#define NULL ((void *)0)
typedef unsigned long size_t; // Customize by platform.
typedef long intptr_t;
typedef unsigned long uintptr_t;
typedef long scalar_t__; // Either arithmetic or pointer type.
/* By default, we understand bool (as a convenience). */
typedef int bool;
#define false 0
#define true 1

/* Forward declarations */

/* Type definitions */
struct xml_node {
  int dummy;
};

/* Variables and functions */
int /*<<< orphan*/ _xml_parse_doc(char *, int, struct xml_node *);
int /*<<< orphan*/ memcpy(char *, char *, int);
int /*<<< orphan*/ sprintf(char *, char *, char *, ...);
int strlen(char *);
char *strstr(char *, char *);
int /*<<< orphan*/ xml_free(char *);
scalar_t__ xml_malloc(int);
struct xml_node *xml_new_element(char *, char *, char *);
struct xml_node *xml_parse_doc(char *doc_buf, int doc_len, char *doc_prefix,
                               char *doc_name, char *doc_uri) {
  struct xml_node *root = NULL;
  char *xml_buf, *start_tag, *end_tag, *empty_tag, *front, *rear;
  xml_buf = (char *)xml_malloc(doc_len + 1);
  memcpy(xml_buf, doc_buf, doc_len);
  xml_buf[doc_len] = '\0';
  if (doc_prefix && doc_uri) {
    start_tag = (char *)xml_malloc(2 * strlen(doc_prefix) + strlen(doc_name) +
                                   strlen(doc_uri) + 14);
    sprintf(start_tag, "<%s:%s xmlns:%s=\"%s\">", doc_prefix, doc_name,
            doc_prefix, doc_uri);
    empty_tag = (char *)xml_malloc(2 * strlen(doc_prefix) + strlen(doc_name) +
                                   strlen(doc_uri) + 15);
    sprintf(empty_tag, "<%s:%s xmlns:%s=\"%s\"/>", doc_prefix, doc_name,
            doc_prefix, doc_uri);
  } else if (doc_prefix) {
    start_tag = (char *)xml_malloc(strlen(doc_prefix) + strlen(doc_name) + 4);
    sprintf(start_tag, "<%s:%s>", doc_prefix, doc_name);
    empty_tag = (char *)xml_malloc(strlen(doc_prefix) + strlen(doc_name) + 5);
    sprintf(empty_tag, "<%s:%s/>", doc_prefix, doc_name);
  } else if (doc_uri) {
    start_tag = (char *)xml_malloc(strlen(doc_name) + strlen(doc_uri) + 12);
    sprintf(start_tag, "<%s xmlns=\"%s\">", doc_name, doc_uri);
    empty_tag = (char *)xml_malloc(strlen(doc_name) + strlen(doc_uri) + 13);
    sprintf(empty_tag, "<%s xmlns=\"%s\"/>", doc_name, doc_uri);
  } else {
    start_tag = (char *)xml_malloc(strlen(doc_name) + 3);
    sprintf(start_tag, "<%s>", doc_name);
    empty_tag = (char *)xml_malloc(strlen(doc_name) + 4);
    sprintf(empty_tag, "<%s/>", doc_name);
  }
  if (doc_prefix) {
    end_tag = (char *)xml_malloc(strlen(doc_prefix) + strlen(doc_name) + 5);
    sprintf(end_tag, "</%s:%s>", doc_prefix, doc_name);
  } else {
    end_tag = (char *)xml_malloc(strlen(doc_name) + 4);
    sprintf(end_tag, "</%s>", doc_name);
  }
  if ((front = strstr(xml_buf, start_tag)) != NULL) {
    front += strlen(start_tag);
    if ((rear = strstr(front, end_tag)) != NULL) {
      int xml_len = rear - front;
      root = xml_new_element(doc_prefix, doc_name, doc_uri);
      _xml_parse_doc(front, xml_len, root);
    }
  } else if ((front = strstr(xml_buf, empty_tag)) != NULL) {
    root = xml_new_element(doc_prefix, doc_name, doc_uri);
  }
  xml_free(start_tag);
  xml_free(end_tag);
  xml_free(empty_tag);
  xml_free(xml_buf);
  return root;
}


x86 assembly (clang, -O0):
<xml_parse_doc>:
push   %rbp
mov    %rsp,%rbp
sub    $0x90,%rsp
mov    %rdi,-0x8(%rbp)
mov    %esi,-0xc(%rbp)
mov    %rdx,-0x18(%rbp)
mov    %rcx,-0x20(%rbp)
mov    %r8,-0x28(%rbp)
movq   $0x0,-0x30(%rbp)
mov    -0xc(%rbp),%edi
add    $0x1,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x38(%rbp)
mov    -0x38(%rbp),%rdi
mov    -0x8(%rbp),%rsi
mov    -0xc(%rbp),%edx
call   1060 <memcpy@plt>
mov    -0x38(%rbp),%rax
movslq -0xc(%rbp),%rcx
