glaurung

Fixture 203

string move copies

C · 9 functions · 4 lanes · 18 of 36 function-lanes behave identically

4 of 4 lanes have a function that returns a different result after decompilation: clang-O2 (4/9), gcc-O2 (4/9), clang-O0 (5/9), gcc-O0 (5/9).

The x86 STRING MOVE — rep movsq — which had no lane in this corpus at all.

Every one of the ~200 fixture sources was compiled at -O0 and -O2 under both gcc and clang and the disassembly grepped for the whole family: movsb, movsw, movsl and movsq appeared zero times. That silence is why the defect this fixture pins survived. Over the committed amd64 sample corpus the same two mnemonics are the third and fourth largest entries in lift_x86's silent-register-write census — movsb 242 occurrences, movsq 134 — and an unlifted instruction does not merely lose its semantics. It declares NO register write, so register dataflow concludes RDI and RSI were never touched and whatever they held before the copy flows on into every later reader. Every glibc memcpy built on rep movsq recovered with both pointers frozen at their pre-loop values.

The shape is not exotic and it is not assembly-only: it is what both compilers emit for an ordinary large-aggregate copy in plain C, with no intrinsic, no attribute and no -march. Verified by disassembly, not from memory — at a 384-byte aggregate:

mv203_by_value_wide gcc -O0, gcc -O2, clang -O0, clang -O2 rep movsq mv203_local_wide_copy gcc -O0, gcc -O2 rep movsq

so all four x86-64 lanes carry the instruction and two of them carry it twice. On i386 both become rep movsl, which is the one member of the family that DID have an arm — and the arm lifted a single element and left ECX untouched, so a repeated dword copy was modelled as copying exactly four bytes. On armv7 and aarch64 the same source compiles to a memcpy call, which is the point of keeping the C portable: this is a string-move lane on x86 and an ordinary aggregate-copy lane everywhere else, and every lane must produce the same numbers.

EVERYTHING IS 32-BIT ON PURPOSE. The elements could as easily be uint64_t, and the copy would still be rep movsq — but 64-bit arithmetic on i386 is carried in a register pair, and the i386 lanes would then fail on the register-pair recovery rather than on anything to do with the copy. Making the VALUES 32-bit keeps the i386 lanes about the string move, which is the only architecture where the dword form appears.

WHAT MAKES IT DISCRIMINATING. A copy is only observable if something reads more than its first element. Each consumer therefore folds EVERY element with a distinct coefficient and also mixes in the last element separately, so the three ways this can be wrong are three different wrong answers:

* pointers frozen (the defect above) -> every element reads as element 0 * one pointer stepped, not the other -> source and destination desync * the count not drained -> the copy runs the wrong length

A plain sum would hide the first of those whenever the elements happen to be permuted, and returning only element 0 would hide all three.

NEGATIVE CONTROLS. mv203_by_value_narrow and mv203_local_narrow_copy are the same two functions at 16 bytes, which both compilers copy with ordinary mov pairs — no string move anywhere in them. mv203_scalar_control has no aggregate at all. If a change breaks the wide cases and leaves these three passing, the fault is in the string move; if it breaks all five, it is somewhere general and this fixture is not the evidence.

tests/decompiler_fixtures/src/203_string_move_copies.c source 
#include <stdint.h>

/* The x86 STRING MOVE — `rep movsq` — which had no lane in this corpus at all.
 *
 * Every one of the ~200 fixture sources was compiled at -O0 and -O2 under both
 * gcc and clang and the disassembly grepped for the whole family: `movsb`,
 * `movsw`, `movsl` and `movsq` appeared zero times. That silence is why the
 * defect this fixture pins survived. Over the committed amd64 sample corpus the
 * same two mnemonics are the third and fourth largest entries in `lift_x86`'s
 * silent-register-write census — `movsb` 242 occurrences, `movsq` 134 — and an
 * unlifted instruction does not merely lose its semantics. It declares NO
 * register write, so register dataflow concludes RDI and RSI were never touched
 * and whatever they held before the copy flows on into every later reader. Every
 * glibc `memcpy` built on `rep movsq` recovered with both pointers frozen at
 * their pre-loop values.
 *
 * The shape is not exotic and it is not assembly-only: it is what both compilers
 * emit for an ordinary large-aggregate copy in plain C, with no intrinsic, no
 * attribute and no -march. Verified by disassembly, not from memory — at a
 * 384-byte aggregate:
 *
 *   mv203_by_value_wide     gcc -O0, gcc -O2, clang -O0, clang -O2   rep movsq
 *   mv203_local_wide_copy   gcc -O0, gcc -O2                         rep movsq
 *
 * so all four x86-64 lanes carry the instruction and two of them carry it twice.
 * On i386 both become `rep movsl`, which is the one member of the family that
 * DID have an arm — and the arm lifted a single element and left ECX untouched,
 * so a repeated dword copy was modelled as copying exactly four bytes. On armv7
 * and aarch64 the same source compiles to a `memcpy` call, which is the point of
 * keeping the C portable: this is a string-move lane on x86 and an ordinary
 * aggregate-copy lane everywhere else, and every lane must produce the same
 * numbers.
 *
 * EVERYTHING IS 32-BIT ON PURPOSE. The elements could as easily be `uint64_t`,
 * and the copy would still be `rep movsq` — but 64-bit arithmetic on i386 is
 * carried in a register pair, and the i386 lanes would then fail on the
 * register-pair recovery rather than on anything to do with the copy. Making the
 * VALUES 32-bit keeps the i386 lanes about the string move, which is the only
 * architecture where the dword form appears.
 *
 * WHAT MAKES IT DISCRIMINATING. A copy is only observable if something reads
 * more than its first element. Each consumer therefore folds EVERY element with
 * a distinct coefficient and also mixes in the last element separately, so the
 * three ways this can be wrong are three different wrong answers:
 *
 *   * pointers frozen (the defect above)  -> every element reads as element 0
 *   * one pointer stepped, not the other  -> source and destination desync
 *   * the count not drained               -> the copy runs the wrong length
 *
 * A plain sum would hide the first of those whenever the elements happen to be
 * permuted, and returning only element 0 would hide all three.
 *
 * NEGATIVE CONTROLS. `mv203_by_value_narrow` and `mv203_local_narrow_copy` are
 * the same two functions at 16 bytes, which both compilers copy with ordinary
 * `mov` pairs — no string move anywhere in them. `mv203_scalar_control` has no
 * aggregate at all. If a change breaks the wide cases and leaves these three
 * passing, the fault is in the string move; if it breaks all five, it is
 * somewhere general and this fixture is not the evidence. */

