rucc_driver/

compile.rs

//! Running the front end over one file, from the bytes on disk to the typed tree.
//!
//! Design: `spec/04-driver-and-cli.md` section 4.3, and the `M2` exit criterion in
//! `spec/17-milestones.md` that says `--emit=tast` works.
//!
//! [`preprocess`](mod@crate::preprocess) stops after phase 4 because `-E` stops there. This
//! carries on: phase 7, the parse, and the checking. It is one function rather than four composed
//! ones because of what the four share. The tokens hold interned symbols, the untyped tree holds
//! tokens, the typed tree holds the untyped tree's spans, and none of them owns the table it is
//! reading, so one [`Session`] has to outlive all of them and there has to be one place that
//! holds it.

use std::path::Path;

use rucc_base::Interner;
use rucc_codegen::coverage::Fired;
use rucc_codegen::elsewhere::Elsewhere;
use rucc_codegen::lowering::Lowerings;
use rucc_codegen::pipeline::{self, Machine, Recording};
use rucc_codegen::pressure::Pressure;
use rucc_diag::{Diagnostic, Severity, Span};
use rucc_ir::{FpContract, Pic as IrPic, Visibility as IrVisibility};
use rucc_lex::{Convert, Keywords, PpToken, convert};
use rucc_lower::Protector as LowerProtector;
use rucc_sema::{Checker, Context as CheckContext};
use rucc_session::{
    Contract, EmitKind, FileSystem, Options, Padding, Pic, Protector, Session, Visibility,
};
use rucc_target::TargetInfo;
use rucc_tuple::{Arch, ObjectFormat};

use crate::preprocess::render;

/// What a compilation produced, which is text for most of the kinds and bytes for one of them.
///
/// Two variants rather than a string, because an object file is not text and a `Vec<u8>` holding
/// UTF-8 for six kinds and a file format for the seventh would leave every reader guessing which
/// it had. [`Artifact::Nothing`] is what a compilation that stopped early gives back, and it is
/// not the same as an empty file: nothing is written for it at all.
#[derive(Debug, Clone, PartialEq, Eq, Default)]
pub enum Artifact {
    /// The compilation stopped before it produced anything, or the kind asked for produces
    /// nothing yet.
    #[default]
    Nothing,
    /// Text, which is every kind up to and including assembly.
    Text(String),
    /// An object file, which is `-c`, and the names a linker can find in it.
    ///
    /// The names travel with the bytes rather than beside them because what wants them is the
    /// archive step, and an index entry that does not match the member is worse than no archive:
    /// the linker searches the index, pulls the member out, and still reports the name undefined.
    /// One value holding both is one value the two cannot disagree in.
    Object {
        /// The file.
        bytes: Vec<u8>,
        /// Every name another object can reach, as the object writer wrote them. Empty is a real
        /// answer: a translation unit of nothing but `static` functions is a member an archive
        /// carries and nothing ever pulls out.
        defines: Vec<String>,
    },
}

impl Artifact {
    /// The bytes to write, which is nothing at all for [`Artifact::Nothing`].
    #[must_use]
    pub fn bytes(&self) -> &[u8] {
        match self {
            Artifact::Nothing => &[],
            Artifact::Text(text) => text.as_bytes(),
            Artifact::Object { bytes, .. } => bytes,
        }
    }
}

/// What compiling one file produced.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Compiled {
    /// What to write, which is nothing when the compilation failed or produced nothing.
    pub artifact: Artifact,
    /// The diagnostics, already rendered, one per element, in the order they were reported.
    pub messages: Vec<String>,
    /// How many of them were errors.
    pub errors: u32,
    /// Which lowering rules this file fired, for `-Zrule-coverage`.
    ///
    /// Empty for a compilation that stopped before the back end, which every kind up to and
    /// including `--emit=ir` does. That is not the same as a rule set nothing reaches and the
    /// caller unions these rather than reading one, so a file that fired nothing adds nothing.
    pub fired: Fired,
    /// What the register allocator had to put on the stack, for `-Zregister-pressure`.
    ///
    /// Empty for the same compilations `fired` is empty for and for the same reason, since both
    /// are written by the back end and neither is a fact a file that stopped before it has.
    pub pressure: Pressure,
    /// What the pre-selection lowering group did, for `-Zlowering`.
    ///
    /// Empty for the same compilations `fired` is empty for and for the same reason, since the
    /// group runs in the back end and a file that stopped before it lowered nothing.
    pub lowerings: Lowerings,
    /// What `-fdump-ir=` asked to see, in the order the passes ran.
    ///
    /// The optimizer does not write files, because nothing below the driver in
    /// `spec/18-package-layout.md` knows what a file is, so the text comes back here and the
    /// caller decides where it goes.
    pub dumps: Vec<rucc_opt::Dump>,
    /// What `-fopt-info` asked to hear, already rendered, one remark per line.
    ///
    /// Empty when the flag was not given, and also empty when it was given and no pass had
    /// anything of the kinds asked for to say. Those two are the same text and different facts,
    /// which is why a misspelled keyword is an error rather than a quiet nothing.
    pub remarks: String,
    /// Every file an `#include` found, for the `-M` family.
    ///
    /// The same list `Preprocessed` carries and for the same reason. A `-MD` writes it beside
    /// the object, so the compiling path needs it as much as the preprocessing one does.
    pub deps: Vec<rucc_pp::Dependency>,
    /// What `-save-temps` asked to be kept, which is nothing at all unless it was given.
    ///
    /// It comes back from here rather than being produced by a second run of the compiler under
    /// different flags, because a second run is a second answer: the file a person reads has to
    /// be the file that was compiled, and two runs of anything with a `__TIME__` in it are not
    /// the same text.
    pub temps: Temps,
}

/// The intermediate text a compilation went through, kept when `-save-temps` asked for it.
///
/// Both are `None` on a compilation that was not asked to keep anything, and the assembly is
/// `None` on one that stopped before there was any. Holding the text rather than writing it is
/// what keeps this function free of the file system, which is what lets it be tested against a
/// map from path to bytes.
#[derive(Debug, Clone, PartialEq, Eq, Default)]
pub struct Temps {
    /// Phase 4's output, the same text `-E` would have printed.
    pub preprocessed: Option<String>,
    /// The assembly the back end produced on the way to the object file.
    pub assembly: Option<String>,
}

impl Compiled {
    /// Whether anything went wrong badly enough that the output should not be used.
    #[must_use]
    pub fn failed(&self) -> bool {
        self.errors > 0
    }

    /// The text that was produced, and the empty string for anything that is not text.
    ///
    /// A caller that asked for one of the text kinds knows which it asked for, so this saves it
    /// matching on a variant it has already ruled out.
    #[must_use]
    pub fn text(&self) -> &str {
        match &self.artifact {
            Artifact::Text(text) => text,
            _ => "",
        }
    }
}

/// Compiles one file as far as `opts.emit` asks for and renders the result.
///
/// `name` is the path as the user wrote it, which is the name every diagnostic about the file
/// uses. Every kind but the executable produces something today, and that one runs the same front
/// end and gives back nothing, so that a file with a mistake in it is reported the same way
/// whichever kind was asked for, rather than compiling silently until the part that is written
/// notices.
///
/// The checking is skipped when the parse reported an error. The two poisoning rules mean a
/// diagnosed expression produces no further complaints, but a declaration the parser had to skip
/// past leaves no declaration behind at all, and every later use of that name would be reported
/// as undeclared. One mistake is worth one message.
#[must_use]
pub fn compile(opts: &Options, name: &str, fs: &dyn FileSystem) -> Compiled {
    let mut sess = Session::new(opts.clone());
    // Before anything else interns a name. The keyword symbols have to be one unbroken run for
    // a lookup to be a subtraction, and the preprocessor interns every identifier it reads, so
    // building this after the expansion would mean building it after `char` had been seen.
    let keywords = Keywords::new(&mut sess.interner, opts.std, opts.gnu_extensions);
    let mut diagnostics: Vec<Diagnostic> = Vec::new();
    // Filled in by the back end when there is one, and empty for every kind that stops before it.
    let mut fired = Fired::new();
    // The same, and the other thing the back end is asked to record about itself.
    let mut pressure = Pressure::new();
    let mut lowerings = Lowerings::asked(opts.lowering_dump.is_some());
    // Filled in by the optimizer, and only when `-fdump-ir=` asked for something.
    let mut dumps = Vec::new();
    let mut remarks = String::new();
    // Filled in as the compilation goes past each of them, and only under `-save-temps`.
    let mut temps = Temps::default();

    let bytes = match fs.read(Path::new(name)) {
        Ok(bytes) => bytes,
        Err(e) => return failure(format!("{name}: {e}")),
    };
    let Ok(file) = sess.sources.add_shared(name, bytes, None) else {
        return failure(format!("{name}: the source map has no room left for this file"));
    };

    // Phases 1 to 4. The expanded stream is turned into pp-tokens straight away, because the
    // include context borrows the source map that rendering a diagnostic reads and the borrow
    // has to end before anything is rendered.
    let mut pp = rucc_pp::Preprocessor::with_prefix_map(opts.prefix_map.macros.clone());
    let predef = rucc_pp::Predef::for_options(opts);
    let expanded: Vec<PpToken> = {
        let mut tokens = Vec::new();
        // The inner block is the borrow. The printer under `-save-temps` reads the source map
        // that the include context is holding, so the context has to be gone before it runs, and
        // nothing happens in between, which is what makes the text it prints the text that is
        // compiled below rather than a second answer to the same question.
        {
            let mut cx =
                rucc_pp::Context::new(&mut sess.interner, &mut sess.sources, fs, &opts.search);
            cx.lex = rucc_lex::Options::for_dialect(opts.std, opts.gnu_extensions);
            cx.pedantic = opts.pedantic;
            if pp.predefine(&sess.target, &predef, &mut cx).is_err() {
                return failure(format!(
                    "{name}: the source map has no room for the built in macros"
                ));
            }
            if pp.preinclude(&opts.preincludes, &mut tokens, &mut cx).is_err() {
                return failure(format!("{name}: the source map has no room for the command line"));
            }
            tokens.append(&mut pp.run(file, &mut cx));
        }
        if opts.save_temps.wanted() {
            temps.preprocessed = Some(rucc_pp::print(
                file,
                &tokens,
                pp.line_directives(),
                &sess.sources,
                &sess.interner,
                rucc_pp::PrintOptions { line_markers: opts.line_markers },
            ));
        }
        tokens.iter().map(|token| token.to_pp()).collect()
    };
    diagnostics.extend(pp.take_diagnostics());
    // Taken here rather than at the end, because the preprocessor is done with and everything
    // after this is about the tree it produced.
    let deps = pp.dependencies().to_vec();

    // Phase 7, which is where a spelling becomes a keyword and a preprocessing number becomes
    // a constant of a type.
    let cx = Convert {
        keywords: &keywords,
        interner: &sess.interner,
        target: &sess.target,
        std: opts.std,
        gnu: opts.gnu_extensions,
        pedantic: opts.pedantic,
    };
    let (tokens, complaints) = convert(&expanded, &cx);
    diagnostics.extend(complaints);

    let parsed = rucc_parse::parse(
        &tokens,
        rucc_parse::Context {
            interner: &sess.interner,
            std: opts.std,
            gnu: opts.gnu_extensions,
            pedantic: opts.pedantic,
            error_limit: opts.error_limit as usize,
        },
    );
    let parse_failed = parsed.diagnostics.iter().any(|d| d.severity.is_fatal());
    diagnostics.extend(parsed.diagnostics);

    let mut artifact = Artifact::Nothing;
    // Zero when nothing instruments, which is the truthful summary of a file built without
    // `-fsafety`: no checks went in, so none is standing, and every call it makes is unmodelled.
    let mut instrumented = Instrumented::default();
    if !parse_failed {
        let mut checker = Checker::new(
            &parsed.ast,
            CheckContext {
                names: &sess.interner,
                target: &sess.target,
                std: opts.std,
                gnu: opts.gnu_extensions,
                pedantic: opts.pedantic,
                permissive: opts.permissive,
                gnu89_inline: opts.gnu89_inline,
                error_limit: opts.error_limit as usize,
                // A freestanding program has no C library, so a name that is the library's
                // everywhere else is the program's own here and means whatever it defined.
                builtins: opts.builtins && opts.hosted,
                no_builtin: &opts.no_builtin,
                short_enums: opts.short_enums,
                ms_extensions: sess.ms_extensions(),
                trapping_math: opts.trapping_math,
            },
        );
        checker.check_unit();
        let checked = checker.finish();
        if !checked.failed() {
            match opts.emit {
                EmitKind::Tast => {
                    artifact = Artifact::Text(rucc_sema::print(
                        &checked.tast,
                        &checked.types,
                        &sess.interner,
                    ));
                }
                // Nothing past the checker, because a granule is a fact about a layout and a
                // layout is settled the moment the closing brace is seen. Lowering the
                // function bodies would take minutes on an amalgamation and answer nothing.
                EmitKind::TypeGranules => {
                    artifact = Artifact::Text(rucc_types::granule_report(
                        &checked.types,
                        &sess.interner,
                        &sess.target,
                    ));
                }
                EmitKind::Ir
                | EmitKind::MirFinal
                | EmitKind::Asm
                | EmitKind::Object
                | EmitKind::Archive
                | EmitKind::Executable
                | EmitKind::SafetySummary => {
                    // What a `.incbin` in an `asm` at file scope names is read through the same
                    // file system the sources came through, and from where the compiler was run
                    // rather than from beside the source, because that is where an assembler
                    // looks for it.
                    let mut read = |named: &str| {
                        fs.read(Path::new(named))
                            .map(|bytes| bytes.as_slice().to_vec())
                            .map_err(|why| why.to_string())
                    };
                    let mut lowered = rucc_lower::lower(
                        name,
                        rucc_lower::Context {
                            tast: &checked.tast,
                            types: &checked.types,
                            target: &sess.target,
                            names: &mut sess.interner,
                            visibility: match opts.visibility {
                                Visibility::Default => IrVisibility::Default,
                                Visibility::Hidden => IrVisibility::Hidden,
                                Visibility::Protected => IrVisibility::Protected,
                            },
                            protector: match opts.protector {
                                Protector::None => LowerProtector::None,
                                Protector::Buffers => LowerProtector::Buffers,
                                Protector::Strong => LowerProtector::Strong,
                                Protector::All => LowerProtector::All,
                            },
                            wrapping: rucc_lower::Wrapping {
                                signed: opts.wrapping.signed,
                                pointer: opts.wrapping.pointer,
                                trap: opts.wrapping.trap,
                            },
                            aliasing: opts.strict_aliasing,
                            padding: opts.padding == Padding::Ignored,
                            contract: match opts.fp_contract {
                                Contract::Off => FpContract::Off,
                                Contract::On => FpContract::On,
                                Contract::Fast => FpContract::Fast,
                            },
                            read: &mut read,
                        },
                    );
                    // The walk reports what it cannot build, and what it did build is printed
                    // anyway: a file with one construct missing from it is more use to read
                    // than nothing at all, and the errors are what stop it being compiled.
                    let failed = lowered.diagnostics.iter().any(|d| d.severity.is_fatal());
                    if !failed {
                        // The verifier runs on everything the walk builds, always. It is the
                        // one check that a bug in the walk cannot talk its way past, and a
                        // wrong instruction found here costs a message rather than an hour
                        // in front of a debugger over the assembly it turned into.
                        if let Err(errors) = rucc_ir::verify(&lowered.module, &sess.interner) {
                            for error in errors {
                                diagnostics.push(internal(&format!("invalid IR, {error}")));
                            }
                        } else if let Err(complaints) =
                            instrument(&mut lowered.module, &mut sess.interner, opts)
                                .map(|done| instrumented = done)
                        {
                            diagnostics.extend(complaints);
                        } else if let Err(complaints) = optimize(
                            &mut lowered.module,
                            &sess.interner,
                            &sess.target,
                            opts,
                            name,
                            &mut dumps,
                            &mut remarks,
                        ) {
                            diagnostics.extend(complaints);
                        } else if opts.emit == EmitKind::SafetySummary {
                            // After the optimizer, because the number that matters is how many
                            // checks are still standing and there is no way to know that before it
                            // has run. Before the back end, because the back end turns a check into
                            // a call and a summary of calls is not a summary of checks.
                            artifact = Artifact::Text(
                                rucc_safety::summarize(
                                    &lowered.module,
                                    &sess.interner,
                                    name,
                                    opts.safety.as_str(),
                                    instrumented.checks,
                                    instrumented.interposed,
                                    instrumented.crossings,
                                )
                                .render(),
                            );
                        } else if opts.emit == EmitKind::Ir {
                            // After the optimizer rather than before it, so that `--emit=ir -O2`
                            // is the IR the back end will be given rather than the IR it would
                            // have been given at `-O0`. There is no other way to see what a pass
                            // did without reading the assembly it turned into.
                            artifact =
                                Artifact::Text(rucc_ir::print(&lowered.module, &sess.interner));
                        } else {
                            // The back end, which is every pass after the IR and which is
                            // where a construct nothing has a rule for is finally noticed.
                            match generate(
                                &mut lowered.module,
                                &mut sess.interner,
                                &sess.target,
                                opts,
                                &mut Recording {
                                    fired: &mut fired,
                                    pressure: &mut pressure,
                                    lowerings: &mut lowerings,
                                },
                                &mut temps.assembly,
                            ) {
                                Ok(made) => artifact = made,
                                Err(complaints) => diagnostics.extend(complaints),
                            }
                        }
                    }
                    diagnostics.extend(lowered.diagnostics);
                }
                _ => {}
            }
        }
        diagnostics.extend(checked.diagnostics);
    }

    let mut messages = Vec::with_capacity(diagnostics.len());
    let mut errors = 0;
    for diag in &diagnostics {
        // `-w` drops the warning here rather than at the several hundred places one is raised,
        // and it drops it before the count, so `-w -Werror` compiles. A warning that was never
        // raised is not a warning there is anything to promote.
        if !opts.warnings && diag.severity == Severity::Warning {
            continue;
        }
        if diag.severity.is_fatal()
            || (diag.severity == Severity::Warning && opts.warnings_are_errors)
        {
            errors += 1;
        }
        messages.push(render(diag, &sess.sources, opts.warnings_are_errors));
    }
    if errors > 0 {
        // A tree built from a file that did not compile is not a tree anything should read.
        artifact = Artifact::Nothing;
    }
    // Kept even when the compilation failed, because a rule that fired did fire and a report about
    // which rules a corpus reaches should not lose the ones a file with a mistake in it reached.
    Compiled { artifact, messages, errors, fired, pressure, lowerings, dumps, remarks, deps, temps }
}

/// Reads one file of IR, checks it, and prints it back.
///
/// This is the compiler's own textual IR arriving as an input rather than leaving as an output,
/// which is what makes the round trip in the M2 exit criterion something to run rather than
/// something to believe: what the printer wrote is read back, verified, and written again, and
/// the two files are either the same bytes or they are not.
///
/// The verifier runs here for the reason it runs after the walk. A module that was printed by
/// this compiler has been through it once already, and one that a person edited has not.
#[must_use]
pub fn compile_ir(opts: &Options, name: &str, fs: &dyn FileSystem) -> Compiled {
    let mut sess = Session::new(opts.clone());
    if opts.emit != EmitKind::Ir {
        return failure(format!(
            "{name}: an input of IR can only be emitted as IR, and `--emit={}` asks for what \
             the C in front of it became",
            opts.emit.as_str()
        ));
    }
    let bytes = match fs.read(Path::new(name)) {
        Ok(bytes) => bytes,
        Err(e) => return failure(format!("{name}: {e}")),
    };
    let Ok(text) = std::str::from_utf8(bytes.as_slice()) else {
        return failure(format!("{name}: this is not text, so it is not IR"));
    };

    let module = match rucc_ir::parse(text, &mut sess.interner) {
        Ok(module) => module,
        Err(error) => {
            return failure(format!("{name}:{}: {}", error.line, error.message));
        }
    };
    let mut diagnostics: Vec<Diagnostic> = Vec::new();
    if let Err(errors) = rucc_ir::verify(&module, &sess.interner) {
        for error in errors {
            diagnostics.push(invalid(&format!("invalid IR, {error}")));
        }
    }
    let mut messages = Vec::with_capacity(diagnostics.len());
    for diag in &diagnostics {
        messages.push(render(diag, &sess.sources, opts.warnings_are_errors));
    }
    let errors = u32::try_from(messages.len()).unwrap_or(u32::MAX);
    let artifact = if errors > 0 {
        Artifact::Nothing
    } else {
        Artifact::Text(rucc_ir::print(&module, &sess.interner))
    };
    // Nothing here reaches the back end, so no rule fired and there is nothing to record.
    Compiled {
        artifact,
        messages,
        errors,
        fired: Fired::new(),
        pressure: Pressure::new(),
        lowerings: Lowerings::new(),
        dumps: Vec::new(),
        remarks: String::new(),
        deps: Vec::new(),
        temps: Temps::default(),
    }
}

/// Puts the memory safety checks in and redirects the calls that cross the boundary, when
/// `-fsafety=` asked for them.
///
/// Between the walk and the optimizer, which is where section 15.3 of
/// `spec/safe-memory/15-integration.md` puts it and which is the whole design in one line: the
/// checks go in while the addresses the program computes still exist, and the optimizer then
/// discharges the ones it can prove. Every sanitizer that came before instruments after the
/// optimizer so that its checks cannot be deleted, and pays for all of them forever.
///
/// The calls to the C library are redirected here too, and in the same window and for a related
/// reason. `spec/safe-memory/10-boundaries.md` section 10.3 wants a `memcpy` modelled by a wrapper
/// that performs the judgements, and `rucc_safety::wrap` is why that has to happen before the
/// optimizer sees the call rather than after.
///
/// The verifier runs again afterwards, for the reason it runs after the walk. This pass rewrites
/// every function in the module, and a pass that produced IR nothing else accepts should say so
/// here rather than in the assembly it turned into.
///
/// # Errors
///
/// When the inserted checks left the module in a state the verifier refuses, which is a bug in
/// this compiler and not in the program being compiled.
fn instrument(
    module: &mut rucc_ir::Module,
    names: &mut Interner,
    opts: &Options,
) -> Result<Instrumented, Vec<Diagnostic>> {
    if !opts.safety.instruments() {
        return Ok(Instrumented::default());
    }
    let mut checks = rucc_safety::run(module, opts.subobject, opts.promise, opts.races);
    // The one check that is about a call rather than about an access, so it is a walk of its own
    // and it is here rather than in the walk above. `rucc_safety::ending` is why, and the short
    // version is that deciding it means resolving a name, which takes the interner.
    //
    // Before the redirection for the same reason the redirection is before the optimizer: what this
    // reads is the name the program wrote, and a pass that had already pointed the call somewhere
    // else would leave it with a name this one has no row for.
    checks.freed = rucc_safety::ending::checks(module, names);
    // Before the optimizer rather than beside the check lowering, which is what
    // `rucc_safety::wrap` argues out: `memcpy` is a name an optimizer knows things about, and a
    // pass that turns a short copy into a pair of loads and stores would leave behind accesses the
    // check insertion has already finished walking past.
    let interposed = rucc_safety::redirect(module, names);
    // After the redirection, so that a call this build models with a wrapper is not also counted
    // as a crossing it did not model.
    let crossings = rucc_safety::witness(module, names);
    match rucc_ir::verify(module, names) {
        Ok(()) => Ok(Instrumented { checks, interposed, crossings }),
        Err(errors) => Err(errors
            .iter()
            .map(|e| internal(&format!("invalid IR after check insertion, {e}")))
            .collect()),
    }
}

/// What the instrumentation did, which nothing but the summary reads.
///
/// Carried out of [`instrument`] rather than recovered from the module afterwards because neither
/// number survives the optimizer: a check that was discharged leaves nothing behind saying it was
/// ever there, and a call that was pointed at a wrapper looks like a call that always named one.
#[derive(Clone, Copy, Debug, Default)]
struct Instrumented {
    /// How many checks of each class went in.
    checks: rucc_safety::Counts,
    /// How many calls were pointed at an interposition wrapper.
    interposed: usize,
    /// How many places a pointer crosses to or from code this build did not instrument.
    crossings: rucc_safety::Sites,
}

