#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
    struct T *prev;
    int data;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  while (__nondet()) {
    y = malloc(sizeof(struct T));
    y->next = x;
    y->prev = NULL;
    y->data = 0;
    if (x)
      x->prev = y;
    x = y;
  }
  y = x;
  x = NULL;
  while (y != NULL) {
    struct T *z = y;
    y = y->next;
    if (y)
      y->prev = NULL;
    z->next = x;
    z->prev = NULL;
    if (x)
      x->prev = z;
    x = z;
  }
  while (x != NULL) {
    y = x;
    x = x->next;
    free(y);
  }
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     11b4 <main+0x84>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x18(%rbp),%rax
movl   $0x0,0x10(%rax)
cmpq   $0x0,-0x10(%rbp)
je     11a7 <main+0x77>
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    114f <main+0x1f>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
movq   $0x0,-0x10(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     1234 <main+0x104>
mov    -0x18(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     11f9 <main+0xc9>
mov    -0x18(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x10(%rbp),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x20(%rbp),%rax
movq   $0x0,0x8(%rax)
cmpq   $0x0,-0x10(%rbp)
je     1227 <main+0xf7>
mov    -0x20(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x20(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    11c4 <main+0x94>
jmp    1239 <main+0x109>
cmpq   $0x0,-0x10(%rbp)
je     1265 <main+0x135>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x10(%rbp)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    1239 <main+0x109>
xor    %eax,%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     11e0 <main+0xb0>
xor    %r14d,%r14d
jmp    115f <main+0x2f>
nopl   0x0(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %rbx,%r14
test   %rax,%rax
je     1189 <main+0x59>
mov    $0x18,%edi
call   1050 <malloc@plt>
mov    %rax,%rbx
mov    %r14,(%rax)
movq   $0x0,0x8(%rax)
movl   $0x0,0x10(%rax)
test   %r14,%r14
je     1150 <main+0x20>
mov    %rbx,0x8(%r14)
jmp    1150 <main+0x20>
xor    %eax,%eax
jmp    1198 <main+0x68>
nopl   (%rax)
mov    %rdi,%rax
test   %rbx,%rbx
je     11d0 <main+0xa0>
mov    %rbx,%rdi
mov    (%rbx),%rbx
test   %rbx,%rbx
je     11ab <main+0x7b>
movq   $0x0,0x8(%rbx)
mov    %rax,(%rdi)
movq   $0x0,0x8(%rdi)
test   %rax,%rax
je     1190 <main+0x60>
mov    %rdi,0x8(%rax)
jmp    1190 <main+0x60>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
mov    (%rdi),%rbx
call   1030 <free@plt>
mov    %rbx,%rdi
test   %rbx,%rbx
jne    11d0 <main+0xa0>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
br label %5
5: ; preds = %24, %0
%6 = call i64 (...) @__nondet()
%7 = icmp ne i64 %6, 0
br i1 %7, label %8, label %26
8: ; preds = %5
%9 = call %struct.T.0* @malloc(i32 24)
%10 = bitcast %struct.T.0* %9 to %struct.T*
store %struct.T* %10, %struct.T** %3
%11 = load %struct.T*, %struct.T** %2
%12 = load %struct.T*, %struct.T** %3
%13 = getelementptr inbounds %struct.T, %struct.T* %12, i32 0, i32 0
store %struct.T* %11, %struct.T** %13
%14 = load %struct.T*, %struct.T** %3
%15 = getelementptr inbounds %struct.T, %struct.T* %14, i32 0, i32 1
store %struct.T* null, %struct.T** %15
%16 = load %struct.T*, %struct.T** %3
%17 = getelementptr inbounds %struct.T, %struct.T* %16, i32 0, i32 2
store i32 0, i32* %17
%18 = load %struct.T*, %struct.T** %2
%19 = icmp ne %struct.T* %18, null
br i1 %19, label %20, label %24
20: ; preds = %8
%21 = load %struct.T*, %struct.T** %3
%22 = load %struct.T*, %struct.T** %2
%23 = getelementptr inbounds %struct.T, %struct.T* %22, i32 0, i32 1
store %struct.T* %21, %struct.T** %23
br label %24
24: ; preds = %20, %8
%25 = load %struct.T*, %struct.T** %3
store %struct.T* %25, %struct.T** %2
br label %5
26: ; preds = %5
%27 = load %struct.T*, %struct.T** %2
store %struct.T* %27, %struct.T** %3
store %struct.T* null, %struct.T** %2
br label %28
28: ; preds = %53, %26
%29 = load %struct.T*, %struct.T** %3
%30 = icmp ne %struct.T* %29, null
br i1 %30, label %31, label %55
31: ; preds = %28
%32 = load %struct.T*, %struct.T** %3
