#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int above_free(int *, int);
int below_free(int *, int);
int direct_dealloc(int *, int, int);
int get_size(int);
int /*<<< orphan*/ get_use_bit(int);
int merge_above(int *, int, int, int);
int merge_below(int *, int, int, int);
int /*<<< orphan*/ printf(char *, int);
int deallocate(int *mem, int address) {
  int fpart_address;
  int merge_block = 0;
  int psize = get_size(mem[address]);
  if (!get_use_bit(mem[address])) {
    printf("Double free corruption. Memory at address %d is already free.\n",
           address);
    fpart_address = -1;
  } else if ((merge_block = above_free(mem, address))) {
    fpart_address = merge_above(mem, address, merge_block, psize);
  } else if ((merge_block = below_free(mem, address))) {
    fpart_address = merge_below(mem, address, merge_block, psize);
  } else {
    fpart_address = direct_dealloc(mem, address, psize);
  }
  return fpart_address;
}


x86 assembly (clang, -O0):
<deallocate>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
movl   $0x0,-0x14(%rbp)
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
mov    (%rax,%rcx,4),%edi
call   1030 <get_size@plt>
mov    %eax,-0x18(%rbp)
mov    -0x8(%rbp),%rax
movslq -0xc(%rbp),%rcx
mov    (%rax,%rcx,4),%edi
call   10a0 <get_use_bit@plt>
cmp    $0x0,%eax
jne    11dd <deallocate+0x5d>
mov    -0xc(%rbp),%esi
lea    0xe34(%rip),%rdi
call   1070 <printf@plt>
movl   $0xffffffff,-0x10(%rbp)
jmp    125d <deallocate+0xdd>
mov    -0x8(%rbp),%rdi
mov    -0xc(%rbp),%esi
call   1060 <above_free@plt>
mov    %eax,-0x14(%rbp)
cmp    $0x0,%eax
je     120f <deallocate+0x8f>
mov    -0x8(%rbp),%rdi
mov    -0xc(%rbp),%esi
mov    -0x14(%rbp),%edx
mov    -0x18(%rbp),%ecx
call   1080 <merge_above@plt>
mov    %eax,-0x10(%rbp)
jmp    1258 <deallocate+0xd8>
mov    -0x8(%rbp),%rdi
mov    -0xc(%rbp),%esi
call   1050 <below_free@plt>
mov    %eax,-0x14(%rbp)
cmp    $0x0,%eax
je     1241 <deallocate+0xc1>
mov    -0x8(%rbp),%rdi
mov    -0xc(%rbp),%esi
mov    -0x14(%rbp),%edx
mov    -0x18(%rbp),%ecx
call   1090 <merge_below@plt>
mov    %eax,-0x10(%rbp)
jmp    1253 <deallocate+0xd3>
mov    -0x8(%rbp),%rdi
mov    -0xc(%rbp),%esi
mov    -0x18(%rbp),%edx
call   1040 <direct_dealloc@plt>
mov    %eax,-0x10(%rbp)
jmp    1258 <deallocate+0xd8>
jmp    125d <deallocate+0xdd>
mov    -0x10(%rbp),%eax
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<deallocate>:
push   %rbp
push   %r15
push   %r14
push   %rbx
push   %rax
mov    %esi,%r15d
mov    %rdi,%rbp
movslq %esi,%rbx
mov    (%rdi,%rbx,4),%edi
call   1030 <get_size@plt>
mov    %eax,%r14d
mov    0x0(%rbp,%rbx,4),%edi
call   10a0 <get_use_bit@plt>
test   %eax,%eax
je     11d1 <deallocate+0x51>
mov    %rbp,%rdi
mov    %r15d,%esi
call   1060 <above_free@plt>
test   %eax,%eax
je     11f0 <deallocate+0x70>
mov    %rbp,%rdi
mov    %r15d,%esi
mov    %eax,%edx
mov    %r14d,%ecx
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
jmp    1080 <merge_above@plt>
lea    0xe28(%rip),%rdi
mov    %r15d,%esi
call   1070 <printf@plt>
mov    $0xffffffff,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
ret
mov    %rbp,%rdi
mov    %r15d,%esi
call   1050 <below_free@plt>
mov    %rbp,%rdi
mov    %r15d,%esi
test   %eax,%eax
je     1219 <deallocate+0x99>
mov    %eax,%edx
mov    %r14d,%ecx
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
jmp    1090 <merge_below@plt>
mov    %r14d,%edx
add    $0x8,%rsp
pop    %rbx
pop    %r14
pop    %r15
pop    %rbp
jmp    1040 <direct_dealloc@plt>