/// Runs the optimizer over the module, and collects whatever the dumps asked for.
///
/// The level chooses a pipeline, the `-f` flags edit it, and at `-O0` there is nothing in it, so
/// this is a walk over an empty list rather than a branch on the level. See section 9.1 of
/// `spec/09-optimizer.md` for why the pipelines are written out rather than assembled.
///
/// # Errors
///
/// When a pass left the module in a state the verifier refuses, which is a bug in the pass and
/// not in the program being compiled, so it is reported as an internal error the way a bad
/// lowering is.
fn optimize(
    module: &mut rucc_ir::Module,
    names: &Interner,
    target: &TargetInfo,
    opts: &Options,
    file: &str,
    dumps: &mut Vec<rucc_opt::Dump>,
    remarks: &mut String,
) -> Result<(), Vec<Diagnostic>> {
    let mut settings = rucc_opt::Options::for_level(opts.opt_level);
    // What the analyses that read a body may believe about it. The same question the back end asks
    // about addresses, with one thing on top: `-fno-semantic-interposition` is the build promising
    // that a name it exports is the one that will run, which is what every distribution builds a
    // library with. It says nothing about how an address is reached, and gcc does not change that
    // under the flag either, so the back end is not given this value.
    settings.interposition = match opts.interposition {
        true => replaceable(target, opts),
        false => IrPic::Executable,
    };
    settings.toggles.clone_from(&opts.passes);
    settings.fuel = opts.pass_fuel.iter().cloned().collect();
    settings.global_fuel = opts.pass_fuel_global;
    settings.verify |= opts.verify_each;
    for (on, spec) in &opts.pass_gates {
        // Same argument as the dumps below: every spelling in here was checked while the
        // arguments were parsed, so a rejection now is this compiler disagreeing with itself.
        if let Err(why) = settings.gates.add(*on, spec) {
            return Err(vec![internal(&why)]);
        }
    }
    for spec in &opts.dump_ir {
        // Every spelling in here was checked while the arguments were parsed, so a rejection
        // now is this compiler disagreeing with itself rather than the command line being wrong.
        if let Err(why) = settings.dumps.add(spec) {
            return Err(vec![internal(&why)]);
        }
    }
    let mut wants = rucc_opt::Wants::none();
    for spec in &opts.opt_info {
        // Same argument as the dumps above: every spelling was checked while the arguments were
        // parsed, so a rejection now is the compiler disagreeing with itself.
        if let Err(why) = wants.add(spec) {
            return Err(vec![internal(&why)]);
        }
    }
    let report = rucc_opt::run(module, names, &settings);
    remarks.push_str(&rucc_opt::optinfo::render(file, &report, names, wants));
    dumps.extend(report.dumps);
    match report.broke.is_empty() {
        true => Ok(()),
        false => Err(report.broke.iter().map(|why| internal(why)).collect()),
    }
}

/// Runs the back end over every function in `module` and writes what came out.
///
/// One machine function per definition in the module, in the order the module holds them, every
/// register physical and every frame offset a constant. A declaration has no body and is skipped,
/// because there is nothing in it to compile.
///
/// What the last step is, is the only thing `--emit=mir-final`, `-S` and `-c` disagree about. The
/// three read the same functions and differ in whether they are printed as machine IR, printed as
/// assembly, or encoded and put in a file, which is the point of section 11.1 of
/// `spec/11-asm-objects-debug.md`: a listing that disagrees with the object file beside it is
/// worse than no listing, and the way to make that impossible is to have one description of an
/// instruction and two ways of writing it down.
///
/// # Errors
///
/// One diagnostic per function the back end could not compile, or one about the target when no
/// back end covers it at all. Every function is attempted rather than stopping at the first, so a
/// file with three constructs missing from the rule set reports three rather than one at a time.
///
/// `assembly` is where `-save-temps` gets its listing from on the path that does not print one,
/// which is the same functions written the other way rather than a second compilation of the same
/// file. A listing that disagrees with the object beside it would be worse than none.
/// Whether a name this file exports is one another object may define or replace.
///
/// The link that reads the object decides half of what is in it, and the command line is where that
/// is said, which is why the flag reaches this far down. See #756.
///
/// ELF only, because it is a question about a format rather than about a machine and the other two
/// answer it differently. Mach-O has a two level namespace, so a name a library defines is bound to
/// that library and is not replaced by a definition loaded earlier, and it has no copy relocations,
/// so a variable defined elsewhere needs the table whichever link is coming. COFF decides what
/// leaves a DLL by an export table the linker is handed. Neither has an object writer here yet, so
/// what this does is decline to say the ELF answer about them.
fn replaceable(target: &TargetInfo, opts: &Options) -> IrPic {
    match (target.tuple.os().object_format(), opts.pic) {
        (Some(ObjectFormat::Elf), Pic::Library) => IrPic::Library,
        _ => IrPic::Executable,
    }
}

fn generate(
    module: &mut rucc_ir::Module,
    names: &mut Interner,
    target: &TargetInfo,
    opts: &Options,
    recording: &mut Recording<'_>,
    assembly: &mut Option<String>,
) -> Result<Artifact, Vec<Diagnostic>> {
    let Some(machine) = Machine::for_target(target) else {
        return Err(vec![unsupported(&format!(
            "there is no back end for {} in this compiler yet, so there is nothing to generate",
            target.tuple
        ))]);
    };
    // Refused rather than dropped. A command line that asks for a stack protector on a target
    // that has nowhere to keep the word one is compared against would otherwise get code with no
    // protection in it and no indication that the flag did nothing, which is the one outcome worse
    // than the error. Windows is the case: it has a protector and it is a different mechanism.
    if opts.protector != Protector::None && machine.conv.guard.is_none() {
        return Err(vec![unsupported(&format!(
            "{} is not supported for {} yet, because the stack protector on that target is not \
             the one this compiler writes",
            opts.protector, target.tuple
        ))]);
    }
    // The same answer for the same reason. What says a file was built to have its control flow
    // checked is a note, the note is an ELF one, and a target whose objects are not ELF has nowhere
    // to put it: the landing pads would go in and nothing would ever turn the check on. Windows has
    // the same hardware and asks for it a different way, which is a bit in the image the linker is
    // told to set rather than anything a compiler writes into an object.
    if opts.control.any() && target.tuple.os().object_format() != Some(ObjectFormat::Elf) {
        return Err(vec![unsupported(&format!(
            "-fcf-protection={} is not supported for {} yet, because what says a file was built \
             for it there is not the note this compiler writes",
            opts.control, target.tuple
        ))]);
    }
    // And once more. A profiled build is one whose functions call a routine the runtime provides,
    // and a target whose runtime provides no such routine would get a call to a name nothing
    // defines, which is a link error a long way from the flag that caused it. Windows profiles a
    // build by calling something else, asked for a different way and taking its argument in a
    // register, so it is not this hook spelled differently.
    let profile = match machine.conv.trace {
        Some(trace) => opts.profile.then(|| opts.hook.early(trace.fentry)),
        None if opts.profile => {
            return Err(vec![unsupported(&format!(
                "-pg is not supported for {} yet, because the profiler's hook on that target is \
                 not the one this compiler calls",
                target.tuple
            ))]);
        }
        None => None,
    };
    // And once more. The room a patcher was promised is only half the feature: the other half is a
    // section listing where every function's room is, and both the section's shape and the way it
    // points at the text it belongs to are ELF's. A format that has no such section would take the
    // nops and quietly lose the list, which is a build that looks patchable and is not.
    if opts.patchable.any() && target.tuple.os().object_format() != Some(ObjectFormat::Elf) {
        return Err(vec![unsupported(&format!(
            "-fpatchable-function-entry= is not supported for {} yet, because what records where \
             the room is there is not the section this compiler writes",
            target.tuple
        ))]);
    }
    let flags = pipeline::Flags {
        frame_pointer: opts.frame_pointer,
        red_zone: opts.red_zone,
        stack_clash: opts.stack_clash,
        landing: opts.control.branch(),
        profile: match profile {
            None => pipeline::Profile::No,
            Some(true) => pipeline::Profile::Early,
            Some(false) => pipeline::Profile::Late,
        },
        patch: pipeline::Room { after: opts.patchable.after(), before: opts.patchable.before },
        // On at every level above `-O0`, which is where gcc turns `-freorder-blocks` on
        // (`gcc/opts.cc:604`) and what `spec/optimizer/38-scheduling-and-layout.md` section 38.3
        // reads off that: it is one of the earliest optimizations there is, it is nearly free,
        // and it helps every target. `-O0` keeps the order the shape of the graph gives, so that
        // the blocks come out in the order they were written and a person stepping through the
        // code walks down the screen.
        reorder: opts.reorder_blocks.unwrap_or_else(|| opts.opt_level.runs_optimizer()),
        // On at every level above `-O0`, for the reason the line above is off at it. Sharing one
        // run of bytes between two locals is a smaller frame and a worse debugger: a variable that
        // is out of scope reads as whatever took its place, which is what `-O0` exists not to do.
        // Above it the frame is the win, and `-fstack-reuse=` says either answer at any level.
        reuse: opts.stack_reuse.unwrap_or_else(|| opts.opt_level.runs_optimizer()),
        // On from `-O2`, which is where gcc turns `-fschedule-insns2` on and what
        // `spec/optimizer/38-scheduling-and-layout.md` section 38.6 asks for. Not at `-O1`,
        // because a schedule is a whole dependence graph per block and `-O1` is the level whose
        // budget is roughly `-O0`'s. Not at `-O0` for the reason nothing else is.
        schedule: opts.schedule_insns.unwrap_or_else(|| opts.opt_level.schedules()),
        // Whatever the command line said, and the model's own answer when it said nothing.
        accurate: opts.cycle_accurate_model,
    };

    // The checks become calls here rather than beside the insertion, because the id each one
    // carries is an index into a table and a row for a check the optimizer deleted is a row nothing
    // will ever name. Section 6.3.1 of `spec/safe-memory/06-instrumentation.md` is what this
    // eventually becomes and `rucc_safety::lower` says why it is not that yet.
    //
    // It is inside the back end rather than beside the optimizer so that `--emit=ir` still shows
    // the checks. The IR a person reads should say what the compiler decided, not how it spelled it
    // for the machine.
    if opts.safety.instruments() {
        // Which calls hand back storage, which the lowering needs and `-O0` has not worked out.
        // `rucc_opt::pipeline` runs this only when some pass in the run reads the summaries, since a
        // flag nothing reads is noise in a dump, and at `-O0` nothing did. Something does now: the
        // capability for a pointer an allocator just returned is the one capability that is exact
        // and costs a load, and `rucc_safety::slot` finds those sites by the flag. The safety suite
        // runs at `-O0`, so without this the cheap case would be the one case that never happens.
        //
        // Safe to run twice and safe to run late, because it only ever sets the flag and never
        // clears one, so a build that had it already gets the same module back.
        rucc_opt::heap::annotate(module, names);
        // Which calls hand their capabilities to the callee and which say there are none. Here and
        // not beside the insertion, because the rule is what each function still has left to check
        // and the optimizer is what makes that small: running before it would give every callee a
        // frame for checks that are about to be discharged. `rucc_safety::handover` is the rule and
        // the pass both, and the census in `--emit=safety-summary` reads the same rule, so the
        // buckets it prints describe the code that was actually built.
        rucc_safety::handover::arrange(module);
        rucc_safety::lower(module, names);
        if let Err(errors) = rucc_ir::verify(module, names) {
            return Err(errors
                .iter()
                .map(|e| internal(&format!("invalid IR after check lowering, {e}")))
                .collect());
        }
    }

    // Worked out before the loop and not inside it, because it reads the whole module and the loop
    // is holding one function of it. It has to be after the check lowering above, since that adds
    // calls to the runtime and so can add a name this file does not define.
    //
    // The link that reads the object decides half of what is in it, and the command line is where
    // that is said, which is why the flag reaches this far down. See #756.
    //
    let elsewhere = Elsewhere::of(module, replaceable(target, opts));

    let mut funcs = Vec::new();
    let mut complaints = Vec::new();
    for id in module.funcs() {
        if module[id].is_declaration() {
            continue;
        }
        match pipeline::compile_recording(
            &mut module[id],
            names,
            &machine,
            &elsewhere,
            flags,
            recording,
        ) {
            Ok(func) => funcs.push(func),
            Err(why) => {
                let name = names.resolve(module[id].name).to_owned();
                // The function knows where the instruction came from, so the message lands on
                // the line somebody wrote rather than on the file as a whole.
                let span = why.inst().map_or(Span::DUMMY, |inst| module[id].span(inst));
                let said = format!("cannot generate code for '{name}': {why}");
                complaints.push(unsupported_at(&said, span));
            }
        }
    }
    if !complaints.is_empty() {
        return Err(complaints);
    }
    // The variables the file defines, which go through the back end the way the functions did not:
    // there is nothing in a variable to select instructions for, so the module is what says what
    // one is right up to the point where it is written down.
    // The second names go the same way and for the same reason, and they are neither a function
    // nor a variable: an alias is an entry in the symbol table and no bytes of anything.
    let (globals, aliases) = match opts.emit {
        EmitKind::Asm | EmitKind::Object | EmitKind::Archive | EmitKind::Executable => (
            rucc_asm::globals(module, names, target.object_format).map_err(refused)?,
            rucc_asm::aliases(module, names).map_err(refused)?,
        ),
        _ => (rucc_asm::Globals::default(), Vec::new()),
    };
    // A failure in either of the last two is a bug here rather than a program this compiler is
    // behind on, because every instruction in a function that got this far came out of the same
    // description both of them read and every register in it has been allocated.
    let unwind = opts.unwinds();
    match opts.emit {
        EmitKind::Asm => {
            rucc_asm::print(&funcs, &globals, &aliases, names, target, unwind, output(opts, target))
                .map(Artifact::Text)
                .map_err(refused)
        }
        // An executable is an object as far as this gets: one is what each file of a link
        // contributes, and the linker is what turns them into the other. An archive is the same
        // again, with the archive writer in place of the linker.
        EmitKind::Object | EmitKind::Archive | EmitKind::Executable => {
            if opts.save_temps.wanted() {
                let listing = rucc_asm::print(
                    &funcs,
                    &globals,
                    &aliases,
                    names,
                    target,
                    unwind,
                    output(opts, target),
                );
                *assembly = Some(listing.map_err(refused)?);
            }
            let text = rucc_asm::assemble(&funcs, names, target, unwind).map_err(refused)?;
            let data = globals.image();
            // A format with no writer is a target this compiler is behind on and anything else
            // the writer refused is a bug here, and the two are not the same news to get.
            let bytes = rucc_object::write(&text, &data, &aliases, target, output(opts, target))
                .map_err(wrote)?;
            // Asked of the writer rather than worked out from the same three values here, so that
            // what the archive's index says and what is in the member cannot come apart. It is
            // wanted only by `--emit=archive` and is cheap enough that the other two kinds are not
            // worth a second path.
            let defines = rucc_object::defines(&text, &data, &aliases, target).map_err(wrote)?;
            Ok(Artifact::Object { bytes, defines })
        }
        _ => Ok(Artifact::Text(rucc_mir::print(&funcs, names, target.regs))),
    }
}

/// What the command line decided about the file being written, in the words the assembler and the
/// object writer use.
///
/// Two spellings of the same facts, because the flags are the command line's and the answer the two
/// writers want is the object format's. The conversion is here rather than in either of them so
/// that the two output paths are handed the same thing and cannot come to disagree about what is
/// in a file.
///
/// The feature word is empty on a machine whose bits these are not. It is the x86 one, and a target
/// that wanted its control flow checked would want a property of its own with a key of its own, so
/// writing this one there would be recording something untrue rather than recording nothing.
fn output(opts: &Options, target: &TargetInfo) -> rucc_object::Output {
    let mut features = 0;
    if target.tuple.arch() == Arch::X86_64 {
        if opts.control.branch() {
            features |= rucc_object::Property::IBT;
        }
        if opts.control.ret() {
            features |= rucc_object::Property::SHSTK;
        }
    }
    rucc_object::Output {
        sections: rucc_object::Sections {
            functions: opts.function_sections,
            data: opts.data_sections,
        },
        property: rucc_object::Property { features },
    }
}

/// What the object writer said, as the kind of news it is.
///
/// A format with no writer is a target this compiler is behind on, which is a program nobody can
/// compile today and not a mistake in the one being compiled. Anything else it refused is a bug
/// here, because every value it was handed came out of this compiler.
fn wrote(why: rucc_object::Error) -> Vec<Diagnostic> {
    match why {
        rucc_object::Error::Format { .. } => vec![unsupported(&why.to_string())],
        rucc_object::Error::Refused { .. } => vec![internal(&why.to_string())],
    }
}

/// What the assembler said, as the kind of news it is.
///
/// Three of these are about a program and the rest are about this compiler. A thread-local
/// variable, an ifunc and a prologue the target's unwind table cannot describe are all valid C that
/// the back end does not build yet, and everything else the assembler refuses is something that
/// should never have reached it.
fn refused(why: rucc_asm::Error) -> Vec<Diagnostic> {
    match why {
        rucc_asm::Error::Thread { .. }
        | rucc_asm::Error::IFunc { .. }
        | rucc_asm::Error::Frame { .. } => {
            vec![unsupported(&why.to_string())]
        }
        _ => vec![internal(&why.to_string())],
    }
}

/// A diagnostic about a program this compiler is not finished enough to compile.
///
/// Not an internal error, because nothing here is wrong: the program is valid C and the part of
/// the back end that would handle it has not been written. The note says so, so that a report
/// about one of these is filed against the milestone rather than as a miscompilation.
fn unsupported(message: &str) -> Diagnostic {
    unsupported_at(message, Span::DUMMY)
}

/// The same, about somewhere in the file rather than about the file.
///
/// The note names the issue tracker rather than `spec/17-milestones.md`, which is a document
/// about the plan: a reader who follows it wants to know whether the construct in front of them
/// is already written down as work, and the milestone list does not answer that.
fn unsupported_at(message: &str, span: Span) -> Diagnostic {
    Diagnostic::error(message.to_owned(), span)
        .with_code("E0653")
        .note("this construct is not lowered yet, see https://github.com/tamnd/rucc/issues", span)
}

/// A diagnostic about IR that was handed to us rather than built by us.
fn invalid(message: &str) -> Diagnostic {
    Diagnostic::error(message.to_owned(), Span::DUMMY).with_code("E0661")
}

/// A diagnostic about this compiler rather than about the program it was given.
fn internal(message: &str) -> Diagnostic {
    Diagnostic::error(format!("internal error: {message}"), Span::DUMMY)
        .with_code("E0652")
        .note("this is a bug in rucc rather than in the program, please report it", Span::DUMMY)
}

/// A result that is nothing but one message, for the failures that happen before there is
/// anything to compile.
fn failure(message: String) -> Compiled {
    Compiled {
        artifact: Artifact::Nothing,
        messages: vec![format!("rucc: error: {message}")],
        errors: 1,
        fired: Fired::new(),
        pressure: Pressure::new(),
        lowerings: Lowerings::new(),
        dumps: Vec::new(),
        remarks: String::new(),
        deps: Vec::new(),
        temps: Temps::default(),
    }
}

#[cfg(test)]
mod tests {
    use rucc_session::{MemoryFileSystem, Std};
    use rucc_target::Triple;

    use super::*;

    fn options() -> Options {
        let mut opts = Options::new("x86_64-unknown-linux-gnu".parse::<Triple>().unwrap());
        opts.emit = EmitKind::Tast;
        opts
    }

    fn run(opts: &Options, source: &str) -> Compiled {
        let mut fs = MemoryFileSystem::new();
        fs.insert("/main.c", source.to_owned().into_bytes());
        compile(opts, "/main.c", &fs)
    }

    /// Options with the compiler's own headers on the search path and nothing else, which is
    /// what a freestanding compilation is. There is no file system underneath these tests,
    /// so a header that reached for one would fail to resolve and say so.
    fn freestanding() -> Options {
        let mut opts = options();
        opts.hosted = false;
        opts.search.push_system(rucc_session::runtime::DIR);
        opts
    }

    /// The typed tree of a freestanding `source`, insisting that it compiled cleanly.
    fn shipped(source: &str) -> String {
        let result = run(&freestanding(), source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    /// The typed tree of `source`, insisting that it compiled cleanly.
    fn tast(source: &str) -> String {
        let result = run(&options(), source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    #[test]
    fn the_shipped_stdarg_declares_a_list_and_the_four_operators() {
        let text = shipped(concat!(
            "#include <stdarg.h>\n",
            "int sum(int n, ...) {\n",
            "  va_list ap, copy;\n",
            "  va_start(ap, n);\n",
            "  va_copy(copy, ap);\n",
            "  int total = va_arg(ap, int) + va_arg(copy, int);\n",
            "  va_end(ap);\n",
            "  va_end(copy);\n",
            "  return total;\n",
            "}\n",
        ));
        assert!(text.contains("va-start"), "{text}");
        assert!(text.contains("va-copy"), "{text}");
        assert!(text.contains("va-arg"), "{text}");
        assert!(text.contains("va-end"), "{text}");
    }

    /// glibc includes `<stdarg.h>` this way from every header that declares a `vprintf`, and
    /// what it wants is the type without the four macro names. Answering the whole header
    /// would put `va_start` in the way of a program that has its own.
    #[test]
    fn stdarg_hands_out_the_type_alone_when_that_is_all_that_was_asked_for() {
        let text = shipped(concat!(
            "#define __need___va_list\n",
            "#include <stdarg.h>\n",
            "int vprint(const char *f, __gnuc_va_list ap);\n",
            "#ifdef va_start\n",
            "#error va_start should not be defined\n",
            "#endif\n",
            "#ifdef _VA_LIST_DEFINED\n",
            "#error va_list should not have been made\n",
            "#endif\n",
        ));
        assert!(text.contains("vprint"), "{text}");
    }

    /// The same protocol on `<stddef.h>`, which glibc uses far more heavily: `<stdio.h>` asks
    /// for `size_t` and `NULL` and would be wrong to receive `offsetof` as well.
    #[test]
    fn stddef_answers_one_piece_at_a_time_and_the_next_request_still_gets_through() {
        let text = shipped(concat!(
            "#define __need_size_t\n",
            "#include <stddef.h>\n",
            "#ifdef offsetof\n",
            "#error offsetof should not be defined yet\n",
            "#endif\n",
            "#define __need_ptrdiff_t\n",
            "#include <stddef.h>\n",
            "#include <stddef.h>\n",
            "size_t a;\n",
            "ptrdiff_t b;\n",
            "wchar_t c;\n",
            "max_align_t d;\n",
            "void *e = NULL;\n",
            "struct P { int x; long y; };\n",
            "size_t f = offsetof(struct P, y);\n",
        ));
        assert!(text.contains("decl #0 a : unsigned long"), "{text}");
        assert!(text.contains("decl #1 b : long"), "{text}");
    }

    #[test]
    fn the_shipped_limits_and_float_are_the_targets_own_answers() {
        let text = shipped(concat!(
            "#include <limits.h>\n",
            "#include <float.h>\n",
            "int bits = CHAR_BIT;\n",
            "long big = LONG_MAX;\n",
            "int low = INT_MIN;\n",
            "int radix = FLT_RADIX;\n",
            "int digits = DBL_MANT_DIG;\n",
        ));
        assert!(text.contains("const 8 : int"), "{text}");
        assert!(text.contains("const 9223372036854775807 : long"), "{text}");
        assert!(text.contains("const 2 : int"), "{text}");
        assert!(text.contains("const 53 : int"), "{text}");
    }

    /// Freestanding, so there is no library header to chain to and `<stdint.h>` writes the
    /// whole set out itself. The widths are the ones the target picked, which is the only
    /// reason this header is the compiler's.
    #[test]
    fn the_shipped_stdint_writes_the_whole_set_when_there_is_no_library_to_defer_to() {
        let text = shipped(concat!(
            "#include <stdint.h>\n",
            "int64_t a = INT64_C(1);\n",
            "uint_least16_t b;\n",
            "intptr_t c;\n",
            "uintmax_t d = UINTMAX_MAX;\n",
            "int wide = sizeof(int_fast64_t);\n",
        ));
        assert!(text.contains("decl #0 a : long"), "{text}");
        assert!(text.contains("decl #1 b : unsigned short"), "{text}");
        assert!(text.contains("decl #2 c : long"), "{text}");
    }

    /// `<mmintrin.h>` is the base of the vector header chain and the first one whose contents
    /// are C rather than declarations, so what this checks is that the C in it compiles: a
    /// header that is nothing but definitions fails as a whole or not at all.
    ///
    /// What the intrinsics answer is not checked here and cannot be, because the answer is
    /// only interesting next to another compiler's. Every intrinsic in the header was built
    /// and run against GCC 16.2.0 on the same inputs, at `-O0`, `-O1`, `-O2` and `-Os`, and
    /// gave the same bytes in all four. Carrying that comparison rather than repeating it by
    /// hand needs a facet in `tamnd/rucc-corpus` that works out the expected bytes itself,
    /// which is a second implementation of MMX and is `tamnd/rucc#1150`.
    #[test]
    fn the_shipped_mmintrin_defines_the_mmx_type_and_the_operations_over_it() {
        let text = shipped(concat!(
            "#include <mmintrin.h>\n",
            "__m64 add(__m64 a, __m64 b) { return _mm_add_pi16(a, b); }\n",
            "__m64 pack(__m64 a, __m64 b) { return _m_packsswb(a, b); }\n",
            "__m64 shift(__m64 a) { return _mm_srai_pi32(a, 3); }\n",
            "int low(__m64 a) { return _mm_cvtsi64_si32(a); }\n",
            "void done(void) { _mm_empty(); }\n",
        ));
        assert!(text.contains("add"), "{text}");
        assert!(text.contains("pack"), "{text}");
        assert!(text.contains("shift"), "{text}");
    }