movb   $0x0,(%rax,%rcx,1)
cmpq   $0x0,-0x18(%rbp)
je     12a8 <xml_parse_doc+0x128>
cmpq   $0x0,-0x28(%rbp)
je     12a8 <xml_parse_doc+0x128>
mov    -0x18(%rbp),%rdi
call   1040 <strlen@plt>
shl    $0x1,%eax
mov    %eax,-0x74(%rbp)
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%ecx
mov    -0x74(%rbp),%eax
add    %ecx,%eax
mov    %eax,-0x70(%rbp)
mov    -0x28(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x70(%rbp),%edi
add    %eax,%edi
add    $0xe,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x18(%rbp),%rdx
mov    -0x20(%rbp),%rcx
mov    -0x18(%rbp),%r8
mov    -0x28(%rbp),%r9
lea    0xdc2(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
mov    -0x18(%rbp),%rdi
call   1040 <strlen@plt>
shl    $0x1,%eax
mov    %eax,-0x6c(%rbp)
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%ecx
mov    -0x6c(%rbp),%eax
add    %ecx,%eax
mov    %eax,-0x68(%rbp)
mov    -0x28(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x68(%rbp),%edi
add    %eax,%edi
add    $0xf,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rdi
mov    -0x18(%rbp),%rdx
mov    -0x20(%rbp),%rcx
mov    -0x18(%rbp),%r8
mov    -0x28(%rbp),%r9
lea    0xd7a(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
jmp    1432 <xml_parse_doc+0x2b2>
cmpq   $0x0,-0x18(%rbp)
je     1338 <xml_parse_doc+0x1b8>
mov    -0x18(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x7c(%rbp)
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x7c(%rbp),%edi
add    %eax,%edi
add    $0x4,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x18(%rbp),%rdx
mov    -0x20(%rbp),%rcx
lea    0xd41(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
mov    -0x18(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x78(%rbp)
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x78(%rbp),%edi
add    %eax,%edi
add    $0x5,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rdi
mov    -0x18(%rbp),%rdx
mov    -0x20(%rbp),%rcx
lea    0xd09(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
jmp    142d <xml_parse_doc+0x2ad>
cmpq   $0x0,-0x28(%rbp)
je     13ce <xml_parse_doc+0x24e>
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x84(%rbp)
mov    -0x28(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x84(%rbp),%edi
add    %eax,%edi
add    $0xc,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
lea    0xcbc(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x80(%rbp)
mov    -0x28(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x80(%rbp),%edi
add    %eax,%edi
add    $0xd,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rdi
mov    -0x20(%rbp),%rdx
mov    -0x28(%rbp),%rcx
lea    0xc8c(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
jmp    1428 <xml_parse_doc+0x2a8>
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%edi
add    $0x3,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x40(%rbp)
mov    -0x40(%rbp),%rdi
mov    -0x20(%rbp),%rdx
lea    0xc6b(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%edi
add    $0x4,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x50(%rbp)
mov    -0x50(%rbp),%rdi
mov    -0x20(%rbp),%rdx
lea    0xc43(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
jmp    142d <xml_parse_doc+0x2ad>
jmp    1432 <xml_parse_doc+0x2b2>
cmpq   $0x0,-0x18(%rbp)
je     1488 <xml_parse_doc+0x308>
mov    -0x18(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,-0x88(%rbp)
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    -0x88(%rbp),%edi
add    %eax,%edi
add    $0x5,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x48(%rbp)
mov    -0x48(%rbp),%rdi
mov    -0x18(%rbp),%rdx
mov    -0x20(%rbp),%rcx
lea    0xbee(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
jmp    14b5 <xml_parse_doc+0x335>