LLVM IR (-O0):
@.str = [63 x i8] c"Double free corruption. Memory at address %d is already free.\0A\00"
define i32 @deallocate(i32* %0, i32 %1) {
%3 = alloca i32*
%4 = alloca i32
%5 = alloca i32
%6 = alloca i32
%7 = alloca i32
store i32* %0, i32** %3
store i32 %1, i32* %4
store i32 0, i32* %6
%8 = load i32*, i32** %3
%9 = load i32, i32* %4
%10 = sext i32 %9 to i64
%11 = getelementptr inbounds i32, i32* %8, i64 %10
%12 = load i32, i32* %11
%13 = call i32 @get_size(i32 %12)
store i32 %13, i32* %7
%14 = load i32*, i32** %3
%15 = load i32, i32* %4
%16 = sext i32 %15 to i64
%17 = getelementptr inbounds i32, i32* %14, i64 %16
%18 = load i32, i32* %17
%19 = call i32 @get_use_bit(i32 %18)
%20 = icmp ne i32 %19, 0
br i1 %20, label %24, label %21
21: ; preds = %2
%22 = load i32, i32* %4
%23 = call i32 @printf(i8* getelementptr inbounds ([63 x i8], [63 x i8]* @.str, i64 0, i64 0), i32 %22)
store i32 -1, i32* %5
br label %53
24: ; preds = %2
%25 = load i32*, i32** %3
%26 = load i32, i32* %4
%27 = call i32 @above_free(i32* %25, i32 %26)
store i32 %27, i32* %6
%28 = icmp ne i32 %27, 0
br i1 %28, label %29, label %35
29: ; preds = %24
%30 = load i32*, i32** %3
%31 = load i32, i32* %4
%32 = load i32, i32* %6
%33 = load i32, i32* %7
%34 = call i32 @merge_above(i32* %30, i32 %31, i32 %32, i32 %33)
store i32 %34, i32* %5
br label %52
35: ; preds = %24
%36 = load i32*, i32** %3
%37 = load i32, i32* %4
%38 = call i32 @below_free(i32* %36, i32 %37)
store i32 %38, i32* %6
%39 = icmp ne i32 %38, 0
br i1 %39, label %40, label %46
40: ; preds = %35
%41 = load i32*, i32** %3
%42 = load i32, i32* %4
%43 = load i32, i32* %6
%44 = load i32, i32* %7
%45 = call i32 @merge_below(i32* %41, i32 %42, i32 %43, i32 %44)
store i32 %45, i32* %5
br label %51
46: ; preds = %35
%47 = load i32*, i32** %3
%48 = load i32, i32* %4
%49 = load i32, i32* %7
%50 = call i32 @direct_dealloc(i32* %47, i32 %48, i32 %49)
store i32 %50, i32* %5
br label %51
51: ; preds = %46, %40
br label %52
52: ; preds = %51, %29
br label %53
53: ; preds = %52, %21
%54 = load i32, i32* %5
ret i32 %54
}

LLVM IR (-O2):
@.str = [63 x i8] c"Double free corruption. Memory at address %d is already free.\0A\00"
define i32 @deallocate(i32* %0, i32 %1) {
%3 = sext i32 %1 to i64
%4 = getelementptr inbounds i32, i32* %0, i64 %3
%5 = load i32, i32* %4
%6 = tail call i32 @get_size(i32 %5)
%7 = load i32, i32* %4
%8 = tail call i32 @get_use_bit(i32 %7)
%9 = icmp eq i32 %8, 0
br i1 %9, label %10, label %12
10: ; preds = %2
%11 = tail call i32 @printf(i8* getelementptr inbounds ([63 x i8], [63 x i8]* @.str, i64 0, i64 0), i32 %1)
br label %24
12: ; preds = %2
%13 = tail call i32 @above_free(i32* %0, i32 %1)
%14 = icmp eq i32 %13, 0
br i1 %14, label %17, label %15
15: ; preds = %12
%16 = tail call i32 @merge_above(i32* %0, i32 %1, i32 %13, i32 %6)
br label %24
17: ; preds = %12
%18 = tail call i32 @below_free(i32* %0, i32 %1)
%19 = icmp eq i32 %18, 0
br i1 %19, label %22, label %20
20: ; preds = %17
%21 = tail call i32 @merge_below(i32* %0, i32 %1, i32 %18, i32 %6)
br label %24
22: ; preds = %17
%23 = tail call i32 @direct_dealloc(i32* %0, i32 %1, i32 %6)
br label %24
24: ; preds = %15, %22, %20, %10
%25 = phi i32 [ %16, %15 ], [ %21, %20 ], [ %23, %22 ], [ -1, %10 ]
ret i32 %25
}