dotscope 0.6.0

//! SSA to CIL code generation.
//!
//! This module provides the ability to convert SSA form back to CIL bytecode,
//! completing the roundtrip: CIL → SSA → (transformations) → CIL.
//!
//! # Architecture
//!
//! The code generator works in several phases:
//!
//! 1. **Register Allocation**: Maps SSA variables to CIL locals
//! 2. **Phi Elimination**: Converts phi nodes to moves at predecessor block ends
//! 3. **Block Ordering**: Orders blocks for efficient code layout
//! 4. **Instruction Selection**: Converts SSA ops to CIL instructions
//! 5. **Branch Resolution**: Resolves block indices to bytecode offsets
//!
//! # Module Organization
//!
//! - [`emitter`]: Low-level CIL instruction emission helpers
//!
//! # Optimizations
//!
//! The code generator performs several optimizations:
//!
//! - **Stack-based value forwarding**: Values that are immediately consumed by
//!   the next instruction are left on the stack instead of storing to locals.
//! - **Fallthrough optimization**: Jumps to the immediately following block are
//!   eliminated since execution falls through naturally.
//!
//! # Example
//!
//! ```rust,ignore
//! use dotscope::compiler::SsaCodeGenerator;
//!
//! let generator = SsaCodeGenerator::new();
//! let (bytecode, max_stack, locals) = generator.generate(&ssa_function)?;
//! ```

mod coalescing;
mod emitter;

#[cfg(test)]
mod tests;

use std::collections::{HashMap, HashSet};

use coalescing::LocalCoalescer;

use crate::{
    analysis::{
        CmpKind, ConstValue, SsaBlock, SsaFunction, SsaInstruction, SsaOp, SsaType, SsaVarId,
        SsaVariable, VariableOrigin,
    },
    assembly::{Immediate, InstructionEncoder, Operand},
    cilassembly::CilAssembly,
    metadata::{
        method::{ExceptionHandler, ExceptionHandlerFlags},
        signatures::{CustomModifiers, SignatureLocalVariable},
        token::Token,
    },
    Error, Result,
};

/// Output of [`SsaCodeGenerator::compile`] — everything needed to assemble a method body.
///
/// Contains the CIL bytecode, stack depth, local variable signatures, and remapped
/// exception handlers. This is the bridge between code generation and
/// [`crate::cilassembly::builders::MethodBodyBuilder::from_compilation`].
pub struct CompilationResult {
    /// CIL bytecode.
    pub bytecode: Vec<u8>,
    /// Maximum evaluation stack depth.
    pub max_stack: u16,
    /// Local variable signatures (already built with correct types).
    pub locals: Vec<SignatureLocalVariable>,
    /// Exception handlers with bytecode offsets (already remapped from SSA block IDs).
    pub exception_handlers: Vec<ExceptionHandler>,
}

/// Describes how an SSA variable maps to CIL storage.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
enum VarStorage {
    /// Variable is stored in an argument slot
    Arg(u16),
    /// Variable is stored in a local slot
    Local(u16),
    /// Variable is currently on the evaluation stack (not yet stored)
    Stack,
}

/// Pool of reusable temporary local slots.
///
/// Temporaries (e.g., for phi copies) are allocated from this pool and can be
/// released back for reuse by other temporaries of the same type.
/// Uses LIFO (stack) order for better cache locality.
#[derive(Debug, Default)]
struct TempPool {
    /// Free slots indexed by type
    free_by_type: HashMap<SsaType, Vec<u16>>,
}

impl TempPool {
    /// Try to allocate a slot from the pool for the given type.
    /// Returns `Some(slot)` if a free slot is available, `None` otherwise.
    fn try_allocate(&mut self, ty: &SsaType) -> Option<u16> {
        self.free_by_type.get_mut(ty).and_then(Vec::pop)
    }

    /// Release a slot back to the pool for the given type.
    /// Uses LIFO (push) for better cache locality when reallocated.
    fn release(&mut self, slot: u16, ty: SsaType) {
        self.free_by_type.entry(ty).or_default().push(slot);
    }

    /// Clear all pooled slots.
    fn clear(&mut self) {
        self.free_by_type.clear();
    }
}

/// SSA to CIL code generator.
///
/// Converts SSA form back to executable CIL bytecode with optimizations.
pub struct SsaCodeGenerator {
    /// Map from SSA variables to their storage location
    var_storage: HashMap<SsaVarId, VarStorage>,
    /// Next available local index
    next_local: u16,
    /// Map from block index to label name
    block_labels: HashMap<usize, String>,
    /// Variables that are currently on the stack (for optimization)
    stack_vars: Vec<SsaVarId>,
    /// Cache of interned decrypted strings (string content -> heap index)
    interned_strings: HashMap<String, u32>,
    /// Deferred constants: single-use constants that should be generated inline
    /// Maps variable ID to the constant value and whether it's been consumed
    deferred_constants: HashMap<SsaVarId, ConstValue>,
    /// Last loaded storage location for dup optimization.
    /// When we load the same location twice in a row, we can use `dup` instead.
    last_load: Option<VarStorage>,
    /// Global use counts for all variables across all blocks.
    /// Used to determine if a value needs to be stored to a local.
    global_use_counts: HashMap<SsaVarId, usize>,
    /// Types of allocated locals (local_idx -> SsaType).
    /// Used for generating correct local variable signatures.
    local_types: HashMap<u16, SsaType>,
    /// Map from original local index to compacted local index.
    /// Used for building local signatures with correct types.
    original_to_compacted: HashMap<u16, u16>,
    /// Map from block ID to its byte offset in the generated bytecode.
    /// Used for remapping exception handler offsets.
    block_offsets: HashMap<usize, u32>,
    /// Stack-local variables: variables that can live entirely on the evaluation
    /// stack without needing a local slot. These are single-use values defined
    /// and consumed within the same basic block before any control flow.
    stack_locals: HashSet<SsaVarId>,
    /// Pool of reusable temporary local slots for phi copies and other temps.
    temp_pool: TempPool,
    /// Locals that are actually used during code generation.
    /// Used to determine the true num_locals (eliminating unused locals).
    used_locals: HashSet<u16>,
}

/// Immutable context for block-level code generation.
///
/// Bundles references to block-specific data structures that are passed
/// unchanged through recursive code generation calls.
struct BlockCodegenContext<'a> {
    /// The SSA function being generated
    ssa: &'a SsaFunction,
    /// Operations in topological order for this block
    ops: &'a [&'a SsaOp],
    /// Pre-computed operands for each operation
    operands_cache: &'a [Vec<SsaVarId>],
    /// Maps variable IDs to their defining operation index
    def_map: &'a HashMap<SsaVarId, usize>,
    /// Current block index being generated
    current_block_idx: usize,
}

/// Work item for iterative code generation.
///
/// We use a multi-phase approach to ensure correct operand ordering:
/// - `Pending`: First visit - check if already generated
/// - `LoadOperand`: Load/generate a specific operand for an instruction
/// - `Emit`: All operands loaded, emit the operation
enum CodeGenWorkItem {
    /// First visit: check if already generated, then schedule operand loads
    Pending(usize),
    /// Load or generate a specific operand for instruction at idx
    /// (op_idx, operand_idx) - which operand of which instruction
    LoadOperand(usize, usize),
    /// All operands are on stack, emit the operation
    Emit(usize),
}

impl Default for SsaCodeGenerator {
    fn default() -> Self {
        Self::new()
    }
}

impl SsaCodeGenerator {
    /// Creates a new code generator.
    #[must_use]
    pub fn new() -> Self {
        Self {
            var_storage: HashMap::new(),
            next_local: 0,
            block_labels: HashMap::new(),
            stack_vars: Vec::new(),
            interned_strings: HashMap::new(),
            deferred_constants: HashMap::new(),
            last_load: None,
            global_use_counts: HashMap::new(),
            local_types: HashMap::new(),
            original_to_compacted: HashMap::new(),
            block_offsets: HashMap::new(),
            stack_locals: HashSet::new(),
            temp_pool: TempPool::default(),
            used_locals: HashSet::new(),
        }
    }

    /// Generates CIL bytecode from an SSA function.
    ///
    /// # Arguments
    ///
    /// * `ssa` - The SSA function to convert.
    ///
    /// # Returns
    ///
    /// A tuple of (bytecode, max_stack, num_locals).
    ///
    /// # Errors
    ///
    /// Returns an error if code generation fails due to invalid SSA or encoding issues.
    ///
    /// # Note
    ///
    /// This method does not support `DecryptedString` constants. If the SSA contains
    /// decrypted strings, use [`generate_with_assembly`](Self::generate_with_assembly) instead
    /// to properly intern strings into the assembly's #US heap.
    pub fn generate(&mut self, ssa: &SsaFunction) -> Result<(Vec<u8>, u16, u16)> {
        self.generate_internal(ssa, None)
    }

    /// Generates CIL bytecode from an SSA function with assembly mutation support.
    ///
    /// This method should be used when the SSA may contain `DecryptedString` constants
    /// from deobfuscation passes. The mutator is used to add decrypted strings to the
    /// assembly's #US heap and obtain proper indices for `ldstr` instructions.
    ///
    /// # Arguments
    ///
    /// * `ssa` - The SSA function to convert.
    /// * `mutator` - An assembly mutator for adding metadata entries (strings, etc.).
    ///
    /// # Returns
    ///
    /// A tuple of (bytecode, max_stack, num_locals).
    ///
    /// # Errors
    ///
    /// Returns an error if code generation fails due to invalid SSA, encoding issues,
    /// or problems adding strings to the heap.
    pub fn generate_with_assembly(
        &mut self,
        ssa: &SsaFunction,
        assembly: &mut CilAssembly,
    ) -> Result<(Vec<u8>, u16, u16)> {
        self.generate_internal(ssa, Some(assembly))
    }

    /// Generates CIL bytecode and builds a complete [`CompilationResult`].
    ///
    /// This is the high-level entry point that wraps [`generate_with_assembly`](Self::generate_with_assembly)
    /// and adds local variable signature building and exception handler remapping.
    /// The result contains everything needed for [`crate::cilassembly::builders::MethodBodyBuilder::from_compilation`]
    /// to assemble the final method body.
    ///
    /// # Arguments
    ///
    /// * `ssa` - The SSA function to convert.
    /// * `assembly` - An assembly mutator for adding metadata entries (strings, etc.).
    ///
    /// # Returns
    ///
    /// A [`CompilationResult`] with bytecode, max stack, local signatures, and exception handlers.
    ///
    /// # Errors
    ///
    /// Returns an error if code generation fails.
    pub fn compile(
        &mut self,
        ssa: &SsaFunction,
        assembly: &mut CilAssembly,
    ) -> Result<CompilationResult> {
        let (bytecode, max_stack, num_locals) = self.generate_with_assembly(ssa, assembly)?;

        // Build local variable signatures from codegen's compacted types
        let locals = self.build_local_signatures(ssa, num_locals)?;

        // Remap exception handlers using block offset mapping
        #[allow(clippy::cast_possible_truncation)]
        let exception_handlers = self.remap_exception_handlers(ssa, bytecode.len() as u32);

        Ok(CompilationResult {
            bytecode,
            max_stack,
            locals,
            exception_handlers,
        })
    }

    /// Builds local variable signatures from codegen state and original SSA types.
    ///
    /// # Errors
    ///
    /// Returns an error if a local variable's type cannot be determined from
    /// either the codegen state or the original SSA function.
    fn build_local_signatures(
        &self,
        ssa: &SsaFunction,
        num_locals: u16,
    ) -> Result<Vec<SignatureLocalVariable>> {
        let mut locals = Vec::with_capacity(num_locals as usize);
        for idx in 0..num_locals {
            let local_type = if let Some(ssa_type) = self.local_types.get(&idx) {
                ssa_type.to_type_signature()
            } else {
                self.original_to_compacted
                    .iter()
                    .find(|(_, &new)| new == idx)
                    .and_then(|(&orig, _)| {
                        ssa.original_local_types()
                            .and_then(|types| types.get(orig as usize))
                            .map(|v| v.base.clone())
                    })
                    .ok_or_else(|| {
                        Error::CodegenFailed(format!(
                            "cannot determine type for local variable {idx}: \
                             not in codegen local_types and no original type mapping found"
                        ))
                    })?
            };
            locals.push(SignatureLocalVariable {
                modifiers: CustomModifiers::default(),
                is_pinned: false,
                is_byref: false,
                base: local_type,
            });
        }
        Ok(locals)
    }

    /// Remaps SSA exception handlers to bytecode offsets using block offset mapping.
    fn remap_exception_handlers(
        &self,
        ssa: &SsaFunction,
        bytecode_len: u32,
    ) -> Vec<ExceptionHandler> {
        if !ssa.has_exception_handlers() {
            return Vec::new();
        }

        ssa.exception_handlers()
            .iter()
            .filter_map(|eh| {
                let try_offset = eh
                    .try_start_block
                    .and_then(|b| self.block_offsets.get(&b).copied())
                    .unwrap_or(eh.try_offset);

                let handler_offset = eh
                    .handler_start_block
                    .and_then(|b| self.block_offsets.get(&b).copied())
                    .unwrap_or(eh.handler_offset);

                let try_end = eh
                    .try_end_block
                    .and_then(|b| self.block_offsets.get(&b).copied())
                    .unwrap_or(handler_offset);

                let handler_end = eh
                    .handler_end_block
                    .and_then(|b| self.block_offsets.get(&b).copied())
                    .unwrap_or(bytecode_len);

                let filter_offset = if eh.flags == ExceptionHandlerFlags::FILTER {
                    eh.filter_start_block
                        .and_then(|b| self.block_offsets.get(&b).copied())
                        .unwrap_or(eh.class_token_or_filter)
                } else {
                    eh.class_token_or_filter
                };

                // Validate offsets are within bytecode bounds
                if try_offset >= bytecode_len
                    || handler_offset >= bytecode_len
                    || try_end > bytecode_len
                    || handler_end > bytecode_len
                {
                    return None;
                }

                Some(ExceptionHandler {
                    flags: eh.flags,
                    try_offset,
                    try_length: try_end.saturating_sub(try_offset),
                    handler_offset,
                    handler_length: handler_end.saturating_sub(handler_offset),
                    handler: None,
                    filter_offset,
                })
            })
            .collect()
    }

    /// Returns the types of any temporary locals allocated during code generation.
    ///
    /// These are locals that were created for PHI copy cycles or other codegen needs,
    /// beyond the original locals from the SSA function. The returned map contains
    /// (local_index -> type) pairs for these temporaries.
    ///
    /// This should be called after `generate_with_assembly` to get the types needed
    /// for generating a correct local variable signature.
    #[must_use]
    pub fn local_types(&self) -> &HashMap<u16, SsaType> {
        &self.local_types
    }

    /// Returns the mapping from original local indices to compacted indices.
    ///
    /// This should be called after `generate_with_assembly` to get the mapping needed
    /// for building local signatures with correct types from original SSA.
    #[must_use]
    pub fn original_local_mapping(&self) -> &HashMap<u16, u16> {
        &self.original_to_compacted
    }

    /// Returns the mapping from block IDs to their byte offsets in the generated code.
    ///
    /// This is used for remapping exception handler offsets. After code generation,
    /// the map contains each block's start offset in the new bytecode layout.
    ///
    /// This should be called after `generate_with_assembly` to get the offsets for
    /// exception handler remapping.
    #[must_use]
    pub fn block_offsets(&self) -> &HashMap<usize, u32> {
        &self.block_offsets
    }

    /// Internal generation method that optionally uses an assembly for string interning.
    fn generate_internal(
        &mut self,
        ssa: &SsaFunction,
        assembly: Option<&mut CilAssembly>,
    ) -> Result<(Vec<u8>, u16, u16)> {
        // Reset state
        self.var_storage.clear();
        self.next_local = 0;
        self.block_labels.clear();
        self.stack_vars.clear();
        self.interned_strings.clear();
        self.deferred_constants.clear();
        self.last_load = None;
        self.local_types.clear();
        self.original_to_compacted.clear();
        self.block_offsets.clear();
        self.stack_locals.clear();
        self.temp_pool.clear();
        self.used_locals.clear();

        // Phase 0: Pre-intern all decrypted strings (if assembly provided)
        if let Some(assembly) = assembly {
            self.preintern_decrypted_strings(ssa, assembly)?;
        }

        // Phase 1: Allocate storage for all SSA variables based on their origins
        self.allocate_storage(ssa)?;

        // Phase 2: Create block labels using actual block IDs (not sequential indices)
        for block in ssa.blocks() {
            let block_id = block.id();
            self.block_labels
                .insert(block_id, format!("block_{block_id}"));
        }
        // Also collect all branch targets and create labels for them
        self.collect_branch_targets(ssa);

        // Phase 3: Generate code
        let mut encoder = InstructionEncoder::new();

        // Set expected stack depth for exception handler entry blocks.
        // Catch and filter handlers start with the exception object already on the stack.
        for handler in ssa.exception_handlers() {
            // Catch handler entry: exception object is on the stack (depth 1)
            if let Some(handler_block) = handler.handler_start_block {
                if handler.flags == ExceptionHandlerFlags::EXCEPTION
                    || handler.flags == ExceptionHandlerFlags::FILTER
                {
                    if let Some(label) = self.block_labels.get(&handler_block) {
                        encoder.set_label_stack_depth(label, 1);
                    }
                }
            }
            // Filter block entry: exception object is on the stack (depth 1)
            if let Some(filter_block) = handler.filter_start_block {
                if handler.flags == ExceptionHandlerFlags::FILTER {
                    if let Some(label) = self.block_labels.get(&filter_block) {
                        encoder.set_label_stack_depth(label, 1);
                    }
                }
            }
        }

        // Collect branch targets - blocks that are referenced by some branch instruction
        let branch_targets: HashSet<usize> = self.block_labels.keys().copied().collect();

