#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */

/* Variables and functions */
unsigned char *malloc(int);
int /*<<< orphan*/ strcpy(unsigned char *, ...);
int strlen(unsigned char *);
int /*<<< orphan*/ strncpy(unsigned char *, unsigned char *, int);
unsigned char *strstr(unsigned char *, unsigned char *);
unsigned char *str_replace(unsigned char *search, unsigned char *replace,
                           unsigned char *subject) {
  unsigned char *p = NULL, *old = NULL, *new_subject = NULL;
  int c = 0, search_size;
  search_size = strlen(search);
  for (p = strstr(subject, search); p != NULL;
       p = strstr(p + search_size, search)) {
    c++;
  }
  c = (strlen(replace) - search_size) * c + strlen(subject);
  new_subject = malloc(c);
  strcpy(new_subject, "");
  old = subject;
  for (p = strstr(subject, search); p != NULL;
       p = strstr(p + search_size, search)) {
    strncpy(new_subject + strlen(new_subject), old, p - old);
    strcpy(new_subject + strlen(new_subject), replace);
    old = p + search_size;
  }
  strcpy(new_subject + strlen(new_subject), old);
  return new_subject;
}


x86 assembly (clang, -O0):
<str_replace>:
push   %rbp
mov    %rsp,%rbp
sub    $0x60,%rsp
mov    %rdi,-0x8(%rbp)
mov    %rsi,-0x10(%rbp)
mov    %rdx,-0x18(%rbp)
movq   $0x0,-0x20(%rbp)
movq   $0x0,-0x28(%rbp)
movq   $0x0,-0x30(%rbp)
movl   $0x0,-0x34(%rbp)
mov    -0x8(%rbp),%rdi
call   1050 <strlen@plt>
mov    %eax,-0x38(%rbp)
mov    -0x18(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1070 <strstr@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x20(%rbp)
je     11d1 <str_replace+0x81>
mov    -0x34(%rbp),%eax
add    $0x1,%eax
mov    %eax,-0x34(%rbp)
mov    -0x20(%rbp),%rdi
movslq -0x38(%rbp),%rax
add    %rax,%rdi
mov    -0x8(%rbp),%rsi
call   1070 <strstr@plt>
mov    %rax,-0x20(%rbp)
jmp    11a0 <str_replace+0x50>
mov    -0x10(%rbp),%rdi
call   1050 <strlen@plt>
sub    -0x38(%rbp),%eax
imul   -0x34(%rbp),%eax
mov    %eax,-0x3c(%rbp)
mov    -0x18(%rbp),%rdi
call   1050 <strlen@plt>
mov    %eax,%ecx
mov    -0x3c(%rbp),%eax
add    %ecx,%eax
mov    %eax,-0x34(%rbp)
mov    -0x34(%rbp),%edi
call   1060 <malloc@plt>
mov    %rax,-0x30(%rbp)
mov    -0x30(%rbp),%rdi
lea    0xdf2(%rip),%rsi
xor    %eax,%eax
call   1040 <strcpy@plt>
mov    -0x18(%rbp),%rax
mov    %rax,-0x28(%rbp)
mov    -0x18(%rbp),%rdi
mov    -0x8(%rbp),%rsi
call   1070 <strstr@plt>
mov    %rax,-0x20(%rbp)
cmpq   $0x0,-0x20(%rbp)
je     12ba <str_replace+0x16a>
mov    -0x30(%rbp),%rax
mov    %rax,-0x50(%rbp)
mov    -0x30(%rbp),%rdi
call   1050 <strlen@plt>
mov    -0x50(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x28(%rbp),%rsi
mov    -0x20(%rbp),%rax
mov    -0x28(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,%edx
call   1030 <strncpy@plt>
mov    -0x30(%rbp),%rax
mov    %rax,-0x48(%rbp)
mov    -0x30(%rbp),%rdi
call   1050 <strlen@plt>
mov    -0x48(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x10(%rbp),%rsi
xor    %eax,%eax
call   1040 <strcpy@plt>
mov    -0x20(%rbp),%rax
movslq -0x38(%rbp),%rcx
add    %rcx,%rax
mov    %rax,-0x28(%rbp)
mov    -0x20(%rbp),%rdi
movslq -0x38(%rbp),%rax
add    %rax,%rdi
mov    -0x8(%rbp),%rsi
call   1070 <strstr@plt>
mov    %rax,-0x20(%rbp)
jmp    122e <str_replace+0xde>
mov    -0x30(%rbp),%rax
mov    %rax,-0x58(%rbp)
mov    -0x30(%rbp),%rdi
call   1050 <strlen@plt>
mov    -0x58(%rbp),%rdi
cltq
add    %rax,%rdi
mov    -0x28(%rbp),%rsi
xor    %eax,%eax
call   1040 <strcpy@plt>
mov    -0x30(%rbp),%rax
