#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
int __VERIFIER_nondet_int();
scalar_t__ alloca(int);
int cstrreplace(char *, char, char);
int main() {
  int length1 = __VERIFIER_nondet_int();
  if (length1 < 1) {
    length1 = 1;
  }
  char *nondetString1 = (char *)alloca(length1 * sizeof(char));
  nondetString1[length1 - 1] = '\0';
  return cstrreplace(nondetString1, (char)__VERIFIER_nondet_int(),
                     (char)__VERIFIER_nondet_int());
}


x86 assembly (clang, -O0):
<main>:
push   %rbp
mov    %rsp,%rbp
sub    $0x20,%rsp
movl   $0x0,-0x4(%rbp)
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
mov    %eax,-0x8(%rbp)
cmpl   $0x1,-0x8(%rbp)
jge    115a <main+0x2a>
movl   $0x1,-0x8(%rbp)
movslq -0x8(%rbp),%rax
shl    $0x0,%rax
mov    %eax,%edi
call   1030 <alloca@plt>
mov    %rax,-0x10(%rbp)
mov    -0x10(%rbp),%rax
mov    -0x8(%rbp),%ecx
sub    $0x1,%ecx
movslq %ecx,%rcx
movb   $0x0,(%rax,%rcx,1)
mov    -0x10(%rbp),%rax
mov    %rax,-0x20(%rbp)
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
mov    %al,-0x11(%rbp)
mov    $0x0,%al
call   1040 <__VERIFIER_nondet_int@plt>
mov    -0x20(%rbp),%rdi
mov    -0x11(%rbp),%cl
movsbl %cl,%esi
movsbl %al,%edx
call   1050 <cstrreplace@plt>
add    $0x20,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<main>:
push   %r14
push   %rbx
push   %rax
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
test   %eax,%eax
mov    $0x1,%ebx
cmovg  %eax,%ebx
mov    %ebx,%edi
call   1030 <alloca@plt>
mov    %rax,%r14
add    $0xffffffff,%ebx
movb   $0x0,(%rax,%rbx,1)
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
mov    %eax,%ebx
xor    %eax,%eax
call   1040 <__VERIFIER_nondet_int@plt>
movsbl %bl,%esi
movsbl %al,%edx
mov    %r14,%rdi
add    $0x8,%rsp
pop    %rbx
pop    %r14
jmp    1050 <cstrreplace@plt>

LLVM IR (-O0):
define i32 @main() {
%1 = alloca i32
%2 = alloca i32
%3 = alloca i8*
store i32 0, i32* %1
%4 = call i32 (...) @__VERIFIER_nondet_int()
store i32 %4, i32* %2
%5 = load i32, i32* %2
%6 = icmp slt i32 %5, 1
br i1 %6, label %7, label %8
7: ; preds = %0
store i32 1, i32* %2
br label %8
8: ; preds = %7, %0
%9 = load i32, i32* %2
%10 = sext i32 %9 to i64
%11 = mul i64 %10, 1
%12 = trunc i64 %11 to i32
%13 = call i64 @alloca(i32 %12)
%14 = inttoptr i64 %13 to i8*
store i8* %14, i8** %3
%15 = load i8*, i8** %3
%16 = load i32, i32* %2
%17 = sub nsw i32 %16, 1
%18 = sext i32 %17 to i64
%19 = getelementptr inbounds i8, i8* %15, i64 %18
store i8 0, i8* %19
%20 = load i8*, i8** %3
%21 = call i32 (...) @__VERIFIER_nondet_int()
%22 = trunc i32 %21 to i8
%23 = call i32 (...) @__VERIFIER_nondet_int()
%24 = trunc i32 %23 to i8
%25 = call i32 @cstrreplace(i8* %20, i8 signext %22, i8 signext %24)
ret i32 %25
}

LLVM IR (-O2):
define i32 @main() {
%1 = tail call i32 (...) @__VERIFIER_nondet_int()
%2 = icmp sgt i32 %1, 1
%3 = select i1 %2, i32 %1, i32 1
%4 = tail call i64 @alloca(i32 %3)
%5 = inttoptr i64 %4 to i8*
%6 = add nsw i32 %3, -1
%7 = zext i32 %6 to i64
%8 = getelementptr inbounds i8, i8* %5, i64 %7
store i8 0, i8* %8
%9 = tail call i32 (...) @__VERIFIER_nondet_int()
%10 = trunc i32 %9 to i8
%11 = tail call i32 (...) @__VERIFIER_nondet_int()
%12 = trunc i32 %11 to i8
%13 = tail call i32 @cstrreplace(i8* %5, i8 signext %10, i8 signext %12)
ret i32 %13
}