#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ __VERIFIER_plot(char *);
scalar_t__ __nondet();
int /*<<< orphan*/ free(struct T *);
struct T *malloc(int);
int main() {
  struct T {
    struct T *next;
    struct T *prev;
    int data;
  };
  struct T *x = NULL;
  struct T *y = NULL;
  x = malloc(sizeof(struct T));
  x->next = NULL;
  x->prev = NULL;
  while (__nondet()) {
    y = malloc(sizeof(struct T));
    y->next = x;
    x->prev = y;
    y->prev = NULL;
    x = y;
  }
  struct T *z = NULL;
  y = malloc(sizeof(struct T));
  y->next = NULL;
  y->prev = NULL;
  struct T *yLast = y;
  while (__nondet()) {
    z = malloc(sizeof(struct T));
    z->next = y;
    y->prev = z;
    z->prev = NULL;
    y = z;
  }
  yLast->next = x;
  x->prev = yLast;
  y = NULL;
  z = NULL;
  __VERIFIER_plot("dll-concat-lists-0001");
  y = x;
  while (y) {
    y = y->next;
  }
  __VERIFIER_plot("dll-concat-lists-0002");
  while (x->next) {
    y = x->next;
    x->next = x->next->next;
    free(y);
  }
  while (x->prev) {
    y = x->prev;
    x->prev = x->prev->prev;
    free(y);
  }
  free(x);
  return 0;
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
movl   $0x0,-0x4(%rbp)
movq   $0x0,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x10(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     11d3 <main+0x93>
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x10(%rbp)
jmp    1184 <main+0x44>
movq   $0x0,-0x20(%rbp)
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,-0x18(%rbp)
mov    -0x18(%rbp),%rax
movq   $0x0,(%rax)
mov    -0x18(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    $0x0,%al
call   1040 <__nondet@plt>
cmp    $0x0,%rax
je     1257 <main+0x117>
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    -0x18(%rbp),%rcx
mov    -0x20(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x20(%rbp),%rcx
mov    -0x18(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x20(%rbp),%rax
movq   $0x0,0x8(%rax)
mov    -0x20(%rbp),%rax
mov    %rax,-0x18(%rbp)
jmp    1208 <main+0xc8>
mov    -0x10(%rbp),%rcx
mov    -0x28(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x28(%rbp),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
movq   $0x0,-0x18(%rbp)
movq   $0x0,-0x20(%rbp)
lea    0xd7b(%rip),%rdi
call   1050 <__VERIFIER_plot@plt>
mov    -0x10(%rbp),%rax
mov    %rax,-0x18(%rbp)
cmpq   $0x0,-0x18(%rbp)
je     12ad <main+0x16d>
mov    -0x18(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
jmp    1292 <main+0x152>
lea    0xd62(%rip),%rdi
call   1050 <__VERIFIER_plot@plt>
mov    -0x10(%rbp),%rax
cmpq   $0x0,(%rax)
je     12f1 <main+0x1b1>
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    (%rax),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    12b9 <main+0x179>
jmp    12f6 <main+0x1b6>
mov    -0x10(%rbp),%rax
cmpq   $0x0,0x8(%rax)
je     1333 <main+0x1f3>
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    %rax,-0x18(%rbp)
mov    -0x10(%rbp),%rax
mov    0x8(%rax),%rax
mov    0x8(%rax),%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,0x8(%rax)
mov    -0x18(%rbp),%rdi
call   1030 <free@plt>
jmp    12f6 <main+0x1b6>
mov    -0x10(%rbp),%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r15
push   %r14
push   %r12
push   %rbx
push   %rax
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,%r15
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     119e <main+0x5e>
nopw   0x0(%rax,%rax,1)
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %r15,(%rax)
mov    %rax,0x8(%r15)
movq   $0x0,0x8(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %rbx,%r15
test   %rax,%rax
jne    1170 <main+0x30>
mov    %rbx,%r15
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,%r14
