For example, all white pawns' attacks are either generated by shifting 7 or 9 bits to the left (or right, I could be mistaken, but I think it's easy to get the gist).
So the white pawn bitboard that looks like this
00000000000000000000000000000000000000001111111100000000
Would be shifted into this
00000000000000000000000000000001111111100000000000000000
However, if you attempt to portray this example in a 8x8 array, one of the pawns goes through the chessboard's edge.
So when the bits are shifted to generate attacks, how do the engines prevent themselves from generating ones that go through the chessboard's edges?
We'll add some whitespace. Suppose you start with a pawn position:
00000000
00000000
00000000
00000000
00000000
10000000
01100101
00011010
00000000
00000000
The newlines are just there for ease of reading, everything is packed bits. Where can the pawns move?
00000000
00000000
00000000
00000000
10000000
01100101
00011010
00000000
00000000
00000000
here, the only risk of going past an edge is at the top, which is easy to deal with.
Next, where can the pawns take? The naive solution is you take the above "move" mask, and shift it left and right 1. As you noticed, this causes wraparound.
00000000
00000000
00000000
00000001
00000000
11001010
00110100
00000000
00000000
00000000
|
00000000
00000000
00000000
00000000
01000000
00110010
10001101
00000000
00000000
00000000
(apologies if you dislike my choice of endianness).
We can fix this with some masking. The bits that will wrap around are at known locations. So we mask them out before we do the operation.
This mask:
11111110
11111110
11111110
11111110
11111110
11111110
11111110
11111110
before we shift right, and
01111111
01111111
01111111
01111111
01111111
01111111
01111111
01111111
before we shift left.
So to see the spots threatened by pawns, where "forward" is a right shift, we do:
auto pawn_moves = pawn_mask >> 8;
auto pawn_left_take = (pawn_moves & not_left_column) << 1;
auto pawn_right_take = (pawn_moves & not_right_column) << 1;
auto pawn_take = pawn_left_take | pawn_right_take;
and there we have it.
Similar masking can be done for other cases. For example, if we are calculating the knight take mask we need 8 masks and 8 shifts, then or them all together.
For a rook moving right 3, you mask out the right 3 columns, then do a right 3 shift on the rook mask.
At some point, however, you are likely to want to use intrinsics and SIMD processing; so the exact bit operations you have that are fast are going to depend on your handware. Maybe unpacking 8 8 bit values into 8 24 bit values, doing your mask-free operation there, then extracting the middle 8 bits is the fastest way on your particular hardware.
Related
This is the strangest problem I have ever encountered. I am programming a chess engine and I have a function that returns a rank mask. For example, Consider this 64-bit bitboard.
00000000
00000000
00000000
00000000
00000100
00000000
00000000
00000000
The 1 in the middle is a piece.
Now my function should return
00000000
00000000
00000000
00000000
11111111
00000000
00000000
00000000
Very simple, just return a mask of the rank. Here is my code
uint64_t get_rank_mask(int sq)
{
return (0xFF<<(sq-(sq%8)));
}
Here is what the function returns when I pass 36, or the square e5
00000000
00000000
00000000
00000000
00000000
00000000
00000000
11111111
Hmm, strange it is. Let me make a small change in the code.
uint64_t get_rank_mask(int sq)
{
uint64_t mask = 0xFF;
mask<<=(sq-(sq%8));
return mask;
}
Here is the return value now
00000000
00000000
00000000
11111111
00000000
00000000
00000000
00000000
And magically, that is the intended result. I don't even know the difference between the two code samples. Can anyone explain this behaviour?
0xFF is an int. Assuming an int has 32 bits, shifting this value left by 32 will invoke undefined behavior.
In the second version, you are storing 0xFF in an unsigned integral type. This can be shifted any number of bits, and that operation is well defined. In your case, you are storing it in an unsigned int with 64 bits, and so shifting left by 32 gives the result you want.
This question already has answers here:
Bitwise NOT operator returning unexpected and negative value? [duplicate]
(4 answers)
Closed 4 years ago.
I want to see how bitwise NOT works through a simple example:
int x = 4;
int y;
int z;
y = ~(x<<1);
z =~(0x01<<1);
cout<<"y = "<<y<<endl;
cout<<"z = "<<z<<endl;
This results in y = -9 and z = -3. I don't see how this happen. Anyone can educate me a bit?
