// File: /workspace/github_c_makefile_star2_O0/mabdi[P]bunney/bunny-main.c
// Function: bitflip_walk
static _u8 bitflip_walk(struct bunny_traceitem* t, _u32 flip) {
  _s32 pos, end = t->fuzzable * 8 - flip;

  if (reg_execs > cycle_branch_limit && (zero_range || reg_params > cycle_value_limit)) return 1;

  flow_command(FLOW_RESET,0,0,0);
  
  for (pos=0;pos <= end;pos++) {
    struct bunny_traceitem* n;
    _u8 rne = 0;
        
    if (pos) {
      flow_command(FLOW_BITFLIP,pos-1,1,0);
      flow_command(FLOW_BITFLIP,pos + flip - 1 ,1,0);
    } else
      flow_command(FLOW_BITFLIP,0,flip,0);

    n = run_program();

    if (check_crash(n)) {
      outf("flipping %u bits at bit offset #%u.\n\n",flip,pos);
      if (keep_fault) continue;
      return 1;
    }

    if (reg_execs > cycle_branch_limit) epath_ign++; else
      if ((rne=register_new_exec(n,1))) {
        outf("      Triggered by flipping %u bits at bit offset #%u.\n",flip,pos);
        reg_execs++;
        if (reg_execs > cycle_branch_limit) 
          outf("      >>> Per-cycle call path limit of %u exceeded (use -N to adjust).\n",cycle_branch_limit);
      }

    if (reg_params > cycle_value_limit) ppath_ign++; else
      if (register_new_param(n,pos/8,(flip+7)/8,1,rne)) {
        outf("      Triggered by flipping %u bits at bit offset #%u.\n",flip,pos);
        reg_params++;
        if (reg_params > cycle_value_limit) 
          outf("      >>> Per-cycle parameter sequence limit of %u exceeded (use -P to adjust).\n",cycle_value_limit);
      }
    
    /* Context not saved */
    if (!rne) discard_context(n,1);
    
  }

  return 0;
  