        // Include blocks that have ops OR are branch targets (even if they only have
        // undecomposed instructions). Blocks that are branch targets must be included
        // so their labels can be defined.
        let blocks_to_include: HashSet<usize> = ssa
            .blocks()
            .iter()
            .filter(|b| !b.instructions().is_empty() || branch_targets.contains(&b.id()))
            .map(SsaBlock::id)
            .collect();

        // Compute optimal block layout to minimize unnecessary branches.
        // This reorders blocks so that fall-through paths don't need explicit jumps.
        let block_ids = Self::compute_block_layout(ssa, &blocks_to_include);
        let blocks_to_generate: Vec<_> = block_ids.iter().filter_map(|&id| ssa.block(id)).collect();

        for (idx, block) in blocks_to_generate.iter().enumerate() {
            // Record block start offset for exception handler remapping
            let pos_before = encoder.current_position();
            self.block_offsets.insert(block.id(), pos_before);

            let next_block_idx = block_ids.get(idx + 1).copied();
            self.generate_block(&mut encoder, ssa, block, block.id(), next_block_idx)?;
        }

        // Phase 4: Finalize and resolve labels
        let (bytecode, max_stack, final_label_positions) = encoder.finalize()?;

        // Phase 5: Update block_offsets with final positions (after branch optimization)
        // The branch optimizer in finalize() may shrink branches, changing positions.
        // We need to use the final label positions to get accurate block offsets.
        for (label, position) in &final_label_positions {
            if let Some(block_id_str) = label.strip_prefix("block_") {
                if let Ok(block_id) = block_id_str.parse::<usize>() {
                    self.block_offsets.insert(block_id, *position);
                }
            }
        }

        // Calculate actual num_locals based on locals that were actually used.
        // This eliminates unused locals that were pre-allocated but never accessed.
        let num_locals = if self.used_locals.is_empty() {
            0
        } else {
            // We need max_index + 1 because local indices are 0-based
            self.used_locals.iter().max().copied().unwrap_or(0) + 1
        };

        Ok((bytecode, max_stack, num_locals))
    }

    /// Pre-interns all decrypted strings in the SSA to the #US heap.
    ///
    /// This scans the SSA for `ConstValue::DecryptedString` constants and adds them
    /// to the assembly's user string heap, caching the resulting indices for use
    /// during code generation.
    fn preintern_decrypted_strings(
        &mut self,
        ssa: &SsaFunction,
        assembly: &mut CilAssembly,
    ) -> Result<()> {
        for block in ssa.blocks() {
            for instr in block.instructions() {
                if let SsaOp::Const {
                    value: ConstValue::DecryptedString(s),
                    ..
                } = instr.op()
                {
                    // Only intern if not already cached
                    if !self.interned_strings.contains_key(s) {
                        let change_ref = assembly.userstring_add(s)?;
                        self.interned_strings
                            .insert(s.clone(), change_ref.placeholder());
                    }
                }
            }
        }
        Ok(())
    }

    /// Collects all branch targets and ensures they have labels.
    fn collect_branch_targets(&mut self, ssa: &SsaFunction) {
        for block in ssa.blocks() {
            for instr in block.instructions() {
                match instr.op() {
                    SsaOp::Jump { target } => {
                        self.block_labels
                            .entry(*target)
                            .or_insert_with(|| format!("block_{target}"));
                    }
                    SsaOp::Branch {
                        true_target,
                        false_target,
                        ..
                    }
                    | SsaOp::BranchCmp {
                        true_target,
                        false_target,
                        ..
                    } => {
                        self.block_labels
                            .entry(*true_target)
                            .or_insert_with(|| format!("block_{true_target}"));
                        self.block_labels
                            .entry(*false_target)
                            .or_insert_with(|| format!("block_{false_target}"));
                    }
                    SsaOp::Switch {
                        targets, default, ..
                    } => {
                        for target in targets {
                            self.block_labels
                                .entry(*target)
                                .or_insert_with(|| format!("block_{target}"));
                        }
                        self.block_labels
                            .entry(*default)
                            .or_insert_with(|| format!("block_{default}"));
                    }
                    SsaOp::Leave { target } => {
                        self.block_labels
                            .entry(*target)
                            .or_insert_with(|| format!("block_{target}"));
                    }
                    _ => {}
                }
            }
        }
    }

    /// Computes optimal block layout to minimize unnecessary branches.
    ///
    /// This reorders blocks so that fall-through paths (where one block jumps
    /// unconditionally to another) don't require explicit branch instructions.
    /// Uses a greedy approach that follows the most common execution path.
    ///
    /// # Algorithm
    ///
    /// 1. Start at block 0 (entry point)
    /// 2. Follow each block's preferred successor (for Jump: the target;
    ///    for Branch/Switch: the first target; for others: none)
    /// 3. When a block has no unvisited successor, pick the next unvisited block
    /// 4. Continue until all blocks are placed
    fn compute_block_layout(ssa: &SsaFunction, blocks_to_include: &HashSet<usize>) -> Vec<usize> {
        // Get the preferred successor for a block (the one we'd like to fall through to)
        fn preferred_successor(
            ssa: &SsaFunction,
            block_id: usize,
            leave_targets: &HashSet<usize>,
        ) -> Option<usize> {
            let block = ssa.block(block_id)?;
            // Look at the terminator instruction
            for instr in block.instructions().iter().rev() {
                match instr.op() {
                    // For Leave/Return/Throw/Rethrow/EndFinally/EndFilter, no successors
                    SsaOp::Leave { .. }
                    | SsaOp::Return { .. }
                    | SsaOp::Throw { .. }
                    | SsaOp::Rethrow
                    | SsaOp::EndFinally
                    | SsaOp::EndFilter { .. } => {
                        return None;
                    }
                    // For unconditional jump, the target is the preferred successor
                    // unless it's a leave target (merge point)
                    SsaOp::Jump { target } => {
                        if !leave_targets.contains(target) {
                            return Some(*target);
                        }
                        return None;
                    }
                    // For branches, prefer the false branch (often the fall-through case)
                    SsaOp::Branch { false_target, .. } | SsaOp::BranchCmp { false_target, .. } => {
                        return Some(*false_target);
                    }
                    // For switch, prefer the default case
                    SsaOp::Switch { default, .. } => {
                        return Some(*default);
                    }
                    _ => {}
                }
            }
            None
        }

        if blocks_to_include.is_empty() {
            return Vec::new();
        }

        // Collect exception handler blocks - these need special placement
        let handler_blocks: HashSet<usize> = ssa
            .exception_handlers()
            .iter()
            .filter_map(|h| h.handler_start_block)
            .collect();

        // Collect Leave targets - these are merge points that should come after handlers
        let leave_targets: HashSet<usize> = ssa
            .blocks()
            .iter()
            .filter_map(|b| {
                if let Some(SsaOp::Leave { target }) = b.terminator_op() {
                    Some(*target)
                } else {
                    None
                }
            })
            .collect();

        let mut layout = Vec::with_capacity(blocks_to_include.len());
        let mut visited = HashSet::with_capacity(blocks_to_include.len());

        // Start with block 0 if it's in the set, otherwise pick the first available
        let start = if blocks_to_include.contains(&0) {
            0
        } else {
            *blocks_to_include.iter().min().unwrap_or(&0)
        };

        // Use a worklist to process blocks
        let mut worklist = vec![start];

        while layout.len() < blocks_to_include.len() {
            // Process the worklist
            while let Some(block_id) = worklist.pop() {
                if !blocks_to_include.contains(&block_id) || visited.contains(&block_id) {
                    continue;
                }

                visited.insert(block_id);
                layout.push(block_id);

                // Try to follow the preferred successor
                if let Some(succ) = preferred_successor(ssa, block_id, &leave_targets) {
                    if blocks_to_include.contains(&succ) && !visited.contains(&succ) {
                        worklist.push(succ);
                    }
                }
            }

            // If worklist is empty but we haven't visited all blocks,
            // prioritize handler blocks, then leave targets, then others
            if layout.len() < blocks_to_include.len() {
                // First, try to add unvisited handler blocks
                if let Some(&block_id) = blocks_to_include
                    .iter()
                    .filter(|&&b| !visited.contains(&b) && handler_blocks.contains(&b))
                    .min()
                {
                    worklist.push(block_id);
                    continue;
                }

                // Then, add leave targets (merge points)
                if let Some(&block_id) = blocks_to_include
                    .iter()
                    .filter(|&&b| !visited.contains(&b) && leave_targets.contains(&b))
                    .min()
                {
                    worklist.push(block_id);
                    continue;
                }

                // Finally, add any remaining blocks
                if let Some(&block_id) = blocks_to_include
                    .iter()
                    .filter(|&&b| !visited.contains(&b))
                    .min()
                {
                    worklist.push(block_id);
                }
            }
        }

        layout
    }

    /// Allocates storage for all SSA variables using graph coloring.
    ///
    /// Arguments get mapped to their original argument slots (ldarg/starg).
    /// Stack temporaries and phi results are coalesced using an interference
    /// graph to minimize the number of local slots needed.
    ///
    /// Single-use constants are deferred and will be generated inline at their
    /// use site instead of being stored to a local.
    fn allocate_storage(&mut self, ssa: &SsaFunction) -> Result<()> {
        // First, compute global use counts and identify single-use constants.
        // This avoids storing constants to locals only to load them back.
        self.global_use_counts = Self::compute_variable_use_counts(ssa);
        self.identify_deferred_constants(ssa, &self.global_use_counts.clone());

        // Identify stack locals - variables that can live entirely on the eval stack.
        // These are single-use values defined and consumed in the same block before
        // any control flow, so they never need a local slot.
        self.stack_locals = self.identify_stack_locals(ssa);

        // Use register allocation for efficient local usage
        // Automatically selects graph coloring (≤500 vars) or linear scan (>500 vars)
        let coalescer = LocalCoalescer::build(ssa);
        let allocation = coalescer.allocate(ssa);

        // Map arguments to their original slots
        for var in ssa.variables() {
            if let VariableOrigin::Argument(idx) = var.origin() {
                self.var_storage.insert(var.id(), VarStorage::Arg(idx));
            }
        }

        // Apply the coalesced allocation ONLY for Local-origin variables
        // Stack/Phi variables will be allocated lazily during emit when actually needed.
        // This ensures we don't allocate locals for dead phi results.
        for (var_id, local_slot) in &allocation.var_to_local {
            // Only apply allocation for Local-origin variables
            if let Some(ssa_var) = ssa.variable(*var_id) {
                if matches!(ssa_var.origin(), VariableOrigin::Local(_))
                    && !self.var_storage.contains_key(var_id)
                    && !self.deferred_constants.contains_key(var_id)
                {
                    self.var_storage
                        .insert(*var_id, VarStorage::Local(*local_slot));
                }
            }
        }

        // Set next_local to count of compacted Local-origin variables
        #[allow(clippy::cast_possible_truncation)]
        {
            self.next_local = allocation.original_to_compacted.len() as u16;
        }
        self.original_to_compacted
            .clone_from(&allocation.original_to_compacted);

        // Phase 2: Pre-allocate ALL phi results to locals.
        // This ensures consistent stack behavior - phi results are always in locals,
        // never on the stack. This simplifies phi copy emission since we don't need
        // to handle the case where a phi result might be on the stack.
        //
        // We filter out dead phi results (use_count == 0) to avoid wasting slots.
        for block in ssa.blocks() {
            for phi in block.phi_nodes() {
                let phi_result = phi.result();

                // Skip if already allocated (shouldn't happen, but be safe)
                if self.var_storage.contains_key(&phi_result) {
                    continue;
                }

                // Skip dead phi results (not used by any instructions)
                let use_count = self
                    .global_use_counts
                    .get(&phi_result)
                    .copied()
                    .unwrap_or(0);
                if use_count == 0 {
                    continue;
                }

                // Allocate a local for this phi result
                let local_idx = self.next_local;
                self.next_local += 1;
                self.var_storage
                    .insert(phi_result, VarStorage::Local(local_idx));

                // Record the type for the local variable signature.
                // Try phi result type first, then infer from operands.
                let phi_type = ssa
                    .variable(phi_result)
                    .map(SsaVariable::var_type)
                    .filter(|t| !t.is_unknown())
                    .cloned();

                let final_type = phi_type.or_else(|| {
                    let mut visited = HashSet::new();
                    visited.insert(phi_result); // prevent self-referential phi loops
                    for operand in phi.operands() {
                        if let Ok(ty) =
                            Self::infer_variable_type_inner(ssa, operand.value(), &mut visited)
                        {
                            return Some(ty);
                        }
                    }
                    None
                });

                let final_type = final_type.ok_or_else(|| {
                    Error::CodegenFailed(format!(
                        "cannot determine type for phi result {phi_result:?} \
                         (local {local_idx}): phi and all operands have unknown types"
                    ))
                })?;
                self.local_types.insert(local_idx, final_type);
            }
        }

        // Phase 3: Pre-allocate Stack-origin variables that are actually used.
        // These are typically orphan variables created during rebuild_ssa for
        // variables that were referenced in instructions but didn't have proper
        // Argument/Local origins. They need local slots during code generation.
        //
        // We also need to allocate storage for phi operands that belong to non-dead
        // phi nodes. Phi operand uses are NOT counted in global_use_counts, so a
        // variable used only as a phi operand would have use_count=0 but still needs
        // storage to be loaded during phi copy emission.

        // First, collect all phi operands that need storage (belong to non-dead phi nodes)
        let mut phi_operands_needing_storage: HashSet<SsaVarId> = HashSet::new();
        for block in ssa.blocks() {
            for phi in block.phi_nodes() {
                let phi_result = phi.result();
                let use_count = self
                    .global_use_counts
                    .get(&phi_result)
                    .copied()
                    .unwrap_or(0);
                // Skip dead phi nodes
                if use_count == 0 {
                    continue;
                }
                // This phi node is live - its operands need storage
                for operand in phi.operands() {
                    phi_operands_needing_storage.insert(operand.value());
                }
            }
        }

        for var in ssa.variables() {
            let var_id = var.id();

            // Skip if already allocated
            if self.var_storage.contains_key(&var_id) {
                continue;
            }

            // Only handle Stack-origin variables
            if !matches!(var.origin(), VariableOrigin::Stack(_)) {
                continue;
            }

            // Skip if it's a deferred constant
            if self.deferred_constants.contains_key(&var_id) {
                continue;
            }

            // Skip if it's a stack local (can live on eval stack)
            if self.stack_locals.contains(&var_id) {
                continue;
            }

            // Skip dead variables that are not phi operands
            let use_count = self.global_use_counts.get(&var_id).copied().unwrap_or(0);
            let is_phi_operand = phi_operands_needing_storage.contains(&var_id);
            if use_count == 0 && !is_phi_operand {
                continue;
            }

            // Allocate a local for this Stack-origin variable
            let local_idx = self.next_local;
            self.next_local += 1;
            self.var_storage
                .insert(var_id, VarStorage::Local(local_idx));

            // Record the type — try declared type first, then infer from definition
            let var_type = var.var_type();
            if var_type.is_unknown() {
                let inferred = Self::infer_variable_type(ssa, var_id)?;
                self.local_types.insert(local_idx, inferred);
            } else {
                self.local_types.insert(local_idx, var_type.clone());
            }
        }

        Ok(())
    }

    /// Computes use counts for all variables in the SSA function.
    ///
    /// This ONLY counts uses in instructions, not phi operands.
    /// Phi operand liveness is determined separately when emitting phi copies,
    /// based on whether the phi result itself is used.
    fn compute_variable_use_counts(ssa: &SsaFunction) -> HashMap<SsaVarId, usize> {
        let mut use_counts: HashMap<SsaVarId, usize> = HashMap::new();

        for block in ssa.blocks() {
            // NOTE: We intentionally DON'T count uses in phi operands here.
            // Phi operands are only "live" if the phi result is used.
            // This prevents allocating locals for dead phi chains.

            // Count uses in instructions only
            for instr in block.instructions() {
                for var in instr.op().uses() {
                    *use_counts.entry(var).or_insert(0) += 1;
                }
            }
        }

        use_counts
    }

    /// Identifies constants that are only used once and can be generated inline.
    fn identify_deferred_constants(
        &mut self,
        ssa: &SsaFunction,
        use_counts: &HashMap<SsaVarId, usize>,
    ) {
        for block in ssa.blocks() {
            for instr in block.instructions() {
                if let SsaOp::Const { dest, value } = instr.op() {
                    // Only defer if used exactly once and not used in phi nodes
                    // (phi operands need to be available at block boundaries)
                    let uses = use_counts.get(dest).copied().unwrap_or(0);
                    if uses == 1 && !Self::is_phi_operand(ssa, *dest) {
                        self.deferred_constants.insert(*dest, value.clone());
                    }
                }
            }
        }
    }

    /// Identifies variables that can live entirely on the evaluation stack.
    ///
    /// Stack locals are variables that meet ALL of these criteria:
    /// 1. Single definition
    /// 2. All uses in same block as definition
    /// 3. Not used as a phi operand (phi copies happen at block boundaries)
    /// 4. Uses are in straight-line code before any control flow
    /// 5. Value is consumed before any terminator
    ///
    /// These variables never need a local slot - they can stay on the eval stack.
    fn identify_stack_locals(&self, ssa: &SsaFunction) -> HashSet<SsaVarId> {
        let mut candidates = HashSet::new();

        for block in ssa.blocks() {
            let block_id = block.id();

            for instr in block.instructions() {
                // Only consider ops that produce a value
                if let Some(dest) = instr.op().dest() {
                    if self.can_be_stack_local(ssa, dest, block_id) {
                        candidates.insert(dest);
                    }
                }
            }
        }

        candidates
    }

    /// Checks if a variable can be a stack local (no local slot needed).
    fn can_be_stack_local(&self, ssa: &SsaFunction, var: SsaVarId, def_block: usize) -> bool {
        // Condition 1: Check use count (should be exactly 1 for stack-only)
        // Variables with 0 uses are dead and will be skipped anyway.
        // Variables with >1 uses might need the value multiple times.
        let use_count = self.global_use_counts.get(&var).copied().unwrap_or(0);
        if use_count != 1 {
            return false;
        }

        // Condition 2: Not used as a phi operand (phi copies happen at block boundaries)
        if Self::is_phi_operand(ssa, var) {
            return false;
        }

        // Condition 3: The single use must be in the same block
        // Find the use site
        let Some(block) = ssa.blocks().iter().find(|b| b.id() == def_block) else {
            return false;
        };

        // Find the definition index and use index within the block
        let instrs = block.instructions();
        let mut def_idx: Option<usize> = None;
        let mut use_idx: Option<usize> = None;

        for (idx, instr) in instrs.iter().enumerate() {
            let op = instr.op();
            // Check if this is the definition
            if op.dest() == Some(var) {
                def_idx = Some(idx);
            }
            // Check if this uses our variable
            if op.uses().contains(&var) {
                use_idx = Some(idx);
            }
        }

        // Must have both def and use in this block
        let (Some(d_idx), Some(u_idx)) = (def_idx, use_idx) else {
            return false;
        };

        // Condition 4: Use must come after definition (should always be true in SSA)
        if u_idx <= d_idx {
            return false;
        }

        // Condition 5: Use must be IMMEDIATELY after def (no instructions between)
        // This is required because any instruction between def and use might push
        // values onto the stack, burying our value and making it inaccessible.
        // A more sophisticated analysis could check if intervening instructions
        // consume their values before our use, but that's complex and error-prone.
        if u_idx != d_idx + 1 {
            return false;
        }

        // Note: We still check for terminators below, but with the immediate-use
        // requirement above, there can't be any terminators between def and use.

