assembly lea instruction of int *q = p++ and int c = a++

Question

In order to deepen the impression about how the " (*p)++ " works, I wrote some test codes like:

int main()
{
  int  a = 3;
  int *p = &a;
  int b = (*p)++;
  int *q = p++;
  int c = a++;
  int d = c++;
  printf("a = %d, b = %d, c = %d, d = %d, p = %#x, q = %#x\n",a, b, c, d, p, q);
}

OUTPUT IS: a = 5, b = 3, c = 5, d = 4, p = 0xc6dc3490, q = 0xc6dc348c

But my question is about the assembly (codes are in orders and not off and on):

main:
        push    rbp
        mov     rbp, rsp
        sub     rsp, 48

;int a = 3 :
        mov     DWORD PTR [rbp-36], 3

;int *p = &a :
        lea     rax, [rbp-36]
        mov     QWORD PTR [rbp-8], rax

;int b = (*p)++ :
        mov     rax, QWORD PTR [rbp-8]
        mov     eax, DWORD PTR [rax]
        lea     ecx, [rax+1]               ;Flag1
        mov     rdx, QWORD PTR [rbp-8]
        mov     DWORD PTR [rdx], ecx
        mov     DWORD PTR [rbp-12], eax

;int *q = p++ :
        mov     rax, QWORD PTR [rbp-8]     ;Flag2
        lea     rdx, [rax+4]               ;Flag3
        mov     QWORD PTR [rbp-8], rdx
        mov     QWORD PTR [rbp-24], rax

;int c = a++;
        mov     eax, DWORD PTR [rbp-36]
        lea     edx, [rax+1]               ;Flag4
        mov     DWORD PTR [rbp-36], edx
        mov     DWORD PTR [rbp-28], eax

;int d = c++;
        mov     eax, DWORD PTR [rbp-28]
        lea     edx, [rax+1]               ;Flag5
        mov     DWORD PTR [rbp-28], edx
        mov     DWORD PTR [rbp-32], eax

... ... (ignore some)

Please pay attention to the "Flagx" lines which make me confused.
From above , we know that
when pointer: int *q = p++ :

lea     rdx, [rax+4]    ;Flag3

Here, 'lea' seems to read the addr value store in 'rax' and +4. then pass to 'rdx'.

while: int c = a++ or int d = c++ :

lea     edx, [rax+1]    ;Flag4/Flag5

Here, 'lea' seems to read the content of the addr value store in 'rax' (which is 3 here), and +1, come to 4 and pass to 'edx'.

But! the point is that 'rax' in these two statments are the same one. They're all from

mov     rax, QWORD PTR [rbp-8]   ;Flag2

As we can see, they ( Flag3 and Flag4/Flag5 ) look very similar, but they work very differently base on a same 'rax', how come ? Can the 'lea' instruction distinguish between 'rdx' and 'edx / ecx' and turn out different results ?
Thank you very much.

You want to look at [**What's the purpose of the LEA instruction?**](https://stackoverflow.com/questions/1658294/whats-the-purpose-of-the-lea-instruction). — David C. Rankin, Jun 27 '17 at 06:42
thank you , but i think that i may not have described my question clearly. i want to know why after "lea rdx, [rax+4]" , 'rdx' stores 'rax' value(which means an address like: 0xeafffac0 ) +4, and after "lea edx, [rax+1]" , 'edx' stores the content of 'rax' address value (here is : 3 , not the address any more) +1. — ProbHunter, Jun 27 '17 at 07:08
@ProbHunter Feel free to [edit] your question to clarify it. — Stargateur, Jun 27 '17 at 07:11
@Stargateur thank you and i have make some changes to my post, hoping to make my question more clearer this time. This's the 1st time i post a question on stackoverflow and my english's not good enough, thank you for your understanding.. — ProbHunter, Jun 28 '17 at 02:16
If you compile with optimization enabled, there's a lot fewer instructions to look at. All the unnecessary loads/store go away. e.g. `int foo(int a) { return a+1; }` [will compile to `lea eax, [rdi+1]` / `ret`](https://godbolt.org/g/sSVha2). (Or with the Windows ABI where the first integer arg goes in RCX, `lea eax, [rcx+1]`.) — Peter Cordes, Jun 29 '17 at 06:19
Also note that `add` and `lea` can be used with garbage in the high bits, because carry propagates from LSB to MSB. So the value in `eax` after `lea eax, [rdi+1]` only depends on `edi`. (This matters for function args, since the caller is allowed to leave garbage in the high 32 bits. You don't need an address-size prefix (`lea eax, [edi+1]`) or zero-extension (`mov eax,edi` / `inc eax`)). See [this Q&A](https://stackoverflow.com/questions/34377711/which-2s-complement-integer-operations-can-be-used-without-zeroing-high-bits-in) for more details. — Peter Cordes, Jun 29 '17 at 06:23

ikegami · Answer 1 · 2017-06-28T02:50:28.067

Here, 'lea' seems to read the content of the addr value store in 'rax' (which is 3 here), and +1, come to 4 and pass to 'edx'.

No, you are mistaken. lea edx, [rax+1] doesn't change rax. rax is already 3 before the lea instruction is evaluated.