    /// The allocator beside the vector headers, which is the one piece of the family that is
    /// not a vector operation. It reaches for `<stddef.h>` and for three names out of the
    /// library, and the point of the test is that the reach resolves with nothing on the
    /// search path but the compiler's own directory.
    #[test]
    fn the_shipped_mm_malloc_asks_for_aligned_memory_and_gives_it_back() {
        let text = shipped(concat!(
            "#include <mm_malloc.h>\n",
            "void *get(void) { return _mm_malloc(64, 16); }\n",
            "void put(void *p) { _mm_free(p); }\n",
        ));
        assert!(text.contains("get"), "{text}");
        assert!(text.contains("put"), "{text}");
    }

    /// `<xmmintrin.h>` is the next rung of the chain and pulls the other two in behind it, so a
    /// program that includes this one alone has to get all three. What the intrinsics answer is
    /// checked the same way `<mmintrin.h>` next door is checked and for the same reason: a
    /// hundred and forty eight lines of answers over nans, infinities, both zeros and values
    /// that do not fit in the integer they convert to, identical to GCC 16.2.0 at `-O0`, `-O1`,
    /// `-O2` and `-Os`.
    ///
    /// `_mm_rcp_ps` is the one answer in that run that is not identical, and is not meant to be.
    /// The instruction approximates a reciprocal and this computes one exactly, so the bits
    /// differ while both sit inside the relative error Intel documents, which the same program
    /// checks directly rather than by comparing bits.
    #[test]
    fn the_shipped_xmmintrin_defines_the_sse_type_and_the_operations_over_it() {
        let text = shipped(concat!(
            "#include <xmmintrin.h>\n",
            "__m128 add(__m128 a, __m128 b) { return _mm_add_ps(a, b); }\n",
            "__m128 one(__m128 a, __m128 b) { return _mm_max_ss(a, b); }\n",
            "__m128 mask(__m128 a, __m128 b) { return _mm_cmpnle_ps(a, b); }\n",
            "__m128 pick(__m128 a, __m128 b) { return _mm_shuffle_ps(a, b, _MM_SHUFFLE(0,1,2,3)); }\n",
            "int bits(__m128 a) { return _mm_movemask_ps(a); }\n",
            "int near(__m128 a) { return _mm_cvtss_si32(a); }\n",
            "__m128 wide(__m64 a) { return _mm_cvtpi16_ps(a); }\n",
            "void *room(void) { return _mm_malloc(64, 16); }\n",
            "void hint(const float *p) { _mm_prefetch(p, _MM_HINT_T0); _mm_sfence(); }\n",
        ));
        assert!(text.contains("add"), "{text}");
        assert!(text.contains("mask"), "{text}");
        assert!(text.contains("pick"), "{text}");
        assert!(text.contains("wide"), "{text}");
    }

    /// The six names of gcc's header this one leaves out, each of which is an instruction whose
    /// answer no plain C reproduces exactly. Leaving them out is what turns a program that wants
    /// one into a diagnostic naming the function it called, rather than into a wrong answer, and
    /// this is what notices if one is ever quietly defined to something close.
    ///
    /// `tamnd/rucc#1157` is the square root, which brings the first four back.
    #[test]
    fn the_shipped_xmmintrin_leaves_out_the_names_that_need_an_instruction() {
        let text = rucc_session::runtime::header("xmmintrin.h").expect("xmmintrin.h is shipped");
        for absent in [
            "_mm_sqrt_ps",
            "_mm_sqrt_ss",
            "_mm_rsqrt_ps",
            "_mm_rsqrt_ss",
            "_mm_getcsr",
            "_mm_setcsr",
        ] {
            let defined = text.contains(&format!("{absent}("));
            assert!(!defined, "{absent} is defined and the header says it is not");
            assert!(text.contains(absent), "{absent} is absent and unexplained");
        }
    }

    #[test]
    fn the_shipped_emmintrin_defines_both_sse2_types_and_the_operations_over_them() {
        let text = shipped(concat!(
            "#include <emmintrin.h>\n",
            "__m128i add(__m128i a, __m128i b) { return _mm_add_epi64(a, b); }\n",
            "__m128i wide(__m128i a, __m128i b) { return _mm_mul_epu32(a, b); }\n",
            "__m128i pick(__m128i a) { return _mm_shuffle_epi32(a, _MM_SHUFFLE(0,1,2,3)); }\n",
            "__m128i up(__m128i a) { return _mm_slli_epi64(a, 13); }\n",
            "__m128i down(__m128i a) { return _mm_srli_si128(a, 3); }\n",
            "__m128i pack(__m128i a, __m128i b) { return _mm_packus_epi16(a, b); }\n",
            "int bits(__m128i a) { return _mm_movemask_epi8(a); }\n",
            "__m128d sum(__m128d a, __m128d b) { return _mm_add_sd(a, b); }\n",
            "__m128d mask(__m128d a, __m128d b) { return _mm_cmpunord_pd(a, b); }\n",
            "__m128i near(__m128d a) { return _mm_cvtpd_epi32(a); }\n",
            "__m128d over(__m128 a) { return _mm_cvtps_pd(a); }\n",
            "__m128i half(__m64 a) { return _mm_movpi64_epi64(a); }\n",
            "__m128i grab(void const *p) { return _mm_loadu_si128(p); }\n",
            "void wall(void) { _mm_lfence(); _mm_mfence(); }\n",
        ));
        assert!(text.contains("wide"), "{text}");
        assert!(text.contains("pack"), "{text}");
        assert!(text.contains("near"), "{text}");
        assert!(text.contains("half"), "{text}");
    }

    /// The umbrella header reaches the three underneath it. This is brotli's use of it, from
    /// `c/enc/matching_tag_mask.h`, which is the whole of what `tamnd/rucc#1236` was about: four
    /// SSE2 names that were already shipped and no way to get at them by the name gcc uses.
    #[test]
    fn the_shipped_immintrin_reaches_the_names_the_headers_under_it_define() {
        let text = shipped(concat!(
            "#include <immintrin.h>\n",
            "unsigned long long matching(unsigned char tag, unsigned char const *bucket) {\n",
            "  __m128i const want = _mm_set1_epi8((char)tag);\n",
            "  __m128i const chunk = _mm_loadu_si128((__m128i const *)(void const *)bucket);\n",
            "  __m128i const same = _mm_cmpeq_epi8(chunk, want);\n",
            "  return (unsigned long long)_mm_movemask_epi8(same);\n",
            "}\n",
            "__m64 narrow(__m64 a, __m64 b) { return _mm_add_pi32(a, b); }\n",
            "__m128 single(__m128 a, __m128 b) { return _mm_add_ps(a, b); }\n",
        ));
        assert!(text.contains("matching"), "{text}");
        assert!(text.contains("narrow"), "the MMX header is not reached: {text}");
        assert!(text.contains("single"), "the SSE header is not reached: {text}");
    }

    /// The wider umbrella reaches everything the narrower one does, and the fence family with it.
    /// This is what mingw-w64's `<winnt.h>` includes and what it then uses, so a Windows program
    /// that has never heard of an intrinsic gets here through `<windows.h>`.
    #[test]
    fn the_shipped_x86intrin_reaches_the_fences_windows_headers_ask_it_for() {
        let text = shipped(concat!(
            "#include <x86intrin.h>\n",
            "void barriers(void *p) {\n",
            "  _mm_lfence();\n",
            "  _mm_sfence();\n",
            "  _mm_mfence();\n",
            "  _mm_pause();\n",
            "  _mm_clflush(p);\n",
            "}\n",
            "__m128i wide(__m128i a, __m128i b) { return _mm_add_epi32(a, b); }\n",
        ));
        assert!(text.contains("barriers"), "{text}");
        assert!(text.contains("wide"), "the SSE2 header is not reached: {text}");
    }

    /// Including it twice is the same as including it once, and so is including it beside the
    /// header it reaches. A program that includes both spellings is the usual case rather than an
    /// odd one, because one of its own headers includes the umbrella and another includes SSE2.
    #[test]
    fn the_umbrella_and_the_header_under_it_can_both_be_included() {
        let text = shipped(concat!(
            "#include <immintrin.h>\n",
            "#include <emmintrin.h>\n",
            "#include <immintrin.h>\n",
            "#include <x86intrin.h>\n",
            "__m128i twice(__m128i a, __m128i b) { return _mm_add_epi32(a, b); }\n",
        ));
        assert!(text.contains("twice"), "{text}");
    }

    /// The float header omits four square roots and SSE2 omits the matching two, for the reason
    /// both headers write down. A later change that quietly defines one as an approximation
    /// would be a wrong answer nobody sees, so the absence is held in place here.
    #[test]
    fn the_shipped_emmintrin_leaves_out_the_two_square_roots() {
        let text = rucc_session::runtime::header("emmintrin.h").expect("emmintrin.h is shipped");
        for absent in ["_mm_sqrt_pd", "_mm_sqrt_sd"] {
            let defined = text.contains(&format!("{absent}("));
            assert!(!defined, "{absent} is defined and the header says it is not");
            assert!(text.contains(absent), "{absent} is absent and unexplained");
        }
    }

    #[test]
    fn the_three_formality_headers_still_have_to_work() {
        let text = shipped(concat!(
            "#include <stdbool.h>\n",
            "#include <stdalign.h>\n",
            "#include <iso646.h>\n",
            "#include <stdnoreturn.h>\n",
            "int t = true and not false;\n",
            "_Alignas(16) char buf[16];\n",
            "int a = alignof(long);\n",
        ));
        assert!(text.contains("decl #0 t : int"), "{text}");
        assert!(text.contains("const 8 : unsigned long"), "{text}");
    }

    /// Including everything twice has to change nothing, because that is what happens in any
    /// program large enough to matter and a guard that is wrong shows up nowhere else.
    ///
    /// Stated as the two trees being the same rather than as a fact about what is in either
    /// one. A header that carries definitions puts them in the tree and moves everything
    /// after them along, so an assertion about where the program's own declaration landed is
    /// an assertion about how much `<mmintrin.h>` defines, which is not what is being asked.
    #[test]
    fn every_shipped_header_can_be_included_twice() {
        let once: String = rucc_session::runtime::names()
            .iter()
            .map(|name| format!("#include <{name}>\n"))
            .collect();
        let twice = once.repeat(2);
        assert_eq!(shipped(&format!("{once}int x;\n")), shipped(&format!("{twice}int x;\n")));
    }

    #[test]
    fn a_file_that_is_not_there_says_so_and_produces_nothing() {
        let fs = MemoryFileSystem::new();
        let result = compile(&options(), "/nope.c", &fs);
        assert!(result.failed());
        assert!(result.messages[0].contains("/nope.c"), "{:?}", result.messages);
        assert!(result.text().is_empty());
    }

    #[test]
    fn an_object_comes_out_with_its_type_its_linkage_and_how_much_of_a_definition_it_is() {
        let text = tast("int x = 1;\n");
        let expected = "\
decl #0 x : int object external static defined
  init
    +0
      const 1 : int
";
        assert_eq!(text, expected);
    }

    #[test]
    fn the_macros_are_expanded_before_anything_is_parsed() {
        // The whole pipeline in one line. The bound came out of a macro, so it was expanded,
        // converted from a preprocessing number to a constant of a type, parsed as an
        // expression, and folded to the number the array type carries.
        let text = tast("#define N 2\nint a[N];\n");
        assert!(text.starts_with("decl #0 a : int[2] object external static tentative"), "{text}");
    }

    /// A pragma survives the preprocessor on purpose, since what one means is not its
    /// business, and nothing after it has a place for a `#` in the grammar. `pack` is the one
    /// the parser reads and every other line is walked past. Both spellings are here because
    /// they arrive by different routes and only one of them was ever on a line of its own in
    /// the source.
    #[test]
    fn a_pragma_is_not_a_declaration_and_the_parse_walks_past_the_ones_it_does_not_read() {
        let text = tast(concat!(
            "#pragma pack(4)\n",
            "struct s { int a; };\n",
            "#pragma pack()\n",
            "int b;\n",
            "_Pragma(\"GCC visibility push(default)\") int c;\n",
        ));
        assert!(text.contains("decl #0 b : int"), "{text}");
        assert!(text.contains("decl #1 c : int"), "{text}");
    }

    /// Every number in these two tests was read off gcc 16 on x86-64 under `-std=gnu23`
    /// rather than reasoned about, which is why they are written as assertions the program
    /// makes about itself: a compilation with no messages is every one of them holding.
    ///
    /// This half is the attributes. `packed` takes the padding out, on the record or on one
    /// member, `aligned` raises and never lowers, and the two written together are the
    /// combination that packs and then aligns the whole thing.
    #[test]
    fn the_layout_attributes_move_the_members_and_the_record_the_way_gcc_lays_them_out() {
        tast(concat!(
            "struct A { char c; int i; } __attribute__((packed));\n",
            "_Static_assert(sizeof(struct A) == 5 && _Alignof(struct A) == 1, \"A\");\n",
            "_Static_assert(__builtin_offsetof(struct A, i) == 1, \"A.i\");\n",
            // `aligned` with nothing in the parentheses is the largest alignment the target
            // has, which gcc calls BIGGEST_ALIGNMENT and which is sixteen everywhere here.
            "struct B { char c; int i; } __attribute__((aligned));\n",
            "_Static_assert(sizeof(struct B) == 16 && _Alignof(struct B) == 16, \"B\");\n",
            "struct C { char c; int i __attribute__((packed)); };\n",
            "_Static_assert(sizeof(struct C) == 5 && _Alignof(struct C) == 1, \"C\");\n",
            "_Static_assert(__builtin_offsetof(struct C, i) == 1, \"C.i\");\n",
            "struct D { char c; int i; } __attribute__((packed, aligned(4)));\n",
            "_Static_assert(sizeof(struct D) == 8 && _Alignof(struct D) == 4, \"D\");\n",
            "_Static_assert(__builtin_offsetof(struct D, i) == 1, \"D.i\");\n",
            "struct E { char c; _Alignas(8) int i; };\n",
            "_Static_assert(sizeof(struct E) == 16 && _Alignof(struct E) == 8, \"E\");\n",
            "_Static_assert(__builtin_offsetof(struct E, i) == 8, \"E.i\");\n",
            "struct F { char c; int i __attribute__((aligned(8))); };\n",
            "_Static_assert(sizeof(struct F) == 16 && _Alignof(struct F) == 8, \"F\");\n",
            // Two the record already had, so the attribute asks for nothing new, and two
            // where four was already there, so the attribute is ignored rather than obeyed.
            "struct G { char c; short s; } __attribute__((aligned(2)));\n",
            "_Static_assert(sizeof(struct G) == 4 && _Alignof(struct G) == 2, \"G\");\n",
            "struct H { char c; int i; } __attribute__((aligned(2)));\n",
            "_Static_assert(sizeof(struct H) == 8 && _Alignof(struct H) == 4, \"H\");\n",
            // `packed` on a member takes the padding out in front of that member alone, so on
            // the first one it does nothing and on the second one it does all of it.
            "struct I { [[gnu::packed]] char c; int i; };\n",
            "_Static_assert(sizeof(struct I) == 8 && _Alignof(struct I) == 4, \"I\");\n",
            "struct J { char c; [[gnu::packed]] int i; };\n",
            "_Static_assert(sizeof(struct J) == 5 && _Alignof(struct J) == 1, \"J\");\n",
            "struct M { char c; int i : 5; int j : 20; } __attribute__((packed));\n",
            "_Static_assert(sizeof(struct M) == 5 && _Alignof(struct M) == 1, \"M\");\n",
            "struct N { char c; long long l; } __attribute__((aligned(32)));\n",
            "_Static_assert(sizeof(struct N) == 32 && _Alignof(struct N) == 32, \"N\");\n",
            "union L { char c; int i; } __attribute__((packed));\n",
            "_Static_assert(sizeof(union L) == 4 && _Alignof(union L) == 1, \"L\");\n",
            // The armoured spellings, which are the ones a system header writes, since a
            // program is entitled to a macro called `packed` and is not entitled to one called
            // `__packed__`. The two names are one attribute and the layout is the same one.
            "struct O { char c; int i; } __attribute__((__packed__));\n",
            "_Static_assert(sizeof(struct O) == 5 && _Alignof(struct O) == 1, \"O\");\n",
            "struct P { char c; int i; } __attribute__((__aligned__(8)));\n",
            "_Static_assert(sizeof(struct P) == 8 && _Alignof(struct P) == 8, \"P\");\n",
        ));
    }

    /// The attribute that changes what a call means rather than what a record lays out.
    ///
    /// Both halves are here. A call hands a value to a parameter of the union type and the value
    /// goes into the member that takes it, which is a compound literal of the union and is the
    /// same object the GNU cast to a union builds. And a declaration written with a member's type
    /// declares the same function as one written with the union, which is what lets a pointer to
    /// either be assigned from the other, and is what gnulib's signature checks do.
    ///
    /// The `void *` member is last on purpose: the search takes a member whose type the value
    /// already has wherever it sits, and falls back to a pointer member that would take the value
    /// silently only when there is no such member, so `char *` reaches the catch-all past two
    /// members that are not it.
    #[test]
    fn a_transparent_union_takes_the_member_a_value_fits_and_is_declared_either_way() {
        let text = tast(concat!(
            "struct one { int x; };\n",
            "struct two { long y; };\n",
            "typedef union { struct one *a; struct two *b; void *any; }\n",
            "  __attribute__((__transparent_union__)) arg;\n",
            "int takes(arg v);\n",
            "int f(struct one *p, struct two *q, char *c) {\n",
            "  return takes(p) + takes(q) + takes(c) + takes(0);\n",
            "}\n",
            // The other half, which is about declarations and not about values.
            "int takes(struct one *p);\n",
            "int (*as_a_member)(struct one *) = takes;\n",
            "int (*as_the_union)(arg) = takes;\n",
        ));
        assert!(text.contains("compound-literal"), "{text}");
    }

    /// The other place glibc writes it, which is the one that matters.
    ///
    /// `sys/socket.h` puts the attribute on the declarator of the typedef rather than after the
    /// closing brace, so a compiler that reads only the second position reads nothing at all of
    /// the eleven pointer union that `bind` and `connect` and five others take.
    #[test]
    fn the_attribute_on_the_declarator_of_a_typedef_is_the_one_glibc_writes() {
        let text = tast(concat!(
            "struct sockaddr { int family; };\n",
            "struct sockaddr_in { int family; int addr; };\n",
            "typedef union { struct sockaddr *plain; struct sockaddr_in *inet; }\n",
            "  addr_arg __attribute__((__transparent_union__));\n",
            "int bind_to(int fd, addr_arg where);\n",
            "int f(struct sockaddr_in *where) { return bind_to(0, where); }\n",
        ));
        assert!(text.contains("compound-literal"), "{text}");
    }

    /// What the attribute promises has to be a promise this can keep, and is checked rather than
    /// believed.
    ///
    /// A union wider than its first member is not passed the way that member is, and a structure
    /// has no members that are alternatives to each other at all. gcc drops the attribute in both
    /// cases with a warning and compiles the program, because the type is still a perfectly good
    /// type and only the extra rule is gone.
    #[test]
    fn a_transparent_union_that_cannot_keep_the_promise_is_dropped_with_a_word_about_it() {
        let result = run(
            &options(),
            concat!(
                "union wider { int small; double large; } __attribute__((transparent_union));\n",
                "struct plain { int x; } __attribute__((transparent_union));\n",
            ),
        );
        assert_eq!(result.messages.len(), 2, "{:?}", result.messages);
        assert!(!result.failed(), "{:?}", result.messages);
        for message in &result.messages {
            assert!(message.contains("'transparent_union' attribute ignored"), "{message}");
        }
        assert!(result.messages[0].contains("first member"), "{:?}", result.messages);
        assert!(result.messages[1].contains("only a union"), "{:?}", result.messages);
    }

    /// What an access to a packed member is allowed to assume about where it starts.
    ///
    /// C 6.2.8 gives an object of type `int` four byte alignment and `packed` takes it away: the
    /// member goes wherever the members in front of it ended, and an `int` one byte into a record
    /// is aligned to one. The number on the access has to say so, because it is what the back end
    /// picks instructions from and what judgement J1 of `spec/safe-memory/04-safety-model.md`
    /// tests at run time. Four on an address that is a multiple of one is the compiler refusing a
    /// program that is doing nothing wrong.
    #[test]
    fn an_access_to_a_packed_member_says_the_alignment_the_layout_left_it() {
        let packed = body(concat!(
            "struct P { char c; int v; } __attribute__((packed));\n",
            "int f(struct P *p) { return p->v; }\n",
        ));
        assert!(packed.contains("load.i32 %2, align 1,"), "{packed}");
        // The same record without the attribute, which is where the type's own answer is right.
        let plain = body(concat!(
            "struct P { char c; int v; };\n",
            "int f(struct P *p) { return p->v; }\n",
        ));
        assert!(plain.contains("load.i32 %2, align 4,"), "{plain}");
    }

    /// The same, for the two ways of being further in than the member itself.
    ///
    /// An array member is stepped through rather than offset to, and a record member is offset to
    /// twice, and both have to carry the outer record's alignment with them. A step of a whole
    /// number of elements leaves what the element width and the address had in common, which for
    /// a one byte aligned base is one byte however wide the elements are.
    #[test]
    fn what_is_inside_a_packed_member_is_no_more_aligned_than_the_member_is() {
        let stepped = body(concat!(
            "struct P { char c; int v[4]; } __attribute__((packed));\n",
            "int f(struct P *p, int i) { return p->v[i]; }\n",
        ));
        assert!(stepped.contains(", align 1,"), "{stepped}");
        assert!(!stepped.contains(", align 4,"), "{stepped}");
        let nested = body(concat!(
            "struct Inner { int v; };\n",
            "struct P { char c; struct Inner in; } __attribute__((packed));\n",
            "int f(struct P *p) { return p->in.v; }\n",
        ));
        assert!(nested.contains(", align 1,"), "{nested}");
        assert!(!nested.contains(", align 4,"), "{nested}");
    }

    /// The same attribute on a declaration rather than on a type, which asks that this object or
    /// this function be at a multiple of that, and which is where a program that has to hand a
    /// buffer to hardware or keep two counters off one cache line writes it.
    ///
    /// A raise and never a lower, which is the one place it does not agree with `_Alignas`: below
    /// what the type already has, `_Alignas` is a constraint violation and this is ignored without
    /// a word. `__alignof__` of the object answers what the object got and not what its type has,
    /// because that is the question a program asking it is asking.
    #[test]
    fn the_aligned_attribute_on_a_declaration_raises_what_that_one_object_is_aligned_to() {
        tast(concat!(
            "int v __attribute__((aligned(64)));\n",
            "_Static_assert(__alignof__(v) == 64, \"v\");\n",
            // Written on the specifiers rather than after the declarator, which asks the same
            // thing and is the spelling a header is more likely to use.
            "__attribute__((aligned(32))) int w;\n",
            "_Static_assert(__alignof__(w) == 32, \"w\");\n",
            "[[gnu::aligned(16)]] int x;\n",
            "_Static_assert(__alignof__(x) == 16, \"x\");\n",
            // Two below the four an `int` already has, so nothing is asked for and nothing is
            // said, and the type still answers for the object.
            "int y __attribute__((aligned(2)));\n",
            "_Static_assert(__alignof__(y) == 4, \"y\");\n",
            // A local, which is the same question one scope down.
            "void f(void) { int a __attribute__((aligned(128)));\n",
            "_Static_assert(__alignof__(a) == 128, \"a\"); (void)a; }\n",
            // The type is untouched by any of it: `aligned` on a declaration says where that
            // declaration goes and says nothing about every other `int` in the program.
            "_Static_assert(__alignof__(int) == 4, \"int\");\n",
            // A function, which has no alignment of its own for this to be measured against and
            // takes whatever was asked for.
            "void g(void) __attribute__((aligned(256)));\n",
            "void g(void) {}\n",
            "_Static_assert(__alignof__(g) == 256, \"g\");\n",
        ));
    }

    /// And what the object file says, which is the half that makes the answer above true. A
    /// function is at a fixed offset inside the text section, so it is at a multiple of two
    /// hundred and fifty six only if the section is at one too.
    #[test]
    fn what_a_declaration_asked_to_be_aligned_to_is_what_the_assembler_is_told() {
        let text = asm(concat!(
            "int v __attribute__((aligned(64)));\n",
            "void g(void) __attribute__((aligned(256)));\n",
            "void g(void) {}\n",
            "void plain(void) {}\n",
        ));
        assert!(text.contains("\t.p2align\t6\n\t.type\tv, @object\n"), "{text}");
        assert!(text.contains("\t.p2align\t8, 0x90\n\t.globl\tg\n"), "{text}");
        assert!(text.contains("\t.p2align\t4, 0x90\n\t.globl\tplain\n"), "{text}");
    }

