int analyze_this() {
  char *p_char = malloc(sizeof(char));
  __ESBMC_assume(p_char);
  int *p_int = malloc(sizeof(int));
  __ESBMC_assume(p_int);
  void *p;
  p = nondet_bool() ? p_char : p_int;
  p_int = p;
  if ((void *)p_int != (void *)p_char)
    *p_int = 1;
}


x86 assembly (clang, -O0):
<analyze_this>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    $0x1,%edi
call   1040 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rdi
mov    $0x0,%al
call   1030 <__ESBMC_assume@plt>
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rdi
mov    $0x0,%al
call   1030 <__ESBMC_assume@plt>
mov    $0x0,%al
call   1050 <nondet_bool@plt>
cmp    $0x0,%eax
je     1187 <analyze_this+0x57>
mov    -0x10(%rbp),%rax
mov    %rax,-0x28(%rbp)
jmp    118f <analyze_this+0x5f>
mov    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    -0x20(%rbp),%rax
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
cmp    -0x10(%rbp),%rax
je     11b7 <analyze_this+0x87>
mov    -0x18(%rbp),%rax
movl   $0x1,(%rax)
mov    -0x4(%rbp),%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<analyze_this>:
push   %r14
push   %rbx
push   %rax
mov    $0x1,%edi
call   1040 <malloc@plt>
mov    %rax,%r14
mov    %rax,%rdi
xor    %eax,%eax
call   1030 <__ESBMC_assume@plt>
mov    $0x4,%edi
call   1040 <malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
xor    %eax,%eax
call   1030 <__ESBMC_assume@plt>
xor    %eax,%eax
call   1050 <nondet_bool@plt>
test   %eax,%eax
cmovne %r14,%rbx
cmp    %r14,%rbx
je     117a <analyze_this+0x4a>
movl   $0x1,(%rbx)
add    $0x8,%rsp
pop    %rbx
pop    %r14
ret

LLVM IR (-O0):
define i32 @analyze_this() {
%1 = alloca i32
%2 = alloca i8*
%3 = alloca i32*
%4 = alloca i8*
%5 = call i8* @malloc(i64 1)
store i8* %5, i8** %2
%6 = load i8*, i8** %2
%7 = call i32 (i8*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i8*, ...)*)(i8* %6)
%8 = call i8* @malloc(i64 4)
%9 = bitcast i8* %8 to i32*
store i32* %9, i32** %3
%10 = load i32*, i32** %3
%11 = call i32 (i32*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32*, ...)*)(i32* %10)
%12 = call i32 (...) @nondet_bool()
%13 = icmp ne i32 %12, 0
br i1 %13, label %14, label %16
14: ; preds = %0
%15 = load i8*, i8** %2
br label %19
16: ; preds = %0
%17 = load i32*, i32** %3
%18 = bitcast i32* %17 to i8*
br label %19
19: ; preds = %16, %14
%20 = phi i8* [ %15, %14 ], [ %18, %16 ]
store i8* %20, i8** %4
%21 = load i8*, i8** %4
%22 = bitcast i8* %21 to i32*
store i32* %22, i32** %3
%23 = load i32*, i32** %3
%24 = bitcast i32* %23 to i8*
%25 = load i8*, i8** %2
%26 = icmp ne i8* %24, %25
br i1 %26, label %27, label %29
27: ; preds = %19
%28 = load i32*, i32** %3
store i32 1, i32* %28
br label %29
29: ; preds = %27, %19
%30 = load i32, i32* %1
ret i32 %30
}

LLVM IR (-O2):
define i32 @analyze_this() {
%1 = tail call dereferenceable_or_null(1) i8* @malloc(i64 1)
%2 = tail call i32 (i8*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i8*, ...)*)(i8* %1)
%3 = tail call dereferenceable_or_null(4) i8* @malloc(i64 4)
%4 = bitcast i8* %3 to i32*
%5 = tail call i32 (i32*, ...) bitcast (i32 (...)* @__ESBMC_assume to i32 (i32*, ...)*)(i32* %4)
%6 = tail call i32 (...) @nondet_bool()
%7 = icmp eq i32 %6, 0
%8 = select i1 %7, i8* %3, i8* %1
%9 = icmp eq i8* %8, %1
br i1 %9, label %12, label %10
10: ; preds = %0
%11 = bitcast i8* %8 to i32*
store i32 1, i32* %11
br label %12
12: ; preds = %10, %0
ret i32 undef
}