glaurung

Fixture 199

pointer return kinds

C · 6 functions · 4 lanes · 24 of 24 function-lanes behave identically

All 4 lanes recompile and return the same results as the original.

FUNCTIONS THAT RETURN A POINTER.

The census that produced this fixture found exactly ONE pointer return in the 900 function definitions of this corpus: 192_pointer_chased_list's l192_find_key, which returns struct L192Node * after chasing a next link. Every other function in every language returns an integer, a float, a void, or (in 195/197/198) an aggregate.

That one function fixes a single point in a space with several independent axes, and it is the axis of "an address recovered from a LOAD". The three this file adds:

* void * — the pointee carries no width. describe_pointer in src/debug/dwarf_signatures.rs gives it a synthetic u8 pointee, so the recovered C, the ctypes prototype and the returned address all have to agree about an element size that the source never wrote down. Nothing in the corpus returns one. * const T * — the same address with konst: true in the descriptor. A recovery that drops the qualifier still compiles; one that drops it and then WRITES through the result does not. Nothing in the corpus returns one. * an address formed by pure ARITHMETIC (buf + k) rather than found by a scan. l192_find_key returns a value it loaded; a computed address is the case where "pointer" and "integer offset" are hardest to tell apart, and where a recovery that silently converts one into the other is still type-correct C.

All of these are execution-differential ONLY through the manifest's pointer_return_arg: exec_class refuses a pointer return outright ("pointer return — addresses not comparable") unless the manifest names the caller-owned buffer parameter the result must point into, and the worker then compares the ELEMENT INDEX on each side rather than two unrelated process addresses. Every function here therefore returns either NULL or an address inside its own buf argument — never one-past-the-end, which _relative_pointer would report as external@0x... and which would differ between the two builds for reasons that say nothing about the decompiler.

TWO NEGATIVE CONTROLS:

ptr199_find_index runs ptr199_find_i32's scan and returns the INDEX as an int32_t. Turning a returned pointer into an index is the single most plausible mis-recovery here, and it is a recovery that satisfies this control while failing every positive case; keeping both side by side is what tells the two apart.

ptr199_first_element ignores key entirely and returns &buf[0] after reading the buffer. A recovery that answers "some address inside the argument buffer" — the shape a dropped comparison produces — passes the positives by luck on the vectors where the match happens to be at index 0, and this control is where it stops passing.

Every function is a pure function of a caller-owned buffer and two integers: no writes, no allocation, no I/O. n is declared a length in the manifest so it is clamped to the buffer, and the scan is a plain forward loop, so nothing here can read out of bounds.

tests/decompiler_fixtures/src/199_pointer_return_kinds.c source 
#include <stdint.h>

