#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
typedef scalar_t__ pid_t;
typedef int /*<<< orphan*/ FILE;

/* Variables and functions */
int STDERR_FILENO;
int STDIN_FILENO;
int STDOUT_FILENO;
int /*<<< orphan*/ close(int);
int /*<<< orphan*/ dup2(int, int);
int /*<<< orphan*/ execv(char *, char **);
int /*<<< orphan*/ execvp(char *, char **);
int /*<<< orphan*/ exit(int /*<<< orphan*/);
int /*<<< orphan*/ *fdopen(int, char *);
scalar_t__ fork();
int /*<<< orphan*/ free(char *);
scalar_t__ malloc(int);
scalar_t__ pipe(int *);
scalar_t__ realloc(char **, int);
int /*<<< orphan*/ *strchr(char *, char);
int /*<<< orphan*/ strcpy(char *, char *);
char *strdup(char *);
int strlen(char *);
char *strtok(char *, char *);
int /*<<< orphan*/ waitpid(scalar_t__, int /*<<< orphan*/ *,
                           int /*<<< orphan*/);
FILE *s_popen(char *cmd, const char *type) {
  pid_t pid;
  int pfd[2];
  int rpipe = 0, wpipe = 0, i;
  char **argv;
  char *ptr;
  char *cmdcpy;
  if (cmd == NULL || cmd == "")
    return (NULL);
  if (type[0] != 'r' && type[0] != 'w')
    return (NULL);
  if ((cmdcpy = strdup(cmd)) == NULL)
    return (NULL);
  argv = NULL;
  if ((ptr = strtok(cmdcpy, " ")) == NULL) {
    free(cmdcpy);
    return (NULL);
  }
  for (i = 0;; i++) {
    if ((argv = (char **)realloc(argv, (i + 1) * sizeof(char *))) == NULL) {
      free(cmdcpy);
      return (NULL);
    }
    if ((*(argv + i) = (char *)malloc((strlen(ptr) + 1) * sizeof(char))) ==
        NULL) {
      free(cmdcpy);
      return (NULL);
    }
    strcpy(argv[i], ptr);
    if ((ptr = strtok(NULL, " ")) == NULL) {
      if ((argv = (char **)realloc(argv, (i + 2) * sizeof(char *))) == NULL) {
        free(cmdcpy);
        return (NULL);
      }
      argv[i + 1] = NULL;
      break;
    }
  }
  if (type[0] == 'r')
    rpipe = 1;
  else
    wpipe = 1;
  if (pipe(pfd) < 0) {
    free(cmdcpy);
    return (NULL);
  }
  if ((pid = fork()) < 0) {
    close(pfd[0]);
    close(pfd[1]);
    free(cmdcpy);
    return (NULL);
  }
  if (pid == 0) {
    if ((pid = fork()) < 0) {
      close(pfd[0]);
      close(pfd[1]);
      free(cmdcpy);
      return (NULL);
    }
    if (pid > 0) {
      exit(0);
    }
    if (rpipe) {
      close(pfd[0]);
      if (pfd[1] != STDOUT_FILENO)
        dup2(pfd[1], STDOUT_FILENO);
      dup2(STDOUT_FILENO, STDERR_FILENO);
    } else {
      close(pfd[1]);
      if (pfd[0] != STDIN_FILENO)
        dup2(pfd[0], STDIN_FILENO);
    }
    if (strchr(argv[0], '/') == NULL)
      execvp(argv[0], argv);
    else
      execv(argv[0], argv);
    close(pfd[0]);
    close(pfd[1]);
    free(cmdcpy);
    return (NULL);
  } else {
    waitpid(pid, NULL, 0);
    if (rpipe) {
      close(pfd[1]);
      free(cmdcpy);
      return (fdopen(pfd[0], "r"));
    } else {
      close(pfd[0]);
      free(cmdcpy);
      return (fdopen(pfd[1], "w"));
    }
  }
}


x86 assembly (clang, -O0):
<s_popen>:
push   %rbp
mov    %rsp,%rbp
sub    $0x50,%rsp
mov    %rdi,-0x10(%rbp)
mov    %rsi,-0x18(%rbp)
movl   $0x0,-0x2c(%rbp)
movl   $0x0,-0x30(%rbp)
cmpq   $0x0,-0x10(%rbp)
je     124a <s_popen+0x3a>
lea    0xdc1(%rip),%rax
cmp    %rax,-0x10(%rbp)
jne    1257 <s_popen+0x47>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x72,%eax
je     1284 <s_popen+0x74>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x77,%eax