mov    -0x20(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%edi
add    $0x4,%edi
call   1030 <xml_malloc@plt>
mov    %rax,-0x48(%rbp)
mov    -0x48(%rbp),%rdi
mov    -0x20(%rbp),%rdx
lea    0xbc5(%rip),%rsi
mov    $0x0,%al
call   1090 <sprintf@plt>
mov    -0x38(%rbp),%rdi
mov    -0x40(%rbp),%rsi
call   10a0 <strstr@plt>
mov    %rax,-0x58(%rbp)
cmp    $0x0,%rax
je     153c <xml_parse_doc+0x3bc>
mov    -0x40(%rbp),%rdi
call   1040 <strlen@plt>
mov    %eax,%ecx
mov    -0x58(%rbp),%rax
movslq %ecx,%rcx
add    %rcx,%rax
mov    %rax,-0x58(%rbp)
mov    -0x58(%rbp),%rdi
mov    -0x48(%rbp),%rsi
call   10a0 <strstr@plt>
mov    %rax,-0x60(%rbp)
cmp    $0x0,%rax
je     1537 <xml_parse_doc+0x3b7>
mov    -0x60(%rbp),%rax
mov    -0x58(%rbp),%rcx
sub    %rcx,%rax
mov    %eax,-0x64(%rbp)
mov    -0x18(%rbp),%rdi
mov    -0x20(%rbp),%rsi
mov    -0x28(%rbp),%rdx
call   1080 <xml_new_element@plt>
mov    %rax,-0x30(%rbp)
mov    -0x58(%rbp),%rdi
mov    -0x64(%rbp),%esi
mov    -0x30(%rbp),%rdx
call   1070 <_xml_parse_doc@plt>
jmp    1571 <xml_parse_doc+0x3f1>
mov    -0x38(%rbp),%rdi
mov    -0x50(%rbp),%rsi
call   10a0 <strstr@plt>
mov    %rax,-0x58(%rbp)
cmp    $0x0,%rax
je     156c <xml_parse_doc+0x3ec>
mov    -0x18(%rbp),%rdi
mov    -0x20(%rbp),%rsi
mov    -0x28(%rbp),%rdx
call   1080 <xml_new_element@plt>
mov    %rax,-0x30(%rbp)
jmp    1571 <xml_parse_doc+0x3f1>
mov    -0x40(%rbp),%rdi
call   1050 <xml_free@plt>
mov    -0x48(%rbp),%rdi
call   1050 <xml_free@plt>
mov    -0x50(%rbp),%rdi
call   1050 <xml_free@plt>
mov    -0x38(%rbp),%rdi
call   1050 <xml_free@plt>
mov    -0x30(%rbp),%rax
add    $0x90,%rsp
pop    %rbp
ret

x86 assembly (clang, -O2):
<xml_parse_doc>:
push   %rbp
push   %r15
push   %r14
push   %r13
push   %r12
push   %rbx
sub    $0x18,%rsp
mov    %r8,%r14
mov    %rcx,%r15
mov    %rdx,%r12
mov    %esi,%ebp
mov    %rdi,%r13
lea    0x1(%rbp),%edi
call   1030 <xml_malloc@plt>
mov    %rax,%rbx
mov    %rax,%rdi
mov    %r13,%rsi
mov    %ebp,%edx
call   1060 <memcpy@plt>
movslq %ebp,%rax
mov    %rbx,(%rsp)
movb   $0x0,(%rbx,%rax,1)
test   %r12,%r12
mov    %r14,0x10(%rsp)
je     126e <xml_parse_doc+0xee>
test   %r14,%r14
je     126e <xml_parse_doc+0xee>
mov    %r12,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebx
mov    %r15,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebp
mov    %r14,%rdi
call   1040 <strlen@plt>
lea    0x0(%rbp,%rbx,2),%ecx
lea    (%rax,%rcx,1),%edi
add    $0xe,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%r13
lea    0xdf5(%rip),%rsi
mov    %rax,%rdi
mov    %r12,%rdx
mov    %r15,%rcx
mov    %r12,%r8
mov    %r14,%r9
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    %r12,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebx
mov    %r15,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebp
mov    %r14,%rdi
call   1040 <strlen@plt>
lea    0x0(%rbp,%rbx,2),%ecx
lea    (%rax,%rcx,1),%edi
add    $0xf,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%rbp
lea    0xdc0(%rip),%rsi
mov    %rax,%rdi
mov    %r12,%rdx
mov    %r15,%rcx
mov    %r12,%r8
mov    %r14,%r9
xor    %eax,%eax
call   1090 <sprintf@plt>
jmp    12e5 <xml_parse_doc+0x165>
test   %r12,%r12
je     13e8 <xml_parse_doc+0x268>
mov    %r12,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebx
mov    %r15,%rdi
call   1040 <strlen@plt>
lea    (%rbx,%rax,1),%edi
add    $0x4,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%r13
lea    0xd8f(%rip),%rsi
mov    %rax,%rdi
mov    %r12,%rdx
mov    %r15,%rcx
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    %r12,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebx
mov    %r15,%rdi
call   1040 <strlen@plt>
lea    (%rbx,%rax,1),%edi
add    $0x5,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%rbp