/* FUNCTIONS THAT RETURN A POINTER.
 *
 * The census that produced this fixture found exactly ONE pointer return in the
 * 900 function definitions of this corpus: `192_pointer_chased_list`'s
 * `l192_find_key`, which returns `struct L192Node *` after chasing a `next`
 * link. Every other function in every language returns an integer, a float, a
 * `void`, or (in 195/197/198) an aggregate.
 *
 * That one function fixes a single point in a space with several independent
 * axes, and it is the axis of "an address recovered from a LOAD". The three
 * this file adds:
 *
 *   * `void *` — the pointee carries no width. `describe_pointer` in
 *     `src/debug/dwarf_signatures.rs` gives it a synthetic `u8` pointee, so the
 *     recovered C, the ctypes prototype and the returned address all have to
 *     agree about an element size that the source never wrote down. Nothing in
 *     the corpus returns one.
 *   * `const T *` — the same address with `konst: true` in the descriptor. A
 *     recovery that drops the qualifier still compiles; one that drops it and
 *     then WRITES through the result does not. Nothing in the corpus returns
 *     one.
 *   * an address formed by pure ARITHMETIC (`buf + k`) rather than found by a
 *     scan. `l192_find_key` returns a value it loaded; a computed address is
 *     the case where "pointer" and "integer offset" are hardest to tell apart,
 *     and where a recovery that silently converts one into the other is still
 *     type-correct C.
 *
 * All of these are execution-differential ONLY through the manifest's
 * `pointer_return_arg`: `exec_class` refuses a pointer return outright
 * ("pointer return — addresses not comparable") unless the manifest names the
 * caller-owned buffer parameter the result must point into, and the worker then
 * compares the ELEMENT INDEX on each side rather than two unrelated process
 * addresses. Every function here therefore returns either NULL or an address
 * inside its own `buf` argument — never one-past-the-end, which
 * `_relative_pointer` would report as `external@0x...` and which would differ
 * between the two builds for reasons that say nothing about the decompiler.
 *
 * TWO NEGATIVE CONTROLS:
 *
 *   `ptr199_find_index` runs `ptr199_find_i32`'s scan and returns the INDEX as
 *   an `int32_t`. Turning a returned pointer into an index is the single most
 *   plausible mis-recovery here, and it is a recovery that satisfies this
 *   control while failing every positive case; keeping both side by side is
 *   what tells the two apart.
 *
 *   `ptr199_first_element` ignores `key` entirely and returns `&buf[0]` after
 *   reading the buffer. A recovery that answers "some address inside the
 *   argument buffer" — the shape a dropped comparison produces — passes the
 *   positives by luck on the vectors where the match happens to be at index 0,
 *   and this control is where it stops passing.
 *
 * Every function is a pure function of a caller-owned buffer and two integers:
 * no writes, no allocation, no I/O. `n` is declared a length in the manifest so
 * it is clamped to the buffer, and the scan is a plain forward loop, so nothing
 * here can read out of bounds. */

/* Scan for `key` and return the address of the FIRST match, or NULL. The
 * canonical pointer return, and the baseline the two `void *` / `const` cases
 * are variations on. */
__attribute__((noinline)) int32_t *ptr199_find_i32(int32_t *buf, int32_t n, int32_t key) {
    int32_t i;
    if (buf == 0) {
        return 0;
    }
    for (i = 0; i < n; i++) {
        if (buf[i] == key) {
            return &buf[i];
        }
    }
    return 0;
}

/* The same address, typed `void *`. The pointee width is not in the source, so
 * every layer has to agree on the synthetic one. */
__attribute__((noinline)) void *ptr199_find_void(int32_t *buf, int32_t n, int32_t key) {
    int32_t i;
    if (buf == 0) {
        return 0;
    }
    for (i = 0; i < n; i++) {
        if (buf[i] == key) {
            return (void *)&buf[i];
        }
    }
    return 0;
}

/* The same address again, read-only. Scans from the END, so this is also the
 * LAST match rather than the first: a recovery that confuses the two returns a
 * different element index on any vector where `key` occurs twice. */
__attribute__((noinline)) const int32_t *ptr199_find_const(const int32_t *buf, int32_t n,
                                                           int32_t key) {
    int32_t i;
    if (buf == 0) {
        return 0;
    }
    for (i = n - 1; i >= 0; i--) {
        if (buf[i] == key) {
            return &buf[i];
        }
    }
    return 0;
}

/* An address formed by ARITHMETIC and not by a load: no element is ever read.
 * `k` is folded into range with a remainder so the result is always inside the
 * buffer and never one-past-the-end. */
__attribute__((noinline)) int32_t *ptr199_offset(int32_t *buf, int32_t n, int32_t k) {
    int32_t index;
    if (buf == 0 || n <= 0) {
        return 0;
    }
    index = k % n;
    if (index < 0) {
        index += n;
    }
    return buf + index;
}

/* CONTROL: `ptr199_find_i32`'s scan, returning the index instead of the
 * address. Passing this while failing the positives localises the defect to the
 * pointer result rather than to the search. */
__attribute__((noinline)) int32_t ptr199_find_index(int32_t *buf, int32_t n, int32_t key) {
    int32_t i;
    if (buf == 0) {
        return -1;
    }
    for (i = 0; i < n; i++) {
        if (buf[i] == key) {
            return i;
        }
    }
    return -1;
}