je     1284 <s_popen+0x74>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    -0x10(%rbp),%rdi
call   1110 <strdup@plt>
mov    %rax,-0x50(%rbp)
cmp    $0x0,%rax
jne    12a8 <s_popen+0x98>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
movq   $0x0,-0x40(%rbp)
mov    -0x50(%rbp),%rdi
lea    0xd45(%rip),%rsi
call   10e0 <strtok@plt>
mov    %rax,-0x48(%rbp)
cmp    $0x0,%rax
jne    12e4 <s_popen+0xd4>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
movl   $0x0,-0x34(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x34(%rbp),%eax
add    $0x1,%eax
cltq
shl    $0x3,%rax
mov    %eax,%esi
call   10b0 <realloc@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
jne    1326 <s_popen+0x116>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    -0x48(%rbp),%rdi
call   1050 <strlen@plt>
add    $0x1,%eax
cltq
shl    $0x0,%rax
mov    %eax,%edi
call   10a0 <malloc@plt>
mov    -0x40(%rbp),%rcx
movslq -0x34(%rbp),%rdx
mov    %rax,(%rcx,%rdx,8)
cmp    $0x0,%rax
jne    136b <s_popen+0x15b>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    -0x40(%rbp),%rax
movslq -0x34(%rbp),%rcx
mov    (%rax,%rcx,8),%rdi
mov    -0x48(%rbp),%rsi
call   1040 <strcpy@plt>
xor    %eax,%eax
mov    %eax,%edi
lea    0xc75(%rip),%rsi
call   10e0 <strtok@plt>
mov    %rax,-0x48(%rbp)
cmp    $0x0,%rax
jne    13f3 <s_popen+0x1e3>
mov    -0x40(%rbp),%rdi
mov    -0x34(%rbp),%eax
add    $0x2,%eax
cltq
shl    $0x3,%rax
mov    %eax,%esi
call   10b0 <realloc@plt>
mov    %rax,-0x40(%rbp)
cmp    $0x0,%rax
jne    13d9 <s_popen+0x1c9>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    -0x40(%rbp),%rax
mov    -0x34(%rbp),%ecx
add    $0x1,%ecx
movslq %ecx,%rcx
movq   $0x0,(%rax,%rcx,8)
jmp    1406 <s_popen+0x1f6>
jmp    13f8 <s_popen+0x1e8>
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x34(%rbp)
jmp    12eb <s_popen+0xdb>
mov    -0x18(%rbp),%rax
movsbl (%rax),%eax
cmp    $0x72,%eax
jne    1422 <s_popen+0x212>
movl   $0x1,-0x2c(%rbp)
jmp    1429 <s_popen+0x219>
movl   $0x1,-0x30(%rbp)
lea    -0x28(%rbp),%rdi
call   1090 <pipe@plt>
cmp    $0x0,%rax
jge    1452 <s_popen+0x242>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    $0x0,%al
call   1130 <fork@plt>
mov    %rax,-0x20(%rbp)
cmp    $0x0,%rax
jge    148d <s_popen+0x27d>
mov    -0x28(%rbp),%edi
call   1080 <close@plt>
mov    -0x24(%rbp),%edi
call   1080 <close@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
cmpq   $0x0,-0x20(%rbp)
jne    15cc <s_popen+0x3bc>
mov    $0x0,%al
call   1130 <fork@plt>
mov    %rax,-0x20(%rbp)
cmp    $0x0,%rax
jge    14d3 <s_popen+0x2c3>
mov    -0x28(%rbp),%edi
call   1080 <close@plt>
mov    -0x24(%rbp),%edi
call   1080 <close@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
cmpq   $0x0,-0x20(%rbp)
jle    14e5 <s_popen+0x2d5>
xor    %edi,%edi
call   1100 <exit@plt>
cmpl   $0x0,-0x2c(%rbp)
je     1536 <s_popen+0x326>
mov    -0x28(%rbp),%edi
call   1080 <close@plt>
mov    -0x24(%rbp),%eax
mov    0x2aef(%rip),%rcx
cmp    (%rcx),%eax
je     151a <s_popen+0x30a>
mov    -0x24(%rbp),%edi
mov    0x2add(%rip),%rax
mov    (%rax),%esi
call   1060 <dup2@plt>
mov    0x2acf(%rip),%rax
mov    (%rax),%edi
mov    0x2aae(%rip),%rax
mov    (%rax),%esi
call   1060 <dup2@plt>
jmp    1566 <s_popen+0x356>
mov    -0x24(%rbp),%edi
call   1080 <close@plt>
mov    -0x28(%rbp),%eax
mov    0x2a88(%rip),%rcx
cmp    (%rcx),%eax
je     1561 <s_popen+0x351>
mov    -0x28(%rbp),%edi
mov    0x2a76(%rip),%rax