    /// And the one position where the attribute means something else. On a declaration it raises
    /// what that one object is aligned to, and on a typedef it says what the type is aligned to,
    /// which gcc lets it lower as well: `typedef int L __attribute__((aligned(2)))` really is an
    /// `int` at a multiple of two and a record with one in it really is smaller for it.
    ///
    /// The size is left alone, which is gcc's answer rather than an omission here. An aligned
    /// typedef whose alignment is larger than what it stands for keeps the size it stands for,
    /// and gcc refuses an array of one rather than padding the elements out to fit.
    #[test]
    fn an_aligned_typedef_says_what_an_object_of_it_is_aligned_to_and_may_lower_it() {
        tast(concat!(
            "typedef int L __attribute__((aligned(2)));\n",
            "_Static_assert(__alignof__(L) == 2, \"L\");\n",
            "_Static_assert(_Alignof(L) == 2, \"L alignof\");\n",
            // Below what an `int` has, which is the half a declaration cannot ask for.
            "_Static_assert(sizeof(L) == 4, \"L size\");\n",
            "struct T { char c; L x; };\n",
            "_Static_assert(sizeof(struct T) == 6, \"T\");\n",
            "_Static_assert(__builtin_offsetof(struct T, x) == 2, \"T.x\");\n",
            // And upwards, which is the ordinary direction and the one a header writes.
            "typedef int H __attribute__((aligned(16)));\n",
            "_Static_assert(__alignof__(H) == 16, \"H\");\n",
            "_Static_assert(sizeof(H) == 4, \"H size\");\n",
            "struct U { char c; H x; };\n",
            "_Static_assert(sizeof(struct U) == 32, \"U\");\n",
            "_Static_assert(__builtin_offsetof(struct U, x) == 16, \"U.x\");\n",
            // A typedef of a typedef, where the nearer one is the one the declaration was
            // written with and is the one that answers.
            "typedef L M __attribute__((aligned(8)));\n",
            "_Static_assert(__alignof__(M) == 8, \"M\");\n",
            // And one that asked for nothing, which still has whatever the one behind it asked
            // for because it is the same type spelled again.
            "typedef L N;\n",
            "_Static_assert(__alignof__(N) == 2, \"N\");\n",
            // The type it stands for is untouched by any of it.
            "_Static_assert(__alignof__(int) == 4, \"int\");\n",
        ));
        let text = asm(concat!(
            "typedef int L __attribute__((aligned(2)));\n",
            "typedef int H __attribute__((aligned(16)));\n",
            "L low;\n",
            "H high;\n",
        ));
        assert!(text.contains("\t.p2align\t1\n\t.type\tlow, @object\n"), "{text}");
        assert!(text.contains("\t.p2align\t4\n\t.type\thigh, @object\n"), "{text}");
    }

    /// The attribute that builds a type rather than changing a layout. `vector_size(n)` says the
    /// declared type is `n` bytes of what was written, taken as lanes, and every operator over
    /// one is that operator over each lane.
    ///
    /// The size is in bytes and not in lanes, which is the part a reader gets backwards: sixteen
    /// of `int` is four lanes and sixteen of `char` is sixteen. A vector is aligned to its own
    /// size, which is what a machine that has the registers wants and what gcc gives one here.
    #[test]
    fn the_vector_size_attribute_builds_a_type_of_lanes_and_measures_it_in_bytes() {
        tast(concat!(
            "typedef int __attribute__((vector_size(16))) v4si;\n",
            "_Static_assert(sizeof(v4si) == 16 && _Alignof(v4si) == 16, \"v4si\");\n",
            "typedef char __attribute__((vector_size(16))) v16qi;\n",
            "_Static_assert(sizeof(v16qi) == 16, \"v16qi\");\n",
            // One lane, which is a power of two and is a vector rather than the type it was
            // written on: the operators it takes are the vector's and not the scalar's.
            "typedef int __attribute__((vector_size(4))) v1si;\n",
            "_Static_assert(sizeof(v1si) == 4, \"v1si\");\n",
            // The armoured spelling and the bracket one, which are the same attribute.
            "typedef float __attribute__((__vector_size__(8))) v2sf;\n",
            "_Static_assert(sizeof(v2sf) == 8, \"v2sf\");\n",
            "typedef short [[gnu::vector_size(8)]] v4hi;\n",
            "_Static_assert(sizeof(v4hi) == 8, \"v4hi\");\n",
            // A lane is what a subscript answers with, and a vector is not a pointer: there is
            // nothing to decay and the lane type is the one the arithmetic happens in.
            "v4si g;\n",
            "_Static_assert(sizeof(g[0]) == 4, \"lane\");\n",
            "_Static_assert(sizeof(g + g) == 16, \"whole\");\n",
            // A scalar beside a vector stands for itself in every lane, so the answer is still
            // the vector and not the wider of the two types.
            "_Static_assert(sizeof(g + 1) == 16, \"broadcast\");\n",
            // An array of them, which is the ordinary way a program holds several.
            "_Static_assert(sizeof(v4si[3]) == 48, \"array\");\n",
        ));
    }

    /// A whole vector written into an array of them, and a vector named by a type name rather
    /// than by a typedef.
    ///
    /// Both are the same question asked twice. A vector is filled like an array of its lanes when
    /// a list is written into it, so a braced element that is itself a vector has to be taken
    /// whole rather than started as the first lane, and the type of what was written is the only
    /// thing that says which was meant. And a type name is where a compound literal and a cast
    /// spell the type out, which a macro taking a lane type and a lane count does, so the
    /// attribute has to be read there and not only on a declaration.
    #[test]
    fn a_vector_is_written_whole_into_an_array_of_them_and_named_by_a_type_name() {
        tast(concat!(
            "typedef int __attribute__((vector_size(8))) v2si;\n",
            "v2si table[] = { (v2si){ 1, 2 }, (v2si){ 3, 4 } };\n",
            "_Static_assert(sizeof(table) == 16, \"two of them and not eight lanes\");\n",
            // The size written out rather than named, which is the spelling a macro expands to.
            "v2si written = (int __attribute__((vector_size(8)))){ 5, 6 };\n",
            "_Static_assert(sizeof((int __attribute__((vector_size(16)))){ 0 }) == 16, \"named\");\n",
            // A lane is still a lane, so a list of them fills the vector the way it always did
            // and the rule above did not turn brace elision off.
            "v2si lanes[2] = { 1, 2, 3, 4 };\n",
            "_Static_assert(sizeof(lanes) == 16, \"still elided\");\n",
        ));
    }

    /// A lane written rather than read, and a shift whose two vectors are not the same type.
    ///
    /// Both are places where a vector is not the aggregate it looks like. A subscript of one is
    /// an lvalue because the vector it came from is an object, so a lane can be assigned to and
    /// has an address, and a qualifier written on the vector reaches every lane the way it does
    /// on an array. And a shift is the one lanewise operator whose sides are not brought to a
    /// single type, since the right side counts rather than computes.
    #[test]
    fn a_lane_is_assignable_and_a_shift_takes_a_count_of_its_own_lane() {
        let result = run(
            &options(),
            concat!(
                "typedef int __attribute__((vector_size(16))) v4si;\n",
                "typedef unsigned __attribute__((vector_size(16))) v4ui;\n",
                "void write(v4si *out, v4ui a, v4si b, int n) {\n",
                "  v4si v = { 1, 2, 3, 4 };\n",
                "  v[0] = n;\n",
                "  v[1] += n;\n",
                "  v[2]++;\n",
                "  *&v[3] = n;\n",
                // The count is signed and the value is not, which no other operator allows.
                "  v4ui shifted = a >> b;\n",
                "  shifted <<= b;\n",
                // A scalar stands in every lane on either side of a shift, which is the half
                // that looks wrong: the shape of the answer comes off the count here.
                "  *out = v + (v4si)shifted + (1 << b);\n",
                "}\n",
                // A qualifier on the vector is a qualifier on the lane, so there is nothing here
                // to write to.
                "void refused(const v4si c) {\n",
                "  c[0] = 1;\n",
                "}\n",
            ),
        );
        assert_eq!(result.messages.len(), 1, "{:?}", result.messages);
        assert!(result.messages[0].contains("assignment of read-only"), "{:?}", result.messages);
    }

    /// The third layout attribute, and the one that is refused rather than read. Reversing the
    /// byte order of every scalar in a record is not something a compiler can do half of, and a
    /// compilation that ignored it would lay the record out in the host's order and hand back
    /// every field with its bytes the wrong way round. Both spellings are here because a header
    /// writes the armoured one, and the member is here because the refusal has to arrive before
    /// the layout is used rather than after.
    #[test]
    fn a_record_that_asks_for_the_other_byte_order_is_refused_rather_than_laid_out_in_this_one() {
        let opts = options();
        let big = "struct s { int i; } __attribute__((scalar_storage_order(\"big-endian\")));\n";
        assert_eq!(
            run(&opts, big).messages,
            ["/main.c:1:36: error: 'scalar_storage_order' is not implemented yet [E0688]\n\
              /main.c:1:36: note: every scalar in this record would be read in the wrong byte \
              order"]
        );

        let armoured =
            "struct s { int i; } __attribute__((__scalar_storage_order__(\"little-endian\")));\n";
        let messages = run(&opts, armoured).messages;
        assert!(messages[0].contains("[E0688]"), "{messages:?}");

        // The attribute in front of the body reaches the same list as the one behind it, and
        // the C23 spelling in gcc's namespace is the same attribute written a third way.
        let front = "struct __attribute__((scalar_storage_order(\"big-endian\"))) s { int i; };\n";
        assert!(run(&opts, front).messages[0].contains("[E0688]"), "{front}");
        let standard = "struct s { int i; } [[gnu::scalar_storage_order(\"big-endian\")]];\n";
        assert!(run(&opts, standard).messages[0].contains("[E0688]"), "{standard}");
    }

    /// Where a bit-field goes, which packing decides and which is the part of all this that
    /// is not what the names suggest. A bit-field goes at the next free bit unless that would
    /// make it span more storage than its own type occupies, and then it moves to the next
    /// boundary of its alignment. Any packing at all takes that rule out, and `#pragma pack`
    /// counts even where it lowers nothing, which is the fourth and seventh cases here.
    ///
    /// Nothing in the language can be asked where a bit-field is, since `offsetof` refuses one
    /// and every size below comes out the same either way, so what is asked is the byte a read
    /// of the field loads from.
    #[test]
    fn packing_is_what_decides_whether_a_bit_field_may_straddle_its_own_storage() {
        // A `char` field after twelve bits, which will not straddle unpacked and does packed.
        assert_eq!(bit_field_byte("struct s { int x : 12; char y : 6; };"), 2);
        assert_eq!(
            bit_field_byte("struct s { int x : 12; char y : 6; } __attribute__((packed));"),
            1
        );
        assert_eq!(
            bit_field_byte("struct s { int x : 12; __attribute__((packed)) char y : 6; };"),
            1
        );
        assert_eq!(bit_field_byte("#pragma pack(4)\nstruct s { int x : 12; char y : 6; };"), 1);
        // A thirty bit field after a byte, which is the case the rule was written for.
        assert_eq!(bit_field_byte("struct s { char x; int y : 30; };"), 4);
        assert_eq!(bit_field_byte("struct s { char x; int y : 30; } __attribute__((packed));"), 1);
        // Four is what an `int` asked for anyway, so this caps nothing and still counts.
        assert_eq!(bit_field_byte("#pragma pack(4)\nstruct s { char x; int y : 30; };"), 1);
        assert_eq!(bit_field_byte("#pragma pack(2)\nstruct s { char x; int y : 30; };"), 1);
    }

    /// The byte a read of `s.y` loads from, which is where the bit-field was placed.
    fn bit_field_byte(record: &str) -> u64 {
        let source = format!("{record}\nint f(struct s *p) {{ return p->y; }}\n");
        let body = body(&source);
        let Some((before, _)) = body.split_once("ptr_add") else { return 0 };
        let (_, constant) = before.rsplit_once("iconst.i64 ").expect("an offset constant");
        constant.lines().next().expect("a line").trim().parse().expect("a byte offset")
    }

    /// An attribute in the middle of a specifier list, which is where a member usually carries
    /// one and which was read and then thrown away. The `[[...]]` spelling and whatever was
    /// written in front of the declaration are collected as the list is walked and the
    /// `__attribute__` spelling is put straight on the specifiers, and the two were assigned
    /// over each other rather than joined.
    #[test]
    fn an_attribute_among_the_specifiers_is_kept_beside_the_ones_written_in_front() {
        tast(concat!(
            "struct a { char c; __attribute__((aligned(8))) int i; };\n",
            "_Static_assert(sizeof(struct a) == 16 && _Alignof(struct a) == 8, \"a\");\n",
            "_Static_assert(__builtin_offsetof(struct a, i) == 8, \"a.i\");\n",
            "struct b { char c; __attribute__((packed)) int i; };\n",
            "_Static_assert(sizeof(struct b) == 5 && _Alignof(struct b) == 1, \"b\");\n",
            "_Static_assert(__builtin_offsetof(struct b, i) == 1, \"b.i\");\n",
            "typedef struct { char c; int i; } __attribute__((packed)) c;\n",
            "_Static_assert(sizeof(c) == 5 && _Alignof(c) == 1, \"c\");\n",
        ));
    }

    /// The other half, which is `#pragma pack`. It caps a member's alignment where `packed`
    /// drops it, so `pack(2)` leaves a `short` where it was and moves an `int`, and it caps a
    /// member the program asked to align as well, which is where the two differ. It is read
    /// at the closing brace of the body, so a line written in the middle of one settles the
    /// whole record rather than the members after it, and `push` and `pop` nest.
    #[test]
    fn pragma_pack_caps_every_member_and_is_read_where_the_body_closes() {
        tast(concat!(
            "#pragma pack(1)\n",
            "struct A { char c; int i; };\n",
            "_Static_assert(sizeof(struct A) == 5 && _Alignof(struct A) == 1, \"A\");\n",
            "_Static_assert(__builtin_offsetof(struct A, i) == 1, \"A.i\");\n",
            "#pragma pack()\n",
            "struct B { char c; int i; };\n",
            "_Static_assert(sizeof(struct B) == 8 && _Alignof(struct B) == 4, \"B\");\n",
            "#pragma pack(2)\n",
            "struct C { char c; int i; double d; };\n",
            "_Static_assert(sizeof(struct C) == 14 && _Alignof(struct C) == 2, \"C\");\n",
            "_Static_assert(__builtin_offsetof(struct C, d) == 6, \"C.d\");\n",
            // A member the program aligned, which `pack` caps and `packed` would not.
            "struct K { char c; int i __attribute__((aligned(8))); };\n",
            "_Static_assert(sizeof(struct K) == 6 && _Alignof(struct K) == 2, \"K\");\n",
            "_Static_assert(__builtin_offsetof(struct K, i) == 2, \"K.i\");\n",
            // The record's own `aligned` is not a member's, so it is not capped.
            "struct J { char c; int i; } __attribute__((aligned(8)));\n",
            "_Static_assert(sizeof(struct J) == 8 && _Alignof(struct J) == 8, \"J\");\n",
            "#pragma pack()\n",
            "#pragma pack(push, 1)\n",
            "struct D { char c; short s; };\n",
            "_Static_assert(sizeof(struct D) == 3 && _Alignof(struct D) == 1, \"D\");\n",
            "#pragma pack(pop)\n",
            "struct E { char c; short s; };\n",
            "_Static_assert(sizeof(struct E) == 4 && _Alignof(struct E) == 2, \"E\");\n",
            // Written in the middle of a body, and it still settles the whole record.
            "struct H { char c;\n",
            "#pragma pack(1)\n",
            "  int i; };\n",
            "_Static_assert(sizeof(struct H) == 5 && _Alignof(struct H) == 1, \"H\");\n",
            "#pragma pack(1)\n",
            "struct I { char c;\n",
            "#pragma pack()\n",
            "  int i; };\n",
            "_Static_assert(sizeof(struct I) == 8 && _Alignof(struct I) == 4, \"I\");\n",
            "#pragma pack()\n",
            // Nested pushes, each one giving back what the one under it had.
            "#pragma pack(push, 8)\n",
            "#pragma pack(push, 1)\n",
            "struct P { char c; int i; };\n",
            "_Static_assert(sizeof(struct P) == 5 && _Alignof(struct P) == 1, \"P\");\n",
            "#pragma pack(pop)\n",
            "struct Q { char c; int i; };\n",
            "_Static_assert(sizeof(struct Q) == 8 && _Alignof(struct Q) == 4, \"Q\");\n",
            "#pragma pack(pop)\n",
            // A cap above what every member already asks for changes nothing at all.
            "#pragma pack(16)\n",
            "struct R { char c; int i; };\n",
            "_Static_assert(sizeof(struct R) == 8 && _Alignof(struct R) == 4, \"R\");\n",
            "#pragma pack()\n",
            "#pragma pack(1)\n",
            "struct S { char c; int i : 5; int j : 20; };\n",
            "_Static_assert(sizeof(struct S) == 5 && _Alignof(struct S) == 1, \"S\");\n",
            "union T { char c; int i; };\n",
            "_Static_assert(sizeof(union T) == 4 && _Alignof(union T) == 1, \"T\");\n",
            "#pragma pack()\n",
        ));
    }

    /// A line the reader cannot make sense of is a warning and the line is dropped, which is
    /// what GCC does with one, and these are its words for each of them. The last line is the
    /// one nothing else would reach, since it stands after every record in the file.
    #[test]
    fn a_pack_line_that_is_not_one_is_reported_in_the_words_gcc_uses() {
        let result = run(
            &options(),
            concat!(
                "#pragma pack 4\n",
                "#pragma pack(pop)\n",
                "#pragma pack(3)\n",
                "#pragma pack(1) junk\n",
                "#pragma pack(push, 1\n",
                "#pragma pack(x)\n",
                // These two are well formed and say nothing. Zero is how a line asks for the
                // target's own alignments back without writing empty parentheses.
                "#pragma pack(0)\n",
                "#pragma pack(push)\n",
                "struct s { char c; int i; };\n",
                "#pragma pack(pop)\n",
                "#pragma pack(pop, foo)\n",
            ),
        );
        let expected = [
            "missing `(` after `#pragma pack` - ignored",
            "`#pragma pack (pop)` encountered without matching `#pragma pack (push)`",
            "alignment must be a small power of two, not 3",
            "junk at end of `#pragma pack`",
            "malformed `#pragma pack(push[, id][, <n>])` - ignored",
            "unknown action `x` for `#pragma pack` - ignored",
            "`#pragma pack(pop, foo)` encountered without matching `#pragma pack(push, foo)`",
        ];
        assert_eq!(result.messages.len(), expected.len(), "{:?}", result.messages);
        for (message, want) in result.messages.iter().zip(expected) {
            assert!(message.contains(want), "expected {want:?} in {message:?}");
        }
    }

    /// A pragma line ends where the next line starts, so a macro that comes to nothing and was
    /// written first on that next line has to hand the line on rather than take it away. This
    /// is SQLite through mingw-w64's headers: `<stdarg.h>` leaves a `#pragma pack(pop)` behind
    /// it and `sqlite3.h` writes every declaration with `SQLITE_API` in front, which is empty.
    /// Without it the pragma swallows the declaration, the program is left without it, and the
    /// only thing said about any of it is that there was junk on the pragma.
    #[test]
    fn a_declaration_behind_an_empty_macro_is_not_eaten_by_the_pragma_above_it() {
        let result = run(
            &options(),
            concat!(
                "#pragma pack(push, 1)\n",
                "#pragma pack(pop)\n",
                "#define API\n",
                "API const char version[] = \"3.53.4\";\n",
                "const char *get(void) { return version; }\n",
            ),
        );
        assert!(result.messages.is_empty(), "{:?}", result.messages);
    }

    /// The two typedef spellings of the 128 bit types. gcc offers them as keywords rather
    /// than as typedefs in a header, which is the only way a program that includes nothing at
    /// all can still use them, and Apple's `<mach/arm/_structs.h>` is one such program.
    #[test]
    fn the_wide_integer_answers_to_all_three_of_its_names() {
        let text = tast("__uint128_t a; __int128_t b; unsigned __int128 c;\n");
        assert!(text.contains("decl #0 a : unsigned __int128"), "{text}");
        assert!(text.contains("decl #1 b : __int128"), "{text}");
        assert!(text.contains("decl #2 c : unsigned __int128"), "{text}");
    }

    #[test]
    fn every_conversion_the_language_performs_is_a_node_in_the_output() {
        // The point of a typed tree. The source has one operator and the output has the
        // widening that operator asked for, spelled out, so that nothing downstream has to
        // work out the conversion rules a second time.
        let text = tast("long f(int a, long b) { return a + b; }\n");
        assert!(text.contains("convert arithmetic"), "{text}");
    }

    #[test]
    fn a_mistake_in_each_phase_reaches_the_caller_and_writes_no_tree() {
        for source in [
            "#error stop\n",
            "int f(void) { return 1 + ; }\n",
            "int f(void) { return undeclared; }\n",
        ] {
            let result = run(&options(), source);
            assert!(result.failed(), "expected this to fail:\n{source}");
            assert!(
                result.text().is_empty(),
                "a file that did not compile wrote a tree:\n{source}"
            );
        }
    }

    #[test]
    fn one_undeclared_name_is_one_message_and_not_one_per_use() {
        // The poisoning rule from `spec/06-lexer-and-parser.md` section 6.8, seen from the
        // outside. Three uses of a name that was never declared, and the operators over them
        // say nothing at all.
        let result = run(&options(), "int f(void) { return nope + nope * nope; }\n");
        assert_eq!(result.errors, 1, "{:?}", result.messages);
    }

    #[test]
    fn a_declaration_the_parser_skipped_does_not_become_an_undeclared_name_as_well() {
        // The reason the checking is skipped after a failed parse. The parser gave up on the
        // first line and there is no `x` in the tree, so a checker run over it would report
        // every use of `x` below as undeclared, which is a second message about one mistake.
        let result = run(&options(), "int x = ;\nint f(void) { return x; }\n");
        assert_eq!(result.errors, 1, "{:?}", result.messages);
    }

    #[test]
    fn werror_turns_a_warning_into_an_error_in_the_count_and_in_the_word() {
        let source = "int f(void) { char c = 300; return c; }\n";
        let plain = run(&options(), source);
        assert_eq!(plain.errors, 0, "{:?}", plain.messages);
        assert_eq!(plain.messages.len(), 1, "expected a warning about the narrowed constant");
        assert!(!plain.text().is_empty(), "a warning is not a reason to write nothing");

        let mut opts = options();
        opts.warnings_are_errors = true;
        let strict = run(&opts, source);
        assert!(strict.failed());
        assert!(strict.text().is_empty(), "and under -Werror it is a reason to write nothing");
        for message in &strict.messages {
            assert!(!message.contains("warning:"), "{message}");
        }
    }

    #[test]
    fn w_drops_the_warning_before_werror_can_promote_it() {
        let source = "int f(void) { char c = 300; return c; }\n";
        let mut opts = options();
        opts.warnings = false;
        let quiet = run(&opts, source);
        assert_eq!(quiet.messages, Vec::<String>::new());
        assert_eq!(quiet.errors, 0);
        assert!(!quiet.text().is_empty(), "and the file still compiles");

        // A build that passes both means it wants neither, and the order it wrote them in is not
        // something to make it think about.
        opts.warnings_are_errors = true;
        let both = run(&opts, source);
        assert_eq!(both.messages, Vec::<String>::new());
        assert!(!both.failed(), "-w -Werror is not an error about a warning nobody saw");
    }

    #[test]
    fn the_dialect_reaches_the_keywords_and_the_checking() {
        // `typeof` is C23's and GNU's, so the same source is a declaration under one dialect
        // and a mistake under the other, which is the keyword table being built per dialect.
        let source = "typeof(1) x;\n";
        let mut opts = options();
        opts.std = Std::C23;
        opts.gnu_extensions = false;
        assert!(!run(&opts, source).failed(), "{:?}", run(&opts, source).messages);

        opts.std = Std::C17;
        assert!(run(&opts, source).failed());
    }

    #[test]
    fn asking_for_a_kind_that_is_not_written_yet_runs_the_front_end_and_writes_nothing() {
        let mut opts = options();
        opts.emit = EmitKind::Object;
        let result = run(&opts, "int x = 1;\n");
        assert!(!result.failed(), "{:?}", result.messages);
        assert!(result.text().is_empty());
        // And it still finds what the checking finds, so a later kind on a broken file is not
        // a silent success.
        assert!(run(&opts, "int f(void) { return undeclared; }\n").failed());
    }

