#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ calloc(int, int);
int /*<<< orphan*/ fatalx(char *, ...);
int /*<<< orphan*/ free(char *);
int /*<<< orphan*/ freestring(char **);
int /*<<< orphan*/ strcpy(char *, char *);
char *strdup(char *);
int strlen(char *);
int /*<<< orphan*/ strncpy(char *, char *, int);
char *strstr(char *, char *);
int substringx(char **ap, char *inx, char *outx, int niter) {
  char *a, *pt;
  char *str;
  int len, off, x;
  if (niter > 50)
    fatalx("bad string replacement\n %s\n", *ap);
  a = *ap;
  len = strlen(a) + strlen(inx) + strlen(outx) + 1;
  pt = strstr(a, inx);
  if (pt == NULL) {
    return 0;
  }
  if ((str = (char *)calloc((len), sizeof(char))) == NULL)
    fatalx("Unable to allocate %d unit(s) for item \n", len);
  off = pt - a;
  strncpy(str, a, off);
  strcpy(str + off, outx);
  x = strlen(outx);
  pt += strlen(inx);
  strcpy(str + off + x, pt);
  freestring(&a);
  *ap = strdup(str);
  free(str);
  return (1 + substringx(ap, inx, outx, niter + 1));
}


x86 assembly (clang, -O0):
<substringx>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
mov    %rdx,-0x20(%rbp)
mov    %ecx,-0x24(%rbp)
cmpl   $0x32,-0x24(%rbp)
jle    11d6 <substringx+0x36>
mov    -0x10(%rbp),%rax
mov    (%rax),%rsi
lea    0xe31(%rip),%rdi
mov    $0x0,%al
call   1060 <fatalx@plt>
mov    -0x10(%rbp),%rax
mov    (%rax),%rax
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rdi
call   1080 <strlen@plt>
mov    %eax,-0x54(%rbp)
mov    -0x18(%rbp),%rdi
call   1080 <strlen@plt>
mov    %eax,%ecx
mov    -0x54(%rbp),%eax
add    %ecx,%eax
mov    %eax,-0x50(%rbp)
mov    -0x20(%rbp),%rdi
call   1080 <strlen@plt>
mov    %eax,%ecx
mov    -0x50(%rbp),%eax
add    %ecx,%eax
add    $0x1,%eax
mov    %eax,-0x44(%rbp)
mov    -0x30(%rbp),%rdi
mov    -0x18(%rbp),%rsi
call   10c0 <strstr@plt>
mov    %rax,-0x38(%rbp)
cmpq   $0x0,-0x38(%rbp)
jne    123e <substringx+0x9e>
movl   $0x0,-0x4(%rbp)
jmp    131e <substringx+0x17e>
mov    -0x44(%rbp),%edi
mov    $0x1,%esi
call   10a0 <calloc@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
jne    126a <substringx+0xca>
mov    -0x44(%rbp),%esi
lea    0xdb9(%rip),%rdi
mov    $0x0,%al
call   1060 <fatalx@plt>
mov    -0x38(%rbp),%rax
mov    -0x30(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,-0x48(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x30(%rbp),%rsi
mov    -0x48(%rbp),%edx
call   1040 <strncpy@plt>
mov    -0x40(%rbp),%rdi
movslq -0x48(%rbp),%rax
add    %rax,%rdi
mov    -0x20(%rbp),%rsi
call   1050 <strcpy@plt>
mov    -0x20(%rbp),%rdi
call   1080 <strlen@plt>
mov    %eax,-0x4c(%rbp)
mov    -0x18(%rbp),%rdi
call   1080 <strlen@plt>
mov    %eax,%ecx