/* CONTROL: the result depends on WHETHER `key` occurs, never on WHERE. It runs
 * the same comparison over the same buffer as `ptr199_find_i32` and then answers
 * one of the two ENDS. A recovery that lets the match position leak into the
 * returned address — the natural way to get the positives right by accident —
 * disagrees here on every vector whose match is in the interior. */
__attribute__((noinline)) int32_t *ptr199_edge_element(int32_t *buf, int32_t n, int32_t key) {
    int32_t i;
    int32_t seen;
    if (buf == 0 || n <= 0) {
        return 0;
    }
    seen = 0;
    for (i = 0; i < n; i++) {
        if (buf[i] == key) {
            seen++;
        }
    }
    return (seen > 0) ? &buf[0] : &buf[n - 1];
}

Recovered C

Generated by glaurung decompile --style decbench at b47f6b43. baseline.json records the result after recompiling the C and calling it beside the original with seeded inputs.

clang -O0

6/6
ptr199_edge_element pass 22 lines 
// glaurung: ptr199_edge_element @ 0x13a0
int32_t * ptr199_edge_element(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int seen;
    int i;
    // x86-64 prologue: save rbp
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    if (((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0)) != 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    seen = 0;
    for (i = 0; (i < arg1); i++) {
        if (((unsigned int)(arg0[(long)(i)]) == (unsigned int)(arg2))) {
            seen = ((unsigned int)(seen) + 1);
        }
    }
    // x86-64 epilogue: restore rbp
    return ((((unsigned long)((unsigned int)(seen)) == 0) | ((long)(seen) < 0)) ? (int32_t *)(((long)arg0 + ((long)((int)(((unsigned long)((unsigned int)(arg1)) - 1))) << 2))) : arg0);
}
ptr199_find_const pass 26 lines 
// glaurung: ptr199_find_const @ 0x1220
const int32_t * ptr199_find_const(const int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long local_8;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (const int32_t *)(0);
    }
    i = ((unsigned int)(arg1) - 1);
    L_124f: ;
    if (((long)(i) < 0)) {
        goto L_1298;
    }
    if (((unsigned int)(arg0[(long)(i)]) == (unsigned int)(arg2))) {
        local_8 = (long)(((long)arg0 + ((long)(i) << 2)));
        // x86-64 epilogue: restore rbp
        return (const int32_t *)(local_8);
    }
    goto L_128a;
    L_128a: ;
    i = ((unsigned int)(i) - 1);
    goto L_124f;
    L_1298: ;
    // x86-64 epilogue: restore rbp
    return (const int32_t *)(0);
}
ptr199_find_i32 pass 26 lines 
// glaurung: ptr199_find_i32 @ 0x1100
int32_t * ptr199_find_i32(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long local_8;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    i = 0;