        // Condition 6: The use itself should not be a terminator operand
        // (terminators trigger spilling, so the value would be stored anyway)
        if Self::is_terminator(instrs[u_idx].op()) {
            return false;
        }

        true
    }

    /// Checks if a variable is used as a phi operand anywhere.
    fn is_phi_operand(ssa: &SsaFunction, var: SsaVarId) -> bool {
        for block in ssa.blocks() {
            for phi in block.phi_nodes() {
                for operand in phi.operands() {
                    if operand.value() == var {
                        return true;
                    }
                }
            }
        }
        false
    }

    /// Checks if a variable is used in any block other than the specified one.
    ///
    /// This is important for determining whether a value can be left on the stack
    /// (only valid if used within the same block) or must be stored to a local
    /// (required if used in a different block, since stack doesn't persist).
    fn is_used_outside_block(ssa: &SsaFunction, var: SsaVarId, def_block: usize) -> bool {
        for block in ssa.blocks() {
            if block.id() == def_block {
                continue; // Skip the defining block
            }

            // NOTE: We intentionally DON'T check phi operands here.
            // Phi operands are handled by emit_phi_stores_for_successor, which runs
            // at the end of the predecessor block (before control flow actually leaves).
            // If the value is still on the stack at that point, it can be used directly.
            // If not, emit_phi_stores_for_successor will handle loading it.

            // Check instruction uses in other blocks
            for instr in block.instructions() {
                if instr.uses().contains(&var) {
                    return true;
                }
            }
        }
        false
    }

    /// Gets the storage for an SSA variable, allocating a local if needed.
    ///
    /// # Errors
    ///
    /// Returns an error if a local must be allocated but its type cannot be determined.
    fn get_or_allocate_storage(&mut self, ssa: &SsaFunction, var: SsaVarId) -> Result<VarStorage> {
        if let Some(&storage) = self.var_storage.get(&var) {
            return Ok(storage);
        }

        // Stack locals never need a local slot - they're consumed before burial
        if self.stack_locals.contains(&var) {
            return Ok(VarStorage::Stack);
        }

        // Try to look up the variable's origin
        if let Some(ssa_var) = ssa.variable(var) {
            match ssa_var.origin() {
                VariableOrigin::Argument(idx) => {
                    let storage = VarStorage::Arg(idx);
                    self.var_storage.insert(var, storage);
                    return Ok(storage);
                }
                VariableOrigin::Local(original_idx) => {
                    // Use the compacted index from the coalescer's allocation
                    if let Some(&compacted_idx) = self.original_to_compacted.get(&original_idx) {
                        let storage = VarStorage::Local(compacted_idx);
                        self.var_storage.insert(var, storage);
                        // Record the type for the compacted slot
                        let var_type = ssa_var.var_type();
                        if !var_type.is_unknown() {
                            self.local_types.insert(compacted_idx, var_type.clone());
                        }
                        return Ok(storage);
                    }
                    // If not in the compacted mapping, fall through to allocate
                    // (this handles edge cases where a Local var wasn't seen during coalescing)
                }
                VariableOrigin::Stack(_) | VariableOrigin::Phi => {
                    // Fall through to allocate a new local
                }
            }
        }

        // Default: allocate a new local
        let local = self.next_local;
        self.next_local += 1;
        let storage = VarStorage::Local(local);
        self.var_storage.insert(var, storage);

        // Record the type of this newly allocated local so it gets included in the signature
        let var_type = ssa
            .variable(var)
            .map(|v| v.var_type().clone())
            .filter(|t| !t.is_unknown())
            .ok_or_else(|| {
                Error::CodegenFailed(format!(
                    "cannot determine type for variable {var:?} when allocating local {local}"
                ))
            })?;
        self.local_types.insert(local, var_type);

        Ok(storage)
    }

    /// Force-allocates storage for a variable that must have a real local/arg slot.
    ///
    /// Unlike `get_or_allocate_storage`, this method never returns `VarStorage::Stack`.
    /// It's used when a variable that was expected to stay on the stack needs to be
    /// stored to a local (e.g., when it gets buried by other values).
    ///
    /// # Errors
    ///
    /// Returns an error if the variable's type cannot be determined.
    fn force_allocate_storage(&mut self, ssa: &SsaFunction, var: SsaVarId) -> Result<VarStorage> {
        // Check existing storage first
        if let Some(&storage) = self.var_storage.get(&var) {
            if !matches!(storage, VarStorage::Stack) {
                return Ok(storage);
            }
            // Stack storage is not allowed - need to allocate a real slot
            // This can happen if the variable was previously identified as a stack_local
            // but now needs real storage due to being buried.
        }

        // Try to look up the variable's origin for arguments
        if let Some(ssa_var) = ssa.variable(var) {
            if let VariableOrigin::Argument(idx) = ssa_var.origin() {
                let storage = VarStorage::Arg(idx);
                self.var_storage.insert(var, storage);
                return Ok(storage);
            }
        }

        // Determine the type for this local:
        // 1. Try the variable's type from SSA
        // 2. Try to infer from the definition operation
        let var_type = Self::infer_variable_type(ssa, var)?;

        // Allocate a new local slot
        let local = self.next_local;
        self.next_local += 1;
        let storage = VarStorage::Local(local);
        self.var_storage.insert(var, storage);

        // Also remove from stack_locals since it now has real storage
        self.stack_locals.remove(&var);

        // Record the type of this newly allocated local
        self.local_types.insert(local, var_type);

        Ok(storage)
    }

    /// Infers the type of a variable from SSA metadata and its definition.
    ///
    /// Delegates to `infer_variable_type_inner` with cycle detection.
    ///
    /// # Errors
    ///
    /// Returns an error if the type cannot be determined from either the SSA
    /// variable metadata or the defining operation.
    fn infer_variable_type(ssa: &SsaFunction, var: SsaVarId) -> Result<SsaType> {
        let mut visited = HashSet::new();
        Self::infer_variable_type_inner(ssa, var, &mut visited)
    }

    /// Recursive helper for type inference with cycle detection.
    ///
    /// Traces through Copy chains and phi operand chains to find a known type.
    fn infer_variable_type_inner(
        ssa: &SsaFunction,
        var: SsaVarId,
        visited: &mut HashSet<SsaVarId>,
    ) -> Result<SsaType> {
        if !visited.insert(var) {
            return Err(Error::CodegenFailed(format!(
                "circular type dependency for variable {var:?}"
            )));
        }

        // 1. Check variable's declared type
        if let Some(v) = ssa.variable(var) {
            if !v.var_type().is_unknown() {
                return Ok(v.var_type().clone());
            }
        }

        // 2. Try defining instruction
        if let Some(def_op) = ssa.get_definition(var) {
            if let Some(inferred) = Self::infer_op_result_type(def_op) {
                return Ok(inferred);
            }
            // For Copy, trace to source variable
            if let SsaOp::Copy { src, .. } = def_op {
                let src = *src;
                return Self::infer_variable_type_inner(ssa, src, visited);
            }
            return Err(Error::CodegenFailed(format!(
                "cannot determine type for variable {var:?}: defining op has no \
                 type inference rule: {def_op:?}"
            )));
        }

        // 3. Check if defined by a phi — trace operands
        if let Some((_block, phi)) = ssa.find_phi_defining(var) {
            for operand in phi.operands() {
                if let Ok(ty) = Self::infer_variable_type_inner(ssa, operand.value(), visited) {
                    return Ok(ty);
                }
            }
            return Err(Error::CodegenFailed(format!(
                "cannot determine type for phi {var:?}: all operands unknown"
            )));
        }

        // 4. No definition found — fall back to I32 (most common CIL stack type).
        //    This handles: arguments/locals without TypeContext, orphan stack
        //    variables from SSA rebuild, and other edge cases.
        Ok(SsaType::I32)
    }

    /// Tries to infer the result type of an SSA operation.
    fn infer_op_result_type(op: &SsaOp) -> Option<SsaType> {
        match op {
            // Constants - infer type from the constant value
            SsaOp::Const { value, .. } => Some(match value {
                ConstValue::I8(_) => SsaType::I8,
                ConstValue::I16(_) => SsaType::I16,
                ConstValue::I32(_) => SsaType::I32,
                ConstValue::I64(_) => SsaType::I64,
                ConstValue::U8(_) => SsaType::U8,
                ConstValue::U16(_) => SsaType::U16,
                ConstValue::U32(_) => SsaType::U32,
                ConstValue::U64(_) => SsaType::U64,
                ConstValue::NativeInt(_) => SsaType::NativeInt,
                ConstValue::NativeUInt(_) => SsaType::NativeUInt,
                ConstValue::F32(_) => SsaType::F32,
                ConstValue::F64(_) => SsaType::F64,
                ConstValue::String(_) | ConstValue::DecryptedString(_) => SsaType::String,
                ConstValue::Null => SsaType::Null,
                ConstValue::True | ConstValue::False => SsaType::Bool,
                // RuntimeTypeHandle / RuntimeMethodHandle / RuntimeFieldHandle
                ConstValue::Type(_) | ConstValue::MethodHandle(_) | ConstValue::FieldHandle(_) => {
                    SsaType::Object
                }
            }),
            // Type conversions have explicit target type
            SsaOp::Conv { target, .. } => Some(target.clone()),
            // Comparisons, arithmetic/bitwise ops, overflow-checked arithmetic,
            // SizeOf, UnboxAny, field loads, LoadObj, calls, LoadArg/LoadLocal
            // all produce int32 (or default to it when metadata is unavailable)
            SsaOp::Ceq { .. }
            | SsaOp::Clt { .. }
            | SsaOp::Cgt { .. }
            | SsaOp::Add { .. }
            | SsaOp::Sub { .. }
            | SsaOp::Mul { .. }
            | SsaOp::Div { .. }
            | SsaOp::Rem { .. }
            | SsaOp::And { .. }
            | SsaOp::Or { .. }
            | SsaOp::Xor { .. }
            | SsaOp::Shl { .. }
            | SsaOp::Shr { .. }
            | SsaOp::Neg { .. }
            | SsaOp::Not { .. }
            | SsaOp::AddOvf { .. }
            | SsaOp::SubOvf { .. }
            | SsaOp::MulOvf { .. }
            | SsaOp::SizeOf { .. }
            | SsaOp::UnboxAny { .. }
            | SsaOp::LoadField { .. }
            | SsaOp::LoadStaticField { .. }
            | SsaOp::LoadObj { .. }
            | SsaOp::Call { dest: Some(_), .. }
            | SsaOp::CallVirt { dest: Some(_), .. }
            | SsaOp::CallIndirect { dest: Some(_), .. }
            | SsaOp::LoadArg { .. }
            | SsaOp::LoadLocal { .. } => Some(SsaType::I32),
            // Box, NewObj, NewArr, CastClass/IsInst produce object references
            SsaOp::Box { .. }
            | SsaOp::NewObj { .. }
            | SsaOp::NewArr { .. }
            | SsaOp::CastClass { .. }
            | SsaOp::IsInst { .. } => Some(SsaType::Object),
            // Array length and LocalAlloc return native int
            SsaOp::ArrayLength { .. } | SsaOp::LocalAlloc { .. } => Some(SsaType::NativeInt),
            // Ckfinite operates on F64 stack type
            SsaOp::Ckfinite { .. } => Some(SsaType::F64),
            // Function pointer loads produce native int
            SsaOp::LoadFunctionPtr { .. } | SsaOp::LoadVirtFunctionPtr { .. } => {
                Some(SsaType::NativeInt)
            }
            // Load element — type embedded in the op
            SsaOp::LoadElement { elem_type, .. } => Some(elem_type.clone()),
            // Load indirect — type embedded in the op
            SsaOp::LoadIndirect { value_type, .. } => Some(value_type.clone()),
            // Load token — determine handle type from token table
            SsaOp::LoadToken { token, .. } => Some(match token.token().table() {
                0x06 | 0x0A | 0x2B => SsaType::RuntimeMethodHandle,
                0x04 => SsaType::RuntimeFieldHandle,
                _ => SsaType::RuntimeTypeHandle,
            }),
            // Unbox and LoadElementAddr produce ByRef to value type (default to ByRef(I32))
            SsaOp::Unbox { .. } | SsaOp::LoadElementAddr { .. } => {
                Some(SsaType::ByRef(Box::new(SsaType::I32)))
            }
            // Field/arg/local address loads (need metadata, default to ByRef(I32))
            SsaOp::LoadFieldAddr { .. }
            | SsaOp::LoadStaticFieldAddr { .. }
            | SsaOp::LoadArgAddr { .. }
            | SsaOp::LoadLocalAddr { .. } => Some(SsaType::ByRef(Box::new(SsaType::I32))),
            // Operations that don't produce values or have complex types
            _ => None,
        }
    }

    /// Gets the storage for an SSA variable.
    ///
    /// If the variable doesn't have directly allocated storage, this traces through
    /// the SSA definition chain to find a source variable that does. This is crucial
    /// for CFF reconstruction where phi copy variables might be defined in intermediate
    /// blocks that aren't part of the reconstructed SSA.
    ///
    /// # Errors
    ///
    /// Returns an error if no storage can be found for the variable. This indicates
    /// a bug in SSA construction - all variables referenced in instructions should
    /// have proper storage allocated or traceable through the SSA graph.
    fn get_storage(&self, var: SsaVarId, ssa: &SsaFunction) -> Result<VarStorage> {
        // Check if variable has direct storage allocation
        if let Some(&storage) = self.var_storage.get(&var) {
            return Ok(storage);
        }

        // Check if the variable has Argument or Local origin directly.
        // This handles cases where a variable wasn't pre-allocated in var_storage
        // but has an explicit origin that tells us where it should live.
        if let Some(ssa_var) = ssa.variable(var) {
            match ssa_var.origin() {
                VariableOrigin::Argument(idx) => return Ok(VarStorage::Arg(idx)),
                VariableOrigin::Local(idx) => {
                    // Use the compacted local slot if available
                    if let Some(&compacted) = self.original_to_compacted.get(&idx) {
                        return Ok(VarStorage::Local(compacted));
                    }
                    return Ok(VarStorage::Local(idx));
                }
                _ => {}
            }
        }

        // Variable not found - trace through SSA to find source with storage
        let traced = self.trace_to_storage(var, ssa, &mut HashSet::new());
        if let Some(storage) = traced {
            return Ok(storage);
        }

        // No storage found - this is a bug in SSA construction.
        // Gather diagnostic information to help identify the root cause.
        let var_info = if let Some(ssa_var) = ssa.variable(var) {
            format!(
                "origin={:?}, type={:?}, version={}",
                ssa_var.origin(),
                ssa_var.var_type(),
                ssa_var.version()
            )
        } else {
            "NOT IN SSA VARIABLE LIST (orphan)".to_string()
        };

        Err(Error::Deobfuscation(format!(
            "No storage found for variable {var:?} ({var_info}) - this indicates a bug in SSA construction. \
             Variables must have proper Argument/Local origins or be traceable through the SSA graph."
        )))
    }

    /// Traces through SSA definitions to find a variable with allocated storage.
    ///
    /// This handles cases where a Copy instruction references a variable defined
    /// in an intermediate block. We trace back through Copy chains and phi nodes
    /// to find the original variable that was allocated storage.
    ///
    /// For phi nodes, if all operands trace to the same storage, that storage is
    /// returned. This correctly handles cases where control flow obfuscation
    /// creates phi nodes for argument values.
    fn trace_to_storage(
        &self,
        var: SsaVarId,
        ssa: &SsaFunction,
        visited: &mut HashSet<SsaVarId>,
    ) -> Option<VarStorage> {
        // Prevent infinite loops
        if !visited.insert(var) {
            return None;
        }

        // Check if this variable has storage
        if let Some(&storage) = self.var_storage.get(&var) {
            return Some(storage);
        }

        // Look up the definition in instructions
        if let Some(def_op) = ssa.get_definition(var) {
            match def_op {
                // For Copy, trace to the source
                SsaOp::Copy { src, .. } => {
                    return self.trace_to_storage(*src, ssa, visited);
                }
                // For other ops, try operands
                _ => {
                    for operand in def_op.uses() {
                        if let Some(storage) = self.trace_to_storage(operand, ssa, visited) {
                            return Some(storage);
                        }
                    }
                }
            }
        }