mov    (%rax),%esi
call   1060 <dup2@plt>
jmp    1566 <s_popen+0x356>
mov    -0x40(%rbp),%rax
mov    (%rax),%rdi
mov    $0x2f,%esi
call   1070 <strchr@plt>
cmp    $0x0,%rax
jne    1596 <s_popen+0x386>
mov    -0x40(%rbp),%rax
mov    (%rax),%rdi
mov    -0x40(%rbp),%rsi
call   10f0 <execvp@plt>
jmp    15a6 <s_popen+0x396>
mov    -0x40(%rbp),%rax
mov    (%rax),%rdi
mov    -0x40(%rbp),%rsi
call   1120 <execv@plt>
mov    -0x28(%rbp),%edi
call   1080 <close@plt>
mov    -0x24(%rbp),%edi
call   1080 <close@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
movq   $0x0,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    -0x20(%rbp),%rdi
xor    %eax,%eax
mov    %eax,%esi
xor    %edx,%edx
call   10d0 <waitpid@plt>
cmpl   $0x0,-0x2c(%rbp)
je     160e <s_popen+0x3fe>
mov    -0x24(%rbp),%edi
call   1080 <close@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x28(%rbp),%edi
lea    0xa02(%rip),%rsi
call   10c0 <fdopen@plt>
mov    %rax,-0x8(%rbp)
jmp    1632 <s_popen+0x422>
mov    -0x28(%rbp),%edi
call   1080 <close@plt>
mov    -0x50(%rbp),%rdi
call   1030 <free@plt>
mov    -0x24(%rbp),%edi
lea    0x9db(%rip),%rsi
call   10c0 <fdopen@plt>
mov    %rax,-0x8(%rbp)
mov    -0x8(%rbp),%rax
add    $0x50,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<s_popen>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
xor    %eax,%eax
test   %rdi,%rdi
je     1458 <s_popen+0x248>
lea    0xdd1(%rip),%rcx
cmp    %rcx,%rdi
je     1458 <s_popen+0x248>
mov    %rsi,%r12
mov    (%rsi),%al
cmp    $0x77,%al
je     124a <s_popen+0x3a>
cmp    $0x72,%al
jne    1456 <s_popen+0x246>
call   1110 <strdup@plt>
test   %rax,%rax
je     1456 <s_popen+0x246>
mov    %rax,%rbx
lea    0xd9e(%rip),%rsi
mov    %rax,%rdi
call   10e0 <strtok@plt>
test   %rax,%rax
je     144e <s_popen+0x23e>
mov    %rax,%r13
mov    %rbx,0x10(%rsp)
mov    $0x8,%ebp
xor    %r14d,%r14d
lea    0xd76(%rip),%r15
xor    %ebx,%ebx
nopl   0x0(%rax)
mov    %rbx,%rdi
mov    %ebp,%esi
call   10b0 <realloc@plt>
test   %rax,%rax
je     1361 <s_popen+0x151>
mov    %rax,%rbx
mov    %r13,%rdi
call   1050 <strlen@plt>
lea    0x1(%rax),%edi
call   10a0 <malloc@plt>
mov    %rax,(%rbx,%r14,8)
test   %rax,%rax
je     1361 <s_popen+0x151>
mov    %rax,%rdi
mov    %r13,%rsi
call   1040 <strcpy@plt>
xor    %edi,%edi
mov    %r15,%rsi
call   10e0 <strtok@plt>
mov    %rax,%r13
add    $0x8,%ebp
add    $0x1,%r14
test   %rax,%rax
jne    1290 <s_popen+0x80>
mov    %rbx,%rdi
mov    %ebp,%esi
call   10b0 <realloc@plt>
test   %rax,%rax
je     1361 <s_popen+0x151>
mov    %rax,%r15
mov    %r14d,%eax
movq   $0x0,(%r15,%rax,8)
mov    (%r12),%bl
lea    0x8(%rsp),%rdi
call   1090 <pipe@plt>
test   %rax,%rax
js     1361 <s_popen+0x151>
xor    %eax,%eax
call   1130 <fork@plt>
test   %rax,%rax
js     13b3 <s_popen+0x1a3>
je     136b <s_popen+0x15b>
mov    %rax,%rdi
xor    %esi,%esi
xor    %edx,%edx
call   10d0 <waitpid@plt>
cmp    $0x72,%bl
jne    13cf <s_popen+0x1bf>
mov    0xc(%rsp),%edi
call   1080 <close@plt>
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    0x8(%rsp),%edi
lea    0xca6(%rip),%rsi
jmp    13ed <s_popen+0x1dd>
mov    0x10(%rsp),%rdi
jmp    1451 <s_popen+0x241>
xor    %eax,%eax
call   1130 <fork@plt>
test   %rax,%rax
js     13b3 <s_popen+0x1a3>
jne    1467 <s_popen+0x257>
cmp    $0x72,%bl
jne    13f4 <s_popen+0x1e4>
mov    0x8(%rsp),%edi
call   1080 <close@plt>
mov    0xc(%rsp),%edi
mov    0x2c5a(%rip),%rbx