    L_112d: ;
    if ((arg1 <= i)) {
        goto L_1178;
    }
    if (((unsigned int)(arg0[(long)(i)]) == (unsigned int)(arg2))) {
        local_8 = (long)(((long)arg0 + ((long)(i) << 2)));
        // x86-64 epilogue: restore rbp
        return (int32_t *)(local_8);
    }
    goto L_116a;
    L_116a: ;
    i = ((unsigned int)(i) + 1);
    goto L_112d;
    L_1178: ;
    // x86-64 epilogue: restore rbp
    return (int32_t *)(0);
}
ptr199_find_index pass 28 lines 
// glaurung: ptr199_find_index @ 0x1320
int32_t ptr199_find_index(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    int local_4;
    if ((arg0 == 0)) {
        local_4 = -1;
        // x86-64 epilogue: restore rbp
        return (unsigned int)(local_4);
    }
    i = 0;
    L_134c: ;
    if ((arg1 <= i)) {
        goto L_138a;
    }
    if (((unsigned int)(arg0[(long)(i)]) == (unsigned int)(arg2))) {
        local_4 = i;
        // x86-64 epilogue: restore rbp
        return (unsigned int)(local_4);
    }
    goto L_137c;
    L_137c: ;
    i = ((unsigned int)(i) + 1);
    goto L_134c;
    L_138a: ;
    local_4 = -1;
    // x86-64 epilogue: restore rbp
    return (unsigned int)(local_4);
}
ptr199_find_void pass 26 lines 
// glaurung: ptr199_find_void @ 0x1190
void * ptr199_find_void(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long local_8;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (void *)(0);
    }
    i = 0;
    L_11bd: ;
    if ((arg1 <= i)) {
        goto L_1208;
    }
    if (((unsigned int)(arg0[(long)(i)]) == (unsigned int)(arg2))) {
        local_8 = (long)(((long)arg0 + ((long)(i) << 2)));
        // x86-64 epilogue: restore rbp
        return (void *)(local_8);
    }
    goto L_11fa;
    L_11fa: ;
    i = ((unsigned int)(i) + 1);
    goto L_11bd;
    L_1208: ;
    // x86-64 epilogue: restore rbp
    return (void *)(0);
}
ptr199_offset pass 21 lines 
// glaurung: ptr199_offset @ 0x12b0
int32_t * ptr199_offset(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int index;
    long local_8;
    // x86-64 prologue: save rbp
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    if (((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0)) != 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    index = ((int)((((long long)(int)((((unsigned long)((long)((int)((unsigned long)((unsigned int)(arg2))))) >> 32) & 0xffffffff)) * (((long long)1) << 32)) + (unsigned int)((unsigned long)((unsigned int)(arg2)))) % (int)(arg1)));
    if (((long)(index) < 0)) {
        index = ((unsigned int)(arg1) + index);
    }
    local_8 = (long)(((long)arg0 + ((long)(index) << 2)));
    // x86-64 epilogue: restore rbp
    return (int32_t *)(local_8);
}

