#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
scalar_t__ malloc(int);
int strlen(char *);
int /*<<< orphan*/ strncpy(char *, char *, int);
char *html_escape(char *s) {
  int extra_size = 0, len = strlen(s);
  char *ret = NULL, *s2 = NULL, *s1 = s;
  while (*s1++) {
    if ('<' == *s1) {
      extra_size += 3;
    } else if ('&' == *s1) {
      extra_size += 4;
    }
  }
  ret = s2 = (char *)malloc(len + extra_size + 1);
  s1 = s;
  while (*s1) {
    if ('<' == *s1) {
      strncpy(s2, "&lt;", 4);
      s2 += 4;
    } else if ('&' == *s1) {
      strncpy(s2, "&amp;", 5);
      s2 += 5;
    } else {
      *s2++ = *s1;
    }
    s1++;
  }
  *s2 = '\0';
  return ret;
}


x86 assembly (clang, -O0):
<html_escape>:
push   %rbp
mov    %rsp,%rbp
sub    $0x30,%rsp
mov    %rdi,-0x8(%rbp)
movl   $0x0,-0xc(%rbp)
mov    -0x8(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x10(%rbp)
movq   $0x0,-0x18(%rbp)
movq   $0x0,-0x20(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
mov    %rax,%rcx
add    $0x1,%rcx
mov    %rcx,-0x28(%rbp)
cmpb   $0x0,(%rax)
je     11c8 <html_escape+0x98>
mov    -0x28(%rbp),%rax
movsbl (%rax),%ecx
mov    $0x3c,%eax
cmp    %ecx,%eax
jne    11a1 <html_escape+0x71>
mov    -0xc(%rbp),%eax
add    $0x3,%eax
mov    %eax,-0xc(%rbp)
jmp    11c3 <html_escape+0x93>
mov    -0x28(%rbp),%rax
movsbl (%rax),%ecx
mov    $0x26,%eax
cmp    %ecx,%eax
jne    11be <html_escape+0x8e>
mov    -0xc(%rbp),%eax
add    $0x4,%eax
mov    %eax,-0xc(%rbp)
jmp    11c3 <html_escape+0x93>
jmp    1167 <html_escape+0x37>
mov    -0x10(%rbp),%edi
add    -0xc(%rbp),%edi
add    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,-0x20(%rbp)
mov    %rax,-0x18(%rbp)
mov    -0x8(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x28(%rbp),%rax
cmpb   $0x0,(%rax)
je     1294 <html_escape+0x164>
mov    -0x28(%rbp),%rax
movsbl (%rax),%ecx
mov    $0x3c,%eax
cmp    %ecx,%eax
jne    122d <html_escape+0xfd>
mov    -0x20(%rbp),%rdi
lea    0xdee(%rip),%rsi
mov    $0x4,%edx
call   1030 <strncpy@plt>
mov    -0x20(%rbp),%rax
add    $0x4,%rax
mov    %rax,-0x20(%rbp)
jmp    1283 <html_escape+0x153>
mov    -0x28(%rbp),%rax
movsbl (%rax),%ecx
mov    $0x26,%eax
cmp    %ecx,%eax
jne    1267 <html_escape+0x137>
mov    -0x20(%rbp),%rdi
lea    0xdb9(%rip),%rsi
mov    $0x5,%edx
call   1030 <strncpy@plt>
mov    -0x20(%rbp),%rax
add    $0x5,%rax
mov    %rax,-0x20(%rbp)
jmp    127e <html_escape+0x14e>
mov    -0x28(%rbp),%rax
mov    (%rax),%cl
mov    -0x20(%rbp),%rax
mov    %rax,%rdx
add    $0x1,%rdx
mov    %rdx,-0x20(%rbp)
mov    %cl,(%rax)
jmp    1283 <html_escape+0x153>
mov    -0x28(%rbp),%rax
add    $0x1,%rax
mov    %rax,-0x28(%rbp)
jmp    11e6 <html_escape+0xb6>
mov    -0x20(%rbp),%rax
movb   $0x0,(%rax)
mov    -0x18(%rbp),%rax
add    $0x30,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<html_escape>:
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
mov    %rdi,%r13