lea    0xd60(%rip),%rsi
mov    %rax,%rdi
mov    %r12,%rdx
mov    %r15,%rcx
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    %r12,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebx
mov    %r15,%rdi
call   1040 <strlen@plt>
lea    (%rbx,%rax,1),%edi
add    $0x5,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%r14
lea    0xd5e(%rip),%rsi
mov    %rax,%rdi
mov    %r12,%rdx
mov    %r15,%rbx
mov    %r15,%rcx
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    (%rsp),%rdi
mov    %r13,%rsi
call   10a0 <strstr@plt>
test   %rax,%rax
je     1381 <xml_parse_doc+0x201>
mov    %rax,%r15
mov    %rbp,0x8(%rsp)
mov    %r13,%rbp
mov    %r13,%rdi
call   1040 <strlen@plt>
cltq
add    %rax,%r15
mov    %r15,%rdi
mov    %r14,%rsi
call   10a0 <strstr@plt>
test   %rax,%rax
je     13ab <xml_parse_doc+0x22b>
mov    %rax,%r13
sub    %r15d,%r13d
mov    %r12,%rdi
mov    %rbx,%rsi
mov    0x10(%rsp),%rdx
call   1080 <xml_new_element@plt>
mov    %rax,%rbx
mov    %r15,%rdi
mov    %r13d,%esi
mov    %rax,%rdx
call   1070 <_xml_parse_doc@plt>
jmp    13ad <xml_parse_doc+0x22d>
mov    (%rsp),%rdi
mov    %rbp,%rsi
call   10a0 <strstr@plt>
test   %rax,%rax
je     145d <xml_parse_doc+0x2dd>
mov    %r12,%rdi
mov    %rbx,%rsi
mov    0x10(%rsp),%rdx
call   1080 <xml_new_element@plt>
mov    %rax,%rbx
jmp    13b5 <xml_parse_doc+0x235>
xor    %ebx,%ebx
mov    %rbp,%r13
mov    0x8(%rsp),%rbp
mov    %r13,%rdi
call   1050 <xml_free@plt>
mov    %r14,%rdi
call   1050 <xml_free@plt>
mov    %rbp,%rdi
call   1050 <xml_free@plt>
mov    (%rsp),%rdi
call   1050 <xml_free@plt>
mov    %rbx,%rax
add    $0x18,%rsp
pop    %rbx
pop    %r12
pop    %r13
pop    %r14
pop    %r15
pop    %rbp
ret
mov    %r15,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebp
test   %r14,%r14
je     1464 <xml_parse_doc+0x2e4>
mov    %r14,%rdi
call   1040 <strlen@plt>
lea    (%rax,%rbp,1),%edi
add    $0xc,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%r13
lea    0xc2a(%rip),%rsi
mov    %rax,%rdi
mov    %r15,%rdx
mov    %r14,%rcx
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    %r15,%rdi
call   1040 <strlen@plt>
mov    %eax,%ebx
mov    %r14,%rdi
call   1040 <strlen@plt>
lea    (%rbx,%rax,1),%edi
add    $0xd,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%rbp
lea    0xc03(%rip),%rsi
mov    %rax,%rdi
mov    %r15,%rdx
mov    %r14,%rcx
xor    %eax,%eax
call   1090 <sprintf@plt>
jmp    14ac <xml_parse_doc+0x32c>
xor    %ebx,%ebx
jmp    13b5 <xml_parse_doc+0x235>
add    $0x3,%ebp
mov    %ebp,%edi
call   1030 <xml_malloc@plt>
mov    %rax,%r13
lea    0xbe7(%rip),%rsi
mov    %rax,%rdi
mov    %r15,%rdx
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    %r15,%rdi
call   1040 <strlen@plt>
lea    0x4(%rax),%edi
call   1030 <xml_malloc@plt>
mov    %rax,%rbp
lea    0xbc5(%rip),%rsi
mov    %rax,%rdi
mov    %r15,%rdx
xor    %eax,%eax
call   1090 <sprintf@plt>
mov    %r15,%rdi
call   1040 <strlen@plt>
lea    0x4(%rax),%edi
call   1030 <xml_malloc@plt>
mov    %rax,%r14
lea    0xbad(%rip),%rsi
mov    %rax,%rdi
mov    %r15,%rbx
mov    %r15,%rdx
xor    %eax,%eax
call   1090 <sprintf@plt>
jmp    131f <xml_parse_doc+0x19f>

LLVM IR (-O0):
%struct.xml_node = type { i32 }
@.str = [22 x i8] c"<%s:%s xmlns:%s=\22%s\22>\00"
@.str.1 = [23 x i8] c"<%s:%s xmlns:%s=\22%s\22/>\00"
@.str.2 = [8 x i8] c"<%s:%s>\00"
@.str.3 = [9 x i8] c"<%s:%s/>\00"
@.str.4 = [16 x i8] c"<%s xmlns=\22%s\22>\00"
@.str.5 = [17 x i8] c"<%s xmlns=\22%s\22/>\00"
@.str.6 = [5 x i8] c"<%s>\00"
@.str.7 = [6 x i8] c"<%s/>\00"
@.str.8 = [9 x i8] c"</%s:%s>\00"
@.str.9 = [6 x i8] c"</%s>\00"
define %struct.xml_node* @xml_parse_doc(i8* %0, i32 %1, i8* %2, i8* %3, i8* %4) {
%6 = alloca i8*
%7 = alloca i32
%8 = alloca i8*