clang -O2

6/6
ptr199_edge_element pass 135 lines 
// glaurung: ptr199_edge_element @ 0x11f0
int32_t * ptr199_edge_element(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int seen;
    int i;
    long ret;
    long var1;
    int var10;
    int var11;
    int var12;
    long var120;
    long var121;
    long var13;
    long var16;
    int var18;
    int var19;
    int var20;
    int var21;
    long var23;
    int var25;
    int var26;
    int var27;
    int var28;
    long var4;
    int var41;
    int var42;
    int var43;
    int var44;
    int var49;
    int var50;
    int var51;
    int var52;
    long var54;
    int var9;
    ret = 0;
    if ((arg0 == 0)) {
        return (int32_t *)(ret);
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return (int32_t *)(ret);
    }
    var1 = (unsigned long)((unsigned int)(arg1));
    if (((unsigned long)(8) <= (unsigned long)((unsigned long)((unsigned int)(arg1))))) {
        var4 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var1)) & -8)));
        var9 = arg2;
        var10 = arg2;
        var11 = arg2;
        var12 = arg2;
        var13 = (var4 - 8);
        var16 = (((unsigned long)(var13) >> 3) + 1);
        if ((var13 == 0)) {
            var18 = 0;
            var19 = 0;
            var20 = 0;
            var21 = 0;
            var23 = 0;
            var25 = 0;
            var26 = 0;
            var27 = 0;
            var28 = 0;
            if (((unsigned long)((unsigned char)((var16 & 1))) != 0)) {
                L_1297: ;
                var41 = (var18 - (-(*(int *)(((long)arg0 + var23 * 4)) == var9)));
                var42 = (var19 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x4)) == var10)));
                var43 = (var20 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x8)) == var11)));
                var44 = (var21 - (-(*(int *)(((long)arg0 + var23 * 4 + 0xc)) == var12)));
                var49 = (var25 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x10)) == var9)));
                var50 = (var26 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x14)) == var10)));
                var51 = (var27 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x18)) == var11)));
                var52 = (var28 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x1c)) == var12)));
            } else {
                var41 = var18;
                var42 = var19;
                var43 = var20;
                var44 = var21;
                var49 = var25;
                var50 = var26;
                var51 = var27;
                var52 = var28;
            }
        } else {
            var54 = (var16 & -2);
            var18 = 0;
            var19 = 0;
            var20 = 0;
            var21 = 0;
            var23 = 0;
            var25 = 0;
            var26 = 0;
            var27 = 0;
            var28 = 0;
            do {
                var18 = ((var18 - (-(*(int *)(((long)arg0 + var23 * 4)) == var9))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x20)) == var9)));
                var19 = ((var19 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x4)) == var10))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x24)) == var10)));
                var20 = ((var20 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x8)) == var11))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x28)) == var11)));
                var21 = ((var21 - (-(*(int *)(((long)arg0 + var23 * 4 + 0xc)) == var12))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x2c)) == var12)));
                var25 = ((var25 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x10)) == var9))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x30)) == var9)));
                var26 = ((var26 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x14)) == var10))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x34)) == var10)));
                var27 = ((var27 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x18)) == var11))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x38)) == var11)));
                var28 = ((var28 - (-(*(int *)(((long)arg0 + var23 * 4 + 0x1c)) == var12))) - (-(*(int *)(((long)arg0 + var23 * 4 + 0x3c)) == var12)));
                var23 = (var23 + 16);
                var54 = (var54 - 2);
            } while ((var54 != 0));
            var41 = var18;
            var42 = var19;
            var43 = var20;
            var44 = var21;
            var49 = var25;