        // Check if defined by a phi node
        // If all phi operands trace to the same storage, return that storage
        if let Some((_, phi)) = ssa.find_phi_defining(var) {
            let operands = phi.operands();
            if !operands.is_empty() {
                // Trace the first operand to get a reference storage
                let first_storage = self.trace_to_storage(operands[0].value(), ssa, visited)?;

                // Check if all other operands trace to the same storage
                for operand in operands.iter().skip(1) {
                    // Skip self-references (phi referring to itself in loops)
                    if operand.value() == var {
                        continue;
                    }
                    let op_storage = self.trace_to_storage(operand.value(), ssa, visited)?;
                    if op_storage != first_storage {
                        // Different storage for different operands - can't determine unique storage
                        return None;
                    }
                }

                return Some(first_storage);
            }
        }

        None
    }

    /// Checks if a variable is immediately consumed by the next operation.
    ///
    /// This is used to determine if we can leave a value on the stack instead
    /// of storing it to a local. A value can stay on the stack if:
    ///
    /// 1. The next instruction uses it as an operand
    /// 2. It's either the first operand, OR all prior operands can be loaded
    ///    without disturbing the stack (i.e., they're simple loads like ldarg/ldloc)
    ///
    /// For binary operations where the value is the second operand (like shift amount),
    /// we check if the first operand is a "simple" load that won't need the stack.
    fn is_immediately_consumed(&self, var: SsaVarId, next_op: Option<&SsaOp>) -> bool {
        let Some(next) = next_op else {
            return false;
        };

        match next {
            // Return immediately consumes its value
            SsaOp::Return { value: Some(v) } if *v == var => true,

            // Branch immediately consumes its condition
            SsaOp::Branch { condition, .. } if *condition == var => true,

            // BranchCmp consumes left operand first, then right
            SsaOp::BranchCmp { left, .. } if *left == var => true,

            // These ops consume their first operand (left) immediately
            SsaOp::Add { left, .. }
            | SsaOp::Sub { left, .. }
            | SsaOp::Mul { left, .. }
            | SsaOp::Div { left, .. }
            | SsaOp::Rem { left, .. }
            | SsaOp::And { left, .. }
            | SsaOp::Or { left, .. }
            | SsaOp::Xor { left, .. }
            | SsaOp::Ceq { left, .. }
            | SsaOp::Clt { left, .. }
            | SsaOp::Cgt { left, .. }
                if *left == var =>
            {
                true
            }

            // Binary ops can also consume their second operand (right) if first is simple
            SsaOp::Add { left, right, .. }
            | SsaOp::Sub { left, right, .. }
            | SsaOp::Mul { left, right, .. }
            | SsaOp::Div { left, right, .. }
            | SsaOp::Rem { left, right, .. }
            | SsaOp::And { left, right, .. }
            | SsaOp::Or { left, right, .. }
            | SsaOp::Xor { left, right, .. }
            | SsaOp::Ceq { left, right, .. }
            | SsaOp::Clt { left, right, .. }
            | SsaOp::Cgt { left, right, .. }
            | SsaOp::BranchCmp { left, right, .. }
                if *right == var && self.is_simple_load(*left) =>
            {
                true
            }

            // Shift ops consume their first operand (value) immediately
            SsaOp::Shl { value, .. } | SsaOp::Shr { value, .. } if *value == var => true,

            // Shift ops can consume amount if value is a simple load
            SsaOp::Shl { value, amount, .. } | SsaOp::Shr { value, amount, .. }
                if *amount == var && self.is_simple_load(*value) =>
            {
                true
            }

            // Unary ops consume their operand
            SsaOp::Neg { operand, .. }
            | SsaOp::Not { operand, .. }
            | SsaOp::Conv { operand, .. }
            | SsaOp::Ckfinite { operand, .. }
                if *operand == var =>
            {
                true
            }

            // Throw consumes its exception
            SsaOp::Throw { exception } if *exception == var => true,

            // Pop consumes its value
            SsaOp::Pop { value } if *value == var => true,

            _ => false,
        }
    }

    /// Checks if a variable can be loaded with a simple instruction that doesn't
    /// disturb the evaluation stack. This is true for arguments and locals.
    fn is_simple_load(&self, var: SsaVarId) -> bool {
        matches!(
            self.var_storage.get(&var),
            Some(VarStorage::Arg(_) | VarStorage::Local(_))
        )
    }

    /// Generates code for a single basic block with instruction scheduling.
    ///
    /// This method schedules instructions to minimize local variable usage by
    /// reordering value definitions to occur immediately before their use.
    /// This is particularly important for stack-based code generation where
    /// we want to leave values on the stack rather than storing to locals.
    fn generate_block(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        block: &SsaBlock,
        block_idx: usize,
        next_block_idx: Option<usize>,
    ) -> Result<()> {
        // Define the block label - the encoder validates stack depth consistency
        // across all control flow paths reaching this label.
        //
        // NOTE: Stack depth mismatches here indicate bugs in the codegen's stack
        // management. These will be addressed in Phase 2 (phi elimination) and
        // Phase 3 (stack optimization) of the codegen improvements.
        let label = self
            .block_labels
            .get(&block_idx)
            .ok_or_else(|| Error::SsaError(format!("Missing label for block {block_idx}")))?
            .clone();
        encoder.define_label(&label)?;

        // Reset tracked stack variables at block boundary
        self.stack_vars.clear();

        // Collect actual ops (non-None) for scheduling, filtering out:
        // - No-op Copy operations (src and dest share same storage due to coalescing)
        // - Nop operations (produce unnecessary bytecode)
        // - Deferred Const operations (will be generated inline at use site)
        let ops: Vec<&SsaOp> = block
            .instructions()
            .iter()
            .map(SsaInstruction::op)
            .filter(|op| {
                match op {
                    SsaOp::Copy { dest, src } => {
                        // Skip Copy if src and dest are coalesced to same storage
                        let src_storage = self.var_storage.get(src);
                        let dest_storage = self.var_storage.get(dest);
                        src_storage != dest_storage || src_storage.is_none()
                    }
                    SsaOp::Const { dest, .. } => {
                        // Skip deferred constants - generated inline at use site
                        !self.deferred_constants.contains_key(dest)
                    }
                    SsaOp::Nop => false, // Skip Nop - produces unnecessary bytecode
                    _ => true,
                }
            })
            .collect();
        if ops.is_empty() {
            // Block has no decomposed ops - it's an empty block (e.g., a merge point created
            // by control flow unflattening or other SSA transformations).
            //
            // Empty blocks act as merge points where control can fall through to the next
            // block. If this is an empty block at the end of the method with branches
            // targeting it, the encoder's finalize() will add a proper terminator.
            return Ok(());
        }

        // Pre-compute operands for each instruction (avoid repeated calls)
        let mut operands_cache: Vec<Vec<SsaVarId>> = ops
            .iter()
            .map(|op| Self::get_operands_in_stack_order(op))
            .collect();

        // For exception/filter handler entry blocks, the exception object is already
        // on the stack when execution enters the handler. Pop instructions that pop
        // this exception object should NOT try to load it first - it's already there.
        //
        // We identify handler entry blocks by checking if this block is a handler_start_block
        // for an EXCEPTION or FILTER handler.
        let is_exception_handler_entry = ssa.exception_handlers().iter().any(|h| {
            h.handler_start_block == Some(block_idx)
                && (h.flags == ExceptionHandlerFlags::EXCEPTION
                    || h.flags == ExceptionHandlerFlags::FILTER)
        });
        let is_filter_entry = ssa.exception_handlers().iter().any(|h| {
            h.filter_start_block == Some(block_idx) && h.flags == ExceptionHandlerFlags::FILTER
        });

        if is_exception_handler_entry || is_filter_entry {
            // Clear operands for Pop instructions that consume the exception object.
            // The exception object is already on the stack when entering the handler.
            // We only clear operands for Pop instructions where the value being popped
            // is NOT defined in this block (meaning it's the exception object from outside).
            //
            // First, collect all variables defined in this block
            let mut defined_in_block: HashSet<SsaVarId> = HashSet::new();
            for op in &ops {
                if let Some(dest) = op.dest() {
                    defined_in_block.insert(dest);
                }
            }

            // Only clear operands for Pop instructions that consume external values
            for (idx, op) in ops.iter().enumerate() {
                if let SsaOp::Pop { value } = op {
                    if !defined_in_block.contains(value) {
                        // This Pop consumes a value not defined in this block
                        // (the exception object), so clear its operands
                        operands_cache[idx].clear();
                    }
                }
            }
        }

        // Build def map: variable -> instruction index
        let mut def_map: HashMap<SsaVarId, usize> = HashMap::with_capacity(ops.len());
        for (idx, op) in ops.iter().enumerate() {
            if let Some(dest) = op.dest() {
                def_map.insert(dest, idx);
            }
        }

        // Identify which variables are used as operands in this block
        let mut used_in_block: HashSet<SsaVarId> = HashSet::with_capacity(ops.len() * 2);
        for operands in &operands_cache {
            for var in operands {
                used_in_block.insert(*var);
            }
        }

        // Find root ops - those whose results are NOT used by other ops
        // in this block (they're terminators, have side effects, or export to other blocks)
        let roots: Vec<usize> = ops
            .iter()
            .enumerate()
            .filter_map(|(idx, op)| {
                let is_root = match op.dest() {
                    Some(dest) => !used_in_block.contains(&dest) || Self::is_terminator(op),
                    None => true, // No dest = side effect only, always a root
                };
                if is_root {
                    Some(idx)
                } else {
                    None
                }
            })
            .collect();

        // Generate code iteratively using explicit work stack
        let ctx = BlockCodegenContext {
            ssa,
            ops: &ops,
            operands_cache: &operands_cache,
            def_map: &def_map,
            current_block_idx: block_idx,
        };
        self.generate_ops_iterative(encoder, &ctx, &roots, next_block_idx)?;

        // Check if the block ends with a non-terminator (falls through to next block)
        // If so, spill remaining stack values and emit phi stores for the fallthrough
        let has_terminator = ops.last().is_some_and(|op| Self::is_terminator(op));
        if !has_terminator {
            // Spill any remaining stack values before fallthrough
            self.spill_stack(encoder, ssa)?;

            if let Some(next_idx) = next_block_idx {
                self.emit_phi_stores_for_successor(encoder, ssa, block_idx, next_idx)?;
            }
        }

        Ok(())
    }

    /// Generates ops iteratively with dependency tracking.
    ///
    /// Uses an explicit work stack instead of recursion to avoid stack overflow
    /// on deep dependency chains and improve cache locality.
    ///
    /// The key insight is that operands must be loaded/generated in order.
    /// We use three phases:
    /// - `Pending`: Schedule operand loads in reverse order, then Emit
    /// - `LoadOperand`: Load or generate a specific operand
    /// - `Emit`: All operands on stack, emit the operation
    fn generate_ops_iterative(
        &mut self,
        encoder: &mut InstructionEncoder,
        ctx: &BlockCodegenContext<'_>,
        roots: &[usize],
        next_block_idx: Option<usize>,
    ) -> Result<()> {
        // Use global use counts to determine if variables need storage.
        // Variables used multiple times (across ANY blocks) must be stored to locals
        // so subsequent uses can load from them. This is critical for cross-block
        // data flow where a value is defined in one block and used in another.
        //
        // Note: We use the global use_counts computed during allocate_storage().
        // Phi operand uses are NOT included in global_use_counts, so phi operand
        // values that are only used as phi operands will have use_count=0 and
        // remain on the stack until the phi stores consume them.
        //
        // If a phi operand value gets "buried" (other operations push values on
        // top of it), the buried handling in load_var will store it to a local
        // and the phi stores will load it from there.
        let use_counts = self.global_use_counts.clone();

        let mut generated: HashSet<usize> = HashSet::with_capacity(ctx.ops.len());
        // Track which Pending items are already scheduled to avoid re-pushing
        let mut scheduled_pending: HashSet<usize> = HashSet::with_capacity(ctx.ops.len());
        // Track which operations are "in progress" (between Pending and Emit).
        // Used for cycle detection - if we need a dependency that's in_progress,
        // we have a cyclic dependency which indicates invalid SSA.
        let mut in_progress: HashSet<usize> = HashSet::with_capacity(ctx.ops.len());
        // Track which LoadOperand (idx, operand_idx) pairs are already scheduled
        let mut scheduled_load: HashSet<(usize, usize)> = HashSet::with_capacity(ctx.ops.len() * 2);
        let mut work_stack: Vec<CodeGenWorkItem> = Vec::with_capacity(ctx.ops.len() * 3);

        // Preserve original instruction order as much as possible.
        // For malware analysis and understanding original intent, the order matters.
        //
        // However, Copy roots require special handling with parallel copy semantics.
        // They may form dependency/storage conflicts like:
        //   v47 = add(v45, v46)  // reads Local(0), Local(1)
        //   v49 = v46            // writes Local(0), reads Local(1)
        //   v50 = v48            // writes Local(1), depends on v47
        //
        // Neither processing order works:
        //   - v49 first: clobbers Local(0) before v47 reads it
        //   - v50 first: v50 stores to Local(1) before v49 reads it
        //
        // Solution: Handle Copy roots with parallel copy semantics AFTER all
        // non-Copy roots are processed. We'll generate their dependencies, load
        // all sources, then store all destinations.
        let mut terminator_roots: Vec<usize> = Vec::new();
        let mut copy_roots: Vec<usize> = Vec::new();
        let mut other_roots: Vec<usize> = Vec::new();
        for &root_idx in roots {
            if Self::is_terminator(ctx.ops[root_idx]) {
                terminator_roots.push(root_idx);
            } else if matches!(ctx.ops[root_idx], SsaOp::Copy { .. }) {
                copy_roots.push(root_idx);
            } else {
                other_roots.push(root_idx);
            }
        }

        // Push non-Copy roots in reverse priority order (stack is LIFO):
        // - If there are Copy roots, DON'T push terminators here - they need to come
        //   AFTER the Copy roots and their dependencies are emitted.
        // - Other roots (non-Copy, non-terminator) are processed first.
        // Note: Copy roots are NOT pushed here - they're handled specially below.
        let defer_terminators = !copy_roots.is_empty();
        if !defer_terminators {
            for root_idx in terminator_roots.iter().rev() {
                work_stack.push(CodeGenWorkItem::Pending(*root_idx));
                scheduled_pending.insert(*root_idx);
            }
        }
        for root_idx in other_roots.into_iter().rev() {
            work_stack.push(CodeGenWorkItem::Pending(root_idx));
            scheduled_pending.insert(root_idx);
        }

        while let Some(item) = work_stack.pop() {
            match item {
                CodeGenWorkItem::Pending(idx) => {
                    scheduled_pending.remove(&idx);
                    if generated.contains(&idx) {
                        continue; // Already done
                    }

                    // Mark as in_progress for cycle detection
                    in_progress.insert(idx);

                    // IMPORTANT: Spill all stack_vars BEFORE loading any operands.
                    //
                    // When loading operands for an operation, we might need to load
                    // some from storage (ldloc/ldarg) and some from stack_vars. The
                    // issue is that loading from storage pushes onto the CIL stack,
                    // which can bury values that were in stack_vars. If we then try
                    // to load another operand and it's not on top of stack_vars, the
                    // spill logic would emit stloc instructions that would store the
                    // WRONG values (the operands we just loaded, not the buried results).
                    //
                    // To prevent this, we spill all stack_vars values upfront, ensuring
                    // a clean stack state before loading any operands.
                    let operands = &ctx.operands_cache[idx];
                    let any_operand_needs_storage_load = operands.iter().any(|op_var| {
                        // Check if this operand would be loaded from storage (not from stack)
                        if let Some(last) = self.stack_vars.last() {
                            if *last == *op_var {
                                return false; // Would be taken from stack, no storage load
                            }
                        }
                        // Would need storage load (or spill + storage load)
                        true
                    });

                    if any_operand_needs_storage_load && !self.stack_vars.is_empty() {
                        // Spill all stack_vars now, before loading any operands
                        self.spill_stack(encoder, ctx.ssa)?;
                    }

                    // Schedule: first Emit (pushed first, runs last),
                    // then LoadOperand for each operand in reverse order
                    work_stack.push(CodeGenWorkItem::Emit(idx));

                    for (op_idx, _) in operands.iter().enumerate().rev() {
                        if !scheduled_load.contains(&(idx, op_idx)) {
                            work_stack.push(CodeGenWorkItem::LoadOperand(idx, op_idx));
                            scheduled_load.insert((idx, op_idx));
                        }
                    }
                }

                CodeGenWorkItem::LoadOperand(idx, operand_idx) => {
                    scheduled_load.remove(&(idx, operand_idx));
                    let operand = ctx.operands_cache[idx][operand_idx];

                    if let Some(&dep_idx) = ctx.def_map.get(&operand) {
                        // Operand is defined in this block
                        if generated.contains(&dep_idx) {
                            // Already generated - load from storage or stack
                            self.load_var(encoder, ctx.ssa, operand)?;
                        } else if let SsaOp::Copy { src, .. } = ctx.ops[dep_idx] {
                            // Operand is defined by a Copy that hasn't been generated yet.
                            // This can happen with circular dependencies through Copy chains
                            // (e.g., Add needs Copy result, Copy needs Add result).
                            // Load the Copy's SOURCE instead - it should be available from
                            // storage (from a previous block/iteration) or will be generated
                            // and stored by the copy_roots handling.
                            self.load_var(encoder, ctx.ssa, *src)?;
                        } else {
                            // Not yet generated - check for cyclic dependency.
                            // If this dependency is "in progress" (between Pending and Emit),
                            // we have a cycle - operation A needs B, but B needs A.
                            if in_progress.contains(&dep_idx) {
                                // This is a cyclic dependency between non-Copy operations,
                                // which indicates invalid SSA. All operations within a block
                                // should have a valid topological order.
                                return Err(Error::Deobfuscation(format!(
                                    "Cyclic dependency detected in block {}: \
                                     op {:?} needs {:?} (defined by {:?}), \
                                     but that definition is already being processed. \
                                     This indicates invalid SSA form.",
                                    ctx.current_block_idx, ctx.ops[idx], operand, ctx.ops[dep_idx]
                                )));
                            }