%9 = alloca i8*
%10 = alloca i8*
%11 = alloca %struct.xml_node*
%12 = alloca i8*
%13 = alloca i8*
%14 = alloca i8*
%15 = alloca i8*
%16 = alloca i8*
%17 = alloca i8*
%18 = alloca i32
store i8* %0, i8** %6
store i32 %1, i32* %7
store i8* %2, i8** %8
store i8* %3, i8** %9
store i8* %4, i8** %10
store %struct.xml_node* null, %struct.xml_node** %11
%19 = load i32, i32* %7
%20 = add nsw i32 %19, 1
%21 = call i64 @xml_malloc(i32 %20)
%22 = inttoptr i64 %21 to i8*
store i8* %22, i8** %12
%23 = load i8*, i8** %12
%24 = load i8*, i8** %6
%25 = load i32, i32* %7
%26 = call i32 @memcpy(i8* %23, i8* %24, i32 %25)
%27 = load i8*, i8** %12
%28 = load i32, i32* %7
%29 = sext i32 %28 to i64
%30 = getelementptr inbounds i8, i8* %27, i64 %29
store i8 0, i8* %30
%31 = load i8*, i8** %8
%32 = icmp ne i8* %31, null
br i1 %32, label %33, label %73
33: ; preds = %5
%34 = load i8*, i8** %10
%35 = icmp ne i8* %34, null
br i1 %35, label %36, label %73
36: ; preds = %33
%37 = load i8*, i8** %8
%38 = call i32 @strlen(i8* %37)
%39 = mul nsw i32 2, %38
%40 = load i8*, i8** %9
%41 = call i32 @strlen(i8* %40)
%42 = add nsw i32 %39, %41
%43 = load i8*, i8** %10
%44 = call i32 @strlen(i8* %43)
%45 = add nsw i32 %42, %44
%46 = add nsw i32 %45, 14
%47 = call i64 @xml_malloc(i32 %46)
%48 = inttoptr i64 %47 to i8*
store i8* %48, i8** %13
%49 = load i8*, i8** %13
%50 = load i8*, i8** %8
%51 = load i8*, i8** %9
%52 = load i8*, i8** %8
%53 = load i8*, i8** %10
%54 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %49, i8* getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0), i8* %50, i8* %51, i8* %52, i8* %53)
%55 = load i8*, i8** %8
%56 = call i32 @strlen(i8* %55)
%57 = mul nsw i32 2, %56
%58 = load i8*, i8** %9
%59 = call i32 @strlen(i8* %58)
%60 = add nsw i32 %57, %59
%61 = load i8*, i8** %10
%62 = call i32 @strlen(i8* %61)
%63 = add nsw i32 %60, %62
%64 = add nsw i32 %63, 15
%65 = call i64 @xml_malloc(i32 %64)
%66 = inttoptr i64 %65 to i8*
store i8* %66, i8** %15
%67 = load i8*, i8** %15
%68 = load i8*, i8** %8
%69 = load i8*, i8** %9
%70 = load i8*, i8** %8
%71 = load i8*, i8** %10
%72 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %67, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0), i8* %68, i8* %69, i8* %70, i8* %71)
br label %148
73: ; preds = %33, %5
%74 = load i8*, i8** %8
%75 = icmp ne i8* %74, null
br i1 %75, label %76, label %101
76: ; preds = %73
%77 = load i8*, i8** %8
%78 = call i32 @strlen(i8* %77)
%79 = load i8*, i8** %9
%80 = call i32 @strlen(i8* %79)
%81 = add nsw i32 %78, %80
%82 = add nsw i32 %81, 4
%83 = call i64 @xml_malloc(i32 %82)
%84 = inttoptr i64 %83 to i8*
store i8* %84, i8** %13
%85 = load i8*, i8** %13
%86 = load i8*, i8** %8
%87 = load i8*, i8** %9
%88 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %85, i8* getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* %86, i8* %87)
%89 = load i8*, i8** %8
%90 = call i32 @strlen(i8* %89)
%91 = load i8*, i8** %9
%92 = call i32 @strlen(i8* %91)
%93 = add nsw i32 %90, %92
%94 = add nsw i32 %93, 5
%95 = call i64 @xml_malloc(i32 %94)
%96 = inttoptr i64 %95 to i8*
store i8* %96, i8** %15
%97 = load i8*, i8** %15
%98 = load i8*, i8** %8
%99 = load i8*, i8** %9
%100 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %97, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i8* %98, i8* %99)
br label %147
101: ; preds = %73
%102 = load i8*, i8** %10
%103 = icmp ne i8* %102, null
br i1 %103, label %104, label %129
104: ; preds = %101
%105 = load i8*, i8** %9
%106 = call i32 @strlen(i8* %105)
%107 = load i8*, i8** %10
%108 = call i32 @strlen(i8* %107)
%109 = add nsw i32 %106, %108
%110 = add nsw i32 %109, 12
%111 = call i64 @xml_malloc(i32 %110)
%112 = inttoptr i64 %111 to i8*