            var50 = var26;
            var51 = var27;
            var52 = var28;
            if (((unsigned long)((unsigned char)((var16 & 1))) == 0)) {
                goto L_12b2;
            }
            goto L_1297;
        }
        L_12b2: ;
        var120 = (unsigned long)((unsigned int)((((var44 + var52) + (var42 + var50)) + ((var43 + var51) + (var41 + var49)))));
        var121 = var120;
        if ((var4 != var1)) {
            L_12e0: ;
            do {
                seen = (var120 + ((unsigned int)(*(int *)(((long)arg0 + var4 * 4))) == (unsigned int)(arg2)));
                i = (var4 + 1);
                var4 = (unsigned long)((unsigned int)(i));
                var120 = (unsigned long)((unsigned int)(seen));
                var121 = (unsigned long)((unsigned int)(seen));
            } while ((var1 != i));
        }
    } else {
        var4 = 0;
        var120 = 0;
        goto L_12e0;
    }
    return (int32_t *)(((long)arg0 + ((((unsigned long)((unsigned int)(var121)) == 0) ? (unsigned long)((unsigned int)((arg1 - 1))) : 0) * 4)));
}
ptr199_find_const pass 21 lines 
// glaurung: ptr199_find_const @ 0x1160
const int32_t * ptr199_find_const(const int32_t * arg0, int32_t arg1, int32_t arg2) {
    long ret;
    long t10;
    long var0;
    long var2;
    if ((arg0 == 0)) {
        return (const int32_t *)(0);
    }
    var0 = (unsigned long)((unsigned int)(arg1));
    ret = 0;
    do {
        if ((((unsigned long)((unsigned int)(var0)) == 0) | ((long)((int)(var0)) < 0))) {
            return (const int32_t *)(ret);
        }
        var2 = (var0 - 1);
        t10 = *(int *)(((long)arg0 + var0 * 4 - 0x4));
        var0 = var2;
    } while (((unsigned int)(t10) != (unsigned int)(arg2)));
    return (const int32_t *)(((long)arg0 + ((unsigned long)((unsigned int)(var2)) * 4)));
}
ptr199_find_i32 pass 25 lines 
// glaurung: ptr199_find_i32 @ 0x1100
int32_t * ptr199_find_i32(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long ret;
    long var1;
    long var3;
    ret = 0;
    if ((arg0 == 0)) {
        return (int32_t *)(ret);
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return (int32_t *)(ret);
    }
    var1 = (unsigned long)((unsigned int)(arg1));
    ret = 0;
    var3 = (long)arg0;
    while (((unsigned int)(*(int *)((var3))) != (unsigned int)(arg2))) {
        var3 = (var3 + 4);
        var1 = (var1 - 1);
        if ((var1 == 0)) {
            return (int32_t *)(ret);
        }
    }
    return (int32_t *)(var3);
}
ptr199_find_index pass 22 lines 
// glaurung: ptr199_find_index @ 0x11b0
int32_t ptr199_find_index(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long ret;
    long var0;
    ret = 0xffffffff;
    if ((arg0 == 0)) {
        return ret;
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return ret;
    }
    var0 = (unsigned long)((unsigned int)(arg1));
    i = 0;
    while (((unsigned int)(*(int *)(((long)arg0 + i * 4))) != (unsigned int)(arg2))) {
        i = (i + 1);
        if ((var0 == i)) {
            return ret;
        }
    }
    return (unsigned int)(i);
}
ptr199_find_void pass 25 lines 
// glaurung: ptr199_find_void @ 0x1130
void * ptr199_find_void(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long ret;
    long var1;
    long var3;
    ret = 0;
    if ((arg0 == 0)) {
        return (void *)(ret);
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return (void *)(ret);
    }
    var1 = (unsigned long)((unsigned int)(arg1));
    ret = 0;
    var3 = (long)arg0;
    while (((unsigned int)(*(int *)((var3))) != (unsigned int)(arg2))) {
        var3 = (var3 + 4);
        var1 = (var1 - 1);
        if ((var1 == 0)) {
            return (void *)(ret);
        }
    }
    return (void *)(var3);
}
ptr199_offset pass 13 lines 
// glaurung: ptr199_offset @ 0x1190
int32_t * ptr199_offset(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int index;
    long ret;
    ret = 0;
    if ((arg0 != 0)) {
        if (((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0)) == 0)) {
            index = ((int)((((long long)(int)((((unsigned long)((long)((int)((unsigned long)((unsigned int)(arg2))))) >> 32) & 0xffffffff)) * (((long long)1) << 32)) + (unsigned int)((unsigned long)((unsigned int)(arg2)))) % (int)(arg1)));
            ret = (long)(((long)arg0 + ((long)((int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((int)(index) >> 31))) & arg1))) + index))) * 4)));
        }
    }
    return (int32_t *)(ret);
}