#define MV203_WIDE 96  /* 384 bytes: above both compilers' rep-movs threshold */
#define MV203_NARROW 4 /* 16 bytes: below it, in every lane */

struct mv203_wide {
    uint32_t q[MV203_WIDE];
};

struct mv203_narrow {
    uint32_t q[MV203_NARROW];
};

/* A deterministic filler. Integer only, and every element differs from every
 * other: the differential compares exact values, and a repeated element would
 * make a frozen pointer invisible. */
__attribute__((noinline)) void mv203_fill_wide(struct mv203_wide *out, int32_t seed) {
    uint32_t state = (uint32_t)seed + 0x9e3779b9u;
    for (int i = 0; i < MV203_WIDE; i++) {
        state = state * 1664525u + 1013904223u;
        out->q[i] = state;
    }
}

__attribute__((noinline)) void mv203_fill_narrow(struct mv203_narrow *out, int32_t seed) {
    uint32_t state = (uint32_t)seed + 0x9e3779b9u;
    for (int i = 0; i < MV203_NARROW; i++) {
        state = state * 1664525u + 1013904223u;
        out->q[i] = state;
    }
}

/* Distinct coefficients, plus the last element mixed in apart from the fold, so
 * a copy that never advanced its pointers cannot land on the same total. */
__attribute__((noinline)) uint32_t mv203_consume_wide(struct mv203_wide v) {
    uint32_t acc = 0;
    for (int i = 0; i < MV203_WIDE; i++) {
        acc += v.q[i] * (uint32_t)(i + 1);
    }
    return acc ^ (v.q[MV203_WIDE - 1] << 1);
}

__attribute__((noinline)) uint32_t mv203_consume_narrow(struct mv203_narrow v) {
    uint32_t acc = 0;
    for (int i = 0; i < MV203_NARROW; i++) {
        acc += v.q[i] * (uint32_t)(i + 1);
    }
    return acc ^ (v.q[MV203_NARROW - 1] << 1);
}

/* THE STRING MOVE, route one: an aggregate passed BY VALUE. The caller copies
 * the whole struct into the outgoing argument area, and above the threshold both
 * compilers do that with `rep movsq` at both optimisation levels. */
__attribute__((noinline)) uint32_t mv203_by_value_wide(int32_t seed) {
    struct mv203_wide a;
    mv203_fill_wide(&a, seed);
    return mv203_consume_wide(a);
}

/* THE STRING MOVE, route two: a struct ASSIGNMENT between two locals. gcc emits
 * `rep movsq` for this at both levels; clang unrolls it into vector moves, so
 * this function is a string-move lane in two of the four x86-64 lanes and an
 * ordinary copy in the other two. Both must agree. */
__attribute__((noinline)) uint32_t mv203_local_wide_copy(int32_t seed) {
    struct mv203_wide a;
    struct mv203_wide b;
    mv203_fill_wide(&a, seed);
    b = a;
    uint32_t acc = 0;
    for (int i = 0; i < MV203_WIDE; i++) {
        acc += b.q[i] * (uint32_t)(i + 1);
    }
    return acc ^ (b.q[MV203_WIDE - 1] << 1);
}

/* NEGATIVE CONTROL: the by-value route below the threshold. No string move in
 * any lane; a register-pair copy instead. */
__attribute__((noinline)) uint32_t mv203_by_value_narrow(int32_t seed) {
    struct mv203_narrow a;
    mv203_fill_narrow(&a, seed);
    return mv203_consume_narrow(a);
}

/* NEGATIVE CONTROL: the assignment route below the threshold. */
__attribute__((noinline)) uint32_t mv203_local_narrow_copy(int32_t seed) {
    struct mv203_narrow a;
    struct mv203_narrow b;
    mv203_fill_narrow(&a, seed);
    b = a;
    uint32_t acc = 0;
    for (int i = 0; i < MV203_NARROW; i++) {
        acc += b.q[i] * (uint32_t)(i + 1);
    }
    return acc ^ (b.q[MV203_NARROW - 1] << 1);
}

/* NEGATIVE CONTROL: no aggregate at all, so nothing here can route through
 * aggregate copy handling of any kind. */
__attribute__((noinline)) uint32_t mv203_scalar_control(int32_t seed) {
    uint32_t state = (uint32_t)seed + 0x9e3779b9u;
    state = state * 1664525u + 1013904223u;
    return state ^ (state << 1);
}

Recovered C

Generated by glaurung decompile --style decbench at b47f6b43. baseline.json records the result after recompiling the C and calling it beside the original with seeded inputs.

