#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int /*<<< orphan*/ smash(char *, int);
int test2(int n) {
  char *array_ptrs[1000];
  int i = 0;
loop:;
  char test[n];
  smash(test, n);
  if (i >= 1000)
    goto end;
  array_ptrs[i] = test;
  ++i;
  goto loop;
end:
  smash(test, n);
  char test2[n];
  smash(test2, n);
  return (array_ptrs[0] - array_ptrs[1000 - 1] < n) ? 0 : 1;
}


x86 assembly (clang, -O0):
<test2>:
push   %rbp
mov    %rsp,%rbp
sub    $0x1f80,%rsp
mov    %edi,-0x8(%rbp)
movl   $0x0,-0x1f54(%rbp)
mov    -0x8(%rbp),%eax
mov    %rsp,%rcx
mov    %rcx,-0x1f60(%rbp)
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rdi
sub    %rcx,%rdi
mov    %rdi,-0x1f80(%rbp)
mov    %rdi,%rsp
mov    %rax,-0x1f68(%rbp)
mov    -0x8(%rbp),%esi
call   1030 <smash@plt>
cmpl   $0x3e8,-0x1f54(%rbp)
jl     1174 <test2+0x64>
jmp    11a8 <test2+0x98>
mov    -0x1f80(%rbp),%rcx
movslq -0x1f54(%rbp),%rax
mov    %rcx,-0x1f50(%rbp,%rax,8)
ff
mov    -0x1f54(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x1f54(%rbp)
movl   $0x2,-0x1f6c(%rbp)
jmp    1209 <test2+0xf9>
mov    -0x1f80(%rbp),%rdi
mov    -0x8(%rbp),%esi
call   1030 <smash@plt>
mov    -0x8(%rbp),%eax
mov    %rax,%rcx
add    $0xf,%rcx
and    $0xfffffffffffffff0,%rcx
mov    %rsp,%rdi
sub    %rcx,%rdi
mov    %rdi,%rsp
mov    %rax,-0x1f78(%rbp)
mov    -0x8(%rbp),%esi
call   1030 <smash@plt>
mov    -0x1f50(%rbp),%rdx
mov    -0x18(%rbp),%rax
sub    %rax,%rdx
movslq -0x8(%rbp),%rsi
mov    $0x1,%eax
xor    %ecx,%ecx
cmp    %rsi,%rdx
cmovl  %ecx,%eax
mov    %eax,-0x4(%rbp)
movl   $0x1,-0x1f6c(%rbp)
mov    -0x1f60(%rbp),%rax
mov    %rax,%rsp
mov    -0x1f6c(%rbp),%eax
sub    $0x1,%eax
je     122c <test2+0x11c>
jmp    1227 <test2+0x117>
jmp    1128 <test2+0x18>
mov    -0x4(%rbp),%eax
mov    %rbp,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<test2>:
push   %rbp
mov    %rsp,%rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x1f48,%rsp
mov    %edi,%r14d
mov    %rsp,%r15
mov    %edi,%r12d
mov    %rsp,%rbx
add    $0xf,%r12
and    $0xfffffffffffffff0,%r12
sub    %r12,%rbx
mov    %rbx,%rsp
mov    %rbx,%rdi
mov    %r14d,%esi
call   1030 <smash@plt>
xor    %r13d,%r13d
nopl   0x0(%rax)
mov    %r15,%rsp
mov    %rsp,%r15
mov    %rbx,-0x1f70(%rbp,%r13,8)
ff
add    $0x1,%r13
mov    %rsp,%rbx
sub    %r12,%rbx
mov    %rbx,%rsp
mov    %rbx,%rdi
mov    %r14d,%esi
call   1030 <smash@plt>
cmp    $0x3e8,%r13
jne    1150 <test2+0x40>
mov    %rbx,%rdi
mov    %r14d,%esi
call   1030 <smash@plt>
mov    %rsp,%rdi
sub    %r12,%rdi
mov    %rdi,%rsp
mov    %r14d,%esi
call   1030 <smash@plt>
mov    -0x1f70(%rbp),%rcx
sub    -0x38(%rbp),%rcx
movslq %r14d,%rdx
xor    %eax,%eax
cmp    %rdx,%rcx
setge  %al
mov    %r15,%rsp
lea    -0x28(%rbp),%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
define i32 @test2(i32 %0) {
%2 = alloca i32
%3 = alloca i32
%4 = alloca [1000 x i8*]