(x<<1) will shift the bits one, so
00000000 00000000 00000000 00000100
will become:
00000000 00000000 00000000 00001000
Which is the representation of 8. Then ~ will invert all the bits such that it becomes:
11111111 11111111 11111111 11110111
Which is the representation of -9.
0x01 is
00000000 00000000 00000000 00000001
in binary, so when shifted once becomes:
00000000 00000000 00000000 00000010
And then when ~ is applied we get:
11111111 11111111 11111111 11111101
Which is -3 in binary
Well, there is a very long story behind.
To make it easier to understand let's use binary numbers.
x = 4 or x = 0b 0000 0000 0000 0000 0000 0000 0000 0100 because sizeOf(int) = 4
after x<<1 x = 0b 0000 0000 0000 0000 0000 0000 0000 1000 and after
~(x<<1) x = 0b 1111 1111 1111 1111 1111 1111 1111 0111.
and here begin complication. Since int is signed type it's mean that the first bit is a sign and the whole system is Two complemnt.
so x = 0b 1111 1111 1111 1111 1111 1111 1111 0111 is x = -9 and for example
x = 0b 1111 1111 1111 1111 1111 1111 1111 1111 is x = -1
and x = 0b 0000 0000 0000 0000 0000 0000 0000 0010 is 2
Learn more about Two complemnt.
Whether an integer is positive or negative (the sign of the integer) is stored in a dedicated bit, the sign bit. The bitwise NOT affects this bit, too, so any positive number becomes a negative number and vice versa.
Note that "dedicated bit" is a bit of an oversimplification, as most contemporary computers do not use "sign and magnitude" representation (where the sign bit would just switch the sign), but "two's complement" representation, where the sign bit also affects the magnitude.
For example, the 8-bit signed integer 00000000 would be 0, but 10000000 (sign bit flipped) would be -128.
The stack frame pointer (EBP) should always point to where the previous stack frame was right but why is that not the case in my application! That would indicate something is really wrong..hard to believe!
I created multiple simple demo applications where the stack pointer always points to the previous stack frame but I can't make sense of why this is not the case in this application and it is happening when my application is just starting up!
The following is my call stack
0:000> k
# ChildEBP RetAddr
00 0018fee4 6381d1cd acn!CAcnApp::InitInstance+0x41 [c:\acn-project\acn\acn.cpp # 527]
01 0018fef4 00428575 MFC80U!AfxWinMain+0x48 [f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmain.cpp # 37]
02 0018ff88 765d336a acn!__tmainCRTStartup+0x150 [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c # 589]
03 0018ff94 76f59902 kernel32!BaseThreadInitThunk+0xe
04 0018ffd4 76f598d5 ntdll!__RtlUserThreadStart+0x70
05 0018ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000> dc 0018fee4
0018fee4 ffffffff 6381d1cd 00489498 00000001 .......c..H.....
0018fef4 00000000 00428575 00400000 00000000 ....u.B...#.....
0018ff04 01e53fd2 0000000a 87b8aee0 00000000 .?..............
0018ff14 00000000 7efde000 00000044 01e54012 .......~D....#..
0018ff24 01e53ff2 01e53fd4 00000000 00000000 .?...?..........
0018ff34 00000000 00000000 00000000 00000000 ................
0018ff44 00000000 00000000 00000000 00000000 ................
0018ff54 00000000 00000000 0018ff84 00428e5d ............].B.
0:000> dc 0018fef4
0018fef4 00000000 00428575 00400000 00000000 ....u.B...#.....
0018ff04 01e53fd2 0000000a 87b8aee0 00000000 .?..............
0018ff14 00000000 7efde000 00000044 01e54012 .......~D....#..
0018ff24 01e53ff2 01e53fd4 00000000 00000000 .?...?..........
0018ff34 00000000 00000000 00000000 00000000 ................
0018ff44 00000000 00000000 00000000 00000000 ................
0018ff54 00000000 00000000 0018ff84 00428e5d ............].B.
0018ff64 01e53fd2 00000000 00000000 0018ff0c .?..............
0:000> dc 0018ff88
0018ff88 0018ff94 765d336a 7efde000 0018ffd4 ....j3]v...~....
