        tmp = XEXP (addr, 1);
        if (!CONST_INT_P (tmp))
  	return 0;
-@@ -9297,9 +9481,10 @@
+@@ -8855,6 +9039,49 @@
+   base_reg = base && GET_CODE (base) == SUBREG ? SUBREG_REG (base) : base;
+   index_reg = index && GET_CODE (index) == SUBREG ? SUBREG_REG (index) : index;
+ 
++  /* Disallow positive constant displacement followed by a register offset for
++   * NaCl64. This may hurt when a symbol is referenced with integer overflow in
++   * mind. NaCl64 will miss overflow because of sandboxing base addition in the
++   * middle.
++   *
++   * Example problem code:
++   * static struct ppp* zzz[16 * 2 + 1];
++   * int main() {
++   *   for (int i = -16; i <= 16; i++)
++   *   zzz[i + 16] = NULL;
++   *   return 0;
++   * }
++   *
++   * Incorrect assembly generated with -O2:
++   *          movl    $-16, %eax
++   *  .L2:
++   *          mov     %eax, %edx
++   *          addl    $1, %eax
++   *          cmpl    $17, %eax
++   *          movl    $0, %nacl:_ZL3zzz+64(%r15,%rdx,4)
++   *          jne     .L2
++   * */
++  if (getenv("NACL_ALLOW_MAGIC_DISP") &&
++      TARGET_64BIT && flag_control_integrity &&
++      !NACL_LEA_MATCH_ADDRESS_OPERAND &&
++      index_reg &&
++      disp && GET_CODE(disp) == CONST)
++    {
++      rtx opcode = XEXP(disp, 0);
++      if (GET_CODE(opcode) == PLUS)
++        {
++          rtx cnst = XEXP(opcode, 1);
++          if (GET_CODE(cnst) != CONST_INT || INTVAL(cnst) > 0)
++            return 0;
++        }
++      else if (GET_CODE(opcode) == MINUS)
++        {
++          rtx cnst = XEXP(opcode, 1);
++          if (GET_CODE(cnst) != CONST_INT || INTVAL(cnst) < 0)
++            return 0;
++        }
++    }
++
+   /* Allow arg pointer and stack pointer as index if there is not scaling.  */
+   if (base_reg && index_reg && scale == 1
+       && (index_reg == arg_pointer_rtx
+@@ -9297,9 +9524,10 @@
  	  goto report_error;
  	}
  

 
 		  if (reg != 0)
 		    {
@@ -9698,9 +9892,9 @@
 		  if (INTVAL (op1) < -16*1024*1024
 		      || INTVAL (op1) >= 16*1024*1024)
 		    {

 
 	  XEXP (x, 1) = temp;
 	  return x;
@@ -10177,7 +10437,21 @@
 	  rtx temp = gen_reg_rtx (Pmode);
 	  rtx val  = force_operand (XEXP (x, 0), temp);
 	  if (val != temp)