store %struct.T* %32, %struct.T** %4
%33 = load %struct.T*, %struct.T** %3
%34 = getelementptr inbounds %struct.T, %struct.T* %33, i32 0, i32 0
%35 = load %struct.T*, %struct.T** %34
store %struct.T* %35, %struct.T** %3
%36 = load %struct.T*, %struct.T** %3
%37 = icmp ne %struct.T* %36, null
br i1 %37, label %38, label %41
38: ; preds = %31
%39 = load %struct.T*, %struct.T** %3
%40 = getelementptr inbounds %struct.T, %struct.T* %39, i32 0, i32 1
store %struct.T* null, %struct.T** %40
br label %41
41: ; preds = %38, %31
%42 = load %struct.T*, %struct.T** %2
%43 = load %struct.T*, %struct.T** %4
%44 = getelementptr inbounds %struct.T, %struct.T* %43, i32 0, i32 0
store %struct.T* %42, %struct.T** %44
%45 = load %struct.T*, %struct.T** %4
%46 = getelementptr inbounds %struct.T, %struct.T* %45, i32 0, i32 1
store %struct.T* null, %struct.T** %46
%47 = load %struct.T*, %struct.T** %2
%48 = icmp ne %struct.T* %47, null
br i1 %48, label %49, label %53
49: ; preds = %41
%50 = load %struct.T*, %struct.T** %4
%51 = load %struct.T*, %struct.T** %2
%52 = getelementptr inbounds %struct.T, %struct.T* %51, i32 0, i32 1
store %struct.T* %50, %struct.T** %52
br label %53
53: ; preds = %49, %41
%54 = load %struct.T*, %struct.T** %4
store %struct.T* %54, %struct.T** %2
br label %28
55: ; preds = %28
br label %56
56: ; preds = %59, %55
%57 = load %struct.T*, %struct.T** %2
%58 = icmp ne %struct.T* %57, null
br i1 %58, label %59, label %67
59: ; preds = %56
%60 = load %struct.T*, %struct.T** %2
store %struct.T* %60, %struct.T** %3
%61 = load %struct.T*, %struct.T** %2
%62 = getelementptr inbounds %struct.T, %struct.T* %61, i32 0, i32 0
%63 = load %struct.T*, %struct.T** %62
store %struct.T* %63, %struct.T** %2
%64 = load %struct.T*, %struct.T** %3
%65 = bitcast %struct.T* %64 to %struct.T.1*
%66 = call i32 @free(%struct.T.1* %65)
br label %56
67: ; preds = %56
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
define i32 @main() {
%1 = tail call i64 (...) @__nondet()
%2 = icmp eq i64 %1, 0
br i1 %2, label %40, label %5
3: ; preds = %16
%4 = bitcast %struct.T.0* %7 to %struct.T*
br label %19
5: ; preds = %0, %16
%6 = phi %struct.T* [ %8, %16 ], [ null, %0 ]
%7 = tail call %struct.T.0* @malloc(i32 24)
%8 = bitcast %struct.T.0* %7 to %struct.T*
%9 = bitcast %struct.T.0* %7 to %struct.T**
store %struct.T* %6, %struct.T** %9
%10 = getelementptr inbounds %struct.T, %struct.T* %8, i64 0, i32 1
store %struct.T* null, %struct.T** %10
%11 = getelementptr inbounds %struct.T, %struct.T* %8, i64 0, i32 2
store i32 0, i32* %11
%12 = icmp eq %struct.T* %6, null
br i1 %12, label %16, label %13
13: ; preds = %5
%14 = getelementptr inbounds %struct.T, %struct.T* %6, i64 0, i32 1
%15 = bitcast %struct.T** %14 to %struct.T.0**
store %struct.T.0* %7, %struct.T.0** %15
br label %16
16: ; preds = %13, %5
%17 = tail call i64 (...) @__nondet()
%18 = icmp eq i64 %17, 0
br i1 %18, label %3, label %5
19: ; preds = %3, %32
%20 = phi %struct.T* [ %21, %32 ], [ null, %3 ]
%21 = phi %struct.T* [ %23, %32 ], [ %4, %3 ]
%22 = getelementptr inbounds %struct.T, %struct.T* %21, i64 0, i32 0
%23 = load %struct.T*, %struct.T** %22
%24 = icmp eq %struct.T* %23, null
br i1 %24, label %27, label %25
25: ; preds = %19
%26 = getelementptr inbounds %struct.T, %struct.T* %23, i64 0, i32 1
store %struct.T* null, %struct.T** %26
br label %27
27: ; preds = %25, %19
store %struct.T* %20, %struct.T** %22
%28 = getelementptr inbounds %struct.T, %struct.T* %21, i64 0, i32 1
store %struct.T* null, %struct.T** %28
%29 = icmp eq %struct.T* %20, null
br i1 %29, label %32, label %30
30: ; preds = %27
%31 = getelementptr inbounds %struct.T, %struct.T* %20, i64 0, i32 1
store %struct.T* %21, %struct.T** %31
br label %32
32: ; preds = %30, %27
br i1 %24, label %33, label %19
33: ; preds = %32, %33
%34 = phi %struct.T* [ %36, %33 ], [ %21, %32 ]
%35 = getelementptr inbounds %struct.T, %struct.T* %34, i64 0, i32 0
%36 = load %struct.T*, %struct.T** %35
%37 = bitcast %struct.T* %34 to %struct.T.1*
%38 = tail call i32 @free(%struct.T.1* %37)
%39 = icmp eq %struct.T* %36, null
br i1 %39, label %40, label %33
40: ; preds = %33, %0
ret i32 0
}