mov    (%rbx),%esi
cmp    %esi,%edi
je     13a3 <s_popen+0x193>
call   1060 <dup2@plt>
mov    (%rbx),%edi
mov    0x10(%rsp),%rbx
mov    0x2c29(%rip),%rax
mov    (%rax),%esi
jmp    1413 <s_popen+0x203>
mov    0x8(%rsp),%edi
call   1080 <close@plt>
mov    0xc(%rsp),%edi
call   1080 <close@plt>
mov    0x10(%rsp),%rdi
jmp    1451 <s_popen+0x241>
mov    0x8(%rsp),%edi
call   1080 <close@plt>
mov    0x10(%rsp),%rdi
call   1030 <free@plt>
mov    0xc(%rsp),%edi
lea    0xc17(%rip),%rsi
call   10c0 <fdopen@plt>
jmp    1458 <s_popen+0x248>
mov    0xc(%rsp),%edi
call   1080 <close@plt>
mov    0x8(%rsp),%edi
mov    0x2bc8(%rip),%rax
mov    (%rax),%esi
cmp    %esi,%edi
mov    0x10(%rsp),%rbx
je     1418 <s_popen+0x208>
call   1060 <dup2@plt>
mov    (%r15),%rdi
mov    $0x2f,%esi
call   1070 <strchr@plt>
mov    (%r15),%rdi
mov    %r15,%rsi
test   %rax,%rax
je     1437 <s_popen+0x227>
call   1120 <execv@plt>
jmp    143c <s_popen+0x22c>
call   10f0 <execvp@plt>
mov    0x8(%rsp),%edi
call   1080 <close@plt>
mov    0xc(%rsp),%edi
call   1080 <close@plt>
mov    %rbx,%rdi
call   1030 <free@plt>
xor    %eax,%eax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
xor    %edi,%edi
call   1100 <exit@plt>

LLVM IR (-O0):
@.str = [1 x i8] zeroinitializer
@.str.1 = [2 x i8] c" \00"
@STDOUT_FILENO = global i32 0
@STDERR_FILENO = global i32 0
@STDIN_FILENO = global i32 0
@.str.2 = [2 x i8] c"r\00"
@.str.3 = [2 x i8] c"w\00"
define i32* @s_popen(i8* %0, i8* %1) {
%3 = alloca i32*
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i64
%7 = alloca [2 x i32]
%8 = alloca i32
%9 = alloca i32
%10 = alloca i32
%11 = alloca i8**
%12 = alloca i8*
%13 = alloca i8*
store i8* %0, i8** %4
store i8* %1, i8** %5
store i32 0, i32* %8
store i32 0, i32* %9
%14 = load i8*, i8** %4
%15 = icmp eq i8* %14, null
br i1 %15, label %19, label %16
16: ; preds = %2
%17 = load i8*, i8** %4
%18 = icmp eq i8* %17, getelementptr inbounds ([1 x i8], [1 x i8]* @.str, i64 0, i64 0)
br i1 %18, label %19, label %20
19: ; preds = %16, %2
store i32* null, i32** %3
br label %240
20: ; preds = %16
%21 = load i8*, i8** %5
%22 = getelementptr inbounds i8, i8* %21, i64 0
%23 = load i8, i8* %22
%24 = sext i8 %23 to i32
%25 = icmp ne i32 %24, 114
br i1 %25, label %26, label %33
26: ; preds = %20
%27 = load i8*, i8** %5
%28 = getelementptr inbounds i8, i8* %27, i64 0
%29 = load i8, i8* %28
%30 = sext i8 %29 to i32
%31 = icmp ne i32 %30, 119
br i1 %31, label %32, label %33
32: ; preds = %26
store i32* null, i32** %3
br label %240
33: ; preds = %26, %20
%34 = load i8*, i8** %4
%35 = call i8* @strdup(i8* %34)
store i8* %35, i8** %13
%36 = icmp eq i8* %35, null
br i1 %36, label %37, label %38
37: ; preds = %33
store i32* null, i32** %3
br label %240
38: ; preds = %33
store i8** null, i8*** %11
%39 = load i8*, i8** %13
%40 = call i8* @strtok(i8* %39, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i8* %40, i8** %12
%41 = icmp eq i8* %40, null
br i1 %41, label %42, label %45
42: ; preds = %38
%43 = load i8*, i8** %13
%44 = call i32 @free(i8* %43)
store i32* null, i32** %3
br label %240
45: ; preds = %38
store i32 0, i32* %10
br label %46
46: ; preds = %106, %45
%47 = load i8**, i8*** %11
%48 = load i32, i32* %10
%49 = add nsw i32 %48, 1
%50 = sext i32 %49 to i64
%51 = mul i64 %50, 8
%52 = trunc i64 %51 to i32
%53 = call i64 @realloc(i8** %47, i32 %52)
%54 = inttoptr i64 %53 to i8**