call   1040 <strlen@plt>
cmpb   $0x0,0x0(%r13)
je     116d <html_escape+0x3d>
lea    0x1(%r13),%rdx
xor    %ecx,%ecx
jmp    115b <html_escape+0x2b>
add    $0x4,%ecx
add    $0x1,%rdx
test   %bl,%bl
je     116f <html_escape+0x3f>
movzbl (%rdx),%ebx
cmp    $0x26,%bl
je     1150 <html_escape+0x20>
cmp    $0x3c,%bl
jne    1153 <html_escape+0x23>
add    $0x3,%ecx
jmp    1153 <html_escape+0x23>
xor    %ecx,%ecx
lea    (%rax,%rcx,1),%edi
add    $0x1,%edi
call   1050 <malloc@plt>
mov    %rax,%r14
lea    0xe81(%rip),%r15
lea    0xe75(%rip),%r12
mov    %rax,%rbx
jmp    11a8 <html_escape+0x78>
mov    %rbx,%rdi
mov    %r12,%rsi
mov    $0x4,%edx
call   1030 <strncpy@plt>
add    $0x4,%rbx
add    $0x1,%r13
movzbl 0x0(%r13),%eax
cmp    $0x26,%al
je     11d0 <html_escape+0xa0>
cmp    $0x3c,%al
je     1190 <html_escape+0x60>
test   %al,%al
je     11ea <html_escape+0xba>
mov    %al,(%rbx)
add    $0x1,%rbx
add    $0x1,%r13
jmp    11a8 <html_escape+0x78>
cs nopw 0x0(%rax,%rax,1)
nop
mov    %rbx,%rdi
mov    %r15,%rsi
mov    $0x5,%edx
call   1030 <strncpy@plt>
add    $0x5,%rbx
add    $0x1,%r13
jmp    11a8 <html_escape+0x78>
movb   $0x0,(%rbx)
mov    %r14,%rax
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
ret

LLVM IR (-O0):
@.str = [5 x i8] c"&lt;\00"
@.str.1 = [6 x i8] c"&amp;\00"
define i8* @html_escape(i8* %0) {
%2 = alloca i8*
%3 = alloca i32
%4 = alloca i32
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
store i8* %0, i8** %2
store i32 0, i32* %3
%8 = load i8*, i8** %2
%9 = call i32 @strlen(i8* %8)
store i32 %9, i32* %4
store i8* null, i8** %5
store i8* null, i8** %6
%10 = load i8*, i8** %2
store i8* %10, i8** %7
br label %11
11: ; preds = %33, %1
%12 = load i8*, i8** %7
%13 = getelementptr inbounds i8, i8* %12, i32 1
store i8* %13, i8** %7
%14 = load i8, i8* %12
%15 = icmp ne i8 %14, 0
br i1 %15, label %16, label %34
16: ; preds = %11
%17 = load i8*, i8** %7
%18 = load i8, i8* %17
%19 = sext i8 %18 to i32
%20 = icmp eq i32 60, %19
br i1 %20, label %21, label %24
21: ; preds = %16
%22 = load i32, i32* %3
%23 = add nsw i32 %22, 3
store i32 %23, i32* %3
br label %33
24: ; preds = %16
%25 = load i8*, i8** %7
%26 = load i8, i8* %25
%27 = sext i8 %26 to i32
%28 = icmp eq i32 38, %27
br i1 %28, label %29, label %32
29: ; preds = %24
%30 = load i32, i32* %3
%31 = add nsw i32 %30, 4
store i32 %31, i32* %3
br label %32
32: ; preds = %29, %24
br label %33
33: ; preds = %32, %21
br label %11
34: ; preds = %11
%35 = load i32, i32* %4
%36 = load i32, i32* %3
%37 = add nsw i32 %35, %36
%38 = add nsw i32 %37, 1
%39 = call i64 @malloc(i32 %38)
%40 = inttoptr i64 %39 to i8*
store i8* %40, i8** %6
store i8* %40, i8** %5
%41 = load i8*, i8** %2
store i8* %41, i8** %7
br label %42
42: ; preds = %72, %34
%43 = load i8*, i8** %7
%44 = load i8, i8* %43
%45 = icmp ne i8 %44, 0
br i1 %45, label %46, label %75
46: ; preds = %42
%47 = load i8*, i8** %7
%48 = load i8, i8* %47
%49 = sext i8 %48 to i32