xorps  %xmm0,%xmm0
movups %xmm0,(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
test   %rax,%rax
je     11ec <main+0xac>
mov    %r14,%r12
mov    $0x18,%edi
call   1060 <malloc@plt>
mov    %rax,%rbx
mov    %r12,(%rax)
mov    %rax,0x8(%r12)
movq   $0x0,0x8(%rax)
xor    %eax,%eax
call   1040 <__nondet@plt>
mov    %rbx,%r12
test   %rax,%rax
jne    11c0 <main+0x80>
mov    %r15,(%r14)
mov    %r14,0x8(%r15)
lea    0xe16(%rip),%rdi
call   1050 <__VERIFIER_plot@plt>
lea    0xe20(%rip),%rdi
call   1050 <__VERIFIER_plot@plt>
nopl   0x0(%rax,%rax,1)
mov    (%r15),%rdi
test   %rdi,%rdi
je     123d <main+0xfd>
mov    (%rdi),%rax
mov    %rax,(%r15)
call   1030 <free@plt>
jmp    1210 <main+0xd0>
cs nopw 0x0(%rax,%rax,1)
nop
mov    0x8(%rdi),%rax
mov    %rax,0x8(%r15)
call   1030 <free@plt>
mov    0x8(%r15),%rdi
test   %rdi,%rdi
jne    1230 <main+0xf0>
mov    %r15,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
@.str = [22 x i8] c"dll-concat-lists-0001\00"
@.str.1 = [22 x i8] c"dll-concat-lists-0002\00"
define i32 @main() {
%1 = alloca i32
%2 = alloca %struct.T*
%3 = alloca %struct.T*
%4 = alloca %struct.T*
%5 = alloca %struct.T*
store i32 0, i32* %1
store %struct.T* null, %struct.T** %2
store %struct.T* null, %struct.T** %3
%6 = call %struct.T.0* @malloc(i32 24)
%7 = bitcast %struct.T.0* %6 to %struct.T*
store %struct.T* %7, %struct.T** %2
%8 = load %struct.T*, %struct.T** %2
%9 = getelementptr inbounds %struct.T, %struct.T* %8, i32 0, i32 0
store %struct.T* null, %struct.T** %9
%10 = load %struct.T*, %struct.T** %2
%11 = getelementptr inbounds %struct.T, %struct.T* %10, i32 0, i32 1
store %struct.T* null, %struct.T** %11
br label %12
12: ; preds = %15, %0
%13 = call i64 (...) @__nondet()
%14 = icmp ne i64 %13, 0
br i1 %14, label %15, label %27
15: ; preds = %12
%16 = call %struct.T.0* @malloc(i32 24)
%17 = bitcast %struct.T.0* %16 to %struct.T*
store %struct.T* %17, %struct.T** %3
%18 = load %struct.T*, %struct.T** %2
%19 = load %struct.T*, %struct.T** %3
%20 = getelementptr inbounds %struct.T, %struct.T* %19, i32 0, i32 0
store %struct.T* %18, %struct.T** %20
%21 = load %struct.T*, %struct.T** %3
%22 = load %struct.T*, %struct.T** %2
%23 = getelementptr inbounds %struct.T, %struct.T* %22, i32 0, i32 1
store %struct.T* %21, %struct.T** %23
%24 = load %struct.T*, %struct.T** %3
%25 = getelementptr inbounds %struct.T, %struct.T* %24, i32 0, i32 1
store %struct.T* null, %struct.T** %25
%26 = load %struct.T*, %struct.T** %3
store %struct.T* %26, %struct.T** %2
br label %12
27: ; preds = %12
store %struct.T* null, %struct.T** %4
%28 = call %struct.T.0* @malloc(i32 24)
%29 = bitcast %struct.T.0* %28 to %struct.T*
store %struct.T* %29, %struct.T** %3
%30 = load %struct.T*, %struct.T** %3
%31 = getelementptr inbounds %struct.T, %struct.T* %30, i32 0, i32 0
store %struct.T* null, %struct.T** %31
%32 = load %struct.T*, %struct.T** %3
%33 = getelementptr inbounds %struct.T, %struct.T* %32, i32 0, i32 1
store %struct.T* null, %struct.T** %33
%34 = load %struct.T*, %struct.T** %3
store %struct.T* %34, %struct.T** %5
br label %35
35: ; preds = %38, %27
%36 = call i64 (...) @__nondet()
%37 = icmp ne i64 %36, 0
br i1 %37, label %38, label %50
38: ; preds = %35
%39 = call %struct.T.0* @malloc(i32 24)
%40 = bitcast %struct.T.0* %39 to %struct.T*
store %struct.T* %40, %struct.T** %4
%41 = load %struct.T*, %struct.T** %3
%42 = load %struct.T*, %struct.T** %4
%43 = getelementptr inbounds %struct.T, %struct.T* %42, i32 0, i32 0
store %struct.T* %41, %struct.T** %43
%44 = load %struct.T*, %struct.T** %4
%45 = load %struct.T*, %struct.T** %3
%46 = getelementptr inbounds %struct.T, %struct.T* %45, i32 0, i32 1