store i8* %112, i8** %13
%113 = load i8*, i8** %13
%114 = load i8*, i8** %9
%115 = load i8*, i8** %10
%116 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %113, i8* getelementptr inbounds ([16 x i8], [16 x i8]* @.str.4, i64 0, i64 0), i8* %114, i8* %115)
%117 = load i8*, i8** %9
%118 = call i32 @strlen(i8* %117)
%119 = load i8*, i8** %10
%120 = call i32 @strlen(i8* %119)
%121 = add nsw i32 %118, %120
%122 = add nsw i32 %121, 13
%123 = call i64 @xml_malloc(i32 %122)
%124 = inttoptr i64 %123 to i8*
store i8* %124, i8** %15
%125 = load i8*, i8** %15
%126 = load i8*, i8** %9
%127 = load i8*, i8** %10
%128 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %125, i8* getelementptr inbounds ([17 x i8], [17 x i8]* @.str.5, i64 0, i64 0), i8* %126, i8* %127)
br label %146
129: ; preds = %101
%130 = load i8*, i8** %9
%131 = call i32 @strlen(i8* %130)
%132 = add nsw i32 %131, 3
%133 = call i64 @xml_malloc(i32 %132)
%134 = inttoptr i64 %133 to i8*
store i8* %134, i8** %13
%135 = load i8*, i8** %13
%136 = load i8*, i8** %9
%137 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %135, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i8* %136)
%138 = load i8*, i8** %9
%139 = call i32 @strlen(i8* %138)
%140 = add nsw i32 %139, 4
%141 = call i64 @xml_malloc(i32 %140)
%142 = inttoptr i64 %141 to i8*
store i8* %142, i8** %15
%143 = load i8*, i8** %15
%144 = load i8*, i8** %9
%145 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %143, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.7, i64 0, i64 0), i8* %144)
br label %146
146: ; preds = %129, %104
br label %147
147: ; preds = %146, %76
br label %148
148: ; preds = %147, %36
%149 = load i8*, i8** %8
%150 = icmp ne i8* %149, null
br i1 %150, label %151, label %164
151: ; preds = %148
%152 = load i8*, i8** %8
%153 = call i32 @strlen(i8* %152)
%154 = load i8*, i8** %9
%155 = call i32 @strlen(i8* %154)
%156 = add nsw i32 %153, %155
%157 = add nsw i32 %156, 5
%158 = call i64 @xml_malloc(i32 %157)
%159 = inttoptr i64 %158 to i8*
store i8* %159, i8** %14
%160 = load i8*, i8** %14
%161 = load i8*, i8** %8
%162 = load i8*, i8** %9
%163 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %160, i8* getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0), i8* %161, i8* %162)
br label %173
164: ; preds = %148
%165 = load i8*, i8** %9
%166 = call i32 @strlen(i8* %165)
%167 = add nsw i32 %166, 4
%168 = call i64 @xml_malloc(i32 %167)
%169 = inttoptr i64 %168 to i8*
store i8* %169, i8** %14
%170 = load i8*, i8** %14
%171 = load i8*, i8** %9
%172 = call i32 (i8*, i8*, i8*, ...) @sprintf(i8* %170, i8* getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0), i8* %171)
br label %173
173: ; preds = %164, %151
%174 = load i8*, i8** %12
%175 = load i8*, i8** %13
%176 = call i8* @strstr(i8* %174, i8* %175)
store i8* %176, i8** %16
%177 = icmp ne i8* %176, null
br i1 %177, label %178, label %204
178: ; preds = %173
%179 = load i8*, i8** %13
%180 = call i32 @strlen(i8* %179)
%181 = load i8*, i8** %16
%182 = sext i32 %180 to i64
%183 = getelementptr inbounds i8, i8* %181, i64 %182
store i8* %183, i8** %16
%184 = load i8*, i8** %16
%185 = load i8*, i8** %14
%186 = call i8* @strstr(i8* %184, i8* %185)
store i8* %186, i8** %17
%187 = icmp ne i8* %186, null
br i1 %187, label %188, label %203
188: ; preds = %178
%189 = load i8*, i8** %17
%190 = load i8*, i8** %16
%191 = ptrtoint i8* %189 to i64
%192 = ptrtoint i8* %190 to i64
%193 = sub i64 %191, %192
%194 = trunc i64 %193 to i32
store i32 %194, i32* %18
%195 = load i8*, i8** %8
%196 = load i8*, i8** %9
%197 = load i8*, i8** %10
%198 = call %struct.xml_node* @xml_new_element(i8* %195, i8* %196, i8* %197)
store %struct.xml_node* %198, %struct.xml_node** %11