%50 = icmp eq i32 60, %49
br i1 %50, label %51, label %56
51: ; preds = %46
%52 = load i8*, i8** %6
%53 = call i32 @strncpy(i8* %52, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 4)
%54 = load i8*, i8** %6
%55 = getelementptr inbounds i8, i8* %54, i64 4
store i8* %55, i8** %6
br label %72
56: ; preds = %46
%57 = load i8*, i8** %7
%58 = load i8, i8* %57
%59 = sext i8 %58 to i32
%60 = icmp eq i32 38, %59
br i1 %60, label %61, label %66
61: ; preds = %56
%62 = load i8*, i8** %6
%63 = call i32 @strncpy(i8* %62, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 5)
%64 = load i8*, i8** %6
%65 = getelementptr inbounds i8, i8* %64, i64 5
store i8* %65, i8** %6
br label %71
66: ; preds = %56
%67 = load i8*, i8** %7
%68 = load i8, i8* %67
%69 = load i8*, i8** %6
%70 = getelementptr inbounds i8, i8* %69, i32 1
store i8* %70, i8** %6
store i8 %68, i8* %69
br label %71
71: ; preds = %66, %61
br label %72
72: ; preds = %71, %51
%73 = load i8*, i8** %7
%74 = getelementptr inbounds i8, i8* %73, i32 1
store i8* %74, i8** %7
br label %42
75: ; preds = %42
%76 = load i8*, i8** %6
store i8 0, i8* %76
%77 = load i8*, i8** %5
ret i8* %77
}

LLVM IR (-O2):
@.str = [5 x i8] c"&lt;\00"
@.str.1 = [6 x i8] c"&amp;\00"
define i8* @html_escape(i8* %0) {
%2 = tail call i32 @strlen(i8* %0)
%3 = load i8, i8* %0
%4 = icmp eq i8 %3, 0
br i1 %4, label %17, label %5
5: ; preds = %1, %14
%6 = phi i8* [ %8, %14 ], [ %0, %1 ]
%7 = phi i32 [ %15, %14 ], [ 0, %1 ]
%8 = getelementptr inbounds i8, i8* %6, i64 1
%9 = load i8, i8* %8
switch i8 %9, label %14 [
i8 60, label %10
i8 38, label %12
]
10: ; preds = %5
%11 = add nsw i32 %7, 3
br label %14
12: ; preds = %5
%13 = add nsw i32 %7, 4
br label %14
14: ; preds = %5, %12, %10
%15 = phi i32 [ %11, %10 ], [ %13, %12 ], [ %7, %5 ]
%16 = icmp eq i8 %9, 0
br i1 %16, label %17, label %5
17: ; preds = %14, %1
%18 = phi i32 [ 0, %1 ], [ %15, %14 ]
%19 = add i32 %2, 1
%20 = add i32 %19, %18
%21 = tail call i64 @malloc(i32 %20)
%22 = inttoptr i64 %21 to i8*
br label %23
23: ; preds = %35, %17
%24 = phi i8* [ %22, %17 ], [ %36, %35 ]
%25 = phi i8* [ %0, %17 ], [ %37, %35 ]
%26 = load i8, i8* %25
switch i8 %26, label %33 [
i8 0, label %38
i8 60, label %27
i8 38, label %30
]
27: ; preds = %23
%28 = tail call i32 @strncpy(i8* %24, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str, i64 0, i64 0), i32 4)
%29 = getelementptr inbounds i8, i8* %24, i64 4
br label %35
30: ; preds = %23
%31 = tail call i32 @strncpy(i8* %24, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.1, i64 0, i64 0), i32 5)
%32 = getelementptr inbounds i8, i8* %24, i64 5
br label %35
33: ; preds = %23
%34 = getelementptr inbounds i8, i8* %24, i64 1
store i8 %26, i8* %24
br label %35
35: ; preds = %30, %33, %27
%36 = phi i8* [ %29, %27 ], [ %32, %30 ], [ %34, %33 ]
%37 = getelementptr inbounds i8, i8* %25, i64 1
br label %23
38: ; preds = %23
store i8 0, i8* %24
ret i8* %22
}