store i8** %54, i8*** %11
%55 = icmp eq i8** %54, null
br i1 %55, label %56, label %59
56: ; preds = %46
%57 = load i8*, i8** %13
%58 = call i32 @free(i8* %57)
store i32* null, i32** %3
br label %240
59: ; preds = %46
%60 = load i8*, i8** %12
%61 = call i32 @strlen(i8* %60)
%62 = add nsw i32 %61, 1
%63 = sext i32 %62 to i64
%64 = mul i64 %63, 1
%65 = trunc i64 %64 to i32
%66 = call i64 @malloc(i32 %65)
%67 = inttoptr i64 %66 to i8*
%68 = load i8**, i8*** %11
%69 = load i32, i32* %10
%70 = sext i32 %69 to i64
%71 = getelementptr inbounds i8*, i8** %68, i64 %70
store i8* %67, i8** %71
%72 = icmp eq i8* %67, null
br i1 %72, label %73, label %76
73: ; preds = %59
%74 = load i8*, i8** %13
%75 = call i32 @free(i8* %74)
store i32* null, i32** %3
br label %240
76: ; preds = %59
%77 = load i8**, i8*** %11
%78 = load i32, i32* %10
%79 = sext i32 %78 to i64
%80 = getelementptr inbounds i8*, i8** %77, i64 %79
%81 = load i8*, i8** %80
%82 = load i8*, i8** %12
%83 = call i32 @strcpy(i8* %81, i8* %82)
%84 = call i8* @strtok(i8* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
store i8* %84, i8** %12
%85 = icmp eq i8* %84, null
br i1 %85, label %86, label %105
86: ; preds = %76
%87 = load i8**, i8*** %11
%88 = load i32, i32* %10
%89 = add nsw i32 %88, 2
%90 = sext i32 %89 to i64
%91 = mul i64 %90, 8
%92 = trunc i64 %91 to i32
%93 = call i64 @realloc(i8** %87, i32 %92)
%94 = inttoptr i64 %93 to i8**
store i8** %94, i8*** %11
%95 = icmp eq i8** %94, null
br i1 %95, label %96, label %99
96: ; preds = %86
%97 = load i8*, i8** %13
%98 = call i32 @free(i8* %97)
store i32* null, i32** %3
br label %240
99: ; preds = %86
%100 = load i8**, i8*** %11
%101 = load i32, i32* %10
%102 = add nsw i32 %101, 1
%103 = sext i32 %102 to i64
%104 = getelementptr inbounds i8*, i8** %100, i64 %103
store i8* null, i8** %104
br label %109
105: ; preds = %76
br label %106
106: ; preds = %105
%107 = load i32, i32* %10
%108 = add nsw i32 %107, 1
store i32 %108, i32* %10
br label %46
109: ; preds = %99
%110 = load i8*, i8** %5
%111 = getelementptr inbounds i8, i8* %110, i64 0
%112 = load i8, i8* %111
%113 = sext i8 %112 to i32
%114 = icmp eq i32 %113, 114
br i1 %114, label %115, label %116
115: ; preds = %109
store i32 1, i32* %8
br label %117
116: ; preds = %109
store i32 1, i32* %9
br label %117
117: ; preds = %116, %115
%118 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%119 = call i64 @pipe(i32* %118)
%120 = icmp slt i64 %119, 0
br i1 %120, label %121, label %124
121: ; preds = %117
%122 = load i8*, i8** %13
%123 = call i32 @free(i8* %122)
store i32* null, i32** %3
br label %240
124: ; preds = %117
%125 = call i64 (...) @fork()
store i64 %125, i64* %6
%126 = icmp slt i64 %125, 0
br i1 %126, label %127, label %136
127: ; preds = %124
%128 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%129 = load i32, i32* %128
%130 = call i32 @close(i32 %129)
%131 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%132 = load i32, i32* %131
%133 = call i32 @close(i32 %132)
%134 = load i8*, i8** %13
%135 = call i32 @free(i8* %134)
store i32* null, i32** %3
br label %240
136: ; preds = %124
%137 = load i64, i64* %6
%138 = icmp eq i64 %137, 0
br i1 %138, label %139, label %217
139: ; preds = %136
%140 = call i64 (...) @fork()
store i64 %140, i64* %6
%141 = icmp slt i64 %140, 0
br i1 %141, label %142, label %151
142: ; preds = %139