mov    -0x38(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x38(%rbp)
mov    -0x40(%rbp),%rdi
movslq -0x48(%rbp),%rax
add    %rax,%rdi
movslq -0x4c(%rbp),%rax
add    %rax,%rdi
mov    -0x38(%rbp),%rsi
call   1050 <strcpy@plt>
lea    -0x30(%rbp),%rdi
call   1090 <freestring@plt>
mov    -0x40(%rbp),%rdi
call   10b0 <strdup@plt>
mov    %rax,%rcx
mov    -0x10(%rbp),%rax
mov    %rcx,(%rax)
mov    -0x40(%rbp),%rdi
call   1030 <free@plt>
mov    -0x10(%rbp),%rdi
mov    -0x18(%rbp),%rsi
mov    -0x20(%rbp),%rdx
mov    -0x24(%rbp),%ecx
add    $0x1,%ecx
call   1070 <substringx@plt>
add    $0x1,%eax
mov    %eax,-0x4(%rbp)
mov    -0x4(%rbp),%eax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<substringx>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x28,%rsp
mov    %rdx,%r12
mov    %rsi,%rbp
mov    %rdi,%rbx
mov    %ecx,0x4(%rsp)
cmp    $0x33,%ecx
jl     11d1 <substringx+0x31>
mov    (%rbx),%rsi
lea    0xe36(%rip),%rdi
xor    %eax,%eax
call   1060 <fatalx@plt>
mov    %rbx,0x8(%rsp)
mov    (%rbx),%r14
mov    %r14,0x20(%rsp)
mov    %r14,%rdi
call   1080 <strlen@plt>
mov    %eax,%ebx
mov    %rbp,%rdi
call   1080 <strlen@plt>
mov    %eax,%r15d
mov    %r12,0x18(%rsp)
mov    %r12,%rdi
call   1080 <strlen@plt>
mov    %eax,%r13d
mov    %r14,%rdi
mov    %rbp,0x10(%rsp)
mov    %rbp,%rsi
call   10c0 <strstr@plt>
test   %rax,%rax
je     12e0 <substringx+0x140>
mov    %rax,%r12
add    %r15d,%ebx
lea    (%rbx,%r13,1),%r15d
add    $0x1,%r15d
mov    %r15d,%edi
mov    $0x1,%esi
call   10a0 <calloc@plt>
mov    %rax,%r13
test   %rax,%rax
jne    1250 <substringx+0xb0>
lea    0xdd6(%rip),%rdi
mov    %r15d,%esi
xor    %eax,%eax
call   1060 <fatalx@plt>
mov    %r12,%rbp
sub    %r14,%rbp
mov    %r13,%rdi
mov    %r14,%rsi
mov    %ebp,%edx
call   1040 <strncpy@plt>
movslq %ebp,%rax
mov    %r13,%rbx
add    %rax,%rbx
mov    %rbx,%rdi
mov    0x18(%rsp),%r14
mov    %r14,%rsi
call   1050 <strcpy@plt>
mov    %r14,%rdi
call   1080 <strlen@plt>
mov    %eax,%ebp
mov    0x10(%rsp),%r15
mov    %r15,%rdi
call   1080 <strlen@plt>
movslq %eax,%rsi
add    %r12,%rsi
movslq %ebp,%rdi
add    %rbx,%rdi
call   1050 <strcpy@plt>
lea    0x20(%rsp),%rdi
call   1090 <freestring@plt>
mov    %r13,%rdi
call   10b0 <strdup@plt>
mov    0x8(%rsp),%rbx
mov    %rax,(%rbx)
mov    %r13,%rdi
call   1030 <free@plt>
mov    0x4(%rsp),%ecx
add    $0x1,%ecx
mov    %rbx,%rdi
mov    %r15,%rsi
mov    %r14,%rdx
call   1070 <substringx@plt>
add    $0x1,%eax
jmp    12e2 <substringx+0x142>
xor    %eax,%eax
add    $0x28,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [28 x i8] c"bad string replacement\0A %s\0A\00"
@.str.1 = [41 x i8] c"Unable to allocate %d unit(s) for item \0A\00"