                            // Generate it now.
                            // Schedule a load AFTER the generation completes.
                            // This is needed because the value might be stored (if buried by
                            // other operand loads) and not left on the stack.
                            if !scheduled_load.contains(&(idx, operand_idx)) {
                                work_stack.push(CodeGenWorkItem::LoadOperand(idx, operand_idx));
                                scheduled_load.insert((idx, operand_idx));
                            }
                            // Generate the dependency
                            if !generated.contains(&dep_idx) {
                                work_stack.push(CodeGenWorkItem::Pending(dep_idx));
                                scheduled_pending.insert(dep_idx);
                            }
                        }
                    } else {
                        // External variable - load from arg/local
                        self.load_var(encoder, ctx.ssa, operand)?;
                    }
                }

                CodeGenWorkItem::Emit(idx) => {
                    // Remove from in_progress (no longer being processed)
                    in_progress.remove(&idx);

                    if generated.contains(&idx) {
                        continue; // Already done
                    }

                    // Generate the operation (operands should be on stack)
                    self.generate_op_core(
                        encoder,
                        ctx.ssa,
                        ctx.current_block_idx,
                        ctx.ops[idx],
                        next_block_idx,
                    )?;
                    generated.insert(idx);

                    // If this op produces a value, handle it based on use count
                    // and whether it's used outside this block (cross-block use).
                    // Note: Skip Copy instructions - they handle their own storage
                    // in generate_op_core and don't leave a result on the stack.
                    let is_copy = matches!(ctx.ops[idx], SsaOp::Copy { .. });
                    if !is_copy {
                        if let Some(dest) = ctx.ops[idx].dest() {
                            let uses = use_counts.get(&dest).copied().unwrap_or(0);
                            // Check if this value is used outside the current block.
                            // If so, it must be stored because stack values don't
                            // persist across block boundaries.
                            let used_outside_block =
                                Self::is_used_outside_block(ctx.ssa, dest, ctx.current_block_idx);

                            if uses > 1 || used_outside_block {
                                // Multi-use or cross-block use: store to local immediately.
                                self.store_var(encoder, ctx.ssa, dest)?;
                            } else {
                                // Single-use value within this block: leave on stack for now.
                                // The consumer should use it directly. Storage will be allocated
                                // lazily if this value gets buried and needs to be saved.
                                self.stack_vars.push(dest);
                            }
                        }
                    }
                }
            }
        }

        // Handle Copy roots with parallel copy semantics.
        // This ensures all sources are loaded before any destinations are stored,
        // preventing read-after-write hazards.
        if !copy_roots.is_empty() {
            self.emit_copy_roots_parallel(encoder, ctx, &copy_roots, &mut generated, &use_counts)?;

            // Now process terminators that were deferred.
            // Terminators must come after Copy roots because:
            // 1. Copy roots may have dependencies (like Add) that need to be generated
            // 2. Those dependencies must execute before the terminator
            // 3. The terminator (e.g., Jump) may emit phi stores that depend on the Copy results
            for &root_idx in &terminator_roots {
                if !generated.contains(&root_idx) {
                    // Load any operands the terminator needs.
                    // Always use load_var which handles buried values correctly.
                    for &operand in &ctx.operands_cache[root_idx] {
                        self.load_var(encoder, ctx.ssa, operand)?;
                    }
                    self.generate_op_core(
                        encoder,
                        ctx.ssa,
                        ctx.current_block_idx,
                        ctx.ops[root_idx],
                        next_block_idx,
                    )?;
                    generated.insert(root_idx);
                }
            }
        }

        Ok(())
    }

    /// Emits Copy root operations with parallel copy semantics.
    ///
    /// Copy roots may have dependencies (other ops that produce their sources)
    /// and may conflict with each other (one reads a local another writes).
    /// This function handles these conflicts by:
    /// 1. Generating all dependencies of all Copy roots
    /// 2. Loading all source values (using temps for conflicts)
    /// 3. Storing all destinations
    fn emit_copy_roots_parallel(
        &mut self,
        encoder: &mut InstructionEncoder,
        ctx: &BlockCodegenContext<'_>,
        copy_roots: &[usize],
        generated: &mut HashSet<usize>,
        use_counts: &HashMap<SsaVarId, usize>,
    ) -> Result<()> {
        struct CopyInfo {
            src_var: SsaVarId,
            dest_var: SsaVarId,
            dest_storage: VarStorage,
        }

        // Phase 1: Generate all dependencies of all Copy roots.
        // This ensures operations like Add are completed before any Copy stores.
        for &copy_idx in copy_roots {
            self.generate_copy_deps_recursive(encoder, ctx, copy_idx, generated, use_counts)?;
        }

        // Phase 2: Collect all copy operations and their storage info.
        // For each Copy root, we need its source value and destination storage.
        let mut copies: Vec<CopyInfo> = Vec::new();

        for &copy_idx in copy_roots {
            if generated.contains(&copy_idx) {
                continue;
            }
            if let SsaOp::Copy { dest, src } = ctx.ops[copy_idx] {
                let dest_storage = self.get_or_allocate_storage(ctx.ssa, *dest)?;
                copies.push(CopyInfo {
                    src_var: *src,
                    dest_var: *dest,
                    dest_storage,
                });
            }
        }

        if copies.is_empty() {
            return Ok(());
        }

        // Phase 3: Detect interference - does any copy read from a local that
        // another copy writes to?
        let has_interference = copies.iter().any(|copy_a| {
            // Get the storage of copy_a's source
            let src_storage = self
                .var_storage
                .get(&copy_a.src_var)
                .copied()
                .unwrap_or(VarStorage::Stack);

            // Check if any other copy writes to this storage
            copies
                .iter()
                .any(|copy_b| !std::ptr::eq(copy_a, copy_b) && src_storage == copy_b.dest_storage)
        });

        if has_interference {
            // Interference detected: use parallel copy semantics.
            // Load all sources first, storing to temporaries.
            // Use the temp pool for slot reuse.
            let mut temps: Vec<(u16, SsaType, VarStorage, SsaVarId)> = Vec::new();
            for copy_info in &copies {
                self.load_var(encoder, ctx.ssa, copy_info.src_var)?;

                // Determine the type for this temporary
                let var_type = Self::infer_variable_type(ctx.ssa, copy_info.src_var)?;

                // Allocate from pool or fresh
                let temp_idx = self.allocate_temp_local(&var_type);

                self.used_locals.insert(temp_idx);
                emitter::emit_stloc(encoder, temp_idx)?;
                self.last_load = None;
                temps.push((
                    temp_idx,
                    var_type,
                    copy_info.dest_storage,
                    copy_info.dest_var,
                ));
            }

            // Now store from temporaries to destinations, then release temps
            for (temp_idx, var_type, dest_storage, dest_var) in temps {
                self.used_locals.insert(temp_idx);
                emitter::emit_ldloc(encoder, temp_idx)?;
                match dest_storage {
                    VarStorage::Local(idx) => {
                        self.used_locals.insert(idx);
                        emitter::emit_stloc(encoder, idx)?;
                    }
                    VarStorage::Arg(idx) => emitter::emit_starg(encoder, idx)?,
                    VarStorage::Stack => {
                        return Err(Error::Deobfuscation(format!(
                            "emit_copy_roots_parallel: copy destination {dest_var:?} has Stack storage - this indicates a bug in storage allocation"
                        )));
                    }
                }
                self.last_load = None;

                // Release temp back to pool for reuse
                self.release_temp_local(temp_idx, &var_type);
            }
        } else {
            // Simple case: no interference, emit load-store pairs directly
            for copy_info in &copies {
                self.load_var(encoder, ctx.ssa, copy_info.src_var)?;
                match copy_info.dest_storage {
                    VarStorage::Local(idx) => {
                        self.used_locals.insert(idx);
                        emitter::emit_stloc(encoder, idx)?;
                    }
                    VarStorage::Arg(idx) => emitter::emit_starg(encoder, idx)?,
                    VarStorage::Stack => {
                        return Err(Error::Deobfuscation(format!(
                            "emit_copy_roots_parallel: copy destination {:?} has Stack storage - this indicates a bug in storage allocation",
                            copy_info.dest_var
                        )));
                    }
                }
                self.last_load = None;
            }
        }

        // Mark all Copy roots as generated
        for &copy_idx in copy_roots {
            generated.insert(copy_idx);
        }

        Ok(())
    }

    /// Recursively generates dependencies of a Copy root.
    fn generate_copy_deps_recursive(
        &mut self,
        encoder: &mut InstructionEncoder,
        ctx: &BlockCodegenContext<'_>,
        idx: usize,
        generated: &mut HashSet<usize>,
        use_counts: &HashMap<SsaVarId, usize>,
    ) -> Result<()> {
        // Get the operands of this op
        let operands = &ctx.operands_cache[idx];

        for &operand in operands {
            if let Some(&dep_idx) = ctx.def_map.get(&operand) {
                if !generated.contains(&dep_idx) {
                    // Recursively generate dependencies first
                    self.generate_copy_deps_recursive(
                        encoder, ctx, dep_idx, generated, use_counts,
                    )?;

                    // Skip Copy ops - they'll be handled in the parallel copy phase
                    if matches!(ctx.ops[dep_idx], SsaOp::Copy { .. }) {
                        continue;
                    }

                    // Spill all stack_vars BEFORE loading operands to avoid the issue where
                    // loading some operands from storage buries stack_vars values, causing
                    // subsequent spills to store the wrong values.
                    if !self.stack_vars.is_empty() {
                        self.spill_stack(encoder, ctx.ssa)?;
                    }

                    // Generate operands for this dependency
                    for &dep_operand in &ctx.operands_cache[dep_idx] {
                        if let Some(&dep_dep_idx) = ctx.def_map.get(&dep_operand) {
                            if generated.contains(&dep_dep_idx) {
                                // Operand's defining op is generated, load it
                                self.load_var(encoder, ctx.ssa, dep_operand)?;
                            } else if matches!(ctx.ops[dep_dep_idx], SsaOp::Copy { .. }) {
                                // Operand is a Copy result that hasn't been generated.
                                // Load the Copy's source instead - it should be available.
                                let SsaOp::Copy { src, .. } = ctx.ops[dep_dep_idx] else {
                                    unreachable!()
                                };
                                self.load_var(encoder, ctx.ssa, *src)?;
                            } else {
                                // The operand's defining op should have been generated
                                // by the recursive call above. If we get here, something
                                // unexpected happened - load it anyway to avoid stack underflow.
                                self.load_var(encoder, ctx.ssa, dep_operand)?;
                            }
                        } else {
                            // External operand
                            self.load_var(encoder, ctx.ssa, dep_operand)?;
                        }
                    }

                    self.generate_op_core(
                        encoder,
                        ctx.ssa,
                        ctx.current_block_idx,
                        ctx.ops[dep_idx],
                        None,
                    )?;
                    generated.insert(dep_idx);

                    // Handle storage for the result
                    if let Some(dest) = ctx.ops[dep_idx].dest() {
                        let uses = use_counts.get(&dest).copied().unwrap_or(0);
                        let used_outside_block =
                            Self::is_used_outside_block(ctx.ssa, dest, ctx.current_block_idx);

                        if uses > 1 || used_outside_block {
                            self.store_var(encoder, ctx.ssa, dest)?;
                        } else {
                            self.stack_vars.push(dest);
                        }
                    }
                }
            }
        }

        Ok(())
    }

    /// Generates just the core operation, assuming operands are already on the stack.
    fn generate_op_core(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        current_block_idx: usize,
        op: &SsaOp,
        next_block_idx: Option<usize>,
    ) -> Result<()> {
        // Clear last_load tracking - after any operation, the stack state changes
        // and the "last loaded" value may no longer be on top of the stack.
        self.last_load = None;

        match op {
            SsaOp::Const { dest, value } => {
                self.generate_const(encoder, value)?;
                // Don't store - the caller will handle the value
                // (it's left on the stack for the consumer)
                let _ = dest; // Silence unused warning
            }

            SsaOp::Add { dest, .. } => {
                encoder.emit_instruction("add", None)?;
                let _ = dest;
            }

            SsaOp::Sub { dest, .. } => {
                encoder.emit_instruction("sub", None)?;
                let _ = dest;
            }

            SsaOp::Mul { dest, .. } => {
                encoder.emit_instruction("mul", None)?;
                let _ = dest;
            }

            SsaOp::Div { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("div.un", None)?;
                } else {
                    encoder.emit_instruction("div", None)?;
                }
                let _ = dest;
            }

            SsaOp::Rem { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("rem.un", None)?;
                } else {
                    encoder.emit_instruction("rem", None)?;
                }
                let _ = dest;
            }

            SsaOp::AddOvf { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("add.ovf.un", None)?;
                } else {
                    encoder.emit_instruction("add.ovf", None)?;
                }
                let _ = dest;
            }

            SsaOp::SubOvf { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("sub.ovf.un", None)?;
                } else {
                    encoder.emit_instruction("sub.ovf", None)?;
                }
                let _ = dest;
            }

            SsaOp::MulOvf { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("mul.ovf.un", None)?;
                } else {
                    encoder.emit_instruction("mul.ovf", None)?;
                }
                let _ = dest;
            }

            SsaOp::And { dest, .. } => {
                encoder.emit_instruction("and", None)?;
                let _ = dest;
            }

            SsaOp::Or { dest, .. } => {
                encoder.emit_instruction("or", None)?;
                let _ = dest;
            }

            SsaOp::Xor { dest, .. } => {
                encoder.emit_instruction("xor", None)?;
                let _ = dest;
            }

            SsaOp::Shl { dest, .. } => {
                encoder.emit_instruction("shl", None)?;
                let _ = dest;
            }

            SsaOp::Shr { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("shr.un", None)?;
                } else {
                    encoder.emit_instruction("shr", None)?;
                }
                let _ = dest;
            }

            SsaOp::Neg { dest, .. } => {
                encoder.emit_instruction("neg", None)?;
                let _ = dest;
            }

            SsaOp::Not { dest, .. } => {
                encoder.emit_instruction("not", None)?;
                let _ = dest;
            }

            SsaOp::Conv {
                dest,
                target,
                overflow_check,
                unsigned,
                ..
            } => {
                // Operand already on stack
                emitter::emit_conv(encoder, target, *overflow_check, *unsigned)?;
                let _ = dest;
            }

            SsaOp::Ckfinite { dest, .. } => {
                encoder.emit_instruction("ckfinite", None)?;
                let _ = dest;
            }

            SsaOp::Ceq { dest, .. } => {
                encoder.emit_instruction("ceq", None)?;
                let _ = dest;
            }

            SsaOp::Clt { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("clt.un", None)?;
                } else {
                    encoder.emit_instruction("clt", None)?;
                }
                let _ = dest;
            }

            SsaOp::Cgt { dest, unsigned, .. } => {
                if *unsigned {
                    encoder.emit_instruction("cgt.un", None)?;
                } else {
                    encoder.emit_instruction("cgt", None)?;
                }
                let _ = dest;
            }

            SsaOp::Return { .. } => {
                // Spill any remaining stack values before return.
                // The return value (if any) is already on the stack from operand loading.
                // We need to spill OTHER values that might be lingering on stack_vars.
                //
                // Note: If there's a return value, it's already been consumed from stack_vars
                // during operand loading, so spilling here won't affect it.
                self.spill_stack(encoder, ssa)?;

                encoder.emit_instruction("ret", None)?;
            }

            SsaOp::Jump { target } => {
                // Spill any remaining stack values before control flow transfer.
                // This ensures all paths to the target have consistent stack depth.
                self.spill_stack(encoder, ssa)?;

                // Emit phi stores for the target block before jumping
                self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, *target)?;

                if Some(*target) != next_block_idx {
                    let label = self
                        .block_labels
                        .get(target)
                        .cloned()
                        .unwrap_or_else(|| format!("block_{target}"));
                    // emit_branch validates stack depth at target
                    encoder.emit_branch("br", &label)?;
                }
            }

            SsaOp::Branch {
                true_target,
                false_target,
                ..
            } => {
                // Spill any remaining stack values except the condition.
                // The condition is already on the stack from operand loading.
                self.spill_stack(encoder, ssa)?;

                // Handle phi stores for both targets using intermediate blocks
                self.emit_branch_with_phi_stores(
                    encoder,
                    ssa,
                    current_block_idx,
                    *true_target,
                    *false_target,
                    next_block_idx,
                )?;
            }

            SsaOp::Switch {
                targets, default, ..
            } => {
                // Spill any remaining stack values except the switch value.
                self.spill_stack(encoder, ssa)?;

                // Handle phi stores for switch targets using intermediate blocks
                self.emit_switch_with_phi_stores(
                    encoder,
                    ssa,
                    current_block_idx,
                    targets,
                    *default,
                    next_block_idx,
                )?;
            }

            SsaOp::Throw { .. } => {
                // Spill any remaining stack values except the exception.
                self.spill_stack(encoder, ssa)?;

                encoder.emit_instruction("throw", None)?;
            }

            SsaOp::Rethrow => {
                // Spill any remaining stack values.
                self.spill_stack(encoder, ssa)?;

                encoder.emit_instruction("rethrow", None)?;
            }

            SsaOp::Leave { target } => {
                // Spill any remaining stack values before leaving protected region.
                self.spill_stack(encoder, ssa)?;

                // Emit phi stores for the target block before leaving
                self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, *target)?;

                let label = self
                    .block_labels
                    .get(target)
                    .cloned()
                    .unwrap_or_else(|| format!("block_{target}"));
                encoder.emit_branch("leave", &label)?;
            }

            SsaOp::EndFinally => {
                // Spill any remaining stack values.
                self.spill_stack(encoder, ssa)?;

                encoder.emit_instruction("endfinally", None)?;
            }

            SsaOp::EndFilter { .. } => {
                // Spill any remaining stack values except the filter result.
                self.spill_stack(encoder, ssa)?;

                encoder.emit_instruction("endfilter", None)?;
            }

            SsaOp::Pop { .. } => {
                // Value already on stack
                encoder.emit_instruction("pop", None)?;
            }

