The provenance memory model for C