add    $0x60,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<str_replace>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
push   %rax
mov    %rdx,%r13
mov    %rsi,(%rsp)
mov    %rdi,%r15
call   1050 <strlen@plt>
mov    %eax,%ebx
mov    %r13,%rdi
mov    %r15,%rsi
call   1070 <strstr@plt>
movslq %ebx,%r14
xor    %ebp,%ebp
test   %rax,%rax
je     11a6 <str_replace+0x56>
cs nopw 0x0(%rax,%rax,1)
nopl   0x0(%rax,%rax,1)
add    $0x1,%ebp
add    %r14,%rax
mov    %rax,%rdi
mov    %r15,%rsi
call   1070 <strstr@plt>
test   %rax,%rax
jne    1190 <str_replace+0x40>
mov    (%rsp),%rdi
call   1050 <strlen@plt>
sub    %ebx,%eax
imul   %eax,%ebp
mov    %r13,%rdi
call   1050 <strlen@plt>
add    %eax,%ebp
mov    %ebp,%edi
call   1060 <malloc@plt>
mov    %rax,%r12
lea    0xe31(%rip),%rsi
mov    %rax,%rdi
xor    %eax,%eax
call   1040 <strcpy@plt>
mov    %r13,%rdi
mov    %r15,%rsi
call   1070 <strstr@plt>
test   %rax,%rax
je     123c <str_replace+0xec>
mov    %rax,%rbx
mov    (%rsp),%rbp
mov    %r12,%rdi
call   1050 <strlen@plt>
movslq %eax,%rdi
add    %r12,%rdi
mov    %ebx,%edx
sub    %r13d,%edx
mov    %r13,%rsi
call   1030 <strncpy@plt>
mov    %r12,%rdi
call   1050 <strlen@plt>
movslq %eax,%rdi
add    %r12,%rdi
mov    %rbp,%rsi
xor    %eax,%eax
call   1040 <strcpy@plt>
mov    %rbx,%r13
add    %r14,%r13
mov    %r13,%rdi
mov    %r15,%rsi
call   1070 <strstr@plt>
mov    %rax,%rbx
test   %rax,%rax
jne    11f0 <str_replace+0xa0>
mov    %r12,%rdi
call   1050 <strlen@plt>
cltq
mov    %r12,%rdi
add    %rax,%rdi
mov    %r13,%rsi
xor    %eax,%eax
call   1040 <strcpy@plt>
mov    %r12,%rax
add    $0x8,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret

LLVM IR (-O0):
@.str = [1 x i8] zeroinitializer
define i8* @str_replace(i8* %0, i8* %1, i8* %2) {
%4 = alloca i8*
%5 = alloca i8*
%6 = alloca i8*
%7 = alloca i8*
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i32
%11 = alloca i32
store i8* %0, i8** %4
store i8* %1, i8** %5
store i8* %2, i8** %6
store i8* null, i8** %7
store i8* null, i8** %8
store i8* null, i8** %9
store i32 0, i32* %10
%12 = load i8*, i8** %4
%13 = call i32 @strlen(i8* %12)
store i32 %13, i32* %11
%14 = load i8*, i8** %6
%15 = load i8*, i8** %4
%16 = call i8* @strstr(i8* %14, i8* %15)
store i8* %16, i8** %7
br label %17
17: ; preds = %23, %3
%18 = load i8*, i8** %7
%19 = icmp ne i8* %18, null
br i1 %19, label %20, label %30
20: ; preds = %17
%21 = load i32, i32* %10
%22 = add nsw i32 %21, 1
store i32 %22, i32* %10
br label %23
23: ; preds = %20
%24 = load i8*, i8** %7
%25 = load i32, i32* %11
%26 = sext i32 %25 to i64
%27 = getelementptr inbounds i8, i8* %24, i64 %26
%28 = load i8*, i8** %4
%29 = call i8* @strstr(i8* %27, i8* %28)
store i8* %29, i8** %7
br label %17
30: ; preds = %17
%31 = load i8*, i8** %5
%32 = call i32 @strlen(i8* %31)
%33 = load i32, i32* %11
%34 = sub nsw i32 %32, %33
%35 = load i32, i32* %10
%36 = mul nsw i32 %34, %35
%37 = load i8*, i8** %6
%38 = call i32 @strlen(i8* %37)
%39 = add nsw i32 %36, %38
store i32 %39, i32* %10
%40 = load i32, i32* %10
%41 = call i8* @malloc(i32 %40)
store i8* %41, i8** %9
%42 = load i8*, i8** %9
%43 = call i32 (i8*, ...) @strcpy(i8* %42, i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str, i64 0, i64 0))
%44 = load i8*, i8** %6
store i8* %44, i8** %8
%45 = load i8*, i8** %6
%46 = load i8*, i8** %4
%47 = call i8* @strstr(i8* %45, i8* %46)
store i8* %47, i8** %7
br label %48
48: ; preds = %76, %30
%49 = load i8*, i8** %7
%50 = icmp ne i8* %49, null
br i1 %50, label %51, label %83