But! the point is that 'rax' in these two statments are the same one. They're all from mov rax, QWORD PTR [rbp-8]

No, you are mistaken. rax is being set by mov eax, DWORD PTR [rbp-36].

Different parts of the general purpose registers can be referenced using different names.

   64                  32        16    8    0
    |                   |         |    |    |
    v                   v         v    v    v
     +----+----+----+----+----+----+----+----+
     |    |    |    |    |    |    |    |    |
     +----+----+----+----+----+----+----+----+

     |<------------------------------------->| rax
                         |<----------------->| eax
                                   |<------->|  ax
                                   |<-->|       ah
                                        |<-->|  al

This means that when you write to eax, you are also writing to the bottom half of rax (and the top half gets zeroed).

So,

                                         ; rax       eax          rdx       edx
; q = p++                                ; +----+----+----+----+  +----+----+----+----+
A1      mov     rax, QWORD PTR [rbp-8]   ; |                 p |  |               ??? |
A2      lea     rdx, [rax+4]             ; |                 p |  |               p+4 |
A3      mov     QWORD PTR [rbp-8], rdx   ; |                 p |  |               p+4 |
A4      mov     QWORD PTR [rbp-24], rax  ; |                 p |  |               p+4 |
; c = a++                                ; |                 p |  |               p+4 |
B1      mov     eax, DWORD PTR [rbp-40]  ; |       0 |       a |  |               p+4 |
B2      lea     edx, [rax+1]             ; |       0 |       a |  |       0 |     a+1 |
B3      mov     DWORD PTR [rbp-40], edx  ; |       0 |       a |  |       0 |     a+1 |
B4      mov     DWORD PTR [rbp-28], eax  ; |       0 |       a |  |       0 |     a+1 |
                                         ; +----+----+----+----+  +----+----+----+----+

You have a bit of an issue. In 64-bit x86 code, when the destination of an instruction is a 32-bit register, the processor automatically zero extended it into the upper 32-bits of the 64-bit register. So `????` in the bottom half of your table is actually a known value of `0`. — Michael Petch, Jun 27 '17 at 16:40
@ikegami thank you for your well text and graphics, this's really helpful. But due to my poor expression in english, i may have not made my question clear, i had changed my post some minutes ago, heading for more wonderful answers. Thank you all! — ProbHunter, Jun 28 '17 at 02:29
@ikegami I have got my answer after your now comment, Thank you very much! that's what i really want to know. As what you said, value of ' rax ' had been changed through ' eax '. :) — ProbHunter, Jun 28 '17 at 03:58

Jabberwocky · Answer 2 · 2017-06-27T07:25:04.780

1

p and q are pointers to int and the size of an int is 4 on your platform. So incrementing p actually increments its value by 4.

int *q = p++;

   mov     rax, QWORD PTR [rbp-8]     ; rax = p
   lea     rdx, [rax+4]               ; same as rdx = rax + 4
   mov     QWORD PTR [rbp-8], rdx     ; p = rdx
   mov     QWORD PTR [rbp-24], rax    ; q = rax

c is an int. So incrementing a actually just increments its value by 1.

c = a++;

   mov     eax, DWORD PTR [rbp-40]    ; rax = a (yes modifying eax actually modifies rax)
   lea     edx, [rax+1]               ; same as edx = rax + 1
   mov     DWORD PTR [rbp-40], edx    ; a = edx
   mov     DWORD PTR [rbp-28], eax    ; c = eax (eax still contains the inital value of a)

More details about the LEA instructions here.

edited Jun 27 '17 at 07:25

answered Jun 27 '17 at 06:53

Jabberwocky

48,281
17
65
115

Re "*same as edx = rax + 1*", Or more relevant, same as edx = eax + 1. – ikegami Jun 27 '17 at 07:31
The OP isn't wondering why sometimes `1`, sometimes `4` is added. – ikegami Jun 28 '17 at 02:58

score -1 · Answer 3 · answered Jun 27 '17 at 06:42

-1

In line int *q = p++ the address pointer is getting incremented. As you know the size of int is 4 bytes and size of int is size of pointer variable, so in assembly code you can see lea rdx, [rax+4].
But in line int c = a++ the value of variable a is getting incremented. So in assembly code you can see lea edx, [rax+1].

Note: Size of int may vary from compiler to compiler. But as per GCC based compilers and in your case int is 4 byte long

answered Jun 27 '17 at 06:42

cse

4,066
2
20
37

1

Re "*size of int is size of pointer variable*", Not in the OP's case. – ikegami Jun 27 '17 at 06:54
@ikegami x86, mean 32 bit no ? Oh never mind fuz add it just now. – Stargateur Jun 27 '17 at 06:55
1

@Stargateur, `p` is read/written as a `QWORD`, which means 64 bits. `rax` is used to store it, which is a 64-bit register. /// Comparitively, `a` is read/written as a `DWORD`, which means 32 bits. `eax` is used to store it, which is a 32-bit register. – ikegami Jun 27 '17 at 07:07
@cse, Re "*How you can say that?*", I've already explained in a follow-up comment. – ikegami Jun 27 '17 at 07:15
1

The OP isn't wondering why sometimes `1`, sometimes `4` is added. – ikegami Jun 28 '17 at 02:59

assembly lea instruction of int *q = p++ and int c = a++

3 Answers3