%143 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%144 = load i32, i32* %143
%145 = call i32 @close(i32 %144)
%146 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%147 = load i32, i32* %146
%148 = call i32 @close(i32 %147)
%149 = load i8*, i8** %13
%150 = call i32 @free(i8* %149)
store i32* null, i32** %3
br label %240
151: ; preds = %139
%152 = load i64, i64* %6
%153 = icmp sgt i64 %152, 0
br i1 %153, label %154, label %156
154: ; preds = %151
%155 = call i32 @exit(i32 0)
unreachable
156: ; preds = %151
%157 = load i32, i32* %8
%158 = icmp ne i32 %157, 0
br i1 %158, label %159, label %176
159: ; preds = %156
%160 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%161 = load i32, i32* %160
%162 = call i32 @close(i32 %161)
%163 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%164 = load i32, i32* %163
%165 = load i32, i32* @STDOUT_FILENO
%166 = icmp ne i32 %164, %165
br i1 %166, label %167, label %172
167: ; preds = %159
%168 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%169 = load i32, i32* %168
%170 = load i32, i32* @STDOUT_FILENO
%171 = call i32 @dup2(i32 %169, i32 %170)
br label %172
172: ; preds = %167, %159
%173 = load i32, i32* @STDOUT_FILENO
%174 = load i32, i32* @STDERR_FILENO
%175 = call i32 @dup2(i32 %173, i32 %174)
br label %190
176: ; preds = %156
%177 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%178 = load i32, i32* %177
%179 = call i32 @close(i32 %178)
%180 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%181 = load i32, i32* %180
%182 = load i32, i32* @STDIN_FILENO
%183 = icmp ne i32 %181, %182
br i1 %183, label %184, label %189
184: ; preds = %176
%185 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%186 = load i32, i32* %185
%187 = load i32, i32* @STDIN_FILENO
%188 = call i32 @dup2(i32 %186, i32 %187)
br label %189
189: ; preds = %184, %176
br label %190
190: ; preds = %189, %172
%191 = load i8**, i8*** %11
%192 = getelementptr inbounds i8*, i8** %191, i64 0
%193 = load i8*, i8** %192
%194 = call i32* @strchr(i8* %193, i8 signext 47)
%195 = icmp eq i32* %194, null
br i1 %195, label %196, label %202
196: ; preds = %190
%197 = load i8**, i8*** %11
%198 = getelementptr inbounds i8*, i8** %197, i64 0
%199 = load i8*, i8** %198
%200 = load i8**, i8*** %11
%201 = call i32 @execvp(i8* %199, i8** %200)
br label %208
202: ; preds = %190
%203 = load i8**, i8*** %11
%204 = getelementptr inbounds i8*, i8** %203, i64 0
%205 = load i8*, i8** %204
%206 = load i8**, i8*** %11
%207 = call i32 @execv(i8* %205, i8** %206)
br label %208
208: ; preds = %202, %196
%209 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%210 = load i32, i32* %209
%211 = call i32 @close(i32 %210)
%212 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%213 = load i32, i32* %212
%214 = call i32 @close(i32 %213)
%215 = load i8*, i8** %13
%216 = call i32 @free(i8* %215)
store i32* null, i32** %3
br label %240
217: ; preds = %136
%218 = load i64, i64* %6
%219 = call i32 @waitpid(i64 %218, i32* null, i32 0)
%220 = load i32, i32* %8
%221 = icmp ne i32 %220, 0
br i1 %221, label %222, label %231
222: ; preds = %217
%223 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%224 = load i32, i32* %223
%225 = call i32 @close(i32 %224)
%226 = load i8*, i8** %13
%227 = call i32 @free(i8* %226)
%228 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%229 = load i32, i32* %228