define i32 @substringx(i8** %0, i8* %1, i8* %2, i32 %3) {
%5 = alloca i32
%6 = alloca i8**
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i32
%10 = alloca i8*
%11 = alloca i8*
%12 = alloca i8*
%13 = alloca i32
%14 = alloca i32
%15 = alloca i32
store i8** %0, i8*** %6
store i8* %1, i8** %7
store i8* %2, i8** %8
store i32 %3, i32* %9
%16 = load i32, i32* %9
%17 = icmp sgt i32 %16, 50
br i1 %17, label %18, label %22
18: ; preds = %4
%19 = load i8**, i8*** %6
%20 = load i8*, i8** %19
%21 = call i32 (i8*, ...) @fatalx(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str, i64 0, i64 0), i8* %20)
br label %22
22: ; preds = %18, %4
%23 = load i8**, i8*** %6
%24 = load i8*, i8** %23
store i8* %24, i8** %10
%25 = load i8*, i8** %10
%26 = call i32 @strlen(i8* %25)
%27 = load i8*, i8** %7
%28 = call i32 @strlen(i8* %27)
%29 = add nsw i32 %26, %28
%30 = load i8*, i8** %8
%31 = call i32 @strlen(i8* %30)
%32 = add nsw i32 %29, %31
%33 = add nsw i32 %32, 1
store i32 %33, i32* %13
%34 = load i8*, i8** %10
%35 = load i8*, i8** %7
%36 = call i8* @strstr(i8* %34, i8* %35)
store i8* %36, i8** %11
%37 = load i8*, i8** %11
%38 = icmp eq i8* %37, null
br i1 %38, label %39, label %40
39: ; preds = %22
store i32 0, i32* %5
br label %94
40: ; preds = %22
%41 = load i32, i32* %13
%42 = call i64 @calloc(i32 %41, i32 1)
%43 = inttoptr i64 %42 to i8*
store i8* %43, i8** %12
%44 = icmp eq i8* %43, null
br i1 %44, label %45, label %48
45: ; preds = %40
%46 = load i32, i32* %13
%47 = call i32 (i8*, ...) @fatalx(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.1, i64 0, i64 0), i32 %46)
br label %48
48: ; preds = %45, %40
%49 = load i8*, i8** %11
%50 = load i8*, i8** %10
%51 = ptrtoint i8* %49 to i64
%52 = ptrtoint i8* %50 to i64
%53 = sub i64 %51, %52
%54 = trunc i64 %53 to i32
store i32 %54, i32* %14
%55 = load i8*, i8** %12
%56 = load i8*, i8** %10
%57 = load i32, i32* %14
%58 = call i32 @strncpy(i8* %55, i8* %56, i32 %57)
%59 = load i8*, i8** %12
%60 = load i32, i32* %14
%61 = sext i32 %60 to i64
%62 = getelementptr inbounds i8, i8* %59, i64 %61
%63 = load i8*, i8** %8
%64 = call i32 @strcpy(i8* %62, i8* %63)
%65 = load i8*, i8** %8
%66 = call i32 @strlen(i8* %65)
store i32 %66, i32* %15
%67 = load i8*, i8** %7
%68 = call i32 @strlen(i8* %67)
%69 = load i8*, i8** %11
%70 = sext i32 %68 to i64
%71 = getelementptr inbounds i8, i8* %69, i64 %70
store i8* %71, i8** %11
%72 = load i8*, i8** %12
%73 = load i32, i32* %14
%74 = sext i32 %73 to i64
%75 = getelementptr inbounds i8, i8* %72, i64 %74
%76 = load i32, i32* %15
%77 = sext i32 %76 to i64
%78 = getelementptr inbounds i8, i8* %75, i64 %77
%79 = load i8*, i8** %11
