In this mode, referring an invalid element of the source forces the result to false (table 4-7, last column) but referring an invalid element of the destination forces the result to true, so the outer loop should still be run even if some elements of the destination will be invalid. They will be avoided in the inner loop, which correctly bounds "i" to validd, but they will still contribute to a positive outcome of the search.
This fixes tst_strstr in glibc 2.17. Reported-by: Florian Weimer <fwei...@redhat.com> Cc: Richard Henderson <r...@twiddle.net> Cc: Eduardo Habkost <ehabk...@redhat.com> Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- target-i386/ops_sse.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target-i386/ops_sse.h b/target-i386/ops_sse.h index 7aa693a..1780d1d 100644 --- a/target-i386/ops_sse.h +++ b/target-i386/ops_sse.h @@ -2037,10 +2037,10 @@ static inline unsigned pcmpxstrx(CPUX86State *env, Reg *d, Reg *s, } break; case 3: - for (j = valids - validd; j >= 0; j--) { + for (j = valids; j >= 0; j--) { res <<= 1; v = 1; - for (i = MIN(upper - j, validd); i >= 0; i--) { + for (i = MIN(valids - j, validd); i >= 0; i--) { v &= (pcmp_val(s, ctrl, i + j) == pcmp_val(d, ctrl, i)); } res |= v; -- 1.8.3.1