gcc -O0

6/6
ptr199_edge_element pass 25 lines 
// glaurung: ptr199_edge_element @ 0x12ee
int32_t * ptr199_edge_element(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int seen;
    int i;
    // x86-64 prologue: save rbp
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    if (((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0)) != 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    seen = 0;
    for (i = 0; (i < arg1); i++) {
        if (((unsigned int)(arg2) == (unsigned int)(arg0[(long)(i)]))) {
            seen = (seen + 1);
        }
    }
    if (((((unsigned long)((unsigned int)(seen)) == 0) | ((long)(seen) < 0)) == 0)) {
        return arg0;
    } else {
        return (int32_t *)(((long)arg0 + (((long)(arg1) << 2) - 4)));
    }
}
ptr199_find_const pass 22 lines 
// glaurung: ptr199_find_const @ 0x11d3
const int32_t * ptr199_find_const(const int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (const int32_t *)(0);
    }
    i = ((unsigned int)(arg1) - 1);
    goto L_1233;
    L_11fe: ;
    if (((unsigned int)(arg2) == (unsigned int)(arg0[(long)(i)]))) {
        // x86-64 epilogue: restore rbp
        return (const int32_t *)(((long)arg0 + ((long)(i) * 4)));
    }
    i = (i - 1);
    L_1233: ;
    if ((0 <= (long)(i))) {
        goto L_11fe;
    }
    // x86-64 epilogue: restore rbp
    return (const int32_t *)(0);
}
ptr199_find_i32 pass 22 lines 
// glaurung: ptr199_find_i32 @ 0x10f9
int32_t * ptr199_find_i32(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    i = 0;
    goto L_1157;
    L_1122: ;
    if (((unsigned int)(arg2) == (unsigned int)(arg0[(long)(i)]))) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(((long)arg0 + ((long)(i) * 4)));
    }
    i = (i + 1);
    L_1157: ;
    if ((i < arg1)) {
        goto L_1122;
    }
    // x86-64 epilogue: restore rbp
    return (int32_t *)(0);
}
ptr199_find_index pass 22 lines 
// glaurung: ptr199_find_index @ 0x1292
int32_t ptr199_find_index(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return 0xffffffff;
    }
    i = 0;
    goto L_12df;
    L_12bb: ;
    if (((unsigned int)(arg2) == (unsigned int)(arg0[(long)(i)]))) {
        // x86-64 epilogue: restore rbp
        return (unsigned int)(i);
    }
    i = (i + 1);
    L_12df: ;
    if ((i < arg1)) {
        goto L_12bb;
    }
    // x86-64 epilogue: restore rbp
    return 0xffffffff;
}
ptr199_find_void pass 22 lines 
// glaurung: ptr199_find_void @ 0x1166
void * ptr199_find_void(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (void *)(0);
    }
    i = 0;
    goto L_11c4;
    L_118f: ;
    if (((unsigned int)(arg2) == (unsigned int)(arg0[(long)(i)]))) {
        // x86-64 epilogue: restore rbp
        return (void *)(((long)arg0 + ((long)(i) * 4)));
    }
    i = (i + 1);
    L_11c4: ;
    if ((i < arg1)) {
        goto L_118f;
    }
    // x86-64 epilogue: restore rbp
    return (void *)(0);
}
ptr199_offset pass 19 lines 
// glaurung: ptr199_offset @ 0x1240
int32_t * ptr199_offset(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int index;
    // x86-64 prologue: save rbp
    if ((arg0 == 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    if (((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0)) != 0)) {
        // x86-64 epilogue: restore rbp
        return (int32_t *)(0);
    }
    index = ((int)((((long long)(int)((((unsigned long)((long)((int)((unsigned long)((unsigned int)(arg2))))) >> 32) & 0xffffffff)) * (((long long)1) << 32)) + (unsigned int)((unsigned long)((unsigned int)(arg2)))) % (int)(arg1)));
    if (((long)(index) < 0)) {
        index = (index + (unsigned int)(arg1));
    }
    // x86-64 epilogue: restore rbp
    return (int32_t *)(((long)arg0 + ((long)(index) * 4)));
}