%80 = call i32 @strcpy(i8* %78, i8* %79)
%81 = call i32 @freestring(i8** %10)
%82 = load i8*, i8** %12
%83 = call i8* @strdup(i8* %82)
%84 = load i8**, i8*** %6
store i8* %83, i8** %84
%85 = load i8*, i8** %12
%86 = call i32 @free(i8* %85)
%87 = load i8**, i8*** %6
%88 = load i8*, i8** %7
%89 = load i8*, i8** %8
%90 = load i32, i32* %9
%91 = add nsw i32 %90, 1
%92 = call i32 @substringx(i8** %87, i8* %88, i8* %89, i32 %91)
%93 = add nsw i32 1, %92
store i32 %93, i32* %5
br label %94
94: ; preds = %48, %39
%95 = load i32, i32* %5
ret i32 %95
}

LLVM IR (-O2):
@.str = [28 x i8] c"bad string replacement\0A %s\0A\00"
@.str.1 = [41 x i8] c"Unable to allocate %d unit(s) for item \0A\00"
define i32 @substringx(i8** nocapture %0, i8* %1, i8* %2, i32 %3) {
%5 = alloca i8*
%6 = bitcast i8** %5 to i8*
%7 = icmp sgt i32 %3, 50
br i1 %7, label %8, label %11
8: ; preds = %4
%9 = load i8*, i8** %0
%10 = tail call i32 (i8*, ...) @fatalx(i8* getelementptr inbounds ([28 x i8], [28 x i8]* @.str, i64 0, i64 0), i8* %9)
br label %11
11: ; preds = %8, %4
%12 = load i8*, i8** %0
store i8* %12, i8** %5
%13 = tail call i32 @strlen(i8* %12)
%14 = tail call i32 @strlen(i8* %1)
%15 = tail call i32 @strlen(i8* %2)
%16 = add i32 %13, 1
%17 = add i32 %16, %14
%18 = add i32 %17, %15
%19 = tail call i8* @strstr(i8* dereferenceable(1) %12, i8* dereferenceable(1) %1)
%20 = icmp eq i8* %19, null
br i1 %20, label %50, label %21
21: ; preds = %11
%22 = tail call i64 @calloc(i32 %18, i32 1)
%23 = inttoptr i64 %22 to i8*
%24 = icmp eq i64 %22, 0
br i1 %24, label %25, label %27
25: ; preds = %21
%26 = tail call i32 (i8*, ...) @fatalx(i8* getelementptr inbounds ([41 x i8], [41 x i8]* @.str.1, i64 0, i64 0), i32 %18)
br label %27
27: ; preds = %25, %21
%28 = ptrtoint i8* %19 to i64
%29 = ptrtoint i8* %12 to i64
%30 = sub i64 %28, %29
%31 = trunc i64 %30 to i32
%32 = tail call i32 @strncpy(i8* %23, i8* %12, i32 %31)
%33 = shl i64 %30, 32
%34 = ashr exact i64 %33, 32
%35 = getelementptr inbounds i8, i8* %23, i64 %34
%36 = tail call i32 @strcpy(i8* %35, i8* %2)
%37 = tail call i32 @strlen(i8* %2)
%38 = tail call i32 @strlen(i8* %1)
%39 = sext i32 %38 to i64
%40 = getelementptr inbounds i8, i8* %19, i64 %39
%41 = sext i32 %37 to i64
%42 = getelementptr inbounds i8, i8* %35, i64 %41
%43 = tail call i32 @strcpy(i8* %42, i8* %40)
%44 = call i32 @freestring(i8** %5)
%45 = call i8* @strdup(i8* %23)
store i8* %45, i8** %0
%46 = call i32 @free(i8* %23)
%47 = add nsw i32 %3, 1
%48 = call i32 @substringx(i8** %0, i8* %1, i8* %2, i32 %47)
%49 = add nsw i32 %48, 1
br label %50
50: ; preds = %11, %27
%51 = phi i32 [ %49, %27 ], [ 0, %11 ]
ret i32 %51
}