gcc-9 fails to constrain `i`, then warns that very large `i` would be truncated. Add `cf_assert` and `xrange` to inform gcc that `i` is constrained.