            SsaOp::Nop => {
                encoder.emit_instruction("nop", None)?;
            }
            SsaOp::Call { dest, method, args } => {
                // num_args: the method arguments that were pushed on stack
                let num_args = u8::try_from(args.len()).unwrap_or(u8::MAX);
                let has_result = dest.is_some();
                encoder.emit_call(
                    "call",
                    Some(Operand::Token(method.token())),
                    num_args,
                    has_result,
                )?;
                // Result left on stack - handled by caller
                let _ = dest;
            }

            SsaOp::CallVirt { dest, method, args } => {
                // num_args: the method arguments that were pushed on stack
                let num_args = u8::try_from(args.len()).unwrap_or(u8::MAX);
                let has_result = dest.is_some();
                encoder.emit_call(
                    "callvirt",
                    Some(Operand::Token(method.token())),
                    num_args,
                    has_result,
                )?;
                let _ = dest;
            }

            SsaOp::CallIndirect {
                dest,
                signature,
                args,
                ..
            } => {
                // num_args: function pointer + the method arguments
                let num_args = u8::try_from(args.len() + 1).unwrap_or(u8::MAX);
                let has_result = dest.is_some();
                encoder.emit_call(
                    "calli",
                    Some(Operand::Token(signature.token())),
                    num_args,
                    has_result,
                )?;
                let _ = dest;
            }

            SsaOp::NewObj { dest, ctor, args } => {
                // num_args: constructor arguments (newobj always returns the new object)
                let num_args = u8::try_from(args.len()).unwrap_or(u8::MAX);
                encoder.emit_call("newobj", Some(Operand::Token(ctor.token())), num_args, true)?;
                let _ = dest;
            }
            SsaOp::Copy { dest, src } => {
                // Copy instruction: src is loaded by scheduler via get_operands_in_stack_order.
                // We just need to emit the store to dest's location.
                // Note: Copy instructions where src and dest have the same storage
                // are filtered out earlier (in generate_block_instructions), so we
                // always need to do the store here.
                let dest_storage = self.get_or_allocate_storage(ssa, *dest)?;
                match dest_storage {
                    VarStorage::Local(idx) => {
                        self.used_locals.insert(idx);
                        emitter::emit_stloc(encoder, idx)?;
                    }
                    VarStorage::Arg(idx) => emitter::emit_starg(encoder, idx)?,
                    VarStorage::Stack => {
                        // Can't store to stack, value already there
                    }
                }
                let _ = src;
            }
            SsaOp::LoadField { dest, field, .. } => {
                // object is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("ldfld", Some(Operand::Token(field.token())))?;
                let _ = dest;
            }
            SsaOp::StoreField { field, .. } => {
                // object and value are loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("stfld", Some(Operand::Token(field.token())))?;
            }

            SsaOp::LoadStaticField { dest, field } => {
                encoder.emit_instruction("ldsfld", Some(Operand::Token(field.token())))?;
                let _ = dest;
            }

            SsaOp::StoreStaticField { field, .. } => {
                // value is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("stsfld", Some(Operand::Token(field.token())))?;
            }
            SsaOp::LoadElement {
                dest, elem_type, ..
            } => {
                // array and index are loaded by scheduler via get_operands_in_stack_order
                emitter::emit_ldelem(encoder, elem_type)?;
                let _ = dest;
            }
            SsaOp::StoreElement { elem_type, .. } => {
                // array, index, and value are loaded by scheduler via get_operands_in_stack_order
                emitter::emit_stelem(encoder, elem_type)?;
            }
            SsaOp::ArrayLength { dest, .. } => {
                // array is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("ldlen", None)?;
                let _ = dest;
            }

            SsaOp::NewArr {
                dest, elem_type, ..
            } => {
                // length is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("newarr", Some(Operand::Token(elem_type.token())))?;
                let _ = dest;
            }
            SsaOp::Box {
                dest, value_type, ..
            } => {
                // value is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("box", Some(Operand::Token(value_type.token())))?;
                let _ = dest;
            }

            SsaOp::Unbox {
                dest, value_type, ..
            } => {
                // object is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("unbox", Some(Operand::Token(value_type.token())))?;
                let _ = dest;
            }
            SsaOp::UnboxAny {
                dest, value_type, ..
            } => {
                // object is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("unbox.any", Some(Operand::Token(value_type.token())))?;
                let _ = dest;
            }
            SsaOp::CastClass {
                dest, target_type, ..
            } => {
                // object is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("castclass", Some(Operand::Token(target_type.token())))?;
                let _ = dest;
            }
            SsaOp::IsInst {
                dest, target_type, ..
            } => {
                // object is loaded by scheduler via get_operands_in_stack_order
                encoder.emit_instruction("isinst", Some(Operand::Token(target_type.token())))?;
                let _ = dest;
            }

            SsaOp::SizeOf { dest, value_type } => {
                encoder.emit_instruction("sizeof", Some(Operand::Token(value_type.token())))?;
                let _ = dest;
            }

            SsaOp::LoadToken { dest, token } => {
                encoder.emit_instruction("ldtoken", Some(Operand::Token(token.token())))?;
                let _ = dest;
            }

            SsaOp::LoadArg { dest, arg_index } => {
                emitter::emit_ldarg(encoder, *arg_index)?;
                let _ = dest;
            }

            SsaOp::LoadLocal { dest, local_index } => {
                self.used_locals.insert(*local_index);
                emitter::emit_ldloc(encoder, *local_index)?;
                let _ = dest;
            }

            SsaOp::LoadArgAddr { dest, arg_index } => {
                emitter::emit_ldarga(encoder, *arg_index)?;
                let _ = dest;
            }

            SsaOp::LoadLocalAddr { dest, local_index } => {
                self.used_locals.insert(*local_index);
                emitter::emit_ldloca(encoder, *local_index)?;
                let _ = dest;
            }

            SsaOp::LoadFieldAddr { dest, field, .. } => {
                encoder.emit_instruction("ldflda", Some(Operand::Token(field.token())))?;
                let _ = dest;
            }

            SsaOp::LoadStaticFieldAddr { dest, field } => {
                encoder.emit_instruction("ldsflda", Some(Operand::Token(field.token())))?;
                let _ = dest;
            }

            SsaOp::LoadFunctionPtr { dest, method } => {
                encoder.emit_instruction("ldftn", Some(Operand::Token(method.token())))?;
                let _ = dest;
            }

            SsaOp::LoadVirtFunctionPtr { dest, method, .. } => {
                encoder.emit_instruction("ldvirtftn", Some(Operand::Token(method.token())))?;
                let _ = dest;
            }

            SsaOp::LocalAlloc { dest, .. } => {
                encoder.emit_instruction("localloc", None)?;
                let _ = dest;
            }

            SsaOp::InitObj { value_type, .. } => {
                encoder.emit_instruction("initobj", Some(Operand::Token(value_type.token())))?;
            }

            SsaOp::LoadObj {
                dest, value_type, ..
            } => {
                encoder.emit_instruction("ldobj", Some(Operand::Token(value_type.token())))?;
                let _ = dest;
            }

            SsaOp::StoreObj { value_type, .. } => {
                encoder.emit_instruction("stobj", Some(Operand::Token(value_type.token())))?;
            }

            SsaOp::LoadIndirect {
                dest, value_type, ..
            } => {
                let mnemonic = match value_type {
                    SsaType::I8 => "ldind.i1",
                    SsaType::U8 => "ldind.u1",
                    SsaType::I16 => "ldind.i2",
                    SsaType::U16 => "ldind.u2",
                    SsaType::U32 => "ldind.u4",
                    SsaType::I64 | SsaType::U64 => "ldind.i8",
                    SsaType::F32 => "ldind.r4",
                    SsaType::F64 => "ldind.r8",
                    SsaType::NativeInt | SsaType::NativeUInt => "ldind.i",
                    SsaType::Object => "ldind.ref",
                    _ => "ldind.i4", // I32 and other types default to i4
                };
                encoder.emit_instruction(mnemonic, None)?;
                let _ = dest;
            }

            SsaOp::StoreIndirect { value_type, .. } => {
                let mnemonic = match value_type {
                    SsaType::I8 | SsaType::U8 => "stind.i1",
                    SsaType::I16 | SsaType::U16 => "stind.i2",
                    SsaType::I64 | SsaType::U64 => "stind.i8",
                    SsaType::F32 => "stind.r4",
                    SsaType::F64 => "stind.r8",
                    SsaType::NativeInt | SsaType::NativeUInt => "stind.i",
                    SsaType::Object => "stind.ref",
                    _ => "stind.i4", // I32, U32, and other types default to i4
                };
                encoder.emit_instruction(mnemonic, None)?;
            }

            SsaOp::Break => {
                encoder.emit_instruction("break", None)?;
            }

            SsaOp::BranchCmp {
                cmp,
                unsigned,
                true_target,
                false_target,
                ..
            } => {
                // Spill any remaining stack values except the comparison operands.
                self.spill_stack(encoder, ssa)?;

                // Emit comparison branch with phi stores - operands are already on the stack
                self.emit_branch_cmp_with_phi_stores(
                    encoder,
                    ssa,
                    current_block_idx,
                    *cmp,
                    *unsigned,
                    *true_target,
                    *false_target,
                    next_block_idx,
                )?;
            }

            SsaOp::LoadElementAddr {
                dest, elem_type, ..
            } => {
                encoder.emit_instruction("ldelema", Some(Operand::Token(elem_type.token())))?;
                let _ = dest;
            }

            SsaOp::InitBlk { .. } => {
                encoder.emit_instruction("initblk", None)?;
            }

            SsaOp::CopyBlk { .. } => {
                encoder.emit_instruction("cpblk", None)?;
            }

            SsaOp::CopyObj { value_type, .. } => {
                encoder.emit_instruction("cpobj", Some(Operand::Token(value_type.token())))?;
            }

            SsaOp::Constrained {
                constraint_type, ..
            } => {
                encoder.emit_instruction(
                    "constrained.",
                    Some(Operand::Token(constraint_type.token())),
                )?;
            }

            SsaOp::Phi { .. } => {
                // Phi nodes are eliminated during code generation - no instruction emitted
            }
        }
        Ok(())
    }

    /// Schedules instructions within a block for optimal stack-based code generation.
    ///
    /// The scheduler reorders instructions so that value definitions occur immediately
    /// before their use, allowing values to be left on the stack instead of stored to
    /// locals. This is essential for producing clean CIL bytecode.
    ///
    /// # Algorithm
    ///
    /// 1. Build a map from each variable to the instruction that defines it
    /// 2. Build a map from each instruction to the variables it uses
    /// 3. Use a modified topological sort that schedules producers just before consumers
    /// 4. Handle terminators (jumps, branches, returns) specially - they must come last
    ///
    /// # Example
    ///
    /// Original SSA order:
    /// ```text
    /// v1 = const 2    // instruction 0
    /// v0 = ldarg 0    // instruction 1
    /// v2 = shl v0, v1 // instruction 2
    /// ret v2          // instruction 3
    /// ```
    ///
    /// Scheduled order:
    /// ```text
    /// v0 = ldarg 0    // instruction 1 (first operand of shl)
    /// v1 = const 2    // instruction 0 (second operand of shl)
    /// v2 = shl v0, v1 // instruction 2 (consumer)
    /// ret v2          // instruction 3 (terminator)
    /// ```
    fn schedule_instructions(&self, ops: &[&SsaOp]) -> Vec<usize> {
        if ops.is_empty() {
            return Vec::new();
        }

        // Build def map: variable -> instruction index that defines it
        let mut def_map: HashMap<SsaVarId, usize> = HashMap::new();
        for (idx, op) in ops.iter().enumerate() {
            if let Some(dest) = op.dest() {
                def_map.insert(dest, idx);
            }
        }

        // Identify terminators (must be scheduled last, in order)
        let terminator_indices: Vec<usize> = ops
            .iter()
            .enumerate()
            .filter(|(_, op)| Self::is_terminator(op))
            .map(|(idx, _)| idx)
            .collect();

        // Set of terminator indices for quick lookup
        let terminator_set: HashSet<usize> = terminator_indices.iter().copied().collect();

        // Identify "root" instructions: those whose results are NOT used by other
        // instructions in the same block (they are consumed by terminators, or
        // are used outside this block, or have side effects).
        // We only schedule these roots, and their dependencies will be pulled in.
        let mut used_in_block: HashSet<SsaVarId> = HashSet::new();
        for op in ops {
            for use_var in Self::get_operands_in_stack_order(op) {
                used_in_block.insert(use_var);
            }
        }

        // Find root instructions: non-terminators whose result is NOT used by
        // another non-terminator in this block
        let mut roots: Vec<usize> = Vec::new();
        for (idx, op) in ops.iter().enumerate() {
            if terminator_set.contains(&idx) {
                continue;
            }
            if let Some(dest) = op.dest() {
                // Check if this result is used only by terminators or outside block
                let used_by_non_terminator = ops.iter().enumerate().any(|(other_idx, other_op)| {
                    !terminator_set.contains(&other_idx)
                        && other_idx != idx
                        && Self::get_operands_in_stack_order(other_op).contains(&dest)
                });
                if !used_by_non_terminator {
                    roots.push(idx);
                }
            } else {
                // Instructions without a dest (side effects) are always roots
                roots.push(idx);
            }
        }

        // Track which instructions have been scheduled
        let mut scheduled: Vec<usize> = Vec::with_capacity(ops.len());
        let mut scheduled_set: HashSet<usize> = HashSet::new();

        // Separate roots into non-Copy and Copy instructions.
        // Copy instructions that write to a local may clobber values that other
        // instructions need to read. By scheduling non-Copy roots first, we ensure
        // all reads from locals happen before any Copy writes that might overwrite them.
        // This prevents Write-After-Read (WAR) hazards caused by storage aliasing
        // (e.g., when phi operands and results are coalesced to the same local).
        let (non_copy_roots, copy_roots): (Vec<usize>, Vec<usize>) = roots
            .into_iter()
            .partition(|&idx| !matches!(ops[idx], SsaOp::Copy { .. }));

        // Schedule non-Copy roots first (arithmetic, loads, etc.)
        for root_idx in non_copy_roots {
            self.schedule_with_dependencies(
                root_idx,
                ops,
                &def_map,
                &terminator_set,
                &mut scheduled,
                &mut scheduled_set,
            );
        }

        // Schedule Copy roots after (these may clobber locals)
        for root_idx in copy_roots {
            self.schedule_with_dependencies(
                root_idx,
                ops,
                &def_map,
                &terminator_set,
                &mut scheduled,
                &mut scheduled_set,
            );
        }

        // Append terminators in their original order
        for term_idx in terminator_indices {
            // Schedule any dependencies of the terminator first
            self.schedule_with_dependencies(
                term_idx,
                ops,
                &def_map,
                &terminator_set,
                &mut scheduled,
                &mut scheduled_set,
            );
        }

        scheduled
    }

    /// Recursively schedules an instruction and its dependencies.
    ///
    /// For each operand used by the instruction, if the operand is defined
    /// in this block and hasn't been scheduled yet, schedule it first.
    /// However, if an operand is the LAST operand and all prior operands are
    /// simple loads, we DON'T schedule it - it will be generated inline and
    /// left on the stack.
    fn schedule_with_dependencies(
        &self,
        idx: usize,
        ops: &[&SsaOp],
        def_map: &HashMap<SsaVarId, usize>,
        terminator_set: &HashSet<usize>,
        scheduled: &mut Vec<usize>,
        scheduled_set: &mut HashSet<usize>,
    ) {
        if scheduled_set.contains(&idx) {
            return; // Already scheduled
        }

        let op = ops[idx];

        // Get the operands in the order they need to be on the stack
        // For binary ops: left first, then right
        // For shifts: value first, then amount
        let operands = Self::get_operands_in_stack_order(op);

        // Schedule dependencies, but skip the last one if prior operands are simple loads
        // This allows the last dependency to be generated inline and left on the stack
        let can_inline_last = operands.len() > 1
            && operands[..operands.len() - 1]
                .iter()
                .all(|&v| self.is_simple_load(v) || !def_map.contains_key(&v));

        for (i, operand) in operands.iter().enumerate() {
            // Skip the last operand if it can be inlined
            let is_last = i == operands.len() - 1;
            if is_last && can_inline_last {
                continue;
            }

            if let Some(&dep_idx) = def_map.get(operand) {
                // Only schedule if defined in this block and not a terminator
                if !terminator_set.contains(&dep_idx) {
                    self.schedule_with_dependencies(
                        dep_idx,
                        ops,
                        def_map,
                        terminator_set,
                        scheduled,
                        scheduled_set,
                    );
                }
            }
        }

        // Now schedule this instruction
        scheduled.push(idx);
        scheduled_set.insert(idx);
    }

    /// Gets the operands of an operation in the order they should appear on the stack.
    ///
    /// For CIL stack-based operations, operands are consumed in a specific order.
    /// This method returns operands in that order so scheduling can ensure
    /// the correct stack layout.
    #[allow(clippy::match_same_arms)] // Arms intentionally separate for semantic clarity
    fn get_operands_in_stack_order(op: &SsaOp) -> Vec<SsaVarId> {
        match op {
            // Binary operations: left on stack bottom, right on top
            SsaOp::Add { left, right, .. }
            | SsaOp::AddOvf { left, right, .. }
            | SsaOp::Sub { left, right, .. }
            | SsaOp::SubOvf { left, right, .. }
            | SsaOp::Mul { left, right, .. }
            | SsaOp::MulOvf { left, right, .. }
            | SsaOp::Div { left, right, .. }
            | SsaOp::Rem { left, right, .. }
            | SsaOp::And { left, right, .. }
            | SsaOp::Or { left, right, .. }
            | SsaOp::Xor { left, right, .. }
            | SsaOp::Ceq { left, right, .. }
            | SsaOp::Clt { left, right, .. }
            | SsaOp::Cgt { left, right, .. } => vec![*left, *right],