clang -O2

4/9
mv203_by_value_narrow fail 12 lines 
// glaurung: mv203_by_value_narrow @ 0x1490
__attribute__((no_stack_protector)) uint32_t mv203_by_value_narrow(int32_t arg0) {
    extern unsigned int mv203_consume_narrow(unsigned long, unsigned long);
    extern void mv203_fill_narrow(char *, int);
    unsigned char local_10[16];
    unsigned int ret;
    long stack_0;
    long stack_1;
    mv203_fill_narrow((char *)(&local_10[0]), (unsigned long)((unsigned int)(arg0)));
    ret = mv203_consume_narrow(stack_0, stack_1);
    return ret;
}
mv203_by_value_wide fail 32 lines 
// glaurung: mv203_by_value_wide @ 0x1320
__attribute__((no_stack_protector)) uint32_t mv203_by_value_wide(int32_t arg0) {
    extern unsigned int mv203_consume_wide(long);
    extern void mv203_fill_wide(char *, int);
    long df_1;
    unsigned char local_188[392];
    unsigned char local_308[384];
    unsigned int ret;
    long t1;
    long t2;
    long t3;
    long t39;
    long var0;
    long var2;
    df_1 = 0;
    *(long *)((&local_188[0] + 384)) = var0;
    mv203_fill_wide((char *)(&local_188[0]), (unsigned long)((unsigned int)(arg0)));
    var2 = 48;
    t39 = (long)(&local_308[0]);
    t1 = (long)(&local_188[0]);
    t2 = 48;
    while ((t2 != 0)) {
        *(long *)(t39) = *(long *)(t1);
        t39 = (t39 + ((df_1 != 0) ? -8 : 8));
        t1 = (t1 + ((df_1 != 0) ? -8 : 8));
        t2 = (t2 - 1);
    }
    t3 = (var2 * 8);
    ret = mv203_consume_wide((long)((&local_308[0] + (df_1 ? (-t3) : t3))));
    // x86-64 epilogue: tear down frame
    return ret;
}
mv203_consume_narrow structural 8 lines 
// glaurung: mv203_consume_narrow @ 0x1300
unsigned int mv203_consume_narrow(unsigned long arg0, unsigned long arg1) {
    unsigned int acc;
    int i;
    long var1;
    var1 = ((unsigned long)(arg1) >> 32);
    return (unsigned int)(((unsigned long)((unsigned int)((var1 + var1))) ^ (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((arg1 + (arg1 * 2)))) + (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((((unsigned long)(arg0) >> 31) & -2))) + arg0)))))) + (var1 * 4))))));
}
mv203_consume_wide structural 90 lines 
// glaurung: mv203_consume_wide @ 0x11e0
__attribute__((no_stack_protector)) uint32_t mv203_consume_wide(long arg0) {
    unsigned char local_18[24];
    long rsp;
    int stack_0;
    long t110;
    long t113;
    long t240;
    long t243;
    int var0;
    int var1;
    int var10;
    int var11;
    int var12;
    int var13;
    long var14;
    long var15;
    int var16;
    int var17;
    int var18;
    int var19;
    int var2;
    int var20;
    int var21;
    int var22;
    int var23;
    int var24;
    int var25;
    int var26;
    int var27;
    int var28;
    int var29;
    int var3;
    int var30;
    int var31;
    int var4;
    int var5;
    int var6;
    int var7;
    var0 = 2;
    var1 = 0;
    var2 = 3;
    var3 = 0;
    var4 = 0;
    var5 = 0;
    var6 = 1;
    var7 = 0;
    var10 = 0;
    var11 = 0;
    var12 = 0;
    var13 = 0;
    var14 = 8;
    var15 = (rsp + 8);
    var16 = -1;
    var17 = -1;
    var18 = -1;
    var19 = -1;
    var20 = 5;
    var21 = 5;
    var22 = 5;
    var23 = 5;
    var24 = 9;
    var25 = 9;
    var26 = 9;
    var27 = 9;
    var28 = 12;
    var29 = 0;
    var30 = 12;
    var31 = 0;
    do {
        var10 = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((var15 + var14 * 4)))) * (unsigned long)((unsigned int)((var4 + var24))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_18[0] + ((var14 * 4) + 16))))) * (unsigned long)((unsigned int)((var4 + var20))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_18[0] + (var14 * 4))))) * (unsigned long)((unsigned int)((var4 - var16))))) + var10)));
        var11 = ((unsigned int)(((unsigned long)((unsigned int)((var6 + var25))) * (unsigned long)((unsigned int)(*(int *)((var15 + var14 * 4 + 0x4)))))) + ((unsigned int)(((unsigned long)((unsigned int)((var6 + var21))) * (unsigned long)((unsigned int)(*(int *)((&local_18[0] + ((var14 * 4) + 20))))))) + ((unsigned int)(((unsigned long)((unsigned int)((var6 - var17))) * (unsigned long)((unsigned int)(*(int *)((&local_18[0] + ((var14 * 4) + 4))))))) + var11)));
        var12 = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((var15 + var14 * 4 + 0x8)))) * (unsigned long)((unsigned int)((var0 + var26))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((var15 + var14 * 4 - 0x8)))) * (unsigned long)((unsigned int)((var0 + var22))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_18[0] + ((var14 * 4) + 8))))) * (unsigned long)((unsigned int)((var0 - var18))))) + var12)));
        var13 = ((unsigned int)(((unsigned long)((unsigned int)((var2 + var27))) * (unsigned long)((unsigned int)(*(int *)((var15 + var14 * 4 + 0xc)))))) + ((unsigned int)(((unsigned long)((unsigned int)((var2 + var23))) * (unsigned long)((unsigned int)(*(int *)((var15 + var14 * 4 - 0x4)))))) + ((unsigned int)(((unsigned long)((unsigned int)((var2 - var19))) * (unsigned long)((unsigned int)(*(int *)((&local_18[0] + ((var14 * 4) + 12))))))) + var13)));
        t110 = (((unsigned long)((unsigned int)(var5)) | (unsigned long)((unsigned int)(var4))) + ((unsigned long)((unsigned int)(var29)) | (unsigned long)((unsigned int)(var28))));
        var4 = (unsigned int)(t110);
        var5 = (((unsigned long)(t110) >> 32) & 0xffffffff);
        t113 = (((unsigned long)((unsigned int)(var7)) | (unsigned long)((unsigned int)(var6))) + ((unsigned long)((unsigned int)(var31)) | (unsigned long)((unsigned int)(var30))));
        var6 = (unsigned int)(t113);
        var7 = (((unsigned long)(t113) >> 32) & 0xffffffff);
        t240 = (((unsigned long)((unsigned int)(var1)) | (unsigned long)((unsigned int)(var0))) + ((unsigned long)((unsigned int)(var29)) | (unsigned long)((unsigned int)(var28))));
        var0 = (unsigned int)(t240);
        var1 = (((unsigned long)(t240) >> 32) & 0xffffffff);
        t243 = (((unsigned long)((unsigned int)(var3)) | (unsigned long)((unsigned int)(var2))) + ((unsigned long)((unsigned int)(var31)) | (unsigned long)((unsigned int)(var30))));
        var2 = (unsigned int)(t243);
        var3 = (((unsigned long)(t243) >> 32) & 0xffffffff);
        var14 = (var14 + 12);
    } while ((var14 != 104));
    return (unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(stack_0)) + (unsigned long)((unsigned int)(stack_0))))) ^ (unsigned long)((unsigned int)(((var13 + var11) + (var12 + var10))))));
}
mv203_fill_narrow pass 17 lines 
// glaurung: mv203_fill_narrow @ 0x11a0
typedef struct mv203_narrow mv203_narrow;
void mv203_fill_narrow(mv203_narrow * arg0, int32_t arg1) {
    int i;
    unsigned int state;
    int var1;
    int var4;
    int var7;
    var1 = ((arg1 * 0x19660d) + 0x42d0d7c4);
    *(int *)(((long)arg0)) = var1;
    var4 = (((unsigned int)(var1) * 0x19660d) + 0x3c6ef35f);
    *(int *)(((long)arg0 + 0x4)) = var4;