%199 = load i8*, i8** %16
%200 = load i32, i32* %18
%201 = load %struct.xml_node*, %struct.xml_node** %11
%202 = call i32 @_xml_parse_doc(i8* %199, i32 %200, %struct.xml_node* %201)
br label %203
203: ; preds = %188, %178
br label %215
204: ; preds = %173
%205 = load i8*, i8** %12
%206 = load i8*, i8** %15
%207 = call i8* @strstr(i8* %205, i8* %206)
store i8* %207, i8** %16
%208 = icmp ne i8* %207, null
br i1 %208, label %209, label %214
209: ; preds = %204
%210 = load i8*, i8** %8
%211 = load i8*, i8** %9
%212 = load i8*, i8** %10
%213 = call %struct.xml_node* @xml_new_element(i8* %210, i8* %211, i8* %212)
store %struct.xml_node* %213, %struct.xml_node** %11
br label %214
214: ; preds = %209, %204
br label %215
215: ; preds = %214, %203
%216 = load i8*, i8** %13
%217 = call i32 @xml_free(i8* %216)
%218 = load i8*, i8** %14
%219 = call i32 @xml_free(i8* %218)
%220 = load i8*, i8** %15
%221 = call i32 @xml_free(i8* %220)
%222 = load i8*, i8** %12
%223 = call i32 @xml_free(i8* %222)
%224 = load %struct.xml_node*, %struct.xml_node** %11
ret %struct.xml_node* %224
}

LLVM IR (-O2):
%struct.xml_node = type { i32 }
@.str = [22 x i8] c"<%s:%s xmlns:%s=\22%s\22>\00"
@.str.1 = [23 x i8] c"<%s:%s xmlns:%s=\22%s\22/>\00"
@.str.2 = [8 x i8] c"<%s:%s>\00"
@.str.3 = [9 x i8] c"<%s:%s/>\00"
@.str.4 = [16 x i8] c"<%s xmlns=\22%s\22>\00"
@.str.5 = [17 x i8] c"<%s xmlns=\22%s\22/>\00"
@.str.6 = [5 x i8] c"<%s>\00"
@.str.7 = [6 x i8] c"<%s/>\00"
@.str.8 = [9 x i8] c"</%s:%s>\00"
@.str.9 = [6 x i8] c"</%s>\00"
define %struct.xml_node* @xml_parse_doc(i8* %0, i32 %1, i8* %2, i8* %3, i8* %4) {
%6 = add nsw i32 %1, 1
%7 = tail call i64 @xml_malloc(i32 %6)
%8 = inttoptr i64 %7 to i8*
%9 = tail call i32 @memcpy(i8* %8, i8* %0, i32 %1)
%10 = sext i32 %1 to i64
%11 = getelementptr inbounds i8, i8* %8, i64 %10
store i8 0, i8* %11
%12 = icmp ne i8* %2, null
%13 = icmp ne i8* %4, null
%14 = and i1 %12, %13
br i1 %14, label %15, label %36
15: ; preds = %5
%16 = tail call i32 @strlen(i8* %2)
%17 = shl nsw i32 %16, 1
%18 = tail call i32 @strlen(i8* %3)
%19 = tail call i32 @strlen(i8* %4)
%20 = add i32 %18, 14
%21 = add i32 %20, %17
%22 = add i32 %21, %19
%23 = tail call i64 @xml_malloc(i32 %22)
%24 = inttoptr i64 %23 to i8*
%25 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %24, i8* dereferenceable(1) getelementptr inbounds ([22 x i8], [22 x i8]* @.str, i64 0, i64 0), i8* %2, i8* %3, i8* %2, i8* %4)
%26 = tail call i32 @strlen(i8* %2)
%27 = shl nsw i32 %26, 1
%28 = tail call i32 @strlen(i8* %3)
%29 = tail call i32 @strlen(i8* %4)
%30 = add i32 %28, 15
%31 = add i32 %30, %27
%32 = add i32 %31, %29
%33 = tail call i64 @xml_malloc(i32 %32)
%34 = inttoptr i64 %33 to i8*
%35 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %34, i8* dereferenceable(1) getelementptr inbounds ([23 x i8], [23 x i8]* @.str.1, i64 0, i64 0), i8* %2, i8* %3, i8* %2, i8* %4)
br label %78
36: ; preds = %5
br i1 %12, label %37, label %52
37: ; preds = %36
%38 = tail call i32 @strlen(i8* %2)
%39 = tail call i32 @strlen(i8* %3)
%40 = add i32 %38, 4
%41 = add i32 %40, %39
%42 = tail call i64 @xml_malloc(i32 %41)
%43 = inttoptr i64 %42 to i8*
%44 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %43, i8* dereferenceable(1) getelementptr inbounds ([8 x i8], [8 x i8]* @.str.2, i64 0, i64 0), i8* %2, i8* %3)
%45 = tail call i32 @strlen(i8* %2)
%46 = tail call i32 @strlen(i8* %3)
%47 = add i32 %45, 5
%48 = add i32 %47, %46
%49 = tail call i64 @xml_malloc(i32 %48)
%50 = inttoptr i64 %49 to i8*
%51 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %50, i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.3, i64 0, i64 0), i8* %2, i8* %3)
br label %78
52: ; preds = %36