    /// The machine code of `source`, insisting that it compiled cleanly.
    fn mir(source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    /// The whole compiler in one assertion, which is what this emit kind is for.
    ///
    /// C in, machine instructions out, every register a real one and every frame offset a
    /// number. Everything between the two is checked somewhere else, one pass at a time. What is
    /// checked here is that the passes are joined up and that the driver runs them.
    #[test]
    fn a_function_goes_from_c_to_instructions_with_real_registers_in_them() {
        let text = mir("int add(int a, int b) { return a + b; }\n");
        assert!(text.starts_with("mfunc @add {"), "{text}");
        assert!(text.contains("x64.add_rr_32"), "{text}");
        assert!(text.contains("x64.ret"), "{text}");
        // A virtual register is what the allocator was there to remove, so one left in the
        // output is the difference between code and something that looks like code.
        assert!(!text.contains('%'), "{text}");
    }

    /// A declaration has no body, so there is nothing to generate for one and nothing is.
    #[test]
    fn a_function_with_no_body_produces_no_machine_function() {
        let text = mir("int g(int);\nint f(int a) { return g(a); }\n");
        assert_eq!(text.matches("mfunc @").count(), 1, "{text}");
        assert!(text.contains("mfunc @f {"), "{text}");
        assert!(text.contains("x64.call"), "{text}");
    }

    /// Two functions come out in the order the module holds them, which is source order.
    #[test]
    fn every_definition_in_the_file_is_generated_and_they_keep_their_order() {
        let text = mir("int a(int x) { return x; }\nint b(int x) { return x; }\n");
        let first = text.find("mfunc @a").expect("the first function");
        let second = text.find("mfunc @b").expect("the second function");
        assert!(first < second, "{text}");
    }

    /// The target reaches the back end, so the same C is different instructions on Windows.
    #[test]
    fn the_target_decides_which_convention_the_generated_code_follows() {
        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        let linux = run(&opts, "int f(int a) { return a; }\n").text().to_owned();
        assert!(linux.contains("$rdi"), "{linux}");

        opts.target = "x86_64-pc-windows-msvc".parse::<Triple>().unwrap();
        let windows = run(&opts, "int f(int a) { return a; }\n").text().to_owned();
        assert!(windows.contains("$rcx"), "{windows}");
        assert!(!windows.contains("$rdi"), "{windows}");
    }

    /// And it reaches the front end, where it decides what an anonymous member is.
    ///
    /// This is the shape `<objidl.h>` writes and the Windows headers are full of: the union inside
    /// `STGMEDIUM` closes with `} DUMMYUNIONNAME;`, and the macro expands to nothing unless the
    /// program defined `NONAMELESSUNION`, so what is left is a union with a tag and no name. On a
    /// Windows target that is an anonymous member, and reading it as a declaration of nothing
    /// drops it, which loses the names and the eight bytes the member takes up both.
    #[test]
    fn a_tagged_member_with_no_name_is_a_member_on_windows_and_nothing_on_linux() {
        let source = concat!(
            "struct S { union U { int i; void *p; }; unsigned long tymed; };\n",
            "int size(void) { return sizeof(struct S); }\n",
            "int f(struct S *s) { s->i = 1; return s->i; }\n",
        );

        let mut opts = options();
        opts.target = "x86_64-pc-windows-gnu".parse::<Triple>().unwrap();
        let windows = run(&opts, source);
        assert!(windows.messages.is_empty(), "{:?}", windows.messages);

        let linux = run(&options(), source);
        assert_eq!(linux.messages.len(), 3, "{:?}", linux.messages);
        assert!(linux.messages[0].contains("does not declare anything"), "{:?}", linux.messages);

        // And the flag answers for either of them, so a program built for Linux against a header
        // written for Windows can be read the way the header meant it.
        let mut opts = options();
        opts.ms_extensions = Some(true);
        let asked = run(&opts, source);
        assert!(asked.messages.is_empty(), "{:?}", asked.messages);
    }

    /// A target with no back end says so rather than generating something for another machine.
    #[test]
    fn a_target_this_has_no_back_end_for_is_reported_rather_than_generated() {
        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        opts.target = "aarch64-unknown-linux-gnu".parse::<Triple>().unwrap();
        let result = run(&opts, "int f(int a) { return a; }\n");
        assert!(result.failed());
        assert!(result.messages[0].contains("no back end for aarch64"), "{:?}", result.messages);
        assert!(result.text().is_empty());
    }

    /// A construct the rule set does not reach yet is named, along with the function it is in.
    ///
    /// The message is about this compiler being unfinished rather than about the program, which
    /// is valid C either way, so it carries the note that says where the work is tracked. Both
    /// functions are attempted, so a file that is ahead of the back end in three places says so
    /// three times rather than one recompilation at a time.
    #[test]
    fn a_construct_the_back_end_cannot_reach_yet_is_reported_against_its_function() {
        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        let source = "void a(int n) { int v[n] __attribute__((aligned(32))); v[0] = 1; }\n\
                      void b(int n) { int v[n] __attribute__((aligned(32))); v[0] = 1; }\n";
        let result = run(&opts, source);
        assert!(result.failed());
        assert_eq!(result.messages.len(), 2, "{:?}", result.messages);
        assert!(result.messages[0].contains("cannot generate code for 'a'"), "{:?}", result);
        assert!(result.messages[0].contains("wants more alignment"), "{:?}", result);
        assert!(result.messages[1].contains("cannot generate code for 'b'"), "{:?}", result);
        assert!(result.text().is_empty());
    }

    /// A variable length array walks its pages under the flag that says every page is touched.
    ///
    /// The pages the prologue takes are touched by the prologue. The pages the array takes are
    /// however many the size worked out to, so touching them is a loop written around the
    /// declaration rather than anything a prologue can do. What says the loop is there is the
    /// ordered comparison it ends each step with, which nothing else in a function writes, and the
    /// touch behind it. Without the flag the declaration is still the one subtraction it always was.
    #[test]
    fn a_variable_length_array_walks_its_pages_where_every_page_of_the_frame_is_to_be_touched() {
        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        let source = "void a(int n) { int v[n]; v[0] = 1; }\n";
        let plain = run(&opts, source);
        assert!(!plain.failed(), "{:?}", plain.messages);
        assert!(!plain.text().contains("cmp_set_a_64"), "{}", plain.text());

        opts.stack_clash = true;
        let result = run(&opts, source);
        assert!(!result.failed(), "{:?}", result.messages);
        assert!(result.text().contains("cmp_set_a_64"), "{}", result.text());
        assert!(result.text().contains("or_mi_8"), "{}", result.text());
    }

    /// An opcode the rule language has no word for is named anyway, and pointed at.
    ///
    /// The rule language's spelling is the better name when there is one, but an opcode it has
    /// no word for is exactly the opcode no rule lowers, so falling back to the opcode and the
    /// type is what makes the message say anything at all in the cases that happen. The span is
    /// the instruction's own, so the message lands on the line rather than on the file.
    ///
    /// The width of the float is what keeps the program refused. Everything else here is split into
    /// halves by `rucc_codegen::wide`, including the divisions and the conversions to a `float` and
    /// a `double`, which became calls into the compiler runtime. A `long double` is the eighty bit
    /// float on this target, the runtime has no conversion at that width because the back end has no
    /// register that holds one, which is tamnd/rucc#326, so a function converting to it is left with
    /// its wide values and reaches the selector the way every function of this width used to.
    #[test]
    fn an_opcode_with_no_name_in_the_rule_language_is_named_by_its_own_spelling() {
        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        let source =
            "long double f(int a) {\n  __int128 wide = a;\n  return (long double) wide;\n}\n";
        let result = run(&opts, source);
        assert!(result.failed());
        assert!(
            result.messages[0].contains("no rule lowers a `sext` producing a `i128`"),
            "{result:?}"
        );
        assert!(result.messages[0].contains(":2:"), "the line the widening is on: {result:?}");
        assert!(!result.messages[0].contains("this instruction"), "{result:?}");
    }

    /// The note names the issue tracker, which is where a reader finds out whether it is known.
    #[test]
    fn the_note_on_unfinished_work_points_at_the_issues_rather_than_at_the_plan() {
        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        let source = "long double f(int a) { __int128 wide = a; return (long double) wide; }\n";
        let result = run(&opts, source);
        assert!(result.failed());
        let note = result.messages.iter().find(|line| line.contains("note:")).expect("a note");
        assert!(note.contains("https://github.com/tamnd/rucc/issues"), "{note}");
        assert!(!note.contains("spec/17-milestones.md"), "{note}");
    }

    /// The two frame flags reach the frame, which is the only thing either of them does.
    #[test]
    fn the_frame_flags_on_the_command_line_reach_the_generated_frame() {
        let source = "int f(int a) { return a; }\n";
        assert!(!mir(source).contains("$rbp"), "a leaf needs no frame pointer by default");

        let mut opts = options();
        opts.emit = EmitKind::MirFinal;
        opts.frame_pointer = true;
        let kept = run(&opts, source).text().to_owned();
        assert!(kept.contains("x64.push_64 $rbp"), "{kept}");
    }

    /// The assembly of `source`, insisting that it compiled cleanly.
    fn asm(source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::Asm;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    /// `-S`, which is the same compiler as the kind above it with a different last step.
    ///
    /// What the assembly says is checked in `rucc-asm`, one instruction at a time and against the
    /// target's own description of what an instruction is. What is checked here is that a C file
    /// goes all the way to a listing an assembler would take, which means the directives around
    /// the function as well as the instructions in it.
    #[test]
    fn a_function_goes_from_c_to_assembly_an_assembler_would_take() {
        let text = asm("int add(int a, int b) { return a + b; }\n");
        assert!(text.contains("\t.globl\tadd\n"), "{text}");
        assert!(text.contains("\t.type\tadd, @function\n"), "{text}");
        assert!(text.contains("\nadd:\n"), "{text}");
        assert!(text.contains("\taddl\t"), "{text}");
        assert!(text.contains("\tret\n"), "{text}");
        assert!(text.contains("\t.size\tadd, .-add\n"), "{text}");
        // Without this the stack the program runs on is executable, which is not a default
        // anybody chose and is not a thing a reader would notice missing.
        assert!(text.contains(".note.GNU-stack"), "{text}");
    }

    /// A call through a function pointer, which is a different instruction from a call to a name.
    ///
    /// Both are in the one function on purpose. What is being read is that the two calls are told
    /// apart all the way down: one carries a name the linker resolves and one carries a register,
    /// and neither turns into the other on the way.
    #[test]
    fn a_call_through_a_function_pointer_goes_through_the_register_it_is_in() {
        let text = asm("int g(int);\nint f(int (*p)(int), int a) { return p(a) + g(a); }\n");
        assert!(text.contains("\tcall\t*%"), "{text}");
        assert!(text.contains("\tcall\tg\n"), "{text}");
        // The address arrived in the first argument register and the argument the call passes has
        // to end up there, so the two cannot be the same register and the compiler has to have
        // moved one of them.
        assert!(text.contains("%rdi"), "{text}");
    }

    /// A name at file scope, which is the one address a function cannot compute for itself. The
    /// `lea` that computes it is folded into the load that reads through it, so what is left to
    /// read is the addressing mode, which is where the instruction pointer shows up.
    #[test]
    fn the_address_of_a_global_is_read_from_the_instruction_pointer() {
        let text = asm("extern int counter;\nint f(void) { return counter; }\n");
        assert!(text.contains("\tmovl\tcounter(%rip), %eax\n"), "{text}");
    }

    /// Every comparison a branch can be on, which the machine jumps on without keeping a byte.
    ///
    /// Ten conditions, and each of them comes out as its opposite because the block falls into the
    /// arm the comparison is true for and jumps to the other one. That is the half of this most
    /// worth pinning: a jump on the condition rather than on its opposite compiles, encodes and
    /// runs, and gets every one of these ten functions backwards. The unsigned four and the signed
    /// four are separate for the same reason, since `jl` where `jb` was meant is a program that
    /// works until an address is above two gigabytes.
    #[test]
    fn a_branch_on_a_comparison_jumps_on_the_opposite_of_what_it_compared() {
        let arms = "return 1; return 2;";
        let signed = [("==", "jne"), ("!=", "je"), ("<", "jge"), ("<=", "jg"), (">", "jle")];
        for (operator, jump) in signed.into_iter().chain([(">=", "jl")]) {
            let text = asm(&format!("int f(int a, int b) {{ if (a {operator} b) {arms} }}\n"));
            assert!(
                text.contains(&format!("\tcmpl\t%esi, %edi\n\t{jump}\t")),
                "{operator}: {text}"
            );
            assert!(!text.contains("\tset"), "{operator}: {text}");
            assert!(!text.contains("\ttest"), "{operator}: {text}");
        }
        let unsigned = [("<", "jae"), ("<=", "ja"), (">", "jbe"), (">=", "jb")];
        for (operator, jump) in unsigned {
            let source =
                format!("int f(unsigned a, unsigned b) {{ if (a {operator} b) {arms} }}\n");
            let text = asm(&source);
            assert!(
                text.contains(&format!("\tcmpl\t%esi, %edi\n\t{jump}\t")),
                "{operator}: {text}"
            );
        }

        // And against a constant, which is four comparisons in five and is where the saving
        // mostly is, since the byte that goes was the only reason the constant was in a register.
        let text = asm("int f(int a) { if (a < 7) return 1; return 2; }\n");
        assert!(text.contains("\tcmpl\t$7, %edi\n\tjge\t"), "{text}");
    }

    /// The comparison whose answer is a value rather than a branch, which keeps its byte.
    ///
    /// The one that goes is the byte nothing but the branch reads. A comparison the program asked
    /// for the answer of is not that, and there is no branch behind it to fold into in any case,
    /// so this is here to say that what was taken out was taken out of one place and not two.
    #[test]
    fn a_comparison_whose_answer_the_program_wanted_still_writes_a_byte() {
        let text = asm("int f(int a, int b) { return a < b; }\n");
        assert!(text.contains("\tsetl\t"), "{text}");
    }

    /// The same source at `-O2`, which is where the optimizer's passes are in the list.
    fn optimized(source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::Asm;
        opts.opt_level = rucc_session::OptLevel::O2;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    /// A dense `switch` whose arms are a function of the label, which is arithmetic.
    ///
    /// Sixteen labels, and the arm for label `k` gives `k + 1`. What came out of this was a
    /// comparison and a jump for every one of them, which is tamnd/rucc#728. What comes out now is
    /// one comparison and one addition, and the count is the whole of the claim: it does not grow
    /// with the number of labels, so sixteen and a hundred and sixty compile to the same thing.
    ///
    /// The comparison is unsigned because the range check is the label minus the lowest one, which
    /// is a count and not a number the program wrote.
    #[test]
    fn a_switch_whose_arms_are_a_function_of_the_label_is_a_range_check_and_arithmetic() {
        let arms: String =
            (0..16).map(|k| format!("case {k}: return {};", k + 1)).collect::<Vec<_>>().join(" ");
        let text = optimized(&format!("int f(int x) {{ switch (x) {{ {arms} }} return 0; }}\n"));
        assert!(text.contains("\tcmpl\t$15, %edi\n\tja\t"), "{text}");
        assert!(text.contains("\taddl\t$1, %edi"), "{text}");
        assert_eq!(text.matches("\tcmp").count(), 1, "{text}");
    }

    /// The same `switch` with one arm off the line, which keeps every comparison it had.
    ///
    /// The answers being a line is what licenses the range check, since a range check answers for
    /// every label in the range at once. One label whose arm disagrees is a label the check would
    /// answer wrongly, so this is here to say that the pass is reading the arms and not counting
    /// the labels.
    #[test]
    fn a_dense_switch_whose_arms_are_not_a_line_keeps_its_comparisons() {
        let arms: String = (0..16)
            .map(|k| format!("case {k}: return {};", if k == 9 { 100 } else { k + 1 }))
            .collect::<Vec<_>>()
            .join(" ");
        let text = optimized(&format!("int f(int x) {{ switch (x) {{ {arms} }} return 0; }}\n"));
        assert!(text.matches("\tcmp").count() > 1, "{text}");
    }

    /// A cast between a pointer and an integer as wide as one, which is every one C writes here.
    #[test]
    fn a_cast_between_a_pointer_and_an_integer_leaves_the_value_where_it_is() {
        let text = asm("long f(void *p) { return (long)p; }\n");
        // Every instruction in the body is a full width move or the return. The copies are the
        // allocator taking no hints, and what matters here is what is not among them: nothing
        // narrows the value and nothing widens it again, which is what a cast that did something
        // would look like.
        for line in text.lines().filter(|line| line.starts_with('\t') && !line.contains('.')) {
            let mnemonic = line.split_whitespace().next().unwrap_or("");
            assert!(matches!(mnemonic, "movq" | "ret"), "{line} in\n{text}");
        }
    }

    /// The arguments past the sixth arrive in the caller's memory rather than in a register, and
    /// where that memory is depends on what the prologue did, so this is checked at the end of the
    /// pipeline rather than in the middle of it.
    #[test]
    fn an_argument_past_the_last_register_is_read_out_of_the_caller_s_stack() {
        let six = "long a, long b, long c, long d, long e, long f";
        let text = asm(&format!("long f({six}, long g, long h) {{ return g + h; }}\n"));

        // Nothing is pushed and no frame is taken, so the only thing between the stack pointer and
        // the caller's arguments is the return address the call pushed. Which is where gcc 16.2.0
        // reads them from too, at `-O0`, though it reads them in three instructions where this
        // reads them in two: the second read is the addition's own memory operand, which is
        // `rucc_codegen::combine`, and the offset in it is the one the frame layout wrote into the
        // load before the two were put together.
        assert!(text.contains("\tmovq\t8(%rsp), "), "{text}");
        assert!(text.contains("\taddq\t16(%rsp), "), "{text}");

        // A narrower one is read at its own width, because the bits above it are bits the
        // convention says nothing about, and one in the other register file with the other file's
        // instruction.
        let narrow = asm(&format!("int f({six}, int g) {{ return g; }}\n"));
        assert!(narrow.contains("\tmovl\t8(%rsp), "), "{narrow}");
        let eight =
            "double a, double b, double c, double d, double e, double f, double g, double h";
        let float = asm(&format!("double f({eight}, double i) {{ return i; }}\n"));
        assert!(float.contains("\tmovsd\t8(%rsp), "), "{float}");
    }

    /// The other end of the same thing. What the caller writes is at the stack pointer, because
    /// that is the bottom of its frame and the bottom of its frame is where the callee looks.
    #[test]
    fn a_call_writes_the_arguments_with_no_register_left_at_the_stack_pointer() {
        let six = "1, 2, 3, 4, 5, 6";
        let decl = "long g(long, long, long, long, long, long, long, long);\n";
        let text = asm(&format!("{decl}long f(void) {{ return g({six}, 7, 8); }}\n"));

        assert!(text.contains("\tmovq\t%"), "{text}");
        assert!(text.contains(", (%rsp)\n"), "{text}");
        assert!(text.contains(", 8(%rsp)\n"), "{text}");
        // And it reserved the bytes it wrote into, so nothing else in the frame is on top of them.
        assert!(text.contains("\tsubq\t$"), "{text}");

        // A narrower one is written at its own width, matching what the callee reads it back with.
        let narrow = "int g(int, int, int, int, int, int, int);\n";
        let text = asm(&format!("{narrow}int f(void) {{ return g({six}, 7); }}\n"));
        assert!(text.contains("\tmovl\t%"), "{text}");
        assert!(text.contains(", (%rsp)\n"), "{text}");
    }

    /// The count a variadic callee on this convention reads is a count of vector registers, so a
    /// float that ran out of them and went to memory is not in it.
    #[test]
    fn a_variadic_call_counts_registers_and_not_arguments() {
        let nine = "1., 2., 3., 4., 5., 6., 7., 8., 9.";
        let decl = "int g(int, ...);\n";
        let text = asm(&format!("{decl}int f(void) {{ return g(0, {nine}); }}\n"));

        assert!(text.contains("\tmovl\t$8, "), "eight registers, not nine: {text}");
        assert!(text.contains("\tmovsd\t%"), "{text}");
        assert!(text.contains(", (%rsp)\n"), "{text}");
    }

    /// The callee's half of the same convention. Every argument register it was handed is written
    /// into its frame on the way in, because which of them hold anything is a thing only the caller
    /// knew, and the ones the signature does name are left out because `va_start` sets the offsets
    /// past them and nothing ever reads their slots.
    #[test]
    fn a_variadic_function_writes_the_argument_registers_it_was_handed_into_its_frame() {
        let body =
            "__builtin_va_list ap; __builtin_va_start(ap, n); __builtin_va_end(ap); return n;";
        let text = asm(&format!("int f(int n, ...) {{ {body} }}\n"));

        // Five general purpose registers and eight vector ones, since the one parameter the
        // signature names took the first of the six.
        let stores = |mnemonic: &str| text.matches(&format!("\t{mnemonic}\t%")).count();
        assert!(text.contains(", 8(%r"), "the second slot, not the first: {text}");
        assert!(!text.contains(", 0(%r"), "{text}");
        // All sixteen bytes of each vector register, which is what gcc writes and what a `va_arg`
        // of a `_Float128` reads back, so the mnemonic is the one that moves a whole register.
        assert_eq!(stores("movaps"), 8, "every vector register: {text}");
        assert_eq!(stores("movsd"), 0, "and the whole of each one: {text}");

        // And the area is one of the function's own stack objects, so the frame holds it.
        assert!(text.contains("\tsubq\t$"), "{text}");
    }

    /// What `va_start` writes is the four fields of the list, and the two numbers among them are
    /// where the arguments the signature names left the walk over each file's registers.
    #[test]
    fn va_start_writes_the_four_fields_the_psabi_describes() {
        let start = "__builtin_va_list ap; __builtin_va_start(ap, d);";
        let params = "int a, int b, int c, double d";
        let text = asm(&format!("int f({params}, ...) {{ {start} return a; }}\n"));

        // Three integers took three of the six general purpose registers, and one double took one
        // of the eight vector ones, so the walk starts at twenty four bytes into the first half and
        // sixteen bytes into the second, which begins at forty eight.
        assert!(text.contains("	movl	$24, "), "{text}");
        assert!(text.contains("	movl	$64, "), "{text}");
        // The other two fields are addresses rather than numbers, so each is stored as a word and
        // each is a `lea` away. One of them reaches above the frame, which is where the caller's
        // arguments are and is the only thing in this function that is not below the stack pointer.
        assert!(text.contains(", 8(%r"), "{text}");
        assert!(text.contains(", 16(%r"), "{text}");
        let frame: u32 = text
            .lines()
            .find_map(|line| line.trim().strip_prefix("subq	$")?.split(',').next()?.parse().ok())
            .expect("a variadic function takes a frame for the save area");
        let above = |line: &str| {
            let at: u32 = line.trim().strip_prefix("leaq	")?.split('(').next()?.parse().ok()?;
            Some(at > frame)
        };
        assert!(text.lines().filter_map(above).any(|it| it), "{frame}: {text}");
    }

    /// A `va_arg` is a branch on whether the argument it wants is still in the save area, and which
    /// of the two halves it walks is the type's answer.
    #[test]
    fn va_arg_branches_on_whether_the_argument_is_still_in_the_save_area() {
        let read = "__builtin_va_list ap; __builtin_va_start(ap, n);";
        let ints = format!("int f(int n, ...) {{ {read} return __builtin_va_arg(ap, int); }}\n");
        let text = asm(&ints);

        // The last general purpose slot begins at forty, so an offset above it is an argument the
        // caller left in its own memory instead.
        assert!(text.contains("$40, "), "{text}");
        assert!(text.contains("	cmpl	"), "{text}");
        // The jump is the unsigned one, since an offset is a count of bytes. It is the opposite
        // of the comparison the front end wrote, because the block falls into the half taken when
        // the argument is still in the save area and jumps to the other one.
        assert!(text.contains("	ja	"), "{text}");

        let arg = "__builtin_va_arg(ap, double)";
        let text = asm(&format!("double f(int n, ...) {{ {read} return {arg}; }}\n"));
        assert!(text.contains("$160, "), "the last vector slot: {text}");
    }

    /// A structure assigned is a copy of a known size, and a copy of a known size is a run of
    /// moves rather than a call to a library this compiler has no way to reach yet.
    #[test]
    fn a_structure_assignment_is_a_move_for_each_word_of_it() {
        let decl = "struct pair { long a, b; };\n";
        let body = "struct pair p = *q; return p.a + p.b;";
        let text = asm(&format!("{decl}long f(struct pair *q) {{ {body} }}\n"));

        assert!(!text.contains("memcpy"), "nothing calls the library: {text}");
        assert!(!text.contains("\tcall"), "{text}");
        // Sixteen bytes aligned to eight is two words, and each is a load and a store.
        assert!(text.matches("\tmovq\t").count() >= 4, "two words each way: {text}");
    }