    var7 = (((unsigned int)(var4) * 0x19660d) + 0x3c6ef35f);
    *(int *)(((long)arg0 + 0x8)) = var7;
    *(int *)(((long)arg0 + 0xc)) = (((unsigned long)((unsigned int)(var7)) * 0x19660d) + 0x3c6ef35f);
    return;
}
mv203_fill_wide structural 28 lines 
// glaurung: mv203_fill_wide @ 0x1140
typedef struct mv203_wide mv203_wide;
void mv203_fill_wide(mv203_wide * arg0, int32_t arg1) {
    int i;
    unsigned int state;
    long ret;
    int var12;
    int var15;
    long var4;
    int var6;
    int var9;
    i = 3;
    var4 = (unsigned long)((unsigned int)((arg1 - 0x61c88647)));
    do {
        var6 = ((var4 * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + i * 4 - 0xc)) = var6;
        var9 = (((unsigned int)(var6) * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + i * 4 - 0x8)) = var9;
        var12 = (((unsigned int)(var9) * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + i * 4 - 0x4)) = var12;
        var15 = (((unsigned int)(var12) * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + i * 4)) = var15;
        ret = ((unsigned long)((unsigned int)(i)) + 4);
        i = ret;
        var4 = (unsigned long)((unsigned int)(var15));
    } while ((ret != 99));
    return;
}
mv203_local_narrow_copy pass 15 lines 
// glaurung: mv203_local_narrow_copy @ 0x14c0
__attribute__((no_stack_protector)) uint32_t mv203_local_narrow_copy(int32_t arg0) {
    extern void mv203_fill_narrow(char *, int);
    unsigned int acc;
    int i;
    unsigned char local_10[16];
    long var0;
    long var1;
    long var2;
    mv203_fill_narrow((char *)(&local_10[0]), (unsigned long)((unsigned int)(arg0)));
    var0 = (unsigned long)((unsigned int)(*(int *)((&local_10[0] + 4))));
    var1 = (unsigned long)((unsigned int)(*(int *)((&local_10[0] + 8))));
    var2 = (unsigned long)((unsigned int)(*(int *)((&local_10[0] + 12))));
    return (unsigned int)(((unsigned long)((unsigned int)((var2 + var2))) ^ (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var1 + (var1 * 2)))) + (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var0 + var0))) + *(int *)(&local_10[0]))))))) + (var2 * 4))))));
}
mv203_local_wide_copy pass 91 lines 
// glaurung: mv203_local_wide_copy @ 0x1360
__attribute__((no_stack_protector)) uint32_t mv203_local_wide_copy(int32_t arg0) {
    extern void mv203_fill_wide(char *, int);
    unsigned int acc;
    unsigned char local_1a0[416];
    long t110;
    long t113;
    long t246;
    long t249;
    int var0;
    int var1;
    int var10;
    int var11;
    int var12;
    int var13;
    long var14;
    int var15;
    int var16;
    int var17;
    int var18;
    long var185;
    int var19;
    int var2;
    int var20;
    int var21;
    int var22;
    int var23;
    int var24;
    int var25;
    int var26;
    int var27;
    int var28;
    int var29;
    int var3;
    int var30;
    int var4;
    int var5;
    int var6;
    int var7;
    mv203_fill_wide((char *)((&local_1a0[0] + 32)), (unsigned long)((unsigned int)(arg0)));
    var0 = 2;
    var1 = 0;
    var2 = 3;
    var3 = 0;
    var4 = 0;
    var5 = 0;
    var6 = 1;
    var7 = 0;
    var10 = 0;
    var11 = 0;
    var12 = 0;
    var13 = 0;
    var14 = 8;
    var15 = -1;
    var16 = -1;
    var17 = -1;
    var18 = -1;
    var19 = 5;
    var20 = 5;
    var21 = 5;
    var22 = 5;
    var23 = 9;
    var24 = 9;
    var25 = 9;
    var26 = 9;
    var27 = 12;
    var28 = 0;
    var29 = 12;
    var30 = 0;
    do {
        var10 = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 32))))) * (unsigned long)((unsigned int)((var4 + var23))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 16))))) * (unsigned long)((unsigned int)((var4 + var19))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + (var14 * 4))))) * (unsigned long)((unsigned int)((var4 - var15))))) + var10)));
        var11 = ((unsigned int)(((unsigned long)((unsigned int)((var6 + var24))) * (unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 36))))))) + ((unsigned int)(((unsigned long)((unsigned int)((var6 + var20))) * (unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 20))))))) + ((unsigned int)(((unsigned long)((unsigned int)((var6 - var16))) * (unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 4))))))) + var11)));
        var12 = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 40))))) * (unsigned long)((unsigned int)((var0 + var25))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 24))))) * (unsigned long)((unsigned int)((var0 + var21))))) + ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 8))))) * (unsigned long)((unsigned int)((var0 - var17))))) + var12)));
        var13 = ((unsigned int)(((unsigned long)((unsigned int)((var2 + var26))) * (unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 44))))))) + ((unsigned int)(((unsigned long)((unsigned int)((var2 + var22))) * (unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 28))))))) + ((unsigned int)(((unsigned long)((unsigned int)((var2 - var18))) * (unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + ((var14 * 4) + 12))))))) + var13)));
        t110 = (((unsigned long)((unsigned int)(var5)) | (unsigned long)((unsigned int)(var4))) + ((unsigned long)((unsigned int)(var28)) | (unsigned long)((unsigned int)(var27))));
        var4 = (unsigned int)(t110);
        var5 = (((unsigned long)(t110) >> 32) & 0xffffffff);
        t113 = (((unsigned long)((unsigned int)(var7)) | (unsigned long)((unsigned int)(var6))) + ((unsigned long)((unsigned int)(var30)) | (unsigned long)((unsigned int)(var29))));
        var6 = (unsigned int)(t113);
        var7 = (((unsigned long)(t113) >> 32) & 0xffffffff);
        t246 = (((unsigned long)((unsigned int)(var1)) | (unsigned long)((unsigned int)(var0))) + ((unsigned long)((unsigned int)(var28)) | (unsigned long)((unsigned int)(var27))));
        var0 = (unsigned int)(t246);
        var1 = (((unsigned long)(t246) >> 32) & 0xffffffff);
        t249 = (((unsigned long)((unsigned int)(var3)) | (unsigned long)((unsigned int)(var2))) + ((unsigned long)((unsigned int)(var30)) | (unsigned long)((unsigned int)(var29))));
        var2 = (unsigned int)(t249);
        var3 = (((unsigned long)(t249) >> 32) & 0xffffffff);
        var14 = (var14 + 12);
    } while ((var14 != 104));
    var185 = (unsigned long)((unsigned int)(*(int *)((&local_1a0[0] + 412))));
    return (unsigned int)(((unsigned long)((unsigned int)((var185 + var185))) ^ (unsigned long)((unsigned int)(((var13 + var11) + (var12 + var10))))));
}
mv203_scalar_control pass 7 lines 
// glaurung: mv203_scalar_control @ 0x1500
uint32_t mv203_scalar_control(int32_t arg0) {
    unsigned int state;
    int var1;
    var1 = ((arg0 * 0x19660d) + 0x42d0d7c4);
    return (unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var1)) + (unsigned long)((unsigned int)(var1))))) ^ (unsigned long)((unsigned int)(var1))));
}