            // Shift operations: value on bottom, amount on top
            SsaOp::Shl { value, amount, .. } | SsaOp::Shr { value, amount, .. } => {
                vec![*value, *amount]
            }

            // Unary operations: single operand
            SsaOp::Neg { operand, .. }
            | SsaOp::Not { operand, .. }
            | SsaOp::Conv { operand, .. }
            | SsaOp::Ckfinite { operand, .. } => vec![*operand],

            // Return with value
            SsaOp::Return { value: Some(v) } => vec![*v],

            // Branch condition
            SsaOp::Branch { condition, .. } => vec![*condition],

            // BranchCmp: left and right operands
            SsaOp::BranchCmp { left, right, .. } => vec![*left, *right],

            // Throw exception
            SsaOp::Throw { exception } => vec![*exception],

            // Pop value
            SsaOp::Pop { value } => vec![*value],

            // Switch value
            SsaOp::Switch { value, .. } => vec![*value],

            // Store operations: object first (if present), then value
            SsaOp::StoreField { object, value, .. } => vec![*object, *value],

            SsaOp::StoreStaticField { value, .. } => vec![*value],

            // Store element: array, index, then value
            SsaOp::StoreElement {
                array,
                index,
                value,
                ..
            } => vec![*array, *index, *value],

            // Load element: array first, then index
            SsaOp::LoadElement { array, index, .. }
            | SsaOp::LoadElementAddr { array, index, .. } => vec![*array, *index],

            // Array length
            SsaOp::ArrayLength { array, .. } => vec![*array],

            // Load field: object reference
            SsaOp::LoadField { object, .. } | SsaOp::LoadFieldAddr { object, .. } => vec![*object],

            // New array: length
            SsaOp::NewArr { length, .. } => vec![*length],

            // Boxing/unboxing operations
            SsaOp::Box { value, .. } => vec![*value],
            SsaOp::Unbox { object, .. }
            | SsaOp::UnboxAny { object, .. }
            | SsaOp::CastClass { object, .. }
            | SsaOp::IsInst { object, .. } => vec![*object],

            // Copy operation
            SsaOp::Copy { src, .. } => vec![*src],

            // Local allocation
            SsaOp::LocalAlloc { size, .. } => vec![*size],

            // Virtual function pointer
            SsaOp::LoadVirtFunctionPtr { object, .. } => vec![*object],

            // Object operations
            SsaOp::InitObj { dest_addr, .. } => vec![*dest_addr],
            SsaOp::LoadObj { src_addr, .. } => vec![*src_addr],
            SsaOp::StoreObj {
                dest_addr, value, ..
            } => vec![*dest_addr, *value],
            SsaOp::CopyObj {
                dest_addr,
                src_addr,
                ..
            } => vec![*dest_addr, *src_addr],

            // Indirect memory operations
            SsaOp::LoadIndirect { addr, .. } => vec![*addr],
            SsaOp::StoreIndirect { addr, value, .. } => vec![*addr, *value],

            // Block memory operations
            SsaOp::InitBlk {
                dest_addr,
                value,
                size,
            } => vec![*dest_addr, *value, *size],
            SsaOp::CopyBlk {
                dest_addr,
                src_addr,
                size,
            } => vec![*dest_addr, *src_addr, *size],

            // Exception handling
            SsaOp::EndFilter { result } => vec![*result],

            // Call operations: use the op's uses() method
            SsaOp::Call { .. }
            | SsaOp::CallVirt { .. }
            | SsaOp::CallIndirect { .. }
            | SsaOp::NewObj { .. } => op.uses(),

            // Operations with no operands or operands from outside the block
            _ => Vec::new(),
        }
    }

    /// Checks if an operation is a terminator (control flow instruction).
    fn is_terminator(op: &SsaOp) -> bool {
        matches!(
            op,
            SsaOp::Jump { .. }
                | SsaOp::Branch { .. }
                | SsaOp::BranchCmp { .. }
                | SsaOp::Switch { .. }
                | SsaOp::Return { .. }
                | SsaOp::Throw { .. }
                | SsaOp::Rethrow
                | SsaOp::Leave { .. }
                | SsaOp::EndFinally
                | SsaOp::EndFilter { .. }
        )
    }

    /// Loads a constant value onto the stack.
    ///
    /// Uses optimized CIL instructions where possible (ldc.i4.0 through ldc.i4.8,
    /// ldc.i4.s for small values, etc.).
    fn generate_const(&self, encoder: &mut InstructionEncoder, value: &ConstValue) -> Result<()> {
        match value {
            // 8-bit signed integers use ldc.i4.s (sign-extends to i32)
            ConstValue::I8(v) => {
                encoder
                    .emit_instruction("ldc.i4.s", Some(Operand::Immediate(Immediate::Int8(*v))))?;
            }

            // 8-bit unsigned integers: use ldc.i4.s only if value fits in signed byte,
            // otherwise use ldc.i4 to avoid incorrect sign extension
            ConstValue::U8(v) => {
                if *v <= 127 {
                    encoder.emit_instruction(
                        "ldc.i4.s",
                        Some(Operand::Immediate(Immediate::Int8((*v).cast_signed()))),
                    )?;
                } else {
                    // Value > 127 would be sign-extended incorrectly by ldc.i4.s
                    encoder.emit_instruction(
                        "ldc.i4",
                        Some(Operand::Immediate(Immediate::Int32(i32::from(*v)))),
                    )?;
                }
            }

            // 16-bit integers widen to i32 for ldc.i4
            ConstValue::I16(v) => {
                encoder.emit_instruction(
                    "ldc.i4",
                    Some(Operand::Immediate(Immediate::Int32(i32::from(*v)))),
                )?;
            }

            ConstValue::U16(v) => {
                encoder.emit_instruction(
                    "ldc.i4",
                    Some(Operand::Immediate(Immediate::Int32(i32::from(*v)))),
                )?;
            }

            // 32-bit signed integers have optimized forms for common values
            ConstValue::I32(v) => {
                emitter::emit_ldc_i4(encoder, *v)?;
            }

            // 32-bit unsigned uses TryFrom (bit-preserving cast to Int32)
            ConstValue::U32(_) => {
                encoder.emit_instruction(
                    "ldc.i4",
                    Some(Operand::Immediate(Immediate::try_from(value)?)),
                )?;
            }

            // 64-bit integers (signed and unsigned) use ldc.i8
            ConstValue::I64(_) | ConstValue::U64(_) => {
                encoder.emit_instruction(
                    "ldc.i8",
                    Some(Operand::Immediate(Immediate::try_from(value)?)),
                )?;
            }

            // Native integers need conv.i/conv.u after loading
            ConstValue::NativeInt(_) => {
                encoder.emit_instruction(
                    "ldc.i8",
                    Some(Operand::Immediate(Immediate::try_from(value)?)),
                )?;
                encoder.emit_instruction("conv.i", None)?;
            }

            ConstValue::NativeUInt(_) => {
                encoder.emit_instruction(
                    "ldc.i8",
                    Some(Operand::Immediate(Immediate::try_from(value)?)),
                )?;
                encoder.emit_instruction("conv.u", None)?;
            }

            // Floating point
            ConstValue::F32(_) => {
                encoder.emit_instruction(
                    "ldc.r4",
                    Some(Operand::Immediate(Immediate::try_from(value)?)),
                )?;
            }

            ConstValue::F64(_) => {
                encoder.emit_instruction(
                    "ldc.r8",
                    Some(Operand::Immediate(Immediate::try_from(value)?)),
                )?;
            }

            // String constants reference the user string heap
            ConstValue::String(idx) => {
                let token = Token::new(0x7000_0000 | *idx);
                encoder.emit_instruction("ldstr", Some(Operand::Token(token)))?;
            }

            // Decrypted strings look up pre-interned index
            ConstValue::DecryptedString(s) => {
                if let Some(&idx) = self.interned_strings.get(s) {
                    let token = Token::new(0x7000_0000 | idx);
                    encoder.emit_instruction("ldstr", Some(Operand::Token(token)))?;
                } else {
                    // String wasn't pre-interned - fall back to ldnull
                    encoder.emit_instruction("ldnull", None)?;
                }
            }

            // Null reference
            ConstValue::Null => {
                encoder.emit_instruction("ldnull", None)?;
            }

            // Booleans use optimized ldc.i4.1/ldc.i4.0
            ConstValue::True => {
                encoder.emit_instruction("ldc.i4.1", None)?;
            }

            ConstValue::False => {
                encoder.emit_instruction("ldc.i4.0", None)?;
            }

            // Runtime handles use ldtoken
            ConstValue::Type(type_ref) => {
                encoder.emit_instruction("ldtoken", Some(Operand::Token(type_ref.token())))?;
            }

            ConstValue::MethodHandle(method_ref) => {
                encoder.emit_instruction("ldtoken", Some(Operand::Token(method_ref.token())))?;
            }

            ConstValue::FieldHandle(field_ref) => {
                encoder.emit_instruction("ldtoken", Some(Operand::Token(field_ref.token())))?;
            }
        }
        Ok(())
    }

    /// Emits a load instruction for an SSA variable (argument, local, or stack).
    ///
    /// This method implements dup optimization: if we're loading the same storage
    /// location that was just loaded, we emit `dup` instead of another load.
    /// This saves code size (dup is 1 byte vs 2-4 bytes for ldloc/ldarg).
    fn load_var(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        var: SsaVarId,
    ) -> Result<()> {
        // Check if the variable is on the stack (from optimization)
        // Check if this is a deferred constant that should be generated inline
        if let Some(value) = self.deferred_constants.remove(&var) {
            // Generate the constant inline instead of loading from storage
            self.generate_const(encoder, &value)?;
            self.last_load = None;
            return Ok(());
        }

        // Only use stack optimization if the variable is on TOP of the tracked stack.
        // Variables anywhere else in stack_vars have been "buried" by subsequent values.
        if let Some(last) = self.stack_vars.last() {
            if *last == var {
                // Value is on top of the stack - no load needed
                self.stack_vars.pop();
                self.last_load = None;
                return Ok(());
            }
        }

        // If we're about to push a new value and there are stack_vars values that
        // will be buried, we need to save them first so they can be loaded later.
        // This handles the case where a single-use value was left on the stack but
        // other operands need to be loaded first.
        while let Some(buried_var) = self.stack_vars.pop() {
            // Get or force-allocate storage for the buried variable.
            // We use force_allocate_storage here because the variable MUST be
            // stored to a local - it's being buried and will need to be loaded later.
            // This handles stack_locals that unexpectedly need real storage.
            let storage = self.force_allocate_storage(ssa, buried_var)?;
            match storage {
                VarStorage::Local(idx) => {
                    self.used_locals.insert(idx);
                    emitter::emit_stloc(encoder, idx)?;
                }
                VarStorage::Arg(idx) => emitter::emit_starg(encoder, idx)?,
                VarStorage::Stack => {
                    // This should not happen with force_allocate_storage
                    return Err(Error::Deobfuscation(format!(
                        "load_var: buried variable {buried_var:?} still has Stack storage after force allocation - this indicates a bug"
                    )));
                }
            }
        }

        // Check if this variable is defined by a Const but wasn't deferred.
        // This handles constants that are used multiple times or defined in
        // non-dominating blocks (e.g., constants defined in initialization
        // paths that are used in loop back-edges).
        if !self.var_storage.contains_key(&var) {
            if let Some(SsaOp::Const { value, .. }) = ssa.get_definition(var) {
                self.generate_const(encoder, value)?;
                self.last_load = None;
                return Ok(());
            }
        }

        let storage = self.get_storage(var, ssa)?;

        // Dup optimization: if we're loading the same location we just loaded,
        // emit dup instead. This works because the previous value is still on
        // the stack and we can duplicate it.
        if self.last_load == Some(storage) {
            encoder.emit_instruction("dup", None)?;
            // Keep last_load the same - the duplicated value is conceptually
            // the same as the original, so another dup would still be valid
            return Ok(());
        }

        // Emit the actual load and track it
        match storage {
            VarStorage::Arg(idx) => {
                emitter::emit_ldarg(encoder, idx)?;
                self.last_load = Some(storage);
            }
            VarStorage::Local(idx) => {
                self.used_locals.insert(idx);
                emitter::emit_ldloc(encoder, idx)?;
                self.last_load = Some(storage);
            }
            VarStorage::Stack => {
                // This happens when a variable was identified as a stack_local
                // (expected to be consumed immediately after definition), but
                // we're trying to load it in a different context. The value
                // should already be on the stack from the producer operation.
                self.last_load = None;
            }
        }
        Ok(())
    }

    /// Emits a store instruction for an SSA variable (argument or local).
    ///
    /// This also clears the `last_load` tracking since a store consumes the top of
    /// the stack, invalidating any previous load state used for dup optimization.
    fn store_var(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        var: SsaVarId,
    ) -> Result<()> {
        // A store consumes the top of the stack, so clear last_load to prevent
        // incorrect dup optimizations. Without this, sequences like:
        //   load X, store Y, load X
        // would incorrectly emit: ldloc.X, stloc.Y, dup
        // when they should emit: ldloc.X, stloc.Y, ldloc.X
        self.last_load = None;

        // Use get_or_allocate_storage to ensure we have a valid slot.
        // This handles the case where a variable doesn't have pre-allocated storage
        // (e.g., a deferred constant that got buried and needs to be stored).
        let storage = self.get_or_allocate_storage(ssa, var)?;

        match storage {
            VarStorage::Arg(idx) => emitter::emit_starg(encoder, idx),
            VarStorage::Local(idx) => {
                self.used_locals.insert(idx);
                emitter::emit_stloc(encoder, idx)
            }
            VarStorage::Stack => {
                // Should not happen - can't store to stack
                Ok(())
            }
        }
    }

    /// Spills all values currently on the stack to local variables.
    ///
    /// This must be called before any control flow instruction (branch, jump, switch,
    /// return, throw, leave) to ensure the stack is at a consistent depth at block
    /// boundaries. All paths to a label must have the same stack depth.
    ///
    /// Values in `stack_vars` are stored to their allocated local slots. This ensures
    /// they can be loaded again if needed in successor blocks.
    fn spill_stack(&mut self, encoder: &mut InstructionEncoder, ssa: &SsaFunction) -> Result<()> {
        // Store all tracked stack values to locals, in order (bottom to top)
        // so the stores happen in the correct stack order.
        while let Some(var) = self.stack_vars.pop() {
            // Use force_allocate_storage instead of get_or_allocate_storage.
            // This handles the case where a variable was identified as a stack_local
            // (expected to be consumed before any spill) but actually needs to be
            // spilled due to control flow (e.g., terminator before consumer).
            let storage = self.force_allocate_storage(ssa, var)?;
            match storage {
                VarStorage::Local(idx) => {
                    self.used_locals.insert(idx);
                    emitter::emit_stloc(encoder, idx)?;
                }
                VarStorage::Arg(idx) => emitter::emit_starg(encoder, idx)?,
                VarStorage::Stack => {
                    // Should never happen with force_allocate_storage
                    return Err(Error::Deobfuscation(format!(
                        "spill_stack: variable {var:?} still has Stack storage after force allocation - this indicates a bug"
                    )));
                }
            }
        }
        self.last_load = None;
        Ok(())
    }

    /// Allocates a temporary local slot, reusing from the pool if available.
    ///
    /// This is used for phi copy temporaries and other short-lived values.
    /// When the temporary is no longer needed, call `release_temp_local` to
    /// return it to the pool for reuse.
    fn allocate_temp_local(&mut self, var_type: &SsaType) -> u16 {
        // Try to reuse a pooled slot of the same type
        if let Some(slot) = self.temp_pool.try_allocate(var_type) {
            return slot;
        }

        // No pooled slot available - allocate a fresh one
        let slot = self.next_local;
        self.next_local += 1;
        self.local_types.insert(slot, var_type.clone());
        slot
    }

    /// Releases a temporary local slot back to the pool for reuse.
    fn release_temp_local(&mut self, slot: u16, var_type: &SsaType) {
        self.temp_pool.release(slot, var_type.clone());
    }

    /// Checks if a successor block has phi nodes with operands from the current block.
    ///
    /// # Errors
    ///
    /// Returns an error if storage cannot be found for phi variables, indicating
    /// a bug in SSA construction.
    fn successor_has_phi_from(
        &self,
        ssa: &SsaFunction,
        current_block: usize,
        successor: usize,
    ) -> Result<bool> {
        let Some(succ_block) = ssa.block(successor) else {
            return Ok(false);
        };

        for phi in succ_block.phi_nodes() {
            if let Some(operand) = phi.operand_from(current_block) {
                // Skip dead phi results (not used by any instructions).
                // These are not pre-allocated during storage allocation.
                let phi_result = phi.result();
                let use_count = self
                    .global_use_counts
                    .get(&phi_result)
                    .copied()
                    .unwrap_or(0);
                if use_count == 0 {
                    continue;
                }

                // Check if phi store would actually do something.
                // IMPORTANT: If the operand doesn't have actual storage (e.g., a constant
                // defined in a non-dominating block), we need phi stores.
                let operand_has_storage = self.var_storage.contains_key(&operand.value());
                if !operand_has_storage {
                    // Operand has no storage - we need to emit it (constant inline)
                    return Ok(true);
                }
                let operand_storage = self.get_storage(operand.value(), ssa)?;
                let result_storage = self.get_storage(phi_result, ssa)?;
                if operand_storage != result_storage {
                    return Ok(true);
                }
            }
        }
        Ok(false)
    }