%230 = call i32* @fdopen(i32 %229, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
store i32* %230, i32** %3
br label %240
231: ; preds = %217
%232 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 0
%233 = load i32, i32* %232
%234 = call i32 @close(i32 %233)
%235 = load i8*, i8** %13
%236 = call i32 @free(i8* %235)
%237 = getelementptr inbounds [2 x i32], [2 x i32]* %7, i64 0, i64 1
%238 = load i32, i32* %237
%239 = call i32* @fdopen(i32 %238, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
store i32* %239, i32** %3
br label %240
240: ; preds = %231, %222, %208, %142, %127, %121, %96, %73, %56, %42, %37, %32, %19
%241 = load i32*, i32** %3
ret i32* %241
}

LLVM IR (-O2):
@.str = [1 x i8] zeroinitializer
@.str.1 = [2 x i8] c" \00"
@STDOUT_FILENO = global i32 0
@STDERR_FILENO = global i32 0
@STDIN_FILENO = global i32 0
@.str.2 = [2 x i8] c"r\00"
@.str.3 = [2 x i8] c"w\00"
define noalias i32* @s_popen(i8* %0, i8* nocapture %1) {
%3 = alloca [2 x i32]
%4 = bitcast [2 x i32]* %3 to i8*
%5 = icmp eq i8* %0, null
%6 = icmp eq i8* %0, getelementptr inbounds ([1 x i8], [1 x i8]* @.str, i64 0, i64 0)
%7 = or i1 %5, %6
br i1 %7, label %145, label %8
8: ; preds = %2
%9 = load i8, i8* %1
switch i8 %9, label %145 [
i8 114, label %10
i8 119, label %10
]
10: ; preds = %8, %8
%11 = tail call i8* @strdup(i8* %0)
%12 = icmp eq i8* %11, null
br i1 %12, label %145, label %13
13: ; preds = %10
%14 = tail call i8* @strtok(i8* %11, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%15 = icmp eq i8* %14, null
br i1 %15, label %16, label %18
16: ; preds = %13
%17 = tail call i32 @free(i8* %11)
br label %145
18: ; preds = %13, %39
%19 = phi i64 [ %22, %39 ], [ 0, %13 ]
%20 = phi i8** [ %26, %39 ], [ null, %13 ]
%21 = phi i8* [ %41, %39 ], [ %14, %13 ]
%22 = add nuw i64 %19, 1
%23 = trunc i64 %22 to i32
%24 = shl i32 %23, 3
%25 = tail call i64 @realloc(i8** %20, i32 %24)
%26 = inttoptr i64 %25 to i8**
%27 = icmp eq i64 %25, 0
br i1 %27, label %28, label %30
28: ; preds = %18
%29 = tail call i32 @free(i8* %11)
br label %145
30: ; preds = %18
%31 = tail call i32 @strlen(i8* %21)
%32 = add nsw i32 %31, 1
%33 = tail call i64 @malloc(i32 %32)
%34 = inttoptr i64 %33 to i8*
%35 = getelementptr inbounds i8*, i8** %26, i64 %19
store i8* %34, i8** %35
%36 = icmp eq i64 %33, 0
br i1 %36, label %37, label %39
37: ; preds = %30
%38 = tail call i32 @free(i8* %11)
br label %145
39: ; preds = %30
%40 = tail call i32 @strcpy(i8* %34, i8* %21)
%41 = tail call i8* @strtok(i8* null, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.1, i64 0, i64 0))
%42 = icmp eq i8* %41, null
br i1 %42, label %43, label %18
43: ; preds = %39
%44 = inttoptr i64 %25 to i8**
%45 = trunc i64 %19 to i32
%46 = shl i32 %45, 3
%47 = add i32 %46, 16
%48 = tail call i64 @realloc(i8** %44, i32 %47)
%49 = inttoptr i64 %48 to i8**
%50 = icmp eq i64 %48, 0
br i1 %50, label %51, label %53
51: ; preds = %43
%52 = tail call i32 @free(i8* %11)
br label %145
53: ; preds = %43
%54 = and i64 %22, 4294967295
%55 = getelementptr inbounds i8*, i8** %49, i64 %54
store i8* null, i8** %55
%56 = load i8, i8* %1
%57 = icmp eq i8 %56, 114
%58 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 0
%59 = call i64 @pipe(i32* %58)
%60 = icmp slt i64 %59, 0
br i1 %60, label %61, label %63
61: ; preds = %53
%62 = call i32 @free(i8* %11)
br label %145
63: ; preds = %53
%64 = call i64 (...) @fork()
%65 = icmp slt i64 %64, 0