gcc -O2

4/9
mv203_by_value_narrow pass 18 lines 
// glaurung: mv203_by_value_narrow @ 0x1370
uint32_t mv203_by_value_narrow(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern unsigned int mv203_consume_narrow(unsigned long, unsigned long);
    extern void mv203_fill_narrow(char *, int);
    long local_10;
    unsigned char local_28[16];
    long ret;
    unsigned int var3;
    local_10 = (long)(0x28);
    mv203_fill_narrow((char *)(&local_28[0]), (unsigned long)((unsigned int)(arg0)));
    var3 = mv203_consume_narrow(*(long *)(&local_28[0]), *(long *)((&local_28[0] + 8)));
    ret = (unsigned long)(var3);
    if ((local_10 != 0x28)) {
        __stack_chk_fail();
    }
    return ret;
}
mv203_by_value_wide fail 40 lines 
// glaurung: mv203_by_value_wide @ 0x1270
uint32_t mv203_by_value_wide(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern unsigned int mv203_consume_wide(long);
    extern void mv203_fill_wide(char *, int);
    long df_1;
    long rbp;
    long ret;
    unsigned char stack_0[792];
    long stack_1;
    long t0;
    long t1;
    long t2;
    long t3;
    long var4;
    unsigned int var9;
    df_1 = 0;
    *(long *)((&stack_0[0] + 784)) = rbp;
    *(long *)((&stack_0[0] + 776)) = (long)((long)(0x28));
    rbp = (long)((&stack_0[0] + 384));
    ((void (*)(char *))mv203_fill_wide)((char *)(rbp));
    var4 = 48;
    t0 = (long)(&stack_0[0]);
    t1 = rbp;
    t2 = 48;
    while ((t2 != 0)) {
        *(long *)(t0) = *(long *)(t1);
        t0 = (t0 + ((df_1 != 0) ? -8 : 8));
        t1 = (t1 + ((df_1 != 0) ? -8 : 8));
        t2 = (t2 - 1);
    }
    t3 = (var4 * 8);
    var9 = mv203_consume_wide((long)((&stack_0[0] + (df_1 ? (-t3) : t3))));
    ret = (unsigned long)(var9);
    if ((stack_1 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
mv203_consume_narrow structural 24 lines 
// glaurung: mv203_consume_narrow @ 0x1230
__attribute__((no_stack_protector)) unsigned int mv203_consume_narrow(unsigned long arg0, unsigned long arg1) {
    unsigned int acc;
    int i;
    unsigned char local_1c[28];
    long var0;
    long var10;
    long var4;
    long var7;
    long var9;
    *(long *)((&local_1c[0] + 4)) = arg0;
    var0 = 1;
    *(long *)((&local_1c[0] + 12)) = arg1;
    var4 = 0;
    do {
        var7 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_1c[0] + (var0 * 4))))) * var0)));
        var0 = (var0 + 1);
        acc = (var4 + var7);
        var9 = (unsigned long)(acc);
        var4 = (unsigned long)(acc);
    } while ((var0 != 5));
    var10 = (unsigned long)((unsigned int)(*(int *)((&local_1c[0] + 16))));
    return (unsigned int)(((unsigned long)((unsigned int)((var10 + var10))) ^ var9));
}
mv203_consume_wide structural 18 lines 
// glaurung: mv203_consume_wide @ 0x1200
uint32_t mv203_consume_wide(long arg0) {
    unsigned int acc;
    int i;
    long rsp;
    int stack_0;
    long var0;
    long var3;
    long var6;
    var0 = 1;
    var3 = 0;
    do {
        var6 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((rsp + var0 * 4 + 0x4)))) * var0)));
        var0 = (var0 + 1);
        var3 = (unsigned long)((unsigned int)((var3 + var6)));
    } while ((var0 != 97));
    return (unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(stack_0)) + (unsigned long)((unsigned int)(stack_0))))) ^ var3));
}
mv203_fill_narrow pass 20 lines 
// glaurung: mv203_fill_narrow @ 0x11d0
typedef struct mv203_narrow mv203_narrow;
void mv203_fill_narrow(mv203_narrow * arg0, int32_t arg1) {
    int i;
    unsigned int state;
    long ret;
    long var2;
    long var3;
    int var5;
    ret = (long)(((long)arg0 + 16));
    var2 = (long)arg0;
    var3 = (unsigned long)((unsigned int)((arg1 - 0x61c88647)));
    do {
        var2 = (var2 + 4);
        var5 = ((var3 * 0x19660d) + 0x3c6ef35f);
        *(int *)((var2 - 0x4)) = var5;
        var3 = (unsigned long)((unsigned int)(var5));
    } while ((var2 != ret));
    return;
}
mv203_fill_wide structural 20 lines 