    /// A word is as wide as the object is aligned to and no wider, so a character array is copied
    /// a byte at a time and a structure of longs eight bytes at a time.
    #[test]
    fn how_wide_a_word_of_a_copy_is_follows_the_alignment() {
        let decl = "struct bytes { char a[8]; };\n";
        let body = "struct bytes p = *q; return p.a[0];";
        let text = asm(&format!("{decl}int f(struct bytes *q) {{ {body} }}\n"));

        // Eight bytes aligned to one is eight words, and each is a load and a store.
        assert!(text.matches("\tmovb\t").count() >= 16, "a byte at a time: {text}");
    }

    /// What an initialiser does not name is zero, which the front end writes as a fill and this
    /// writes as the byte spread across each word.
    #[test]
    fn the_part_of_an_initialiser_that_names_nothing_is_stored_as_zero() {
        let decl = "struct wide { long a, b, c; };\n";
        let text = asm(&format!("{decl}long f(void) {{ struct wide w = {{ 7 }}; return w.c; }}\n"));

        assert!(!text.contains("memset"), "nothing calls the library: {text}");
        assert!(text.contains("\tmovq\t$0, ") || text.contains("$0, %"), "the zero: {text}");
    }

    /// A copy too large to be worth unrolling is a call to the runtime, which is the C library on
    /// a hosted target and `rucc-builtins` on a freestanding one.
    #[test]
    fn a_copy_too_large_to_unroll_calls_the_runtime() {
        let decl = "struct huge { char a[4096]; };\n";
        let mut opts = options();
        opts.emit = EmitKind::Asm;
        let source = format!("{decl}void f(struct huge *p, struct huge *q) {{ *p = *q; }}\n");
        let result = run(&opts, &source);
        assert!(!result.failed(), "{:?}", result.messages);
        let text = result.text();
        assert!(text.contains("call") && text.contains("memcpy"), "{text}");
        // The size in the register the convention passes the third argument in, which is what
        // says the call was built from the convention and not from the shape of the IR.
        assert!(text.contains("4096"), "the size travels: {text}");
    }

    /// And an object passed by value with more words in it than that is the same call again,
    /// written in front of the call the object is an argument of.
    ///
    /// The copy is one the caller owes the callee, since the callee is free to write to what it
    /// was handed, so it is not an optimization that the size decides but the only way the call
    /// can be made at all.
    #[test]
    fn a_structure_too_large_to_unroll_is_copied_into_the_argument_area_by_the_runtime() {
        let decl = "struct huge { char a[4096]; };\nint take(struct huge);\n";
        let text = asm(&format!("{decl}int f(struct huge *p) {{ return take(*p); }}\n"));

        let copy = text.find("call\tmemcpy").expect("the copy");
        let call = text.find("call\ttake").expect("the call");
        assert!(copy < call, "the copy comes first: {text}");
        // Into the bottom of the outgoing area, which is where the stack pointer already is, and
        // with the size in the register the convention passes the third argument in.
        assert!(text.contains("leaq\t(%rsp), %rdi"), "the destination: {text}");
        assert!(text.contains("$4096, %edx"), "the size: {text}");
    }

    /// A frame that had to force its own alignment cannot say how far away the caller's stack
    /// pointer was, so it reaches back through the frame pointer instead.
    #[test]
    fn a_realigned_frame_reads_them_through_the_frame_pointer() {
        let six = "long a, long b, long c, long d, long e, long f";
        let body = "_Alignas(32) long wide[4]; wide[0] = g; return wide[0];";
        let text = asm(&format!("long f({six}, long g) {{ {body} }}\n"));

        // The frame pointer is saved and pointed at where it was saved before the alignment is
        // forced, so the caller's arguments stay a constant distance from it: one word for the
        // saved frame pointer and one for the return address.
        assert!(text.contains("\tandq\t$-32, %rsp"), "{text}");
        assert!(text.contains("\tmovq\t16(%rbp), "), "{text}");
        assert!(!text.contains("\tmovq\t16(%rsp), "), "{text}");
    }

    /// The object format decides the directives, and the target decides the object format.
    #[test]
    fn the_target_decides_how_the_assembly_is_spelled() {
        let mut opts = options();
        opts.emit = EmitKind::Asm;
        opts.target = "x86_64-apple-darwin".parse::<Triple>().unwrap();
        let text = run(&opts, "int f(void) { return 0; }\n").text().to_owned();
        assert!(text.contains("__TEXT,__text"), "{text}");
        assert!(text.contains("\n_f:\n"), "{text}");
        assert!(!text.contains(".note.GNU-stack"), "{text}");
    }

    /// The object file of `source`, insisting that it compiled cleanly.
    fn obj(source: &str) -> Vec<u8> {
        let mut opts = options();
        opts.emit = EmitKind::Object;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        match result.artifact {
            Artifact::Object { bytes, .. } => bytes,
            other => panic!("expected an object, got {other:?}"),
        }
    }

    /// `-c`, which is the last step of the three the back end can end with.
    ///
    /// What is in the file is checked in `rucc-object`, a field at a time. What is checked here is
    /// that a C file goes all the way to one, which is the whole compiler in one line and the
    /// thing that stops working when a layer between them changes its mind about something.
    #[test]
    fn a_function_goes_from_c_to_an_object_a_linker_would_take() {
        let bytes = obj("int add(int a, int b) { return a + b; }\n");
        assert_eq!(&bytes[..4], b"\x7fELF", "an object file starts by saying it is one");
        let text = asm("int add(int a, int b) { return a + b; }\n");
        assert!(
            text.contains("\taddl\t"),
            "and the listing of it is the same instructions:\n{text}"
        );
    }

    /// A variable this file defines, which is what a reference to one has to resolve against.
    #[test]
    fn a_variable_goes_from_c_to_the_section_it_belongs_in() {
        let text = asm("int counter = 42;\nstatic int hidden;\nconst int fixed = 7;\n");
        assert!(text.contains("\t.data\n\t.globl\tcounter\n"), "{text}");
        assert!(text.contains("\ncounter:\n\t.long\t42\n"), "{text}");
        assert!(text.contains("\t.size\tcounter, .-counter\n"), "{text}");
        // A zeroed variable carries its size and none of its bytes, and a `static` one is not
        // announced to the linker at all, which is the whole of what `static` means here.
        assert!(text.contains("\t.bss\n\t.p2align\t2\n"), "{text}");
        assert!(text.contains("\nhidden:\n\t.space\t4\n"), "{text}");
        assert!(!text.contains(".globl\thidden"), "{text}");
        // Nothing writes through it, so it goes in a page the loader can map read only and every
        // process running the program can share.
        assert!(text.contains("\t.section\t.rodata\n"), "{text}");
    }

    /// A bit-field with a value in it, which is written as the bytes the value lands in.
    ///
    /// The interesting one is the field whose lowest byte is zero. The bytes a bit-field
    /// initializer makes are put together first and then taken back out as the run they make,
    /// and taking them out starts at the byte the field starts at, so a zero byte at the front
    /// used to end the object up in `.bss` with the rest of its value thrown away.
    #[test]
    fn a_bit_field_initializer_writes_every_byte_of_the_value_and_not_only_the_ones_that_are_set() {
        let text = asm("struct s { unsigned f : 20; } x = { 0x12300 };\n");
        assert!(text.contains("\t.data\n"), "there is something to write: {text}");
        assert!(text.contains("\nx:\n\t.ascii\t\"\\000#\\001\"\n"), "and it is the value: {text}");

        // Two fields, the first of them zero, which is the same thing said with the zero byte
        // inside the run rather than at the front of it.
        let text = asm("struct s { unsigned a : 8; unsigned b : 8; } x = { 0, 3 };\n");
        assert!(text.contains("\nx:\n\t.ascii\t\"\\000\\003\"\n"), "{text}");

        // Wider than an `int`, which is the same code and is worth saying because the value no
        // longer fits in the thirty two bits a bit-field used to be read at.
        let text = asm("struct s { unsigned long long f : 40; } x = { 0x100000 };\n");
        assert!(text.contains("\nx:\n\t.ascii\t\"\\000\\000\\020\"\n\t.space\t5\n"), "{text}");

        // Nothing in it, which still costs no bytes in the file.
        let text = asm("struct s { unsigned f : 20; } x = { 0 };\n");
        assert!(text.contains("\t.bss\n"), "an object of zeroes is zeroes: {text}");
        assert!(text.contains("\nx:\n\t.space\t4\n"), "{text}");
    }

    /// A string literal, which is a variable the program never named.
    #[test]
    fn a_string_literal_is_a_variable_with_a_name_no_program_could_write() {
        let text = asm("const char *f(void) { return \"hi\"; }\n");
        assert!(text.contains("\t.ascii\t\"hi\\000\"\n"), "{text}");
        assert!(text.contains("\t.section\t.rodata\n"), "{text}");
        let label = text
            .lines()
            .find(|line| line.starts_with(".Lstr"))
            .unwrap_or_else(|| panic!("a label for the literal in\n{text}"));
        assert!(!text.contains(&format!(".globl\t{}", label.trim_end_matches(':'))), "{text}");
    }

    /// A variable holding the address of another one, which is the only hole an image has in it.
    #[test]
    fn an_address_in_an_initializer_is_left_to_the_linker() {
        let source = "int counter;\nint *p = &counter;\n";
        let text = asm(source);
        assert!(text.contains("\np:\n\t.quad\tcounter\n"), "{text}");
        // And in the object it is eight zero bytes and a relocation, which is what the two paths
        // being one description is for.
        let bytes = obj(source);
        assert!(bytes.windows(8).any(|w| w == b"counter\0"), "the object has to name it");
    }

    /// A const table of function pointers, which is the shape that made SQLite link with a warning.
    ///
    /// The table is const so nothing in the program writes it, but the addresses in it are not
    /// numbers a link knows, so the loader writes it once at startup. Putting it in `.rodata`
    /// leaves a relocation in a section that is never writable, and what the linker does about
    /// that is set `DT_TEXTREL` on the whole image and say so. `.data.rel.ro` is writable for
    /// exactly as long as the loader is writing it and read only afterwards, which is what the
    /// program asked for in the first place.
    #[test]
    fn a_constant_holding_an_address_goes_in_the_section_the_loader_may_write_once() {
        // Both names are `static` and both are defined here, so nothing else can be the one that
        // defines them and the linker may lay the table out in the first pages of the segment.
        let text = asm("static void a(void) {}\nstatic void b(void) {}\n\
             struct m { void (*x)(void); void (*y)(void); };\n\
             const struct m t = { a, b };\n");
        assert!(text.contains("\t.section\t.data.rel.ro.local,\"aw\",@progbits\n"), "{text}");
        assert!(text.contains("\nt:\n\t.quad\ta\n\t.quad\tb\n"), "{text}");

        // One name this file only declares is enough to lose the `.local` half, because a name the
        // link resolves from somewhere else is one another object may turn out to define.
        let text =
            asm("void a(void);\nstruct m { void (*x)(void); };\nconst struct m t = { a };\n");
        assert!(text.contains("\t.section\t.data.rel.ro,\"aw\",@progbits\n"), "{text}");

        // And a constant with no address in it stays exactly where it was.
        let text = asm("const int fixed = 7;\n");
        assert!(text.contains("\t.section\t.rodata\n"), "{text}");
    }

    /// A thread-local variable, which is the whole of one: the storage and the way to reach it.
    ///
    /// The two halves are in one test on purpose. Either one alone is worse than neither: a
    /// definition with no way to reach it is a variable nothing can read, and a reference with no
    /// definition behind it is the bug this pair was written to prevent, where a thread-local is
    /// read as though it were an ordinary global and every thread quietly shares one copy.
    #[test]
    fn a_thread_local_variable_is_storage_a_thread_gets_a_copy_of_and_an_offset_into_it() {
        let text = asm("_Thread_local int x = 1;\nint read(void) { return x; }\n");
        // The storage: the section the loader makes a copy of for every thread, and the symbol
        // type that makes a linker refuse an ordinary relocation aimed at it.
        assert!(text.contains("\t.section\t.tdata,\"awT\",@progbits\n"), "{text}");
        assert!(text.contains("\t.type\tx, @tls_object\n"), "{text}");
        // The way to reach it: how far into a thread's block it sits, out of the table, plus where
        // this thread's block is, out of the segment register.
        assert!(text.contains("x@GOTTPOFF(%rip)"), "{text}");
        assert!(text.contains("%fs:0"), "{text}");
    }

    /// The second half of that on its own, which is what a program asks for when the number it
    /// wants is the thread rather than anything in it.
    ///
    /// rpmalloc writes this to find its per thread cache, and it is the whole of what stood
    /// between that library and a build. gcc 16 writes the same one instruction.
    #[test]
    fn the_address_of_this_thread_s_own_storage_is_read_out_of_the_segment_register() {
        let text = asm("void *here(void) { return __builtin_thread_pointer(); }\n");
        assert!(text.contains("movq\t%fs:0, "), "{text}");
        // No table slot and no addition, because there is no variable to find inside the block.
        assert!(!text.contains("GOTTPOFF"), "{text}");
    }

    /// The four hints and the one thing that decides between them, which is the locality.
    ///
    /// A prefetch promises nothing, so what is checked here is the instruction rather than any
    /// effect: the program runs the same whichever of the four it gets, and the whole point of
    /// writing one is which. The four spellings are what gcc 16.2.0 writes for the same four
    /// programs, measured on x86-64 rather than read off a manual.
    ///
    /// The write hint is not one of them. `prefetchw` is not in the base instruction set and gcc
    /// writes it only when the command line says the part has it, so a prefetch for a write is the
    /// same instruction as a prefetch for a read, which is the fourth line here.
    #[test]
    fn a_prefetch_is_one_of_four_instructions_and_the_locality_is_what_picks() {
        for (locality, wanted) in
            [(0, "prefetchnta"), (1, "prefetcht2"), (2, "prefetcht1"), (3, "prefetcht0")]
        {
            let source =
                format!("void warm(void *p) {{ __builtin_prefetch(p, 0, {locality}); }}\n");
            let text = asm(&source);
            assert!(text.contains(&format!("\t{wanted}\t")), "locality {locality}: {text}");
        }
        // The one argument form, which means a read that wants all of the data afterwards.
        let text = asm("void warm(void *p) { __builtin_prefetch(p); }\n");
        assert!(text.contains("\tprefetcht0\t"), "{text}");
        // A prefetch for a write, which on a part nobody said has `prefetchw` is the same
        // instruction as the read above.
        let text = asm("void warm(void *p) { __builtin_prefetch(p, 1); }\n");
        assert!(text.contains("\tprefetcht0\t"), "{text}");
        assert!(!text.contains("prefetchw"), "{text}");
    }

    /// The stop, which is the one instruction the machine is promised never to have a meaning for.
    ///
    /// What is checked is the instruction and not any effect, because the effect is a fault and a
    /// unit test has nowhere to take one. gcc 16.2.0 writes the same instruction for the same
    /// program, and it is not a call, which is the half that matters in a kernel and in a
    /// freestanding program: neither has an `abort` for a call to reach.
    ///
    /// The second half is the block going on after it. A statement written under a stop is
    /// compiled the way it would have been without one, so the addition is still there, and that
    /// is the front end declining to treat a stop as the end of a path.
    #[test]
    fn a_trap_is_the_instruction_the_machine_has_no_meaning_for() {
        let text = asm("void stop(void) { __builtin_trap(); }\n");
        assert!(text.contains("\tud2\n"), "{text}");
        assert!(!text.contains("\tcall"), "a stop is not a call to anything: {text}");

        let text = asm("int stop(int a) { __builtin_trap(); return a + 1; }\n");
        assert!(text.contains("\tud2\n"), "{text}");
        assert!(text.contains("\taddl\t"), "the block goes on after a stop: {text}");
    }

    /// The promise about the low bits of an address, whose value is the address.
    ///
    /// Nothing here reads an alignment fact about a value yet, so what the call leaves behind is
    /// its first argument and no instruction at all. The claim worth checking end to end is that
    /// the name is gone: a builtin nothing lowers reaches the assembler as a call to a name no
    /// object file defines, which is how this one used to fail to link out of glibc's string
    /// headers.
    ///
    /// The arguments behind the address are still evaluated, because gcc 16.2.0 evaluates them at
    /// every optimization level even though it has folded the call away. A constant has nothing to
    /// run and is dropped, and a call does, so the second half asks for the callee by name.
    #[test]
    fn assume_aligned_is_its_first_argument_and_keeps_the_rest() {
        let text = asm("void *aligned(char *p) { return __builtin_assume_aligned(p, 16); }\n");
        assert!(!text.contains("assume_aligned"), "{text}");
        assert!(!text.contains("\tcall"), "nothing is called for an alignment fact: {text}");

        let source = "unsigned long width(void);\n\
                      void *aligned(char *p) { return __builtin_assume_aligned(p, width()); }\n";
        let text = asm(source);
        assert!(!text.contains("assume_aligned"), "{text}");
        assert!(text.contains("width"), "the argument that is not the answer still runs: {text}");
    }

    /// Where a frame is, which on this machine is what the frame pointer holds.
    ///
    /// The first half is a function that would have kept no frame pointer at all, since it is a
    /// leaf with no locals, and keeps one because it asked where its frame is. The answer being
    /// `%rbp` rather than an offset off `%rsp` is the whole of the builtin at a depth of zero.
    ///
    /// The second half is the walk. Each link above zero is one load through the register the last
    /// one wrote, so a depth of two is two loads and a depth of three is three, which is what gcc
    /// 16.2.0 writes for the same programs at `-O2`.
    #[test]
    fn the_frame_address_is_the_frame_pointer_after_walking_that_many_links() {
        let text = asm("void *here(void) { return __builtin_frame_address(0); }\n");
        assert!(text.contains("pushq\t%rbp"), "a function that asks keeps a frame pointer: {text}");
        assert!(text.contains("movq\t%rbp, %rax"), "{text}");
        assert!(!text.contains("\tcall"), "a frame address is not a call to anything: {text}");

        let walk = |depth: u32| {
            let source = format!("void *up(void) {{ return __builtin_frame_address({depth}); }}\n");
            asm(&source).matches("movq\t(%r").count()
        };
        assert_eq!(walk(1), 1, "one link is one load");
        assert_eq!(walk(3), 3, "three links are three loads");
    }

    /// The address a frame returns to, which is one word above the frame the walk ended at.
    ///
    /// A word is eight bytes here and the `8(...)` is the whole claim: the call instruction pushed
    /// the return address and the prologue pushed the caller's frame pointer under it, so what the
    /// frame pointer points at is the link and what is above it is where control goes back to.
    /// gcc 16.2.0 writes `movq 8(%rbp), %rax` for the first of these, measured at `-O2`.
    ///
    /// The second half is the same walk the frame address does, with the load at the end of it
    /// reading one word further along rather than the register itself being the answer.
    #[test]
    fn the_return_address_is_one_word_above_the_frame_the_walk_ended_at() {
        let text = asm("void *back(void) { return __builtin_return_address(0); }\n");
        assert!(text.contains("pushq\t%rbp"), "a function that asks keeps a frame pointer: {text}");
        assert!(text.contains("movq\t8(%rbp), %rax"), "{text}");
        assert!(!text.contains("\tcall"), "a return address is not a call to anything: {text}");

        let text = asm("void *back(void) { return __builtin_return_address(2); }\n");
        assert_eq!(text.matches("movq\t(%r").count(), 2, "two links are two loads: {text}");
        assert!(text.contains("movq\t8(%r"), "and the answer is above the last of them: {text}");
    }

    /// A depth that is not a constant is refused, and so is one past the limit.
    ///
    /// The first is gcc's rule and not a convenience: what the call becomes is a walk that many
    /// links long, written out, so a number that is not known until the program runs has nothing
    /// to walk. gcc 16.2.0 says `invalid argument to '__builtin_return_address'` for the same
    /// program.
    ///
    /// The second is where this and gcc part company. gcc writes the walk however long it is, and
    /// this refuses a depth no program has a use for rather than filling an object file with loads
    /// that fault part way up.
    #[test]
    fn a_depth_that_is_not_a_small_constant_is_refused() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        for source in [
            "void *up(int n) { return __builtin_return_address(n); }\n",
            "void *up(void) { return __builtin_frame_address(1000); }\n",
        ] {
            let messages = run(&opts, source).messages;
            let named = messages.iter().any(|m| m.contains("E0705"));
            assert!(named, "expected a refusal in {messages:?}");
        }
    }

    /// Bytes off the frame, which is the stack pointer moving down and the answer being where it
    /// moved to.
    ///
    /// The rounding is the alignment: the size is taken up to the next sixteen before it is
    /// subtracted, so the pointer suits anything the program puts behind it. gcc 16.2.0 rounds the
    /// same way at `-O0` and spends a division doing it, which is the one place the two differ and
    /// is about how the rounding is written rather than about what it answers.
    ///
    /// There is no call anywhere in either program. An alloca that had reached the linker would
    /// have found the C library's, which is a real function with a real frame and is not what a
    /// program writing the builtin asked for.
    #[test]
    fn an_alloca_takes_the_bytes_off_the_stack_pointer_and_answers_where_they_are() {
        let text =
            asm("void use(void *p); void f(unsigned long n) { use(__builtin_alloca(n)); }\n");
        assert!(text.contains("andq\t$-16"), "the size is rounded up to sixteen: {text}");
        assert!(text.contains("subq\t%rdi, %rsp"), "and taken off the stack pointer: {text}");
        assert_eq!(text.matches("\tcall").count(), 1, "the only call is the one written: {text}");

        // The plain name, which a program that declares it the way the C library does means the
        // same thing by. `gcc.c-torture/execute/20010122-1.c` is exactly this program.
        let plain = concat!(
            "extern void *alloca(__SIZE_TYPE__);\n",
            "void use(void *p);\n",
            "void f(unsigned long n) { use(alloca(n)); }\n",
        );
        let text = asm(plain);
        assert!(text.contains("subq\t%rdi, %rsp"), "the plain name is the same bytes: {text}");
        assert_eq!(text.matches("\tcall").count(), 1, "and is not a call either: {text}");

        // And a program that means something of its own by the name keeps it, which is what the
        // declaration is looked at for.
        let own = concat!(
            "static void *alloca(unsigned long n) { return 0; }\n",
            "void *f(unsigned long n) { return alloca(n); }\n",
        );
        assert!(asm(own).contains("\tcall"), "a name the program took back is a call");
    }

    /// The bytes an alloca took live until the function returns and not until the end of the block
    /// the call was written in.
    ///
    /// That is what makes it different from a variable length array, and the way it is kept is that
    /// every scope open where the call was written stops giving the stack back. The second program
    /// is the mixed case: an array in the outer block and an alloca in the inner one, where the
    /// inner block gives nothing back either even though an array is in scope that ordinarily
    /// would. gcc 16.2.0 at `-O0` writes no restore at the end of either block, measured rather
    /// than read off the manual.
    #[test]
    fn the_bytes_an_alloca_took_are_still_there_at_the_end_of_the_block_that_took_them() {
        let inner = "{ use(__builtin_alloca(n)); }";
        for body in [inner.to_owned(), format!("int a[n]; {inner} use(a);")] {
            let source = format!("void use(void *p);\nvoid f(unsigned long n) {{ {body} }}\n");
            let text = asm(&source);
            // Every instruction that writes the stack pointer, which in a function that gives
            // nothing back is the alloca taking bytes and the epilogue putting the frame pointer
            // there. A restore would be a third kind, a move out of a register the save wrote.
            for line in text.lines().filter(|line| line.trim_end().ends_with(", %rsp")) {
                let taking = line.contains("subq");
                let leaving = line.contains("%rbp");
                assert!(taking || leaving, "nothing puts the stack back: {line} in {text}");
            }
        }
    }

    /// Not a rewording of the check above: what the two paths agree about is the point.
    #[test]
    fn the_object_and_the_listing_are_two_spellings_of_one_compilation() {
        // A call, because it is the one thing whose spelling in the two differs completely: the
        // listing writes a name and the object writes four zero bytes and a relocation asking the
        // linker for the same name. If either path had lost the callee, one of these would fail.
        let source = "int callee(void); int g(void) { return callee(); }\n";
        let bytes = obj(source);
        assert!(
            bytes.windows(7).any(|w| w == b"callee\0"),
            "the object has to name the callee for the linker to find it"
        );
        let text = asm(source);
        assert!(text.contains("\tcall\tcallee\n"), "{text}");
    }

    /// What a file of a link contributes is an object, and the default emit is a link.
    ///
    /// This is here because getting it wrong is silent in the worst way: an empty file is a valid
    /// empty linker script, so a link fed one gets as far as reporting every symbol of the file as
    /// undefined and says nothing about the compilation that produced nothing.
    #[test]
    fn compiling_for_an_executable_produces_an_object_and_not_a_dump() {
        let mut opts = options();
        // What a command line with no `-c` and no `-S` on it asks for.
        opts.emit = EmitKind::Executable;
        let result = run(&opts, "int main(void) { return 0; }\n");
        assert_eq!(result.messages, Vec::<String>::new());
        match result.artifact {
            Artifact::Object { bytes, .. } => assert_eq!(&bytes[..4], b"\x7fELF"),
            other => panic!("expected an object, got {other:?}"),
        }
    }