gcc -O2

6/6
ptr199_edge_element pass 27 lines 
// glaurung: ptr199_edge_element @ 0x1240
int32_t * ptr199_edge_element(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    int seen;
    long var5;
    long var7;
    if ((arg0 == 0)) {
        return (int32_t *)(0);
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return (int32_t *)(0);
    }
    var5 = 0;
    i = 0;
    do {
        var7 = var5;
        if (((unsigned int)(*(int *)(((long)arg0 + i * 4))) == (unsigned int)(arg2))) {
            var7 = (unsigned long)((unsigned int)((var5 + 1)));
        }
        i = (i + 1);
        var5 = var7;
    } while (((((unsigned int)(arg1) == (unsigned int)(i)) | (arg1 < i)) == 0));
    if (((unsigned long)((unsigned int)(var7)) == 0)) {
        return (int32_t *)((((long)arg0 + ((long)(arg1) * 4)) - 4));
    }
    return arg0;
}
ptr199_find_const pass 25 lines 
// glaurung: ptr199_find_const @ 0x1180
const int32_t * ptr199_find_const(const int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long ret;
    int var2;
    long var6;
    long var9;
    if ((arg0 == 0)) {
        return (const int32_t *)(0);
    }
    var2 = (arg1 - 1);
    if (((long)((int)(var2)) < 0)) {
        return (const int32_t *)(0);
    }
    var6 = ((long)((int)(var2)) << 2);
    ret = (long)(((long)arg0 + var6));
    var9 = (long)(((((long)arg0 + var6) - 4) - ((unsigned long)((unsigned int)(var2)) << 2)));
    while (((unsigned int)(*(int *)((ret))) != (unsigned int)(arg2))) {
        ret = (ret - 4);
        if ((ret == var9)) {
            return (const int32_t *)(0);
        }
    }
    return (const int32_t *)(ret);
}
ptr199_find_i32 pass 21 lines 
// glaurung: ptr199_find_i32 @ 0x1100
int32_t * ptr199_find_i32(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long ret;
    long var3;
    ret = (long)arg0;
    if ((arg0 == 0)) {
        return (int32_t *)(0);
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return (int32_t *)(0);
    }
    var3 = (long)((((long)arg0 + ((unsigned long)((unsigned int)((arg1 - 1))) * 4)) + 4));
    while (((unsigned int)(*(int *)((ret))) != (unsigned int)(arg2))) {
        ret = (ret + 4);
        if ((ret == var3)) {
            return (int32_t *)(0);
        }
    }
    return (int32_t *)(ret);
}
ptr199_find_index pass 27 lines 
// glaurung: ptr199_find_index @ 0x1200
int32_t ptr199_find_index(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long var1;
    long var5;
    long var6;
    if ((arg0 == 0)) {
        return 0xffffffff;
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return 0xffffffff;
    }
    var1 = (long)(arg1);
    i = 0;
    while (1) {
        var5 = (unsigned long)((unsigned int)(i));
        if (((unsigned int)(*(int *)(((long)arg0 + i * 4))) == (unsigned int)(arg2))) {
            break;
        }
        var6 = ((unsigned long)((unsigned int)(i)) + 1);
        i = var6;
        if ((var6 == var1)) {
            return 0xffffffff;
        }
    }
    return (unsigned int)(var5);
}
ptr199_find_void pass 21 lines 
// glaurung: ptr199_find_void @ 0x1140
void * ptr199_find_void(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int i;
    long ret;
    long var3;
    ret = (long)arg0;
    if ((arg0 == 0)) {
        return (void *)(0);
    }
    if ((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0))) {
        return (void *)(0);
    }
    var3 = (long)((((long)arg0 + ((unsigned long)((unsigned int)((arg1 - 1))) * 4)) + 4));
    while (((unsigned int)(*(int *)((ret))) != (unsigned int)(arg2))) {
        ret = (ret + 4);
        if ((ret == var3)) {
            return (void *)(0);
        }
    }
    return (void *)(ret);
}
ptr199_offset pass 13 lines 
// glaurung: ptr199_offset @ 0x11d0
int32_t * ptr199_offset(int32_t * arg0, int32_t arg1, int32_t arg2) {
    int index;
    long var0;
    var0 = (unsigned long)((unsigned int)(arg2));
    if ((arg0 != 0)) {
        if (((((unsigned long)((unsigned int)(arg1)) == 0) | ((long)(arg1) < 0)) == 0)) {
            index = ((int)((((long long)(int)((((unsigned long)((long)((int)(var0))) >> 32) & 0xffffffff)) * (((long long)1) << 32)) + (unsigned int)(var0)) % (int)(arg1)));
            return (int32_t *)(((long)arg0 + ((long)((int)(((0 <= (long)(index)) ? index : (unsigned long)((unsigned int)((arg1 + index)))))) * 4)));
        }
    }
    return (int32_t *)(0);
}

← 213 fixtures