// glaurung: mv203_fill_wide @ 0x11a0
typedef struct mv203_wide mv203_wide;
void mv203_fill_wide(mv203_wide * arg0, int32_t arg1) {
    int i;
    unsigned int state;
    long var1;
    long var2;
    long var3;
    int var5;
    var1 = (long)(((long)arg0 + 384));
    var2 = (unsigned long)((unsigned int)((arg1 - 0x61c88647)));
    var3 = (long)arg0;
    do {
        var3 = (var3 + 4);
        var5 = ((var2 * 0x19660d) + 0x3c6ef35f);
        *(int *)((var3 - 0x4)) = var5;
        var2 = (unsigned long)((unsigned int)(var5));
    } while ((var3 != var1));
    return;
}
mv203_local_narrow_copy pass 42 lines 
// glaurung: mv203_local_narrow_copy @ 0x13c0
uint32_t mv203_local_narrow_copy(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern void mv203_fill_narrow(char *, int);
    unsigned int acc;
    long local_10;
    unsigned char local_28[16];
    unsigned char local_38[16];
    long ret;
    long var11;
    long var14;
    long var16;
    long var17;
    int var4;
    int var5;
    int var6;
    long var7;
    local_10 = (long)(0x28);
    mv203_fill_narrow((char *)(&local_38[0]), (unsigned long)((unsigned int)(arg0)));
    var4 = *(int *)((&local_38[0] + 4));
    var5 = *(int *)((&local_38[0] + 8));
    var6 = *(int *)((&local_38[0] + 12));
    var7 = 1;
    *(int *)(&local_28[0]) = *(int *)(&local_38[0]);
    *(int *)((&local_28[0] + 4)) = var4;
    *(int *)((&local_28[0] + 8)) = var5;
    *(int *)((&local_28[0] + 12)) = var6;
    var11 = 0;
    do {
        var14 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_28[0] + ((var7 * 4) - 4))))) * var7)));
        var7 = (var7 + 1);
        acc = (var11 + var14);
        var16 = (unsigned long)(acc);
        var11 = (unsigned long)(acc);
    } while ((var7 != 5));
    var17 = (unsigned long)((unsigned int)(*(int *)((&local_28[0] + 12))));
    ret = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var17 + var17))) ^ var16)));
    if ((local_10 != 0x28)) {
        __stack_chk_fail();
    }
    return ret;
}
mv203_local_wide_copy fail 51 lines 
// glaurung: mv203_local_wide_copy @ 0x12e0
uint32_t mv203_local_wide_copy(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern void mv203_fill_wide(char *, int);
    unsigned int acc;
    long df_1;
    long rbp;
    long ret;
    long rsp;
    unsigned char stack_0[4];
    unsigned char stack_1[408];
    long t1;
    long t137;
    long t2;
    long var14;
    long var17;
    long var19;
    long var9;
    df_1 = 0;
    rsp = (rsp - 8);
    *(long *)((&stack_1[0] + 400)) = rbp;
    rsp = (rsp - 784);
    *(long *)((&stack_1[0] + 392)) = (long)((long)(0x28));
    rbp = rsp;
    ((void (*)(char *))mv203_fill_wide)((char *)(rsp));
    var14 = 0;
    var9 = 1;
    t137 = (long)(&stack_1[0]);
    t1 = rbp;
    t2 = 48;
    while ((t2 != 0)) {
        *(long *)(t137) = *(long *)(t1);
        t137 = (t137 + ((df_1 != 0) ? -8 : 8));
        t1 = (t1 + ((df_1 != 0) ? -8 : 8));
        t2 = (t2 - 1);
    }
    do {
        var17 = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&stack_0[0] + (var9 * 4))))) * var9)));
        var9 = (var9 + 1);
        var14 = (unsigned long)((unsigned int)((var14 + var17)));
    } while ((var9 != 97));
    var19 = (unsigned long)((unsigned int)(*(int *)((&stack_1[0] + 380))));
    ret = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var19 + var19))) ^ var14)));
    if ((*(long *)((&stack_1[0] + 392)) != 0x28)) {
        __stack_chk_fail();
    }
    rsp = (rsp + 784);
    rbp = *(long *)((&stack_1[0] + 400));
    // x86-64 epilogue: tear down frame
    return ret;
}
mv203_scalar_control pass 7 lines 
// glaurung: mv203_scalar_control @ 0x1430
uint32_t mv203_scalar_control(int32_t arg0) {
    unsigned int state;
    int var3;
    var3 = (((unsigned int)((arg0 - 0x61c88647)) * 0x19660d) + 0x3c6ef35f);
    return (unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(var3)) + (unsigned long)((unsigned int)(var3))))) ^ (unsigned long)((unsigned int)(var3))));
}