    /// A target with a back end but no object writer says so rather than writing the wrong file.
    #[test]
    fn a_platform_with_no_object_writer_is_said_so_rather_than_written_as_elf() {
        let mut opts = options();
        opts.emit = EmitKind::Object;
        opts.target = "x86_64-apple-darwin".parse::<Triple>().unwrap();
        let result = run(&opts, "int f(void) { return 0; }\n");
        assert!(result.failed(), "an object nobody can read is worse than a message");
        assert!(
            result.messages.iter().any(|m| m.contains("no object writer")),
            "{:?}",
            result.messages
        );
    }

    /// The IR of `source`, insisting that it compiled cleanly.
    fn ir(source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    /// What was said about `source`, insisting that something was.
    fn errors(source: &str) -> Vec<String> {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let result = run(&opts, source);
        assert!(result.failed(), "expected this to be refused:\n{source}");
        result.messages
    }

    /// The body of the one function in `source`, which is what most of these are about.
    fn body(source: &str) -> String {
        let text = ir(source);
        let (_, rest) = text.split_once("{\n").expect("a function definition");
        let (body, _) = rest.rsplit_once("}\n").expect("a function definition");
        body.to_owned()
    }

    /// What `-fgnu89-inline` is for, seen at the only place it shows: whether a body reached the
    /// module or only a declaration did.
    ///
    /// The C99 reading is the one an inline definition is written for and is not being changed
    /// here. What the flag is for is a program written before C99 swapped the two, which relies on
    /// `inline` alone leaving something behind for another unit to call, and there are twelve of
    /// those in the GCC torture suite alone.
    #[test]
    fn gnu89_inline_is_what_decides_whether_a_bare_inline_definition_reaches_the_module() {
        let source = "inline int f(int x) { return x + 1; }\n";
        let with = |flag: bool| {
            let mut opts = options();
            opts.emit = EmitKind::Ir;
            opts.gnu89_inline = flag;
            let result = run(&opts, source);
            assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile");
            result.text().to_owned()
        };

        // Under C's reading the module holds the declaration and the calls in this unit go to
        // whatever definition another unit has, which is C 6.7.4p7 and is what gcc does too.
        assert!(!with(false).contains("block0"), "no body: {}", with(false));

        // Under GNU's it is an ordinary external definition, so the body is there and the symbol
        // is one the linker can resolve against.
        assert!(with(true).contains("block0"), "a body: {}", with(true));
    }

    /// Every shape that reads or writes through a C type names that type.
    ///
    /// The tree itself is `rucc_lower::aliasing`'s and is tested there. What this is about is that
    /// the walk reaches it from every shape a program actually writes, since a node on the scalar
    /// load and nothing on the member load would be a layer that answers for a third of the
    /// accesses in a program and is not worth having.
    #[test]
    fn an_access_through_a_type_names_the_type_it_went_through() {
        let source = "\
struct s { int a; float b; };\n\
union u { int i; float f; };\n\
int scalar(int *p) { return *p; }\n\
float member(struct s *p) { p->a = 1; return p->b; }\n\
int element(int *a, long i) { return a[i]; }\n\
float through_a_union(union u *p) { p->i = 1; return p->f; }\n";
        let text = ir(source);
        assert!(text.contains(r#"!0 = tbaa "char""#), "the root: {text}");
        assert!(text.contains(r#"tbaa "int", parent !0"#), "int under it: {text}");
        assert!(text.contains(r#"tbaa "float", parent !0"#), "float under it: {text}");
        // One per access, and a function whose accesses all go through one type says so once per
        // access rather than once per function.
        let named = text.lines().filter(|line| line.contains(", tbaa !")).count();
        assert_eq!(named, 6, "six accesses: {text}");
    }

    /// `-fno-strict-aliasing` is the front end leaving the name off.
    ///
    /// Nothing asks the alias analysis anything yet, so no program compiles differently for having
    /// passed this today. What this test is for is the day one does: the flag has to be the
    /// absence of the names rather than a condition somewhere downstream, since that is the only
    /// version of it that a pass added later cannot forget about.
    #[test]
    fn turning_strict_aliasing_off_leaves_the_type_off_every_access() {
        let source = "int punned(float *f, int *i) { *i = 1; *f = 2.0f; return *i; }\n";
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.strict_aliasing = false;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile");
        let text = result.text().to_owned();
        assert!(!text.contains("tbaa"), "not even the root: {text}");
    }

    /// `return;` from a function that promised a value, which only C89 lets through and which
    /// therefore only reaches the IR builder under that dialect.
    ///
    /// Zero goes back. The alternatives are worse: an empty return list builds a `ret` the
    /// verifier refuses, which is what a torture case found, and `unreachable` would be a claim
    /// that the branch reaching this never runs, which is a claim about the program rather than
    /// about the value and lets the optimizer delete the path that led here.
    #[test]
    fn a_bare_return_from_a_function_that_promised_a_value_gives_back_a_zero() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.std = Std::C89;
        let compiled = |source: &str| {
            let result = run(&opts, source);
            assert_eq!(result.messages, Vec::<String>::new(), "C89 has nothing to say about this");
            result.text().to_owned()
        };

        let text = compiled("int f(int x) { if (x) return; return 3; }\n");
        assert!(text.contains("iconst.i32 0\n    return"), "zero goes back: {text}");
        assert!(!text.contains("unreachable"), "the branch that reached it is kept: {text}");

        // A floating point return needs the constant of its own kind rather than an integer one.
        let text = compiled("double f(int x) { if (x) return; return 1.0; }\n");
        assert!(text.contains("fconst.f64 0x0\n    return"), "a float zero goes back: {text}");
    }

    /// What C89 6.3.2.2 declares for a call to a name nothing declared, seen in the IR rather than
    /// in what was said about it.
    ///
    /// `extern int f();`, so the call gives back an `int` and its arguments are promoted rather
    /// than converted to parameters there are none of. The declaration lasts for the file, which
    /// is what makes a second call to the same name ordinary and is why gcc says this once per
    /// file rather than once per call.
    #[test]
    fn a_call_to_a_name_nothing_declared_declares_it_as_c89_said_to() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.std = Std::C89;
        let compiled = |source: &str| {
            let result = run(&opts, source);
            assert_eq!(result.messages, Vec::<String>::new(), "C89 has nothing to say about this");
            result.text().to_owned()
        };

        // An `int` back, which is the whole of what the implicit declaration says.
        let text = compiled("int f(void) { return g(); }\n");
        assert!(text.contains("call @g"), "the call is to the name that was written: {text}");
        assert!(text.contains("i32"), "and it gives back an int: {text}");

        // No prototype, so a `char` argument arrives promoted to `int` the way an argument to a
        // function whose parameters are unspecified does.
        let text = compiled("int f(char c) { return g(c); }\n");
        assert!(text.contains("sext.i32"), "the argument is promoted: {text}");

        // A name written as a value rather than called is still undeclared, since the rule is
        // about a call and nothing else.
        let mut opts = options();
        opts.std = Std::C89;
        let said = run(&opts, "int f(void) { return h; }\n").messages.join("\n");
        assert!(said.contains("'h' undeclared"), "not a call, so not declared: {said}");
    }

    /// A file that calls a name above the definition of it, which is the shape the implicit
    /// declaration has to survive rather than swallow.
    ///
    /// The definition merges into the declaration the call already made rather than making a
    /// second one, so a declaration the tree does not carry at the top level takes the definition
    /// down with it: the body is attached to a node nothing walks and no function comes out.
    /// Nothing about the call itself looks wrong when that happens, and the program gets to the
    /// linker before anyone finds out, which is where `execute/cmpsi-1.c` in the torture suite
    /// found it, as an undefined reference to a name defined eleven lines further down.
    #[test]
    fn a_name_called_before_it_is_defined_still_gets_its_definition() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.std = Std::C89;
        let text = run(&opts, "int f(void) { return dummy(); }\ndummy () { return 7; }\n")
            .text()
            .to_owned();
        assert!(text.contains("func @f()"), "the caller is there: {text}");
        assert!(text.contains("func @dummy"), "and so is what it calls: {text}");
        assert!(text.contains("iconst.i32 7"), "with the body it was given: {text}");
    }

    /// An old style definition whose parameter is narrower than what a call passes it.
    ///
    /// There is no prototype for a call to convert its argument to, so the argument is promoted
    /// and an `int` arrives for a parameter the body reads as an `unsigned char`. The entry block
    /// is where the two meet, and gcc writes the same pair of instructions there: store the low
    /// byte, read it back widened. `execute/950605-1.c` in the torture suite calls `f(-1)` and
    /// checks the parameter against `0xFF`, which is the difference between converting and not.
    #[test]
    fn an_old_style_parameter_is_converted_from_what_the_call_promoted_it_to() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.std = Std::C89;
        let compiled = |source: &str| run(&opts, source).text().to_owned();

        let text = compiled("f (c) unsigned char c; { return c; }\n");
        assert!(text.contains("func @f(i32"), "an int arrives: {text}");
        assert!(text.contains("trunc.i8"), "and is cut down to what was declared: {text}");
        assert!(text.contains("zext.i32"), "then read back unsigned: {text}");

        // A `short` is the same shape and signed, so it comes back the other way.
        let text = compiled("f (s) short s; { return s; }\n");
        assert!(text.contains("trunc.i16"), "cut down: {text}");
        assert!(text.contains("sext.i32"), "and read back signed: {text}");

        // A `float` parameter is promoted to `double`, and without the conversion the multiply
        // below has one f64 operand and one f32, which the verifier refuses as invalid IR.
        let text = compiled("f (x) float x; { return x * 2; }\n");
        assert!(text.contains("func @f(f64"), "a double arrives: {text}");
        assert!(text.contains("fptrunc.f32"), "and is narrowed to the float: {text}");

        // A parameter a prototype named arrives as itself and nothing is converted, which is the
        // case this must not have changed.
        let text = compiled("int f(unsigned char c) { return c; }\n");
        assert!(text.contains("func @f(i8)"), "the declared type arrives: {text}");
        assert!(!text.contains("trunc"), "so there is nothing to cut down: {text}");
    }

    /// The six rules gcc 14 turned from a warning into an error, and the three answers each one
    /// gets depending on the dialect and on `-fpermissive`.
    ///
    /// The table is a measurement rather than a reading of the release notes. Six files, one per
    /// rule, put through gcc 16.2.0 on x86-64 Linux under each of the four command lines below
    /// with no `-W` flags on any of them, and what came back is what is written here. The three
    /// rules that say nothing under C89 are the three C89 did not have, and the three that warn
    /// there were constraint violations then as well.
    #[test]
    fn the_rules_gcc_promoted_are_decided_by_the_dialect_and_by_fpermissive() {
        // `-std=gnu89`, `-std=gnu17`, `-std=gnu17 -fpermissive`, and `-std=gnu23`.
        let modes = [(Std::C89, false), (Std::C17, false), (Std::C17, true), (Std::C23, false)];
        let cases = [
            ("static counted;\n", ["", "error", "warning", "error"]),
            ("int f(void) { return g(); }\n", ["", "error", "warning", "error"]),
            ("int f(x) { return x; }\n", ["", "error", "warning", "error"]),
            ("int *p;\nvoid h(void) { p = 1; }\n", ["warning", "error", "warning", "error"]),
            (
                "char *q;\nint *r;\nvoid k(void) { r = q; }\n",
                ["warning", "error", "warning", "error"],
            ),
            ("int f(void) { return; }\n", ["", "error", "warning", "error"]),
            ("void g(void) { return 1; }\n", ["warning", "error", "warning", "error"]),
        ];

        for (source, wanted) in cases {
            for (&(std, permissive), wanted) in modes.iter().zip(wanted) {
                let mut opts = options();
                opts.std = std;
                opts.permissive = permissive;
                let said = run(&opts, source).messages.join("\n");
                let severity = if said.contains(": error: ") {
                    "error"
                } else if said.contains(": warning: ") {
                    "warning"
                } else {
                    ""
                };
                let how = if permissive { " -fpermissive" } else { "" };
                assert_eq!(
                    severity,
                    wanted,
                    "under -std={}{how}, {source} was answered with `{said}`",
                    std.as_str()
                );
                if wanted.is_empty() {
                    assert!(said.is_empty(), "nothing to say, but said `{said}`");
                }
            }
        }
    }

    /// A first argument that is not a list, which the four variadic operators answer in two ways.
    ///
    /// gcc has `va_arg` as an operator, since it takes a type name and no function can, and the
    /// other three as builtin functions taking the address of a list. The difference is not a
    /// naming one: the operator's complaint is its own and is an error under every dialect, and
    /// the three functions go through the ordinary rule about an argument of the wrong type,
    /// which is one of the rules the table above is about. The same four command lines through
    /// gcc 16.2.0 on x86-64 Linux is where these came from.
    #[test]
    fn the_three_variadic_builtins_answer_a_bad_list_the_way_a_call_answers_a_bad_argument() {
        let modes = [(Std::C89, false), (Std::C17, false), (Std::C17, true), (Std::C23, false)];
        let cases = [
            (
                "int f(int n, ...) { char *p; return __builtin_va_arg(p, int); }\n",
                "first argument to 'va_arg' not of type 'va_list'",
                ["error", "error", "error", "error"],
            ),
            (
                "void f(int n, ...) { char *p; __builtin_va_start(p, n); }\n",
                "passing argument 1 of '__builtin_va_start' from incompatible pointer type",
                ["warning", "error", "warning", "error"],
            ),
            (
                "void f(int n, ...) { int x; __builtin_va_end(x); }\n",
                "passing argument 1 of '__builtin_va_end' makes pointer from integer without a \
                 cast",
                ["warning", "error", "warning", "error"],
            ),
            (
                "void f(int n, ...) { __builtin_va_list a; char *p; __builtin_va_copy(a, p); }\n",
                "passing argument 2 of '__builtin_va_copy' from incompatible pointer type",
                ["warning", "error", "warning", "error"],
            ),
        ];

        for (source, message, wanted) in cases {
            for (&(std, permissive), wanted) in modes.iter().zip(wanted) {
                let mut opts = options();
                opts.std = std;
                opts.permissive = permissive;
                let said = run(&opts, source).messages.join("\n");
                let how = if permissive { " -fpermissive" } else { "" };
                assert!(
                    said.contains(&format!(": {wanted}: {message}")),
                    "under -std={}{how}, {source} was answered with `{said}`",
                    std.as_str()
                );
            }
        }
    }

    /// The IR of `source` at one safety tier, insisting that it compiled cleanly.
    fn safe_ir(tier: rucc_session::Safety, source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.safety = tier;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    const READS_THROUGH_A_POINTER: &str = "int read(int *p) { return p[1]; }\n";

    /// The IR for a source built with a tier and a padding mode.
    fn padded_ir(padding: Padding, source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.safety = rucc_session::Safety::Detect;
        opts.padding = padding;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    const FILLS_A_RECORD_A_MEMBER_AT_A_TIME: &str = "struct padded { char tag; int value; };\n\
         void fill(struct padded *p) { p->tag = 1; p->value = 2; }\n";

    #[test]
    fn a_record_filled_a_member_at_a_time_comes_out_whole_when_padding_does_not_participate() {
        // Section 9.3 of document 09, and the reason the default is the one it gives library code.
        // Four bytes from the `char` and four from the `int` is the whole of an eight byte record,
        // so the `memcmp` or the hash or the `write` that reads it back is not refused.
        let text = padded_ir(Padding::Ignored, FILLS_A_RECORD_A_MEMBER_AT_A_TIME);
        assert_eq!(text.matches("owns 4").count(), 2, "{text}");
    }

    #[test]
    fn a_store_says_only_what_it_wrote_when_padding_does_participate() {
        // The kernel profile's default, which is section 9.3's actual rule: the padding stays
        // unwritten and the read of the record that would leak it is the one that reports.
        let text = padded_ir(Padding::Tracked, FILLS_A_RECORD_A_MEMBER_AT_A_TIME);
        assert!(!text.contains("owns"), "{text}");
    }

    #[test]
    fn a_member_of_a_union_owns_nothing_after_it() {
        // The bytes after a short member of a union belong to a longer member rather than to
        // padding, and saying a store through the short one wrote them would be saying the longer
        // one holds a value nobody put there.
        let text = padded_ir(
            Padding::Ignored,
            "union u { char tag; long wide; };\nvoid fill(union u *p) { p->tag = 1; }\n",
        );
        assert!(!text.contains("owns"), "{text}");
    }

    #[test]
    fn an_inner_records_trailing_padding_reaches_the_outer_records() {
        // The composition. `in` owns four bytes of `outer` because `x` starts there, and `c` is
        // the last member of `in`, so what it owns is what `in` owns rather than its own one byte.
        // Without that the three bytes between them would stay unwritten and a read of the whole
        // thing would report.
        let text = padded_ir(
            Padding::Ignored,
            "struct inner { char c; };\n\
             struct outer { struct inner in; int x; };\n\
             void fill(struct outer *p) { p->in.c = 1; p->x = 2; }\n",
        );
        assert_eq!(text.matches("owns 4").count(), 2, "{text}");
    }

    #[test]
    fn a_build_that_did_not_ask_for_the_monitor_is_compiled_the_way_it_always_was() {
        // This is the load bearing test of the whole flag. The monitor is being built in the open
        // and every build in the world is compiled by this compiler with the flag absent, so a
        // check that leaked into that path would be a regression for everybody.
        let text = ir(READS_THROUGH_A_POINTER);
        assert!(!text.contains("check_"), "{text}");
        assert!(!text.contains("cap_of"), "{text}");
    }

    #[test]
    fn asking_for_a_tier_puts_the_checks_in_before_the_optimizer_sees_them() {
        let text = safe_ir(rucc_session::Safety::Detect, READS_THROUGH_A_POINTER);
        assert!(text.contains("cap_of"), "{text}");
        assert!(text.contains("check_bounds"), "{text}");
        assert!(text.contains("check_live"), "{text}");
        // The subscript is address arithmetic, so J2 applies to it as well as J1.
        assert!(text.contains("check_deriv"), "{text}");
        // And the read names a type, so it asks the type plane about the bytes as well.
        assert!(text.contains("check_type"), "{text}");
    }

    #[test]
    fn the_three_tiers_that_are_not_off_all_check_the_same_accesses_so_far() {
        // What separates them is the reporter and the boundary, which are milestones S2 and S3.
        // Pinning it here means the day they stop agreeing, this test says so rather than the
        // difference going unnoticed.
        let detect = safe_ir(rucc_session::Safety::Detect, READS_THROUGH_A_POINTER);
        for tier in [rucc_session::Safety::Enforce, rucc_session::Safety::Kernel] {
            assert_eq!(safe_ir(tier, READS_THROUGH_A_POINTER), detect, "{tier}");
        }
    }

    /// The safety summary of `source` at one tier, insisting that it compiled cleanly.
    fn summary(tier: rucc_session::Safety, source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::SafetySummary;
        opts.safety = tier;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    #[test]
    fn the_summary_counts_the_checks_that_went_in_and_the_ones_still_standing() {
        let text = summary(rucc_session::Safety::Detect, READS_THROUGH_A_POINTER);
        assert!(text.contains("\"tier\": \"detect\""), "{text}");
        // One load, so one of each of the two access checks, and the subscript is a derivation.
        assert!(
            text.contains("\"bounds\": { \"emitted\": 1, \"remaining\": 1, \"discharged\": 0 }"),
            "{text}"
        );
        assert!(
            text.contains(
                "\"derivation\": { \"emitted\": 1, \"remaining\": 1, \"discharged\": 0 }"
            ),
            "{text}"
        );
    }

    #[test]
    fn a_build_without_the_monitor_summarises_as_a_build_with_no_checks_in_it() {
        // Which is the honest summary rather than an error. A build system that emits a summary
        // for every unit should get one for the units nobody asked to instrument too, and the
        // zeroes are what say that the guarantee over that file is nothing at all.
        let text = summary(rucc_session::Safety::Off, READS_THROUGH_A_POINTER);
        assert!(text.contains("\"tier\": \"off\""), "{text}");
        assert!(
            text.contains("\"bounds\": { \"emitted\": 0, \"remaining\": 0, \"discharged\": 0 }"),
            "{text}"
        );
    }

    #[test]
    fn a_call_the_boundary_models_is_counted_apart_from_one_it_does_not() {
        let text = summary(
            rucc_session::Safety::Detect,
            "void *memcpy(void *, const void *, unsigned long);\n\
             int puts(const char *);\n\
             void f(char *d, char *s) { memcpy(d, s, 4); puts(d); }\n",
        );
        assert!(text.contains("\"interposed\": 1"), "{text}");
        assert!(text.contains("\"puts\""), "{text}");
        // The wrapper it was pointed at is ours, so it is not on the list of things this build
        // failed to model. Counting it there would make instrumenting a file look worse than
        // leaving it alone.
        assert!(!text.contains("__rucc_wrap_memcpy\""), "{text}");
    }

    #[test]
    fn the_two_directions_a_pointer_crosses_the_boundary_are_counted_apart() {
        // `f` is a name the linker can bind to and takes a pointer, so a pointer arrives there.
        // `notes_open` is a library this build did not instrument, so a pointer comes back from
        // it. Both are crossings and neither is the other, which is why there are two numbers.
        let text = summary(
            rucc_session::Safety::Detect,
            "void *notes_open(void);\n\
             char *f(char *p) { char *q = notes_open(); return q ? q : p; }\n",
        );
        assert!(text.contains("\"crossings\": { \"entered\": 1, \"returned\": 1 }"), "{text}");
        assert!(text.contains("\"notes_open\""), "{text}");
    }

    #[test]
    fn a_static_function_nobody_takes_the_address_of_is_not_a_crossing() {
        // Nothing outside the file can reach it, so a witness on its parameters would be counting
        // a crossing that does not happen.
        let text = summary(
            rucc_session::Safety::Detect,
            "static int len(const char *p) { return p ? 1 : 0; }\n\
             int f(void) { return len(\"x\"); }\n",
        );
        assert!(text.contains("\"crossings\": { \"entered\": 0, \"returned\": 0 }"), "{text}");
    }

    /// The granule report for `source`, insisting that it compiled cleanly.
    fn granules(source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::TypeGranules;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    #[test]
    fn the_granule_report_names_every_record_and_both_keyings() {
        let text = granules(
            "struct hot { char *p; int a; int b; };\n\
             int f(struct hot *h) { return h->a; }\n",
        );
        assert!(text.contains("struct hot"), "{text}");
        // Both keyings are reported because which types count as one is a decision the design
        // has not made yet, and a report that picked one would be hiding the cost of the other.
        assert!(text.contains("every type distinct"), "{text}");
        assert!(text.contains("every pointer one type"), "{text}");
        assert!(text.contains("budget"), "{text}");
    }

    #[test]
    fn a_record_nothing_uses_is_still_measured() {
        // The measurement is about what a program declares, not about what it runs, so a type
        // that is only ever declared still costs the plane whatever its layout costs.
        let text = granules("struct unused { long a; double b; };\nint f(void) { return 0; }\n");
        assert!(text.contains("struct unused"), "{text}");
    }

    #[test]
    fn the_granule_report_stops_before_anything_is_lowered() {
        // A layout is settled at the closing brace, so lowering the function bodies would take
        // minutes on an amalgamation and answer nothing. The evidence that it stops is that a
        // body the back end has no way to compile still produces a report.
        let text = granules(
            "struct wide { long double d; };\n\
             long double f(long double x) { return x * x; }\n",
        );
        assert!(text.contains("struct wide"), "{text}");
    }

    #[test]
    fn a_witness_reaches_the_assembler_as_a_call_to_the_runtime() {
        // The count only means anything if the call is really there, and a summary saying one is
        // there is not evidence that the back end emitted it.
        let text = safe_asm(rucc_session::Safety::Detect, "char *f(char *p) { return p; }\n");
        assert!(text.contains("\tcall\t__rucc_cap_witness\n"), "{text}");
    }

    #[test]
    fn a_pointer_turned_into_an_integer_is_on_the_trust_set() {
        let text = summary(
            rucc_session::Safety::Detect,
            "unsigned long f(int *p) { return (unsigned long) p; }\n",
        );
        assert!(text.contains("\"exposed\": 1"), "{text}");
    }

    /// The assembly of `source` at one safety tier, insisting that it compiled cleanly.
    fn safe_asm(tier: rucc_session::Safety, source: &str) -> String {
        let mut opts = options();
        opts.emit = EmitKind::Asm;
        opts.safety = tier;
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        result.text().to_owned()
    }