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x30, %rsp
movq %rdi, -0x10(%rbp)
movl %esi, -0x14(%rbp)
movq -0x10(%rbp), %rax
movl 0x4(%rax), %eax
shll $0x3, %eax
subl -0x14(%rbp), %eax
movl %eax, -0x1c(%rbp)
movl 0x8d23(%rip), %eax      # 0x123c8
cmpl 0x8b79(%rip), %eax      # 0x12224
jbe 0x96d0
movzbl 0x8c51(%rip), %eax      # 0x12305
cmpl $0x0, %eax
jne 0x96c7
movl 0x8d0d(%rip), %eax      # 0x123cc
cmpl 0x8b63(%rip), %eax      # 0x12228
jbe 0x96d0
movb $0x1, -0x1(%rbp)
jmp 0x999e
movl $0x2, %edi
xorl %ecx, %ecx
movl %ecx, %esi
movl %ecx, %edx
callq 0x7590
movl $0x0, -0x18(%rbp)
movl -0x18(%rbp), %eax
cmpl -0x1c(%rbp), %eax
jg 0x999a
movb $0x0, -0x29(%rbp)
cmpl $0x0, -0x18(%rbp)
je 0x9730
movl -0x18(%rbp), %esi
subl $0x1, %esi
movl $0x64, %edi
movl $0x1, %edx
xorl %ecx, %ecx
callq 0x7590
movl -0x18(%rbp), %esi
addl -0x14(%rbp), %esi
subl $0x1, %esi
movl $0x64, %edi
movl $0x1, %edx
xorl %ecx, %ecx
callq 0x7590
jmp 0x9741
movl -0x14(%rbp), %edx
movl $0x64, %edi
xorl %ecx, %ecx
movl %ecx, %esi
callq 0x7590
callq 0x7b70
movq %rax, -0x28(%rbp)
movq -0x28(%rbp), %rdi
callq 0xcf40
cmpb $0x0, %al
je 0x97ab
jmp 0x9759
movl -0x14(%rbp), %esi
movl -0x18(%rbp), %edx
leaq 0x6cb0(%rip), %rdi      # 0x10416
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8b63(%rip)      # 0x122d8
je 0x9792
movq 0x8b5a(%rip), %rdi      # 0x122d8
movl -0x14(%rbp), %edx
movl -0x18(%rbp), %ecx
leaq 0x6c8b(%rip), %rsi      # 0x10416
movb $0x0, %al
callq 0x22d0
jmp 0x9794
cmpb $0x0, 0x8b67(%rip)      # 0x12302
je 0x97a2
jmp 0x998c
movb $0x1, -0x1(%rbp)
jmp 0x999e
movl 0x8c17(%rip), %eax      # 0x123c8
cmpl 0x8a6d(%rip), %eax      # 0x12224
jbe 0x97cd
movl 0x8ba1(%rip), %eax      # 0x12360
addl $0x1, %eax
movl %eax, 0x8b98(%rip)      # 0x12360
jmp 0x9883
movq -0x28(%rbp), %rdi
movl $0x1, %esi
callq 0x8770
movb %al, -0x29(%rbp)
cmpb $0x0, %al
je 0x9881
jmp 0x97e8
movl -0x14(%rbp), %esi
movl -0x18(%rbp), %edx
leaq 0x6c47(%rip), %rdi      # 0x1043c
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8ad4(%rip)      # 0x122d8
je 0x9821
movq 0x8acb(%rip), %rdi      # 0x122d8
movl -0x14(%rbp), %edx
movl -0x18(%rbp), %ecx
leaq 0x6c22(%rip), %rsi      # 0x1043c
movb $0x0, %al
callq 0x22d0
jmp 0x9823
movl 0x8b9f(%rip), %eax      # 0x123c8
addl $0x1, %eax
movl %eax, 0x8b96(%rip)      # 0x123c8
movl 0x8b90(%rip), %eax      # 0x123c8
cmpl 0x89e6(%rip), %eax      # 0x12224
jbe 0x987f
jmp 0x9842
movl 0x89dc(%rip), %esi      # 0x12224
leaq 0x6a25(%rip), %rdi      # 0x10274
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8a7a(%rip)      # 0x122d8
je 0x987b
movq 0x8a71(%rip), %rdi      # 0x122d8
movl 0x89b7(%rip), %edx      # 0x12224
leaq 0x6a00(%rip), %rsi      # 0x10274
movb $0x0, %al
callq 0x22d0
jmp 0x987d
jmp 0x987f
jmp 0x9881
jmp 0x9883
movl 0x8b43(%rip), %eax      # 0x123cc
cmpl 0x8999(%rip), %eax      # 0x12228
jbe 0x98a5
movl 0x8ad1(%rip), %eax      # 0x12368
addl $0x1, %eax
movl %eax, 0x8ac8(%rip)      # 0x12368
jmp 0x9976
movq -0x28(%rbp), %rdi
movl -0x18(%rbp), %eax
movl $0x8, %ecx
cltd
idivl %ecx
movl %eax, %esi
movl -0x14(%rbp), %eax
addl $0x7, %eax
shrl $0x3, %eax
movl $0x1, %ecx
movzbl %al, %edx
movzbl -0x29(%rbp), %r8d
callq 0x8b80
cmpb $0x0, %al
je 0x9974
jmp 0x98db
movl -0x14(%rbp), %esi
movl -0x18(%rbp), %edx
leaq 0x6b54(%rip), %rdi      # 0x1043c
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x89e1(%rip)      # 0x122d8
je 0x9914
movq 0x89d8(%rip), %rdi      # 0x122d8
movl -0x14(%rbp), %edx
movl -0x18(%rbp), %ecx
leaq 0x6b2f(%rip), %rsi      # 0x1043c
movb $0x0, %al
callq 0x22d0
jmp 0x9916
movl 0x8ab0(%rip), %eax      # 0x123cc
addl $0x1, %eax
movl %eax, 0x8aa7(%rip)      # 0x123cc
movl 0x8aa1(%rip), %eax      # 0x123cc
cmpl 0x88f7(%rip), %eax      # 0x12228
jbe 0x9972
jmp 0x9935
movl 0x88ed(%rip), %esi      # 0x12228
leaq 0x6b32(%rip), %rdi      # 0x10474
movb $0x0, %al
callq 0x2030
cmpq $0x0, 0x8987(%rip)      # 0x122d8
je 0x996e
movq 0x897e(%rip), %rdi      # 0x122d8
movl 0x88c8(%rip), %edx      # 0x12228
leaq 0x6b0d(%rip), %rsi      # 0x10474
movb $0x0, %al
callq 0x22d0
jmp 0x9970
jmp 0x9972
jmp 0x9974
jmp 0x9976
cmpb $0x0, -0x29(%rbp)
jne 0x998a
movq -0x28(%rbp), %rdi
movl $0x1, %esi
callq 0x8570
jmp 0x998c
movl -0x18(%rbp), %eax
addl $0x1, %eax
movl %eax, -0x18(%rbp)
jmp 0x96e7
movb $0x0, -0x1(%rbp)
movb -0x1(%rbp), %al
addq $0x30, %rsp
popq %rbp
retq
nopw (%rax,%rax)