0018ff98 76f59902 7efde000 7d7a657d 00000000 ...v...~}ez}....
0018ffa8 00000000 7efde000 00000000 00000000 .......~........
0018ffb8 00000000 0018ffa0 00000000 ffffffff ................
0018ffc8 76f958c5 0b965c89 00000000 0018ffec .X.v.\..........
0018ffd8 76f598d5 0042873d 7efde000 00000000 ...v=.B....~....
0018ffe8 00000000 00000000 00000000 0042873d ............=.B.
0018fff8 7efde000 00000000 78746341 00000020 ...~....Actx ...
The control is in the first line of InitInstance() so it's like my application is drawing its first breath and the stack seems to be already corrupted? Well the app class constructor comes before this but I checked the call stack is in similar state there as well.
Notice the stack frame pointer (EFP) check for both 1st and 2nd frame fails but the stack is good beyond that.
My first question is that is there any explanation the call stack can be like this and this being Ok? In other words, can we say the call stack is definitely broken? The application does load and calls various dlls if that may play any part (don't know why it would though).
What could be the suspect in this case since the application has only barely started!?
Update (code)
Here is constructor which is very simple. And as for InitInstance(), that function is very long but my breakpoint is on first line so its code is never executed when call stack is like that.
CAcnApp::CAcnApp()
{
m_bServMode = FALSE;
m_bFactory = FALSE;
m_bDownload = FALSE;
m_pEngine = NULL;
m_hWiztomMod = NULL;
m_pServer = new CAcnServer;
}
Second update
I posted a follow up question to share extra information after further investigation and that does qualify as separate question due to differences.
BTW, global or file global objects are created before the main function is called.
If an object's constructor has problems, you could see any number of defects occurring before main is called.
Review your object's constructors. You should be able to set a breakpoint in the object's constructor.
Edit 1: Memory allocation in constructor
Having a global object that has dynamic memory allocation may cause problems. The object requires that the dynamic memory allocation is initialized before the object is constructed. Try commenting out the dynamic memory allocation and see if the issue goes away.
A workaround is to create an "initialize" method that can be called after the main entry point is reached. The initialize method would perform dynamic memory allocation.
I have the following function that takes 3 double arguments. Inside my debugger when a break on this function is reached. Inspecting the arguments to the function I don't see the 3 double arguments.
On an x86 platform are double arguments to a function stored on the stack?
Below is the function and disassembly in windbg. Why don't I see the values passed in to the function as Args to Child in windbg?
vector<double> calculate_quadratic(double a, double b, double c)
{
double discriminant = (b * b) - 4 * a * c;
vector<double>result;
try
{
if (discriminant < 0)
throw Bad_Value{};
else
{
double d = sqrt(discriminant);
double px = (-b + d) / (2 * a);
double nx = (-b - d) / (2 * a);
result.push_back(px);
result.push_back(nx);
}
}
catch (Bad_Value)
{
cerr << "invalid value" << endl;
}
return result;
}
0:000> kb
# ChildEBP RetAddr Args to Child
00 003dfd2c 0126ad86 003dfe30 00000000 3ff00000 quadratic!calculate_quadratic
01 003dfe84 0126ba6e 00000001 0043d080 0043dd18 quadratic!main+0xc6
02 003dfe98 0126b8d0 ac1dec02 00000000 00000000 quadratic!invoke_main+0x1e
03 003dfef0 0126b76d 003dff00 0126ba88 003dff0c quadratic!__scrt_common_main_seh+0x150
04 003dfef8 0126ba88 003dff0c 772c336a 7efde000 quadratic!__scrt_common_main+0xd
05 003dff00 772c336a 7efde000 003dff4c 777f9f72 quadratic!mainCRTStartup+0x8
06 003dff0c 777f9f72 7efde000 77465726 00000000 kernel32!BaseThreadInitThunk+0xe
07 003dff4c 777f9f45 01261127 7efde000 00000000 ntdll!__RtlUserThreadStart+0x70
08 003dff64 00000000 01261127 7efde000 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000> r
eax=003dfe30 ebx=003dfd48 ecx=acd07c23 edx=582e27d8 esi=003dfd50 edi=003dfd4c
eip=01268f70 esp=003dfd30 ebp=003dfe84 iopl=0 nv up ei pl nz ac po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000212
quadratic!calculate_quadratic:
01268f70 push ebp
0:000> dv /t /v
003dfd38 double a = 1
003dfd40 double b = -3
003dfd48 double c = 2
003dfd0c double discriminant = 1.7499487580265442e+127
003dfcf4 struct Vector<double> result = struct Vector<double>
Dumping the ChildEBP of the top frame I can now see the arguments on the stack in reverse order - In this case i used 10 three times which is represented as 4024000000000000
0:000> kb
# ChildEBP RetAddr Args to Child
00 004cfac4 0017ad86 004cfbc8 00000000 40240000 quadratic!calculate_quadratic
0:000> dd 004cfac4
004cfac4 5a23da80 0017ad86 004cfbc8 00000000
004cfad4 40240000 00000000 40240000 00000000
004cfae4 40240000 ed0a64cf 00000000 00000000
0:000> .formats 4024000000000000
Evaluate expression:
Hex: 40240000`00000000
Decimal: 4621819117588971520
Octal: 0400440000000000000000
Binary: 01000000 00100100 00000000 00000000 00000000 00000000 00000000 00000000
Chars: #$......