clang -O0

5/9
mv203_by_value_narrow pass 12 lines 
// glaurung: mv203_by_value_narrow @ 0x13c0
__attribute__((no_stack_protector)) uint32_t mv203_by_value_narrow(int32_t arg0) {
    extern unsigned int mv203_consume_narrow(unsigned long, unsigned long);
    extern void mv203_fill_narrow(char *, int);
    unsigned char local_18[16];
    unsigned int ret;
    // x86-64 prologue: save rbp, frame 32 bytes
    mv203_fill_narrow((char *)(&local_18[0]), (unsigned long)((unsigned int)(arg0)));
    ret = mv203_consume_narrow(*(long *)(&local_18[0]), *(long *)((&local_18[0] + 8)));
    // x86-64 epilogue: restore rbp
    return ret;
}
mv203_by_value_wide fail 33 lines 
// glaurung: mv203_by_value_wide @ 0x12d0
__attribute__((no_stack_protector)) uint32_t mv203_by_value_wide(int32_t arg0) {
    extern unsigned int mv203_consume_wide(long);
    extern void mv203_fill_wide(char *, int);
    long df_1;
    unsigned char local_188[384];
    long rbp;
    unsigned int ret;
    unsigned char stack_0[792];
    long t1;
    long t2;
    long t3;
    long t42;
    long var1;
    df_1 = 0;
    *(long *)((&stack_0[0] + 784)) = rbp;
    mv203_fill_wide((char *)(&local_188[0]), (unsigned long)((unsigned int)(arg0)));
    var1 = 48;
    t42 = (long)(&stack_0[0]);
    t1 = (long)(&local_188[0]);
    t2 = 48;
    while ((t2 != 0)) {
        *(long *)(t42) = *(long *)(t1);
        t42 = (t42 + ((df_1 != 0) ? -8 : 8));
        t1 = (t1 + ((df_1 != 0) ? -8 : 8));
        t2 = (t2 - 1);
    }
    t3 = (var1 * 8);
    ret = mv203_consume_wide((long)((&stack_0[0] + (df_1 ? (-t3) : t3))));
    rbp = *(long *)((&stack_0[0] + 784));
    // x86-64 epilogue: tear down frame
    return ret;
}
mv203_consume_narrow structural 15 lines 
// glaurung: mv203_consume_narrow @ 0x1270
__attribute__((no_stack_protector)) unsigned int mv203_consume_narrow(unsigned long arg0, unsigned long arg1) {
    unsigned int acc;
    int i;
    unsigned char local_10[16];
    // x86-64 prologue: save rbp
    *(long *)(&local_10[0]) = arg0;
    *(long *)((&local_10[0] + 8)) = arg1;
    acc = 0;
    for (i = 0; ((long)(i) < 4); i++) {
        acc = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_10[0] + ((long)(i) * 4))))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))) + acc);
    }
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)(acc) ^ (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_10[0] + 12)))) << 1)))));
}
mv203_consume_wide structural 15 lines 
// glaurung: mv203_consume_wide @ 0x1210
__attribute__((no_stack_protector)) uint32_t mv203_consume_wide(long arg0) {
    unsigned int acc;
    int i;
    long local_10;
    unsigned char stack_1[8];
    // x86-64 prologue: save rbp
    local_10 = (long)(&stack_1[0]);
    acc = 0;
    for (i = 0; ((long)(i) < 96); i++) {
        acc = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((local_10 + ((long)(i) * 4))))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))) + acc);
    }
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)(acc) ^ (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((local_10 + 0x17c)))) << 1)))));
}
mv203_fill_narrow pass 14 lines 
// glaurung: mv203_fill_narrow @ 0x11b0
typedef struct mv203_narrow mv203_narrow;
void mv203_fill_narrow(mv203_narrow * arg0, int32_t arg1) {
    unsigned int state;
    int i;
    // x86-64 prologue: save rbp
    state = ((unsigned int)(arg1) - 0x61c88647);
    for (i = 0; ((long)(i) < 4); i++) {
        state = ((state * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + ((long)(i) * 4))) = state;
    }
    // x86-64 epilogue: restore rbp
    return;
}
mv203_fill_wide structural 14 lines 
// glaurung: mv203_fill_wide @ 0x1150
typedef struct mv203_wide mv203_wide;
void mv203_fill_wide(mv203_wide * arg0, int32_t arg1) {
    unsigned int state;
    int i;
    // x86-64 prologue: save rbp
    state = ((unsigned int)(arg1) - 0x61c88647);
    for (i = 0; ((long)(i) < 96); i++) {
        state = ((state * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + ((long)(i) * 4))) = state;
    }
    // x86-64 epilogue: restore rbp
    return;
}
mv203_local_narrow_copy pass 18 lines 
// glaurung: mv203_local_narrow_copy @ 0x13f0
__attribute__((no_stack_protector)) uint32_t mv203_local_narrow_copy(int32_t arg0) {
    extern void mv203_fill_narrow(char *, int);
    unsigned int acc;
    int i;
    unsigned char local_18[16];
    unsigned char local_28[16];
    // x86-64 prologue: save rbp, frame 48 bytes
    mv203_fill_narrow((char *)(&local_18[0]), (unsigned long)((unsigned int)(arg0)));
    *(long *)(&local_28[0]) = *(long *)(&local_18[0]);
    *(long *)((&local_28[0] + 8)) = *(long *)((&local_18[0] + 8));
    acc = 0;
    for (i = 0; ((long)(i) < 4); i++) {
        acc = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_28[0] + ((long)(i) * 4))))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))) + acc);
    }
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)(acc) ^ (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_28[0] + 12)))) << 1)))));
}
mv203_local_wide_copy pass 19 lines 
// glaurung: mv203_local_wide_copy @ 0x1310
__attribute__((no_stack_protector)) uint32_t mv203_local_wide_copy(int32_t arg0) {
    extern void * memcpy(void *, const void *, __SIZE_TYPE__);
    extern void mv203_fill_wide(char *, int);
    unsigned int acc;
    int i;
    unsigned char local_188[384];
    unsigned char local_308[384];
    void * var0;
    // x86-64 prologue: save rbp, frame 784 bytes
    mv203_fill_wide((char *)(&local_188[0]), (unsigned long)((unsigned int)(arg0)));
    var0 = memcpy((void *)(&local_308[0]), (const void *)(&local_188[0]), (__SIZE_TYPE__)(384));
    acc = 0;
    for (i = 0; ((long)(i) < 96); i++) {
        acc = ((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_308[0] + ((long)(i) * 4))))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))) + acc);
    }
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)(acc) ^ (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_308[0] + 380)))) << 1)))));
}
mv203_scalar_control pass 9 lines 
// glaurung: mv203_scalar_control @ 0x1470
uint32_t mv203_scalar_control(int32_t arg0) {
    unsigned int state;
    // x86-64 prologue: save rbp
    state = ((unsigned int)(arg0) - 0x61c88647);
    state = ((state * 0x19660d) + 0x3c6ef35f);
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)(state) ^ (unsigned long)((unsigned int)(((unsigned long)(state) << 1)))));
}