store %struct.T* %44, %struct.T** %46
%47 = load %struct.T*, %struct.T** %4
%48 = getelementptr inbounds %struct.T, %struct.T* %47, i32 0, i32 1
store %struct.T* null, %struct.T** %48
%49 = load %struct.T*, %struct.T** %4
store %struct.T* %49, %struct.T** %3
br label %35
50: ; preds = %35
%51 = load %struct.T*, %struct.T** %2
%52 = load %struct.T*, %struct.T** %5
%53 = getelementptr inbounds %struct.T, %struct.T* %52, i32 0, i32 0
store %struct.T* %51, %struct.T** %53
%54 = load %struct.T*, %struct.T** %5
%55 = load %struct.T*, %struct.T** %2
%56 = getelementptr inbounds %struct.T, %struct.T* %55, i32 0, i32 1
store %struct.T* %54, %struct.T** %56
store %struct.T* null, %struct.T** %3
store %struct.T* null, %struct.T** %4
%57 = call i32 @__VERIFIER_plot(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%58 = load %struct.T*, %struct.T** %2
store %struct.T* %58, %struct.T** %3
br label %59
59: ; preds = %62, %50
%60 = load %struct.T*, %struct.T** %3
%61 = icmp ne %struct.T* %60, null
br i1 %61, label %62, label %66
62: ; preds = %59
%63 = load %struct.T*, %struct.T** %3
%64 = getelementptr inbounds %struct.T, %struct.T* %63, i32 0, i32 0
%65 = load %struct.T*, %struct.T** %64
store %struct.T* %65, %struct.T** %3
br label %59
66: ; preds = %59
%67 = call i32 @__VERIFIER_plot(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
br label %68
68: ; preds = %73, %66
%69 = load %struct.T*, %struct.T** %2
%70 = getelementptr inbounds %struct.T, %struct.T* %69, i32 0, i32 0
%71 = load %struct.T*, %struct.T** %70
%72 = icmp ne %struct.T* %71, null
br i1 %72, label %73, label %87
73: ; preds = %68
%74 = load %struct.T*, %struct.T** %2
%75 = getelementptr inbounds %struct.T, %struct.T* %74, i32 0, i32 0
%76 = load %struct.T*, %struct.T** %75
store %struct.T* %76, %struct.T** %3
%77 = load %struct.T*, %struct.T** %2
%78 = getelementptr inbounds %struct.T, %struct.T* %77, i32 0, i32 0
%79 = load %struct.T*, %struct.T** %78
%80 = getelementptr inbounds %struct.T, %struct.T* %79, i32 0, i32 0
%81 = load %struct.T*, %struct.T** %80
%82 = load %struct.T*, %struct.T** %2
%83 = getelementptr inbounds %struct.T, %struct.T* %82, i32 0, i32 0
store %struct.T* %81, %struct.T** %83
%84 = load %struct.T*, %struct.T** %3
%85 = bitcast %struct.T* %84 to %struct.T.1*
%86 = call i32 @free(%struct.T.1* %85)
br label %68
87: ; preds = %68
br label %88
88: ; preds = %93, %87
%89 = load %struct.T*, %struct.T** %2
%90 = getelementptr inbounds %struct.T, %struct.T* %89, i32 0, i32 1
%91 = load %struct.T*, %struct.T** %90
%92 = icmp ne %struct.T* %91, null
br i1 %92, label %93, label %107
93: ; preds = %88
%94 = load %struct.T*, %struct.T** %2
%95 = getelementptr inbounds %struct.T, %struct.T* %94, i32 0, i32 1
%96 = load %struct.T*, %struct.T** %95
store %struct.T* %96, %struct.T** %3
%97 = load %struct.T*, %struct.T** %2
%98 = getelementptr inbounds %struct.T, %struct.T* %97, i32 0, i32 1
%99 = load %struct.T*, %struct.T** %98
%100 = getelementptr inbounds %struct.T, %struct.T* %99, i32 0, i32 1
%101 = load %struct.T*, %struct.T** %100
%102 = load %struct.T*, %struct.T** %2
%103 = getelementptr inbounds %struct.T, %struct.T* %102, i32 0, i32 1
store %struct.T* %101, %struct.T** %103
%104 = load %struct.T*, %struct.T** %3
%105 = bitcast %struct.T* %104 to %struct.T.1*
%106 = call i32 @free(%struct.T.1* %105)
br label %88
107: ; preds = %88
%108 = load %struct.T*, %struct.T** %2
%109 = bitcast %struct.T* %108 to %struct.T.1*
%110 = call i32 @free(%struct.T.1* %109)
ret i32 0
}

LLVM IR (-O2):
%struct.T = type { %struct.T*, %struct.T*, i32 }
%struct.T.0 = type opaque
%struct.T.1 = type opaque