%5 = alloca i32
%6 = alloca i8*
%7 = alloca i64
%8 = alloca i32
%9 = alloca i64
store i32 %0, i32* %3
store i32 0, i32* %5
br label %10
10: ; preds = %46, %1
%11 = load i32, i32* %3
%12 = zext i32 %11 to i64
%13 = call i8* @llvm.stacksave()
store i8* %13, i8** %6
%14 = alloca i8, i64 %12
store i64 %12, i64* %7
%15 = load i32, i32* %3
%16 = call i32 @smash(i8* %14, i32 %15)
%17 = load i32, i32* %5
%18 = icmp sge i32 %17, 1000
br i1 %18, label %19, label %20
19: ; preds = %10
br label %26
20: ; preds = %10
%21 = load i32, i32* %5
%22 = sext i32 %21 to i64
%23 = getelementptr inbounds [1000 x i8*], [1000 x i8*]* %4, i64 0, i64 %22
store i8* %14, i8** %23
%24 = load i32, i32* %5
%25 = add nsw i32 %24, 1
store i32 %25, i32* %5
store i32 2, i32* %8
br label %46
26: ; preds = %19
%27 = load i32, i32* %3
%28 = call i32 @smash(i8* %14, i32 %27)
%29 = load i32, i32* %3
%30 = zext i32 %29 to i64
%31 = alloca i8, i64 %30
store i64 %30, i64* %9
%32 = load i32, i32* %3
%33 = call i32 @smash(i8* %31, i32 %32)
%34 = getelementptr inbounds [1000 x i8*], [1000 x i8*]* %4, i64 0, i64 0
%35 = load i8*, i8** %34
%36 = getelementptr inbounds [1000 x i8*], [1000 x i8*]* %4, i64 0, i64 999
%37 = load i8*, i8** %36
%38 = ptrtoint i8* %35 to i64
%39 = ptrtoint i8* %37 to i64
%40 = sub i64 %38, %39
%41 = load i32, i32* %3
%42 = sext i32 %41 to i64
%43 = icmp slt i64 %40, %42
%44 = zext i1 %43 to i64
%45 = select i1 %43, i32 0, i32 1
store i32 %45, i32* %2
store i32 1, i32* %8
br label %46
46: ; preds = %26, %20
%47 = load i8*, i8** %6
%48 = load i32, i32* %8
switch i32 %48, label %51 [
i32 2, label %10
i32 1, label %49
]
49: ; preds = %46
%50 = load i32, i32* %2
ret i32 %50
51: ; preds = %46
unreachable
}

LLVM IR (-O2):
define i32 @test2(i32 %0) {
%2 = alloca [1000 x i8*]
%3 = bitcast [1000 x i8*]* %2 to i8*
%4 = zext i32 %0 to i64
%5 = call i8* @llvm.stacksave()
%6 = alloca i8, i64 %4
%7 = call i32 @smash(i8* %6, i32 %0)
br label %8
8: ; preds = %1, %8
%9 = phi i64 [ 0, %1 ], [ %13, %8 ]
%10 = phi i8* [ %6, %1 ], [ %15, %8 ]
%11 = phi i8* [ %5, %1 ], [ %14, %8 ]
%12 = getelementptr inbounds [1000 x i8*], [1000 x i8*]* %2, i64 0, i64 %9
store i8* %10, i8** %12
%13 = add nuw nsw i64 %9, 1
%14 = call i8* @llvm.stacksave()
%15 = alloca i8, i64 %4
%16 = call i32 @smash(i8* %15, i32 %0)
%17 = icmp eq i64 %13, 1000
br i1 %17, label %18, label %8
18: ; preds = %8
%19 = call i32 @smash(i8* %15, i32 %0)
%20 = alloca i8, i64 %4
%21 = call i32 @smash(i8* %20, i32 %0)
%22 = getelementptr inbounds [1000 x i8*], [1000 x i8*]* %2, i64 0, i64 0
%23 = load i8*, i8** %22
%24 = getelementptr inbounds [1000 x i8*], [1000 x i8*]* %2, i64 0, i64 999
%25 = load i8*, i8** %24
%26 = ptrtoint i8* %23 to i64
%27 = ptrtoint i8* %25 to i64
%28 = sub i64 %26, %27
%29 = sext i32 %0 to i64
%30 = icmp sge i64 %28, %29
%31 = zext i1 %30 to i32
ret i32 %31
}