gcc -O0

5/9
mv203_by_value_narrow pass 20 lines 
// glaurung: mv203_by_value_narrow @ 0x1411
uint32_t mv203_by_value_narrow(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern unsigned int mv203_consume_narrow(unsigned long, unsigned long);
    extern void mv203_fill_narrow(char *, int);
    unsigned char local_20[16];
    long local_8;
    long ret;
    unsigned int var7;
    // x86-64 prologue: save rbp, frame 48 bytes
    local_8 = (long)(0x28);
    mv203_fill_narrow((char *)(&local_20[0]), (unsigned long)((unsigned int)(arg0)));
    var7 = mv203_consume_narrow(*(long *)(&local_20[0]), *(long *)((&local_20[0] + 8)));
    ret = (unsigned long)(var7);
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
mv203_by_value_wide fail 41 lines 
// glaurung: mv203_by_value_wide @ 0x12d3
uint32_t mv203_by_value_wide(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern unsigned int mv203_consume_wide(long);
    extern void mv203_fill_wide(char *, int);
    long df_1;
    unsigned char local_190[384];
    long local_8;
    long rbp;
    long ret;
    unsigned char stack_0[808];
    long t1;
    long t135;
    long t2;
    long t3;
    long var10;
    unsigned int var13;
    df_1 = 0;
    *(long *)((&stack_0[0] + 800)) = rbp;
    rbp = (long)((&stack_0[0] + 800));
    local_8 = (long)(0x28);
    mv203_fill_wide((char *)(&local_190[0]), (unsigned long)((unsigned int)(arg0)));
    var10 = 48;
    t135 = (long)(&stack_0[0]);
    t1 = (long)(&local_190[0]);
    t2 = 48;
    while ((t2 != 0)) {
        *(long *)(t135) = *(long *)(t1);
        t135 = (t135 + ((df_1 != 0) ? -8 : 8));
        t1 = (t1 + ((df_1 != 0) ? -8 : 8));
        t2 = (t2 - 1);
    }
    t3 = (var10 * 8);
    var13 = mv203_consume_wide((long)((&stack_0[0] + (df_1 ? (-t3) : t3))));
    ret = (unsigned long)(var13);
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
mv203_consume_narrow structural 17 lines 
// glaurung: mv203_consume_narrow @ 0x1281
__attribute__((no_stack_protector)) unsigned int mv203_consume_narrow(unsigned long arg0, unsigned long arg1) {
    unsigned int acc;
    int i;
    unsigned char local_20[32];
    long var11;
    // x86-64 prologue: save rbp
    *(long *)(&local_20[0]) = arg0;
    *(long *)((&local_20[0] + 8)) = arg1;
    acc = 0;
    for (i = 0; ((((unsigned long)((unsigned int)(i)) == 3) | ((long)(i) < 3)) != 0); i++) {
        acc = (acc + (unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_20[0] + ((long)(i) * 4))))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))));
    }
    var11 = (unsigned long)((unsigned int)(*(int *)((&local_20[0] + 12))));
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)((unsigned int)((var11 + var11))) ^ acc));
}
mv203_consume_wide structural 14 lines 
// glaurung: mv203_consume_wide @ 0x123d
uint32_t mv203_consume_wide(long arg0) {
    unsigned int acc;
    int i;
    long rbp;
    int stack_1;
    // x86-64 prologue: save rbp
    acc = 0;
    for (i = 0; ((((unsigned long)((unsigned int)(i)) == 95) | ((long)(i) < 95)) != 0); i++) {
        acc = (acc + (unsigned int)(((unsigned long)((unsigned int)(*(int *)(((rbp + ((long)(i) * 4)) + 16)))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))));
    }
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)((unsigned int)(((unsigned long)((unsigned int)(stack_1)) + (unsigned long)((unsigned int)(stack_1))))) ^ acc));
}
mv203_fill_narrow pass 14 lines 
// glaurung: mv203_fill_narrow @ 0x11eb
typedef struct mv203_narrow mv203_narrow;
void mv203_fill_narrow(mv203_narrow * arg0, int32_t arg1) {
    unsigned int state;
    int i;
    // x86-64 prologue: save rbp
    state = ((unsigned int)(arg1) - 0x61c88647);
    for (i = 0; ((((unsigned long)((unsigned int)(i)) == 3) | ((long)(i) < 3)) != 0); i++) {
        state = ((state * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + ((long)(i) * 4))) = state;
    }
    // x86-64 epilogue: restore rbp
    return;
}
mv203_fill_wide structural 14 lines 
// glaurung: mv203_fill_wide @ 0x1199
typedef struct mv203_wide mv203_wide;
void mv203_fill_wide(mv203_wide * arg0, int32_t arg1) {
    unsigned int state;
    int i;
    // x86-64 prologue: save rbp
    state = ((unsigned int)(arg1) - 0x61c88647);
    for (i = 0; ((((unsigned long)((unsigned int)(i)) == 95) | ((long)(i) < 95)) != 0); i++) {
        state = ((state * 0x19660d) + 0x3c6ef35f);
        *(int *)(((long)arg0 + ((long)(i) * 4))) = state;
    }
    // x86-64 epilogue: restore rbp
    return;
}
mv203_local_narrow_copy pass 30 lines 
// glaurung: mv203_local_narrow_copy @ 0x1469
uint32_t mv203_local_narrow_copy(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern void mv203_fill_narrow(char *, int);
    unsigned int acc;
    int i;
    unsigned char local_20[16];
    unsigned char local_30[16];
    long local_8;
    long ret;
    long var15;
    long var6;
    // x86-64 prologue: save rbp, frame 80 bytes
    local_8 = (long)(0x28);
    mv203_fill_narrow((char *)(&local_30[0]), (unsigned long)((unsigned int)(arg0)));
    var6 = *(long *)((&local_30[0] + 8));
    *(long *)(&local_20[0]) = *(long *)(&local_30[0]);
    *(long *)((&local_20[0] + 8)) = var6;
    acc = 0;
    for (i = 0; ((((unsigned long)((unsigned int)(i)) == 3) | ((long)(i) < 3)) != 0); i++) {
        acc = (acc + (unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_20[0] + ((long)(i) * 4))))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))));
    }
    var15 = (unsigned long)((unsigned int)(*(int *)((&local_20[0] + 12))));
    ret = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var15 + var15))) ^ acc)));
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
mv203_local_wide_copy pass 39 lines 
// glaurung: mv203_local_wide_copy @ 0x1352
uint32_t mv203_local_wide_copy(int32_t arg0) {
    extern __attribute__((noreturn)) void __stack_chk_fail(void);
    extern void mv203_fill_wide(char *, int);
    unsigned int acc;
    int i;
    long df_1;
    unsigned char local_190[384];
    unsigned char local_310[384];
    long local_8;
    long ret;
    long t1;
    long t142;
    long t2;
    long var21;
    df_1 = 0;
    local_8 = (long)(0x28);
    mv203_fill_wide((char *)(&local_310[0]), (unsigned long)((unsigned int)(arg0)));
    t142 = (long)(&local_190[0]);
    t1 = (long)(&local_310[0]);
    t2 = 48;
    while ((t2 != 0)) {
        *(long *)(t142) = *(long *)(t1);
        t142 = (t142 + ((df_1 != 0) ? -8 : 8));
        t1 = (t1 + ((df_1 != 0) ? -8 : 8));
        t2 = (t2 - 1);
    }
    acc = 0;
    for (i = 0; ((((unsigned long)((unsigned int)(i)) == 95) | ((long)(i) < 95)) != 0); i++) {
        acc = (acc + (unsigned int)(((unsigned long)((unsigned int)(*(int *)((&local_190[0] + ((long)(i) * 4))))) * (unsigned long)((unsigned int)(((unsigned long)((unsigned int)(i)) + 1))))));
    }
    var21 = (unsigned long)((unsigned int)(*(int *)((&local_190[0] + 380))));
    ret = (unsigned long)((unsigned int)(((unsigned long)((unsigned int)((var21 + var21))) ^ acc)));
    if ((local_8 != 0x28)) {
        __stack_chk_fail();
    }
    // x86-64 epilogue: restore rbp
    return ret;
}
mv203_scalar_control pass 9 lines 
// glaurung: mv203_scalar_control @ 0x14f5
uint32_t mv203_scalar_control(int32_t arg0) {
    unsigned int state;
    // x86-64 prologue: save rbp
    state = ((unsigned int)(arg0) - 0x61c88647);
    state = ((state * 0x19660d) + 0x3c6ef35f);
    // x86-64 epilogue: restore rbp
    return (unsigned int)(((unsigned long)((unsigned int)(((unsigned long)(state) + (unsigned long)(state)))) ^ state));
}

← 213 fixtures