Time: Fri Dec 18 11:22:38.897 16246 (UTC - 5:00)
Float: low 0 high 2.5625
Double: 10
The default calling convention for C/C++ is cdecl. In this calling convention, when building for x86, arguments are passed on the stack in reverse order. Compiler options or function decorations can override this behaviour, of course.
Looking at your WinDBG output, the first three stack entries (args to child) are :
003dfe30 00000000 3ff00000
Since a double is 64 bits wide you're only looking at one and a half of your arguments. The first entry looks to be the contents of EAX...perhaps a compiler optimization has pushed EAX to the stack at the point your breakpoint hit? The next value is 00000000 3ff00000, which is LE of 3ff0000000000000 = 1(IEEE754), the leftmost argument and the last to be passed to the stack in cdecl.
How arguments are passed is compiler dependent and can often be changed by options or compiler directives.
Most x86 compilers will use either the x87 FPU stack (ST0-ST7 registers) or the SSE registers (XMM0-XMM7) if for passing floating point arguments. On MSVC, this is controlled by the /arch and /fp options.
I have a corruption memory heap problem with an application.
by using windbg and a dump file of the crash as an input I have the following output with dd esp command
0:002> dd esp
00000000`03e3e490 14badf55 00000000 03e3e8c0 00000000
00000000`03e3e4a0 00000000 00000000 03e3e8c0 00000000
00000000`03e3e4b0 03e3e8c0 00000000 6b0064f2 00000000
00000000`03e3e4c0 03e3f030 00000000 6b002510 00000000
00000000`03e3e4d0 00000000 00000000 03dfede8 00000000
00000000`03e3e4e0 c0000005 00000000 00000000 7d6210e8
00000000`03e3e4f0 00000002 00000000 00000000 00000000
00000000`03e3e500 00000000 00001000 78b83980 036b0000
There is this adress : 14badf55
I really don't know how to interpret this "bad"..
Is anyone have an idea of the meaning of this bad ?
EDIT:
when I try to use this command :
u 14badf55
the following output comes :
00000000`14badf55 ?? ???
^ Memory access error in 'u 14badf55'
The .ecxr command give me :
rax=0000000003e3e488 rbx=0000000003e3e8c0 rcx=0000000003e3dfb0
rdx=0000000000000000 rsi=000000006b005a17 rdi=0000000000000000
rip=000000006b006369 rsp=0000000003e3e490 rbp=0000000003dfede8
r8=000000006b00254a r9=0000000003e3e4d8 r10=0000000000000007
r11=0000000000000000 r12=000000006b01fe90 r13=0000000000000000
r14=0000000003e3f110 r15=0000000078b83980
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=0000 es=0000 fs=0000 gs=0000 efl=00000204
wow64!Wow64NotifyDebugger+0x9:
00000000`6b006369 b001 mov al,1
You can see the c0000005 output in the file. This is the sign of a access violation.
Run the following:
- .cxr 00000000`03e3e4e0 (To set the exception context)
- kL (to get a stack trace)