %10, 0
br i1 %11, label %12, label %13
12: ; preds = %0
store i32** %2, i32*** %5
br label %14
13: ; preds = %0
store i32** %3, i32*** %5
br label %14
14: ; preds = %13, %12
%15 = load i32*, i32** %2
store i32 1, i32* %15
%16 = load i32*, i32** %3
store i32 0, i32* %16
%17 = load i32, i32* %7
%18 = icmp ne i32 %17, 0
br i1 %18, label %19, label %21
19: ; preds = %14
%20 = load i32*, i32** %3
store i32* %20, i32** %4
br label %23
21: ; preds = %14
%22 = load i32*, i32** %2
store i32* %22, i32** %4
br label %23
23: ; preds = %21, %19
%24 = load i32*, i32** %3
%25 = load i32**, i32*** %5
store i32* %24, i32** %25
%26 = load i32*, i32** %2
store i32 2, i32* %26
%27 = load i32*, i32** %3
store i32 2, i32* %27
%28 = load i32*, i32** %4
%29 = load i32, i32* %28
%30 = icmp sle i32 1, %29
%31 = zext i1 %30 to i32
%32 = call i32 @assert(i32 %31)
%33 = load i32*, i32** %4
%34 = load i32, i32* %33
%35 = icmp eq i32 %34, 2
%36 = zext i1 %35 to i32
%37 = call i32 @assert(i32 %36)
ret i32 0
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32* @malloc(i32 4)
%2 = tail call i32* @malloc(i32 4)
%3 = tail call i32 @assert(i32 1)
%4 = tail call i32 @assert(i32 1)
ret i32 0
}