51: ; preds = %48
%52 = load i8*, i8** %9
%53 = load i8*, i8** %9
%54 = call i32 @strlen(i8* %53)
%55 = sext i32 %54 to i64
%56 = getelementptr inbounds i8, i8* %52, i64 %55
%57 = load i8*, i8** %8
%58 = load i8*, i8** %7
%59 = load i8*, i8** %8
%60 = ptrtoint i8* %58 to i64
%61 = ptrtoint i8* %59 to i64
%62 = sub i64 %60, %61
%63 = trunc i64 %62 to i32
%64 = call i32 @strncpy(i8* %56, i8* %57, i32 %63)
%65 = load i8*, i8** %9
%66 = load i8*, i8** %9
%67 = call i32 @strlen(i8* %66)
%68 = sext i32 %67 to i64
%69 = getelementptr inbounds i8, i8* %65, i64 %68
%70 = load i8*, i8** %5
%71 = call i32 (i8*, ...) @strcpy(i8* %69, i8* %70)
%72 = load i8*, i8** %7
%73 = load i32, i32* %11
%74 = sext i32 %73 to i64
%75 = getelementptr inbounds i8, i8* %72, i64 %74
store i8* %75, i8** %8
br label %76
76: ; preds = %51
%77 = load i8*, i8** %7
%78 = load i32, i32* %11
%79 = sext i32 %78 to i64
%80 = getelementptr inbounds i8, i8* %77, i64 %79
%81 = load i8*, i8** %4
%82 = call i8* @strstr(i8* %80, i8* %81)
store i8* %82, i8** %7
br label %48
83: ; preds = %48
%84 = load i8*, i8** %9
%85 = load i8*, i8** %9
%86 = call i32 @strlen(i8* %85)
%87 = sext i32 %86 to i64
%88 = getelementptr inbounds i8, i8* %84, i64 %87
%89 = load i8*, i8** %8
%90 = call i32 (i8*, ...) @strcpy(i8* %88, i8* %89)
%91 = load i8*, i8** %9
ret i8* %91
}

LLVM IR (-O2):
@.str = [1 x i8] zeroinitializer
define i8* @str_replace(i8* %0, i8* %1, i8* %2) {
%4 = tail call i32 @strlen(i8* %0)
%5 = tail call i8* @strstr(i8* dereferenceable(1) %2, i8* dereferenceable(1) %0)
%6 = icmp eq i8* %5, null
br i1 %6, label %16, label %7
7: ; preds = %3
%8 = sext i32 %4 to i64
br label %9
9: ; preds = %7, %9
%10 = phi i8* [ %5, %7 ], [ %14, %9 ]
%11 = phi i32 [ 0, %7 ], [ %12, %9 ]
%12 = add nuw nsw i32 %11, 1
%13 = getelementptr inbounds i8, i8* %10, i64 %8
%14 = tail call i8* @strstr(i8* %13, i8* dereferenceable(1) %0)
%15 = icmp eq i8* %14, null
br i1 %15, label %16, label %9
16: ; preds = %9, %3
%17 = phi i32 [ 0, %3 ], [ %12, %9 ]
%18 = tail call i32 @strlen(i8* %1)
%19 = sub nsw i32 %18, %4
%20 = mul nsw i32 %19, %17
%21 = tail call i32 @strlen(i8* %2)
%22 = add nsw i32 %20, %21
%23 = tail call i8* @malloc(i32 %22)
%24 = tail call i32 (i8*, ...) @strcpy(i8* %23, i8* getelementptr inbounds ([1 x i8], [1 x i8]* @.str, i64 0, i64 0))
%25 = tail call i8* @strstr(i8* dereferenceable(1) %2, i8* dereferenceable(1) %0)
%26 = icmp eq i8* %25, null
br i1 %26, label %47, label %27
27: ; preds = %16
%28 = sext i32 %4 to i64
br label %29
29: ; preds = %27, %29
%30 = phi i8* [ %25, %27 ], [ %45, %29 ]
%31 = phi i8* [ %2, %27 ], [ %44, %29 ]
%32 = tail call i32 @strlen(i8* %23)
%33 = sext i32 %32 to i64
%34 = getelementptr inbounds i8, i8* %23, i64 %33
%35 = ptrtoint i8* %30 to i64
%36 = ptrtoint i8* %31 to i64
%37 = sub i64 %35, %36
%38 = trunc i64 %37 to i32
%39 = tail call i32 @strncpy(i8* %34, i8* %31, i32 %38)
%40 = tail call i32 @strlen(i8* %23)
%41 = sext i32 %40 to i64
%42 = getelementptr inbounds i8, i8* %23, i64 %41
%43 = tail call i32 (i8*, ...) @strcpy(i8* %42, i8* %1)
%44 = getelementptr inbounds i8, i8* %30, i64 %28
%45 = tail call i8* @strstr(i8* %44, i8* dereferenceable(1) %0)
%46 = icmp eq i8* %45, null
br i1 %46, label %47, label %29
47: ; preds = %29, %16
%48 = phi i8* [ %2, %16 ], [ %44, %29 ]
%49 = tail call i32 @strlen(i8* %23)
%50 = sext i32 %49 to i64
%51 = getelementptr inbounds i8, i8* %23, i64 %50
%52 = tail call i32 (i8*, ...) @strcpy(i8* %51, i8* %48)
ret i8* %23
}