    /// Emits a conditional branch (brtrue/brfalse) with proper phi store handling.
    ///
    /// When branch targets have phi nodes, we emit intermediate blocks that:
    /// 1. Execute the phi stores for that specific edge
    /// 2. Jump to the actual target
    ///
    /// This handles the "critical edge splitting" problem where different predecessors
    /// need to provide different values to phi nodes.
    fn emit_branch_with_phi_stores(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        current_block_idx: usize,
        true_target: usize,
        false_target: usize,
        next_block_idx: Option<usize>,
    ) -> Result<()> {
        let true_has_phi = self.successor_has_phi_from(ssa, current_block_idx, true_target)?;
        let false_has_phi = self.successor_has_phi_from(ssa, current_block_idx, false_target)?;

        let true_label = self
            .block_labels
            .get(&true_target)
            .cloned()
            .unwrap_or_else(|| format!("block_{true_target}"));
        let false_label = self
            .block_labels
            .get(&false_target)
            .cloned()
            .unwrap_or_else(|| format!("block_{false_target}"));

        // Simple case: no phi stores needed for either target
        if !true_has_phi && !false_has_phi {
            if Some(false_target) == next_block_idx {
                encoder.emit_branch("brtrue", &true_label)?;
            } else if Some(true_target) == next_block_idx {
                encoder.emit_branch("brfalse", &false_label)?;
            } else {
                encoder.emit_branch("brtrue", &true_label)?;
                encoder.emit_branch("br", &false_label)?;
            }
            return Ok(());
        }

        // Generate unique intermediate label for false path (true path is inline)
        let phi_false_label = format!("phi_false_{current_block_idx}_{false_target}");

        // Emit the conditional branch
        // Strategy: brfalse to false handling, then handle true path
        if true_has_phi {
            encoder.emit_branch(
                "brfalse",
                if false_has_phi {
                    &phi_false_label
                } else {
                    &false_label
                },
            )?;

            // True path: emit phi stores then jump
            self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, true_target)?;
            if Some(true_target) != next_block_idx {
                encoder.emit_branch("br", &true_label)?;
            }
        } else {
            // No phi stores for true - just branch directly
            encoder.emit_branch("brtrue", &true_label)?;
        }

        // False path handling
        if false_has_phi {
            // Define the intermediate label for false path
            if true_has_phi {
                encoder.define_label(&phi_false_label)?;
            }
            // Emit phi stores for false target
            self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, false_target)?;
            if Some(false_target) != next_block_idx {
                encoder.emit_branch("br", &false_label)?;
            }
        } else if !true_has_phi {
            // Neither has phi, but we need to handle fallthrough
            if Some(false_target) != next_block_idx {
                encoder.emit_branch("br", &false_label)?;
            }
        }

        Ok(())
    }

    /// Emits a comparison branch (beq, blt, etc.) with proper phi store handling.
    #[allow(clippy::too_many_arguments)] // Branch emission requires comparison type, targets, and context
    fn emit_branch_cmp_with_phi_stores(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        current_block_idx: usize,
        cmp: CmpKind,
        unsigned: bool,
        true_target: usize,
        false_target: usize,
        next_block_idx: Option<usize>,
    ) -> Result<()> {
        let true_has_phi = self.successor_has_phi_from(ssa, current_block_idx, true_target)?;
        let false_has_phi = self.successor_has_phi_from(ssa, current_block_idx, false_target)?;

        let true_label = self
            .block_labels
            .get(&true_target)
            .cloned()
            .unwrap_or_else(|| format!("block_{true_target}"));
        let false_label = self
            .block_labels
            .get(&false_target)
            .cloned()
            .unwrap_or_else(|| format!("block_{false_target}"));

        // Get the comparison mnemonic and its inverse
        let (mnemonic, inverse_mnemonic) = match (cmp, unsigned) {
            (CmpKind::Eq, _) => ("beq", "bne.un"),
            (CmpKind::Ne, _) => ("bne.un", "beq"),
            (CmpKind::Lt, false) => ("blt", "bge"),
            (CmpKind::Lt, true) => ("blt.un", "bge.un"),
            (CmpKind::Le, false) => ("ble", "bgt"),
            (CmpKind::Le, true) => ("ble.un", "bgt.un"),
            (CmpKind::Gt, false) => ("bgt", "ble"),
            (CmpKind::Gt, true) => ("bgt.un", "ble.un"),
            (CmpKind::Ge, false) => ("bge", "blt"),
            (CmpKind::Ge, true) => ("bge.un", "blt.un"),
        };

        // Simple case: no phi stores needed for either target
        if !true_has_phi && !false_has_phi {
            encoder.emit_branch(mnemonic, &true_label)?;
            if Some(false_target) != next_block_idx {
                encoder.emit_branch("br", &false_label)?;
            }
            return Ok(());
        }

        // Generate unique intermediate labels
        let phi_false_label = format!("phi_false_{current_block_idx}_{false_target}");

        if true_has_phi {
            // Use inverse condition to branch to false handling, then handle true inline
            encoder.emit_branch(
                inverse_mnemonic,
                if false_has_phi {
                    &phi_false_label
                } else {
                    &false_label
                },
            )?;

            // True path: emit phi stores then jump
            self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, true_target)?;
            if Some(true_target) != next_block_idx {
                encoder.emit_branch("br", &true_label)?;
            }
        } else {
            // No phi stores for true - just branch directly
            encoder.emit_branch(mnemonic, &true_label)?;
        }

        // False path handling
        if false_has_phi {
            if true_has_phi {
                encoder.define_label(&phi_false_label)?;
            }
            self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, false_target)?;
            if Some(false_target) != next_block_idx {
                encoder.emit_branch("br", &false_label)?;
            }
        } else if !true_has_phi && Some(false_target) != next_block_idx {
            encoder.emit_branch("br", &false_label)?;
        }

        Ok(())
    }

    /// Emits a switch instruction with proper phi store handling.
    ///
    /// For each switch target that has phi nodes from the current block,
    /// we create an intermediate block that executes the phi stores and
    /// then jumps to the actual target.
    fn emit_switch_with_phi_stores(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        current_block_idx: usize,
        targets: &[usize],
        default: usize,
        next_block_idx: Option<usize>,
    ) -> Result<()> {
        // Determine which targets need phi stores
        let mut needs_intermediate: Vec<bool> = Vec::with_capacity(targets.len());
        for &target in targets {
            needs_intermediate.push(self.successor_has_phi_from(ssa, current_block_idx, target)?);
        }
        let default_needs_intermediate =
            self.successor_has_phi_from(ssa, current_block_idx, default)?;

        // Build the label list for the switch instruction
        // Use intermediate labels for targets that need phi stores
        let mut switch_labels: Vec<String> = Vec::with_capacity(targets.len());
        for (i, &target) in targets.iter().enumerate() {
            if needs_intermediate[i] {
                switch_labels.push(format!("phi_switch_{current_block_idx}_{i}"));
            } else {
                switch_labels.push(
                    self.block_labels
                        .get(&target)
                        .cloned()
                        .unwrap_or_else(|| format!("block_{target}")),
                );
            }
        }

        // Emit the switch instruction
        let label_refs: Vec<&str> = switch_labels.iter().map(String::as_str).collect();
        encoder.emit_switch(&label_refs)?;

        // Emit jump to default (or intermediate for default)
        let default_label = self
            .block_labels
            .get(&default)
            .cloned()
            .unwrap_or_else(|| format!("block_{default}"));

        if default_needs_intermediate {
            let default_intermediate = format!("phi_switch_{current_block_idx}_default");
            if Some(default) != next_block_idx {
                encoder.emit_branch("br", &default_intermediate)?;
            }

            // Emit intermediate blocks for targets that need phi stores
            for (i, &target) in targets.iter().enumerate() {
                if needs_intermediate[i] {
                    let intermediate_label = format!("phi_switch_{current_block_idx}_{i}");
                    encoder.define_label(&intermediate_label)?;
                    self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, target)?;
                    let target_label = self
                        .block_labels
                        .get(&target)
                        .cloned()
                        .unwrap_or_else(|| format!("block_{target}"));
                    encoder.emit_branch("br", &target_label)?;
                }
            }

            // Emit intermediate block for default
            encoder.define_label(&default_intermediate)?;
            self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, default)?;
            if Some(default) != next_block_idx {
                encoder.emit_branch("br", &default_label)?;
            }
        } else {
            // Default doesn't need phi stores
            if Some(default) != next_block_idx {
                encoder.emit_branch("br", &default_label)?;
            }

            // Emit intermediate blocks for targets that need phi stores
            for (i, &target) in targets.iter().enumerate() {
                if needs_intermediate[i] {
                    let intermediate_label = format!("phi_switch_{current_block_idx}_{i}");
                    encoder.define_label(&intermediate_label)?;
                    self.emit_phi_stores_for_successor(encoder, ssa, current_block_idx, target)?;
                    let target_label = self
                        .block_labels
                        .get(&target)
                        .cloned()
                        .unwrap_or_else(|| format!("block_{target}"));
                    encoder.emit_branch("br", &target_label)?;
                }
            }
        }

        Ok(())
    }

    /// Emits phi stores for a successor block.
    ///
    /// This implements phi elimination by converting SSA phi nodes to explicit stores
    /// at the end of predecessor blocks. The key challenge is handling "parallel copy"
    /// semantics correctly - all phi operands must be read BEFORE any are written,
    /// since phi nodes conceptually execute simultaneously.
    ///
    /// For example, consider:
    ///   PHI prev = phi(..., curr)    // prev gets old value of curr
    ///   PHI curr = phi(..., new_val) // curr gets new value
    ///
    /// Naive interleaved load/store would fail if curr is processed first:
    ///   1. Load new_val, store to curr (overwrites old curr!)
    ///   2. Load curr (now wrong!), store to prev
    ///
    /// We solve this by:
    /// 1. Building a dependency graph of the parallel copies
    /// 2. Processing non-cyclic dependencies in topological order
    /// 3. Breaking cycles with a temporary variable
    fn emit_phi_stores_for_successor(
        &mut self,
        encoder: &mut InstructionEncoder,
        ssa: &SsaFunction,
        current_block_idx: usize,
        successor_idx: usize,
    ) -> Result<()> {
        // Get the successor block
        let Some(successor) = ssa.block(successor_idx) else {
            return Ok(());
        };

        // Collect phi copies: (operand_storage, result_storage, operand_var)
        // We track operand_var to use load_var which handles constants correctly.
        //
        // Since Phase 2 pre-allocates all phi results to locals, we can directly
        // build the copies list without a two-phase approach.
        let mut copies: Vec<(VarStorage, VarStorage, SsaVarId)> = Vec::new();

        for phi in successor.phi_nodes() {
            if let Some(operand) = phi.operand_from(current_block_idx) {
                let operand_value = operand.value();
                let phi_result = phi.result();

                // Skip dead phi results (not used by any instructions).
                // These were also skipped during pre-allocation.
                let use_count = self
                    .global_use_counts
                    .get(&phi_result)
                    .copied()
                    .unwrap_or(0);
                if use_count == 0 {
                    continue;
                }

                // Get storage for both operand and result.
                // Phi results are pre-allocated to locals in allocate_storage().
                // Operands may be in args, locals, or need to be loaded (constants).
                let operand_storage = self
                    .var_storage
                    .get(&operand_value)
                    .copied()
                    .unwrap_or(VarStorage::Stack); // Will be loaded via load_var

                let result_storage = self
                    .var_storage
                    .get(&phi_result)
                    .copied()
                    .expect("Phi result should be pre-allocated");

                // Skip if coalesced (both have same storage) AND operand is not on stack.
                // If operand is on stack, we need to emit a store even for same storage.
                let operand_on_stack = self.stack_vars.contains(&operand_value);
                if operand_storage == result_storage && !operand_on_stack {
                    continue;
                }

                // Update type info: use operand's type if more specific than phi's
                if let VarStorage::Local(idx) = result_storage {
                    if let Some(operand_var) = ssa.variable(operand_value) {
                        let operand_type = operand_var.var_type();
                        if !operand_type.is_unknown() && !matches!(operand_type, SsaType::I32) {
                            self.local_types.insert(idx, operand_type.clone());
                        }
                    }
                }

                copies.push((operand_storage, result_storage, operand_value));
            }
        }

        if copies.is_empty() {
            return Ok(());
        }

        // Deduplicate copies with the same source and destination
        let mut seen: HashSet<(VarStorage, VarStorage)> = HashSet::new();
        copies.retain(|(src, dst, _)| seen.insert((*src, *dst)));

        // For correct parallel copy semantics, we must load ALL values before storing ANY.
        // This ensures that reads see the original values, not values modified by other copies.
        //
        // However, we can't just load all values onto the stack because:
        // 1. The stack depth could become large
        // 2. We need to pair loads with the correct stores
        //
        // Solution: Use a simple approach that handles the common cases efficiently:
        // - For non-interfering copies (no copy reads another's destination), do load-store pairs
        // - For interfering copies, use topological order with cycle breaking via temporaries
        //
        // Detect if any copy reads a location that another copy writes
        let has_interference = copies
            .iter()
            .any(|(src, _, _)| copies.iter().any(|(_, dst, _)| src == dst));

        if !has_interference {
            // Simple case: no interference, emit load-store pairs directly
            for (_, result_storage, operand_var) in &copies {
                self.load_var(encoder, ssa, *operand_var)?;
                match result_storage {
                    VarStorage::Local(idx) => {
                        self.used_locals.insert(*idx);
                        emitter::emit_stloc(encoder, *idx)?;
                    }
                    VarStorage::Arg(idx) => emitter::emit_starg(encoder, *idx)?,
                    VarStorage::Stack => {
                        return Err(Error::Deobfuscation(format!(
                            "emit_phi_stores_for_successor: phi result has Stack storage (operand={operand_var:?}) - this indicates a bug in phi pre-allocation"
                        )));
                    }
                }
                // Clear last_load after store to prevent incorrect dup optimization.
                // Without this, a subsequent load from the same local would emit dup
                // instead of ldloc, but the stack is now empty after the store.
                self.last_load = None;
            }
            return Ok(());
        }

        // Complex case: there's interference. Use topological ordering with cycle breaking.
        // Build dependency graph: copy A depends on copy B if A's source = B's destination
        // (i.e., A needs to read before B writes)
        let mut ordered_copies: Vec<(VarStorage, VarStorage, SsaVarId)> = Vec::new();
        let mut pending: Vec<Option<(VarStorage, VarStorage, SsaVarId)>> =
            copies.into_iter().map(Some).collect();
        let mut cycle_copies: Vec<(VarStorage, VarStorage, SsaVarId)> = Vec::new();

        // Iterate until all copies are scheduled
        loop {
            let mut made_progress = false;

            // Find copies whose destination is not read by any other pending copy
            for i in 0..pending.len() {
                let Some((_, dst, _)) = pending[i].as_ref() else {
                    continue;
                };
                let dst = *dst;

                // Check if this destination is read by any other pending copy
                let dst_is_read = pending.iter().enumerate().any(|(j, opt)| {
                    if i == j {
                        return false;
                    }
                    if let Some((src, _, _)) = opt {
                        *src == dst
                    } else {
                        false
                    }
                });

                if !dst_is_read {
                    // Safe to schedule this copy
                    if let Some(copy) = pending[i].take() {
                        ordered_copies.push(copy);
                        made_progress = true;
                    }
                }
            }

            // Count remaining copies
            let remaining: usize = pending.iter().filter(|o| o.is_some()).count();

            if remaining == 0 {
                break;
            }

            if !made_progress {
                // Cycle detected - move all remaining copies to cycle_copies
                for opt in &mut pending {
                    if let Some(copy) = opt.take() {
                        cycle_copies.push(copy);
                    }
                }
                break;
            }
        }

        // Emit non-cyclic copies in order (these are safe as load-store pairs)
        for (_, result_storage, operand_var) in &ordered_copies {
            self.load_var(encoder, ssa, *operand_var)?;
            match result_storage {
                VarStorage::Local(idx) => {
                    self.used_locals.insert(*idx);
                    emitter::emit_stloc(encoder, *idx)?;
                }
                VarStorage::Arg(idx) => emitter::emit_starg(encoder, *idx)?,
                VarStorage::Stack => {
                    return Err(Error::Deobfuscation(format!(
                        "emit_phi_stores_for_successor: phi result has Stack storage (operand={operand_var:?}) - this indicates a bug in phi pre-allocation"
                    )));
                }
            }
            // Clear last_load after store to prevent incorrect dup optimization
            self.last_load = None;
        }

        // Handle cyclic copies using temporaries
        // For a cycle like: A -> B -> C -> A
        // We need to: save A to temp, do B->A, C->B, temp->C
        // Use the temp pool for slot reuse.
        if !cycle_copies.is_empty() {
            // Load all cycle sources first, storing to temporaries
            let mut temps: Vec<(u16, SsaType, VarStorage)> = Vec::new();
            for (_, result_storage, operand_var) in &cycle_copies {
                self.load_var(encoder, ssa, *operand_var)?;

                // Determine the type for this temporary
                let var_type = Self::infer_variable_type(ssa, *operand_var)?;

                // Allocate from pool or fresh
                let temp_idx = self.allocate_temp_local(&var_type);

                self.used_locals.insert(temp_idx);
                emitter::emit_stloc(encoder, temp_idx)?;
                self.last_load = None; // Clear after store
                temps.push((temp_idx, var_type, *result_storage));
            }

            // Now store from temporaries to destinations, then release temps
            for (temp_idx, var_type, result_storage) in temps {
                self.used_locals.insert(temp_idx);
                emitter::emit_ldloc(encoder, temp_idx)?;
                match result_storage {
                    VarStorage::Local(idx) => {
                        self.used_locals.insert(idx);
                        emitter::emit_stloc(encoder, idx)?;
                    }
                    VarStorage::Arg(idx) => emitter::emit_starg(encoder, idx)?,
                    VarStorage::Stack => {
                        return Err(Error::Deobfuscation(
                            "emit_phi_stores_for_successor: phi result has Stack storage in cycle handling - this indicates a bug in phi pre-allocation".to_string()
                        ));
                    }
                }
                self.last_load = None; // Clear after store

                // Release temp back to pool for reuse
                self.release_temp_local(temp_idx, &var_type);
            }
        }

        Ok(())
    }
}