%53 = tail call i32 @strlen(i8* %3)
br i1 %13, label %54, label %68
54: ; preds = %52
%55 = tail call i32 @strlen(i8* %4)
%56 = add i32 %53, 12
%57 = add i32 %56, %55
%58 = tail call i64 @xml_malloc(i32 %57)
%59 = inttoptr i64 %58 to i8*
%60 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %59, i8* dereferenceable(1) getelementptr inbounds ([16 x i8], [16 x i8]* @.str.4, i64 0, i64 0), i8* %3, i8* %4)
%61 = tail call i32 @strlen(i8* %3)
%62 = tail call i32 @strlen(i8* %4)
%63 = add i32 %61, 13
%64 = add i32 %63, %62
%65 = tail call i64 @xml_malloc(i32 %64)
%66 = inttoptr i64 %65 to i8*
%67 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %66, i8* dereferenceable(1) getelementptr inbounds ([17 x i8], [17 x i8]* @.str.5, i64 0, i64 0), i8* %3, i8* %4)
br label %88
68: ; preds = %52
%69 = add nsw i32 %53, 3
%70 = tail call i64 @xml_malloc(i32 %69)
%71 = inttoptr i64 %70 to i8*
%72 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %71, i8* dereferenceable(1) getelementptr inbounds ([5 x i8], [5 x i8]* @.str.6, i64 0, i64 0), i8* %3)
%73 = tail call i32 @strlen(i8* %3)
%74 = add nsw i32 %73, 4
%75 = tail call i64 @xml_malloc(i32 %74)
%76 = inttoptr i64 %75 to i8*
%77 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %76, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str.7, i64 0, i64 0), i8* %3)
br label %88
78: ; preds = %15, %37
%79 = phi i8* [ %34, %15 ], [ %50, %37 ]
%80 = phi i8* [ %24, %15 ], [ %43, %37 ]
%81 = tail call i32 @strlen(i8* %2)
%82 = tail call i32 @strlen(i8* %3)
%83 = add i32 %81, 5
%84 = add i32 %83, %82
%85 = tail call i64 @xml_malloc(i32 %84)
%86 = inttoptr i64 %85 to i8*
%87 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %86, i8* dereferenceable(1) getelementptr inbounds ([9 x i8], [9 x i8]* @.str.8, i64 0, i64 0), i8* %2, i8* %3)
br label %96
88: ; preds = %68, %54
%89 = phi i8* [ %76, %68 ], [ %66, %54 ]
%90 = phi i8* [ %71, %68 ], [ %59, %54 ]
%91 = tail call i32 @strlen(i8* %3)
%92 = add nsw i32 %91, 4
%93 = tail call i64 @xml_malloc(i32 %92)
%94 = inttoptr i64 %93 to i8*
%95 = tail call i32 (i8*, i8*, i8*, ...) @sprintf(i8* dereferenceable(1) %94, i8* dereferenceable(1) getelementptr inbounds ([6 x i8], [6 x i8]* @.str.9, i64 0, i64 0), i8* %3)
br label %96
96: ; preds = %88, %78
%97 = phi i8* [ %80, %78 ], [ %90, %88 ]
%98 = phi i8* [ %79, %78 ], [ %89, %88 ]
%99 = phi i8* [ %86, %78 ], [ %94, %88 ]
%100 = tail call i8* @strstr(i8* dereferenceable(1) %8, i8* dereferenceable(1) %97)
%101 = icmp eq i8* %100, null
br i1 %101, label %115, label %102
102: ; preds = %96
%103 = tail call i32 @strlen(i8* %97)
%104 = sext i32 %103 to i64
%105 = getelementptr inbounds i8, i8* %100, i64 %104
%106 = tail call i8* @strstr(i8* %105, i8* dereferenceable(1) %99)
%107 = icmp eq i8* %106, null
br i1 %107, label %120, label %108
108: ; preds = %102
%109 = ptrtoint i8* %106 to i64
%110 = ptrtoint i8* %105 to i64
%111 = sub i64 %109, %110
%112 = trunc i64 %111 to i32
%113 = tail call %struct.xml_node* @xml_new_element(i8* %2, i8* %3, i8* %4)
%114 = tail call i32 @_xml_parse_doc(i8* %105, i32 %112, %struct.xml_node* %113)
br label %120
115: ; preds = %96
%116 = tail call i8* @strstr(i8* dereferenceable(1) %8, i8* dereferenceable(1) %98)
%117 = icmp eq i8* %116, null
br i1 %117, label %120, label %118
118: ; preds = %115
%119 = tail call %struct.xml_node* @xml_new_element(i8* %2, i8* %3, i8* %4)
br label %120
120: ; preds = %115, %118, %102, %108
%121 = phi %struct.xml_node* [ %113, %108 ], [ null, %102 ], [ %119, %118 ], [ null, %115 ]
%122 = tail call i32 @xml_free(i8* %97)
%123 = tail call i32 @xml_free(i8* %99)
%124 = tail call i32 @xml_free(i8* %98)
%125 = tail call i32 @xml_free(i8* %8)
ret %struct.xml_node* %121
}