@.str = [22 x i8] c"dll-concat-lists-0001\00"
@.str.1 = [22 x i8] c"dll-concat-lists-0002\00"
define i32 @main() {
%1 = tail call %struct.T.0* @malloc(i32 24)
%2 = bitcast %struct.T.0* %1 to %struct.T*
%3 = bitcast %struct.T.0* %1 to i8*
%4 = tail call i64 (...) @__nondet()
%5 = icmp eq i64 %4, 0
br i1 %5, label %18, label %6
6: ; preds = %0, %6
%7 = phi %struct.T* [ %9, %6 ], [ %2, %0 ]
%8 = tail call %struct.T.0* @malloc(i32 24)
%9 = bitcast %struct.T.0* %8 to %struct.T*
%10 = bitcast %struct.T.0* %8 to %struct.T**
store %struct.T* %7, %struct.T** %10
%11 = getelementptr inbounds %struct.T, %struct.T* %7, i64 0, i32 1
%12 = bitcast %struct.T** %11 to %struct.T.0**
store %struct.T.0* %8, %struct.T.0** %12
%13 = getelementptr inbounds %struct.T, %struct.T* %9, i64 0, i32 1
store %struct.T* null, %struct.T** %13
%14 = tail call i64 (...) @__nondet()
%15 = icmp eq i64 %14, 0
br i1 %15, label %16, label %6
16: ; preds = %6
%17 = bitcast %struct.T.0* %8 to %struct.T*
br label %18
18: ; preds = %16, %0
%19 = phi %struct.T* [ %2, %0 ], [ %17, %16 ]
%20 = tail call %struct.T.0* @malloc(i32 24)
%21 = bitcast %struct.T.0* %20 to %struct.T**
%22 = bitcast %struct.T.0* %20 to i8*
%23 = tail call i64 (...) @__nondet()
%24 = icmp eq i64 %23, 0
br i1 %24, label %37, label %25
25: ; preds = %18
%26 = bitcast %struct.T.0* %20 to %struct.T*
br label %27
27: ; preds = %25, %27
%28 = phi %struct.T* [ %30, %27 ], [ %26, %25 ]
%29 = tail call %struct.T.0* @malloc(i32 24)
%30 = bitcast %struct.T.0* %29 to %struct.T*
%31 = bitcast %struct.T.0* %29 to %struct.T**
store %struct.T* %28, %struct.T** %31
%32 = getelementptr inbounds %struct.T, %struct.T* %28, i64 0, i32 1
%33 = bitcast %struct.T** %32 to %struct.T.0**
store %struct.T.0* %29, %struct.T.0** %33
%34 = getelementptr inbounds %struct.T, %struct.T* %30, i64 0, i32 1
store %struct.T* null, %struct.T** %34
%35 = tail call i64 (...) @__nondet()
%36 = icmp eq i64 %35, 0
br i1 %36, label %37, label %27
37: ; preds = %27, %18
store %struct.T* %19, %struct.T** %21
%38 = getelementptr inbounds %struct.T, %struct.T* %19, i64 0, i32 1
%39 = bitcast %struct.T** %38 to %struct.T.0**
store %struct.T.0* %20, %struct.T.0** %39
%40 = tail call i32 @__VERIFIER_plot(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0))
%41 = tail call i32 @__VERIFIER_plot(i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str.1, i64 0, i64 0))
%42 = getelementptr inbounds %struct.T, %struct.T* %19, i64 0, i32 0
%43 = load %struct.T*, %struct.T** %42
%44 = icmp eq %struct.T* %43, null
br i1 %44, label %45, label %48
45: ; preds = %48, %37
%46 = load %struct.T*, %struct.T** %38
%47 = icmp eq %struct.T* %46, null
br i1 %47, label %64, label %56
48: ; preds = %37, %48
%49 = phi %struct.T* [ %54, %48 ], [ %43, %37 ]
%50 = getelementptr inbounds %struct.T, %struct.T* %49, i64 0, i32 0
%51 = load %struct.T*, %struct.T** %50
store %struct.T* %51, %struct.T** %42
%52 = bitcast %struct.T* %49 to %struct.T.1*
%53 = tail call i32 @free(%struct.T.1* %52)
%54 = load %struct.T*, %struct.T** %42
%55 = icmp eq %struct.T* %54, null
br i1 %55, label %45, label %48
56: ; preds = %45, %56
%57 = phi %struct.T* [ %62, %56 ], [ %46, %45 ]
%58 = getelementptr inbounds %struct.T, %struct.T* %57, i64 0, i32 1
%59 = load %struct.T*, %struct.T** %58
store %struct.T* %59, %struct.T** %38
%60 = bitcast %struct.T* %57 to %struct.T.1*
%61 = tail call i32 @free(%struct.T.1* %60)
%62 = load %struct.T*, %struct.T** %38
%63 = icmp eq %struct.T* %62, null
br i1 %63, label %64, label %56
64: ; preds = %56, %45
%65 = bitcast %struct.T* %19 to %struct.T.1*
%66 = tail call i32 @free(%struct.T.1* %65)
ret i32 0
}