br i1 %65, label %66, label %73
66: ; preds = %63
%67 = load i32, i32* %58
%68 = call i32 @close(i32 %67)
%69 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%70 = load i32, i32* %69
%71 = call i32 @close(i32 %70)
%72 = call i32 @free(i8* %11)
br label %145
73: ; preds = %63
%74 = icmp eq i64 %64, 0
br i1 %74, label %75, label %129
75: ; preds = %73
%76 = call i64 (...) @fork()
%77 = icmp slt i64 %76, 0
br i1 %77, label %78, label %85
78: ; preds = %75
%79 = load i32, i32* %58
%80 = call i32 @close(i32 %79)
%81 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%82 = load i32, i32* %81
%83 = call i32 @close(i32 %82)
%84 = call i32 @free(i8* %11)
br label %145
85: ; preds = %75
%86 = icmp eq i64 %76, 0
br i1 %86, label %89, label %87
87: ; preds = %85
%88 = call i32 @exit(i32 0)
unreachable
89: ; preds = %85
br i1 %57, label %90, label %104
90: ; preds = %89
%91 = load i32, i32* %58
%92 = call i32 @close(i32 %91)
%93 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%94 = load i32, i32* %93
%95 = load i32, i32* @STDOUT_FILENO
%96 = icmp eq i32 %94, %95
br i1 %96, label %100, label %97
97: ; preds = %90
%98 = call i32 @dup2(i32 %94, i32 %95)
%99 = load i32, i32* @STDOUT_FILENO
br label %100
100: ; preds = %97, %90
%101 = phi i32 [ %99, %97 ], [ %94, %90 ]
%102 = load i32, i32* @STDERR_FILENO
%103 = call i32 @dup2(i32 %101, i32 %102)
br label %113
104: ; preds = %89
%105 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%106 = load i32, i32* %105
%107 = call i32 @close(i32 %106)
%108 = load i32, i32* %58
%109 = load i32, i32* @STDIN_FILENO
%110 = icmp eq i32 %108, %109
br i1 %110, label %113, label %111
111: ; preds = %104
%112 = call i32 @dup2(i32 %108, i32 %109)
br label %113
113: ; preds = %104, %111, %100
%114 = load i8*, i8** %49
%115 = call i32* @strchr(i8* %114, i8 signext 47)
%116 = icmp eq i32* %115, null
%117 = load i8*, i8** %49
br i1 %116, label %118, label %120
118: ; preds = %113
%119 = call i32 @execvp(i8* %117, i8** %49)
br label %122
120: ; preds = %113
%121 = call i32 @execv(i8* %117, i8** %49)
br label %122
122: ; preds = %120, %118
%123 = load i32, i32* %58
%124 = call i32 @close(i32 %123)
%125 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%126 = load i32, i32* %125
%127 = call i32 @close(i32 %126)
%128 = call i32 @free(i8* %11)
br label %145
129: ; preds = %73
%130 = call i32 @waitpid(i64 %64, i32* null, i32 0)
br i1 %57, label %131, label %138
131: ; preds = %129
%132 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%133 = load i32, i32* %132
%134 = call i32 @close(i32 %133)
%135 = call i32 @free(i8* %11)
%136 = load i32, i32* %58
%137 = call i32* @fdopen(i32 %136, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.2, i64 0, i64 0))
br label %145
138: ; preds = %129
%139 = load i32, i32* %58
%140 = call i32 @close(i32 %139)
%141 = call i32 @free(i8* %11)
%142 = getelementptr inbounds [2 x i32], [2 x i32]* %3, i64 0, i64 1
%143 = load i32, i32* %142
%144 = call i32* @fdopen(i32 %143, i8* getelementptr inbounds ([2 x i8], [2 x i8]* @.str.3, i64 0, i64 0))
br label %145
145: ; preds = %10, %8, %2, %138, %131, %122, %78, %66, %61, %51, %37, %28, %16
%146 = phi i32* [ null, %16 ], [ null, %28 ], [ null, %37 ], [ null, %51 ], [ null, %61 ], [ null, %66 ], [ null, %78 ], [ null, %122 ], [ %137, %131 ], [ %144, %138 ], [ null, %2 ], [ null, %8 ], [ null, %10 ]
ret i32* %146
}