    #[test]
    fn a_check_reaches_the_assembler_as_a_call_to_the_runtime() {
        let text = safe_asm(rucc_session::Safety::Detect, READS_THROUGH_A_POINTER);
        assert!(text.contains("\tcall\t__rucc_check_bounds\n"), "{text}");
        assert!(text.contains("\tcall\t__rucc_check_live\n"), "{text}");
        assert!(text.contains("\tcall\t__rucc_check_deriv\n"), "{text}");
        assert!(text.contains("\tcall\t__rucc_check_type\n"), "{text}");
        assert!(text.contains("\tcall\t__rucc_check_init\n"), "{text}");
    }

    #[test]
    fn every_check_that_reached_the_assembler_has_a_row_describing_it() {
        // Five checks and five descriptors, each in the section the runtime's reporter reads.
        // The width is `rucc_safety::lower::WIDTH` and the row is `rucc_safe_rt::fail::Descriptor`,
        // and the two agreeing is what makes the address a check is handed mean anything.
        let text = safe_asm(rucc_session::Safety::Detect, READS_THROUGH_A_POINTER);
        let section = format!("\t.section\t{},", rucc_safety::SECTION);
        assert_eq!(text.matches(&section).count(), 5, "{text}");
        for index in 0..5 {
            let name = format!("__rucc_safety_desc_{index}");
            // Defined once and referenced once, because a descriptor nothing points at describes
            // nothing and a reference with no definition does not link.
            assert!(text.contains(&format!("{name}:\n")), "{text}");
            assert!(text.contains(&format!("{name}(%rip)")), "{text}");
        }
        assert!(!text.contains("__rucc_safety_desc_5"), "{text}");
    }

    /// `__builtin_constant_p` is answered in the front end and never reaches the IR.
    ///
    /// gcc folds it after optimization, so its answer for an argument that is not written as a
    /// constant can differ between `-O0` and `-O2`. What is checked here is the front end's
    /// answer, which is the same at every level, and the four cases where gcc gives the same
    /// answer at both levels are the ones measured on gcc 16: a literal is one, a variable is
    /// zero, a string literal is one and the address of an object is zero.
    #[test]
    fn builtin_constant_p_is_folded_where_it_is_written_rather_than_called() {
        let text = ir(concat!(
            "int g;\n",
            "int a = __builtin_constant_p(1);\n",
            "int b = __builtin_constant_p(g);\n",
            "int c = __builtin_constant_p(\"abc\");\n",
            "int d = __builtin_constant_p(&g);\n",
            "int e = __builtin_constant_p(1.5);\n",
            "int h = __builtin_choose_expr(__builtin_constant_p(3), 11, 22);\n",
        ));
        assert!(text.contains("global @a : i32 = 1,"), "{text}");
        assert!(text.contains("global @b : i32 = 0,"), "{text}");
        assert!(text.contains("global @c : i32 = 1,"), "{text}");
        assert!(text.contains("global @d : i32 = 0,"), "{text}");
        assert!(text.contains("global @e : i32 = 1,"), "{text}");
        assert!(text.contains("global @h : i32 = 11,"), "{text}");
        assert!(!text.contains("__builtin_constant_p"), "it is not a call to anything:\n{text}");

        // The argument is not evaluated, which is what gcc does with it as well, so `i` is
        // still zero. The second constant is the answer, which nothing reads and which the
        // first pass that looks for dead code will take out.
        let text = body("int f(void) { int i = 0; __builtin_constant_p(i++); return i; }\n");
        assert_eq!(text, "block0:\n    %0 = iconst.i32 0\n    %1 = iconst.i32 0\n    return %0\n");
    }

    /// A library builtin is the library function of the same name, and the call says so.
    ///
    /// A program writes `__builtin_strlen` rather than `strlen` to reach the function the C
    /// library promises where its own name has been taken by a macro, and to say that the usual
    /// meaning is the one intended. So the name in the program and the name in the object file
    /// are two different names and the call carries the second one. gcc folds several of these
    /// when the arguments allow it, which is an optimization on top of a call that is already
    /// right rather than instead of it, so nothing here depends on any folding happening.
    #[test]
    fn a_call_to_a_library_builtin_reaches_the_library_function() {
        let text = body("void f(void) { __builtin_abort(); }\n");
        assert_eq!(text, "block0:\n    call @abort() : ()\n    return\n");

        // Nothing declared either of these and nothing had to: the prefix is what says the name
        // belongs to the implementation, and the type comes out of `features.toml`.
        let text = ir("int f(const char *s) { return __builtin_puts(s) + __builtin_strlen(s); }\n");
        assert!(text.contains("call @puts(%0) : (ptr) -> i32"), "{text}");
        assert!(text.contains("call @strlen(%0) : (ptr) -> i64"), "{text}");
        assert!(!text.contains("__builtin_"), "the prefix is not part of any name here:\n{text}");
    }

    /// A `_chk` builtin reaches the checking function in the library with the object size still
    /// on the end of it.
    ///
    /// This is what a fortified `string.h` turns every copy into, so it is what a program built
    /// the way a distribution builds one is full of, and the whole of what makes the call right
    /// is that the size goes with it. The checking function takes `(size_t) -1` to mean nothing
    /// is known and does no check, which is what the header passes when the destination's object
    /// is not in sight, so the unconditional call means the same thing in both cases and costs a
    /// call gcc would have folded away in the second.
    ///
    /// The name is the one place this family reads like an exception and is not one:
    /// `__builtin___memcpy_chk` with `__builtin_` taken off is `__memcpy_chk`.
    #[test]
    fn a_chk_builtin_reaches_the_checking_function_and_keeps_the_size() {
        let text = ir(concat!(
            "char d[8];\n",
            "void f(const char *s, unsigned long n) {\n",
            "  __builtin___memcpy_chk(d, s, n, __builtin_object_size(d, 0));\n",
            "  __builtin___strcpy_chk(d, s, __builtin_object_size(d, 1));\n",
            "  __builtin___memset_chk(d, 0, n, 8);\n",
            "}\n",
        ));
        assert!(text.contains("call @__memcpy_chk("), "{text}");
        assert!(text.contains("call @__strcpy_chk("), "{text}");
        assert!(text.contains("call @__memset_chk("), "{text}");
        assert!(text.contains("iconst.i64 8"), "the object size reaches the call: {text}");
        assert!(!text.contains("__builtin_"), "the prefix is not part of any name here:\n{text}");
    }

    /// A checking call whose object size says nothing is known is the plain library call.
    ///
    /// That is the whole of the folding half of the family. The checking function reads the all
    /// ones value as do not check, so the call it was going to make is the function it guards with
    /// an argument nobody reads on the end of it, and gcc drops the argument and calls the plain
    /// function at every level including `-O0`. Where the size is a real number the checking call
    /// stands, because the check is the point.
    #[test]
    fn a_checking_call_whose_size_says_nothing_is_known_is_the_plain_library_call() {
        let text = ir(concat!(
            "extern char *p;\n",
            "char d[8];\n",
            "void f(const char *s, unsigned long n) {\n",
            "  __builtin___memcpy_chk(d, s, n, __builtin_object_size(d, 0));\n",
            "  __builtin___memcpy_chk(p, s, n, __builtin_object_size(p, 0));\n",
            "  __builtin___strcpy_chk(p, s, __builtin_object_size(p, 0));\n",
            "  __builtin___stpncpy_chk(p, s, n, __builtin_object_size(p, 0));\n",
            "  __builtin___sprintf_chk(p, 1, __builtin_object_size(p, 0), s);\n",
            "}\n",
        ));

        // The destination whose object is in sight keeps its check, size and all.
        assert!(
            text.contains("call @__memcpy_chk(%2, %0, %1, %3) : (ptr, ptr, i64, i64)"),
            "{text}"
        );

        // The three whose object is not lose the argument and the name along with it. The type of
        // the call goes with them, which is what says the argument is gone rather than ignored.
        assert!(text.contains("call @memcpy(%6, %0, %1) : (ptr, ptr, i64) -> ptr"), "{text}");
        assert!(text.contains("call @strcpy(%10, %0) : (ptr, ptr) -> ptr"), "{text}");
        assert!(text.contains("call @stpncpy(%14, %0, %1) : (ptr, ptr, i64) -> ptr"), "{text}");

        // The formatted one never folds, whatever the size says, because refusing a `%n` in a
        // writable format is the other half of what it was asked to do.
        assert!(text.contains("call @__sprintf_chk("), "{text}");

        // Nothing is left behind in the instructions either. The size the folded calls no longer
        // take is a constant nobody reads, and no instruction is written for one.
        let asm = asm(concat!(
            "void f(char *p, const char *s, unsigned long n) {\n",
            "  __builtin___memcpy_chk(p, s, n, __builtin_object_size(p, 0));\n",
            "}\n",
        ));
        assert!(asm.contains("call\tmemcpy"), "{asm}");
        assert!(!asm.contains("$-1"), "the size that went away leaves no instruction:\n{asm}");
    }

    /// The `v` spellings take a `__builtin_va_list`, which is the first type in the table the
    /// target chooses the shape of rather than the width of.
    ///
    /// On x86-64 it is an array of one, so what the prototype has to say is the pointer that
    /// array decays to, which is the same adjustment C makes to any parameter written as an array
    /// and is what a `va_list` parameter already holds. A prototype that kept the array would be
    /// one no argument could ever match.
    #[test]
    fn the_v_spellings_of_the_chk_family_take_the_list_a_va_list_parameter_holds() {
        let text = ir(concat!(
            "char d[64];\n",
            "int f(const char *fmt, ...) {\n",
            "  __builtin_va_list ap;\n",
            "  __builtin_va_start(ap, fmt);\n",
            "  int n = __builtin___vsprintf_chk(d, 1, __builtin_object_size(d, 0), fmt, ap);\n",
            "  __builtin_va_end(ap);\n",
            "  return n;\n",
            "}\n",
        ));
        assert!(text.contains("call @__vsprintf_chk("), "{text}");
        assert!(text.contains("iconst.i64 64"), "the object size reaches the call: {text}");
    }

    /// The absolute value family is four instructions and not a call, whoever declared the name.
    ///
    /// `abs`, `labs` and `llabs` are reserved to the implementation, so a program that writes one
    /// means the one the C library promises and the compiler is allowed to know what it does. The
    /// program in `gcc.c-torture/execute/20021127-1.c` is the one that insists: it defines `llabs`
    /// to abort and expects the call not to reach it. Measured against gcc 16.2.0, which writes a
    /// `neg` and a `cmovns` and never calls the definition either.
    ///
    /// The most negative value comes back as itself, which is what the arithmetic gives and what
    /// gcc's pair of instructions gives, and C says the answer is undefined there.
    #[test]
    fn the_absolute_value_family_is_the_magnitude_and_not_a_call() {
        let text = body(concat!(
            "long long llabs(long long);\n",
            "long long f(long long x) { return llabs(x); }\n",
        ));
        assert!(text.contains("%1 = iconst.i64 63"), "{text}");
        assert!(text.contains("%2 = ashr %0, %1"), "{text}");
        assert!(text.contains("%3 = xor %0, %2"), "{text}");
        assert!(text.contains("%4 = sub %3, %2"), "{text}");
        assert!(!text.contains("call"), "the call does not happen:\n{text}");

        // The narrower two, whose width comes from the type the library gives the name and not
        // from anything at the call.
        let text = body("int abs(int);\nint f(int x) { return abs(x); }\n");
        assert!(text.contains("iconst.i32 31"), "{text}");
        let text = body("long labs(long);\nlong f(long x) { return labs(x); }\n");
        assert!(text.contains("iconst.i64 63"), "{text}");

        // The prefixed spelling is the same node, and it is what a program writes to reach the
        // library's meaning where the plain name has been taken.
        let text = body("long long f(long long x) { return __builtin_llabs(x); }\n");
        assert!(!text.contains("call"), "{text}");

        // A definition of the name in the same file changes nothing, which is the whole point.
        let text = ir(concat!(
            "long long llabs(long long b);\n",
            "long long g(long long x) { return llabs(x); }\n",
            "long long llabs(long long b) { return 7; }\n",
        ));
        assert!(!text.contains("call @llabs"), "{text}");
    }

    /// A byte swap is one instruction and not a call, and nothing had to declare it.
    ///
    /// SQLite writes these for its page headers and glibc's `<endian.h>` defines `htobe32` and its
    /// neighbours as exactly these, so a program that reads a file format reaches one without ever
    /// naming it. There is no object file anywhere that defines `__builtin_bswap32`, so a call left
    /// standing here would not link.
    #[test]
    fn a_byte_swap_is_arithmetic_and_not_a_call() {
        let text = body("unsigned f(unsigned x) { return __builtin_bswap32(x); }\n");
        assert_eq!(text, "block0(%0: i32):\n    %1 = bswap %0\n    return %1\n");

        // The argument is converted by the prototype the way any other call's would be, so the
        // swap happens at the width the name says and not at the width the program wrote.
        let text = body("unsigned f(unsigned char c) { return __builtin_bswap32(c); }\n");
        assert!(text.contains("zext.i32 %0"), "widened first: {text}");
        assert!(text.contains("bswap %1"), "and swapped at four bytes: {text}");
    }

    /// Each of the three reverses in the width its name says, which is the type of the node.
    ///
    /// The width matters more here than it looks. `__builtin_bswap16` is the two bytes of a
    /// `uint16_t` exchanged, and if the node came out at the machine's width instead then the bits
    /// above the value would be dragged into the answer and the result would be zero.
    #[test]
    fn the_byte_swaps_reverse_at_the_width_their_name_says() {
        for (name, ty, width) in [
            ("__builtin_bswap16", "unsigned short", "i16"),
            ("__builtin_bswap32", "unsigned", "i32"),
            ("__builtin_bswap64", "unsigned long long", "i64"),
        ] {
            let source = format!("{ty} f({ty} x) {{ return {name}(x); }}\n");
            let text = body(&source);
            assert_eq!(
                text,
                format!("block0(%0: {width}):\n    %1 = bswap %0\n    return %1\n"),
                "{name}"
            );
        }
    }

    /// The three bit counts the IR has an instruction for are that instruction and not a call.
    ///
    /// Eighteen rows of `features.toml` come out of six questions, and three of the six are one
    /// instruction each. The kernel's bitmap search is built on them, ffmpeg counts leading zeroes
    /// in its bitstream reader and SQLite uses one to size a page, so a call left standing here
    /// would not link against anything and would be slow if it did.
    #[test]
    fn the_bit_counts_are_instructions_and_not_calls() {
        let text = body("int f(unsigned x) { return __builtin_clz(x); }\n");
        assert_eq!(text, "block0(%0: i32):\n    %1 = ctlz %0\n    return %1\n");

        let text = body("int f(unsigned x) { return __builtin_ctz(x); }\n");
        assert_eq!(text, "block0(%0: i32):\n    %1 = cttz %0\n    return %1\n");

        let text = body("int f(unsigned x) { return __builtin_popcount(x); }\n");
        assert_eq!(text, "block0(%0: i32):\n    %1 = ctpop %0\n    return %1\n");
    }

    /// The width counted is the operand's and the width answered is `int`, which are two different
    /// things at every spelling but the narrowest.
    ///
    /// This is the mistake the family invites. `__builtin_clz` of a value counts the leading zeroes
    /// of it narrowed to `unsigned int` and `__builtin_clzll` counts them at sixty four bits, and
    /// those are different numbers for the same value. What decides it is the prototype the row
    /// carries, so the count happens after the conversion and the narrowing back to `int` happens
    /// after the count.
    #[test]
    fn the_bit_counts_ask_about_the_width_their_name_says() {
        let text = body("int f(unsigned long long x) { return __builtin_clzll(x); }\n");
        assert!(text.starts_with("block0(%0: i64):"), "counted at eight bytes: {text}");
        assert!(text.contains("%1 = ctlz %0"), "{text}");
        assert!(text.contains("trunc.i32 %1"), "and answered in an int: {text}");

        // The same value asked about at the narrower width, which converts first and so counts
        // something else.
        let text = body("int f(unsigned long long x) { return __builtin_clz(x); }\n");
        assert!(text.contains("trunc.i32 %0"), "narrowed to what was asked about: {text}");
        assert!(text.contains("ctlz %1"), "and counted there: {text}");

        let text = body("int f(unsigned long x) { return __builtin_popcountl(x); }\n");
        assert!(text.contains("%1 = ctpop %0"), "{text}");
        assert!(!text.contains("call"), "{text}");
    }

    /// A parity is whether the count of set bits is odd, which is that count and its low bit.
    ///
    /// Not the machine's parity flag, which on x86-64 is over the low byte of a result and so is a
    /// different question, and not the count itself, since C says the answer is zero or one.
    #[test]
    fn a_parity_is_the_low_bit_of_the_set_bit_count() {
        let text = body("int f(unsigned x) { return __builtin_parity(x); }\n");
        assert!(text.contains("%1 = ctpop %0"), "{text}");
        assert!(text.contains("iconst.i32 1"), "{text}");
        assert!(text.contains("and %1, %2"), "the low bit of it: {text}");
    }

    /// `__builtin_ffs` is the trailing zero count and one, kept only when there was a bit to find.
    ///
    /// The one in the family defined at zero, where it answers zero. Written as a mask rather than
    /// as a branch: the count and the comparison do not depend on each other and both are cheap, so
    /// a branch would buy nothing and cost two blocks and a join.
    #[test]
    fn the_first_set_bit_is_one_based_and_zero_for_a_zero() {
        let text = body("int f(int x) { return __builtin_ffs(x); }\n");
        assert!(text.contains("%1 = cttz %0"), "{text}");
        assert!(text.contains("%4 = add %1, %2"), "one more than the count: {text}");
        assert!(text.contains("%5 = icmp ne %0, %3"), "whether there was a bit at all: {text}");
        assert!(text.contains("%7 = sub %3, %6"), "spread to a mask: {text}");
        assert!(text.contains("%8 = and %4, %7"), "and kept only then: {text}");
        assert!(!text.contains("br_if"), "no branch: {text}");
    }

    /// `__builtin_clrsb` is how many bits below the sign bit repeat it, which is a leading zero
    /// count of the value folded onto its own sign.
    ///
    /// Exclusive or with the sign spread over every bit turns a negative value into its complement
    /// and leaves one that is not negative alone, so in both cases the top bit is clear and there
    /// is one zero above the highest bit that does not repeat the sign. The answer is one less
    /// than that count, and the shift left is what takes the one off, with the low bit set on the
    /// way so that zero and minus one have something to count: both of them fold to a word with no
    /// bits in it, which is the one input a leading zero count says nothing about.
    #[test]
    fn the_redundant_sign_bit_count_is_instructions_and_not_a_call() {
        let text = body("int f(int x) { return __builtin_clrsb(x); }\n");
        assert!(text.contains("%1 = iconst.i32 31"), "{text}");
        assert!(text.contains("%2 = ashr %0, %1"), "the sign over every bit: {text}");
        assert!(text.contains("%3 = xor %0, %2"), "folded onto it: {text}");
        assert!(text.contains("%5 = shl %3, %4"), "one less than the count: {text}");
        assert!(text.contains("%6 = or %5, %4"), "with something to count at zero: {text}");
        assert!(text.contains("%7 = ctlz %6"), "{text}");
        assert!(!text.contains("call"), "{text}");
        assert!(!text.contains("br_if"), "no branch: {text}");
    }

    /// The unsigned four are the same four instructions answering in the unsigned type.
    ///
    /// Which on a two's complement machine is the same bits, so what this checks is that the type
    /// of the answer is the unsigned one. The reason the family exists is the most negative value,
    /// whose magnitude is not representable in the signed type and is representable in this one.
    #[test]
    fn the_unsigned_absolute_value_family_answers_in_the_unsigned_type() {
        let text = body("unsigned f(int x) { return __builtin_uabs(x); }\n");
        assert!(text.contains("%1 = iconst.i32 31"), "{text}");
        assert!(text.contains("%4 = sub %3, %2"), "{text}");
        assert!(!text.contains("call"), "nothing declares uabs, so a call would not link: {text}");

        let text = body("unsigned long long f(long long x) { return __builtin_ullabs(x); }\n");
        assert!(text.contains("iconst.i64 63"), "at the width the name says: {text}");

        // The answer is the unsigned type and not the signed one, which is what a comparison
        // against it is decided by.
        let text = body("int f(int x) { return __builtin_uabs(x) > 2147483647u; }\n");
        assert!(text.contains("icmp ugt"), "compared unsigned: {text}");
    }

    /// `intmax_t` is not a fixed type, so the two widest spellings ask the target what it is.
    ///
    /// `long` where that is sixty four bits wide and `long long` where it is not, which is the rule
    /// `rucc_pp::predef` writes `__INTMAX_TYPE__` out of. The three targets here are all LP64, so
    /// the answer is `long` and the shift is sixty three, and the point of the test is that the
    /// signature was understood at all rather than refused for naming a type the table could not
    /// spell.
    #[test]
    fn the_widest_absolute_value_is_whichever_type_the_target_makes_intmax_t() {
        let text = body("long f(long x) { return __builtin_imaxabs(x); }\n");
        assert!(text.contains("iconst.i64 63"), "{text}");
        assert!(text.contains("%4 = sub %3, %2"), "{text}");
        assert!(!text.contains("call"), "{text}");

        let text = body("unsigned long f(long x) { return __builtin_umaxabs(x); }\n");
        assert!(text.contains("iconst.i64 63"), "{text}");
        assert!(!text.contains("call"), "{text}");
    }

    /// The `_p` spellings ask the same question, write nothing, and do not evaluate the third
    /// argument.
    ///
    /// gcc says the third argument is there for its type alone, so a call is two operands and a
    /// type by the time it reaches the IR. What the type decides is the same thing it decides for
    /// the three that write: whether the exact answer would have fit there, which is why the
    /// second call below is done at a wider width than the first.
    #[test]
    fn an_overflow_predicate_writes_nothing_and_answers_the_bit_the_check_would() {
        let text =
            body("int f(int a, int b) { return __builtin_add_overflow_p(a, b, (int) 0); }\n");
        assert!(text.contains("%2, %3 = sadd_overflow.(i32, i1) %0, %1"), "{text}");
        assert!(!text.contains("store"), "nothing is written: {text}");
        assert!(!text.contains("call"), "{text}");

        // A wider destination is a wider arithmetic, and the narrowing test that goes with it is
        // what says whether the answer got there, exactly as for the spelling that stores.
        let text =
            body("int f(int a, int b) { return __builtin_mul_overflow_p(a, b, (long long) 0); }\n");
        assert!(text.contains("smul_overflow.(i64, i1)"), "{text}");
        assert!(!text.contains("store"), "{text}");

        // The third argument is a value and not a pointer, and a side effect written in it does
        // not happen, because what the argument is there for is its type.
        let text = body(concat!(
            "int g(void);\n",
            "int f(int a, int b) { return __builtin_sub_overflow_p(a, b, g()); }\n",
        ));
        assert!(!text.contains("call @g"), "the third argument is not evaluated: {text}");
    }

    /// The three overflow checks are arithmetic and a flag, and not a call to anything.
    ///
    /// gcc has emitted these since 5.0 and there is no object file that defines one, so a call left
    /// standing here would not link. SQLite reaches all three within twenty lines of each other, in
    /// `sqlite3AddInt64` and its two neighbours, which is the reason they were done now.
    ///
    /// The IR instruction answers two things at once, the wrapped value and whether it wrapped,
    /// which is a shape nothing else in the IR has. The store is the builtin writing the answer
    /// through the pointer it was handed.
    #[test]
    fn an_overflow_check_is_arithmetic_and_not_a_call() {
        let text =
            body("int f(int a, int b, int *r) { return __builtin_add_overflow(a, b, r); }\n");
        assert!(text.contains("%3, %4 = sadd_overflow.(i32, i1) %0, %1"), "{text}");
        assert!(text.contains("store %3 -> %2"), "{text}");
        assert!(!text.contains("call"), "{text}");

        let text =
            body("int f(int a, int b, int *r) { return __builtin_sub_overflow(a, b, r); }\n");
        assert!(text.contains("ssub_overflow.(i32, i1) %0, %1"), "{text}");

        let text =
            body("int f(int a, int b, int *r) { return __builtin_mul_overflow(a, b, r); }\n");
        assert!(text.contains("smul_overflow.(i32, i1) %0, %1"), "{text}");

        // Unsigned operands get the unsigned form, which is a different question about the same
        // arithmetic: an unsigned sum wraps where a signed one of the same bits does not.
        let text = body(
            "int f(unsigned a, unsigned b, unsigned *r) { return __builtin_add_overflow(a, b, r); }\n",
        );
        assert!(text.contains("uadd_overflow.(i32, i1) %0, %1"), "{text}");
    }

    /// The arithmetic happens at a type that holds every value all three written types can hold.
    ///
    /// That is what makes the check exact. `unsigned int` and `int` in one call need thirty three
    /// bits between them, so the add is done at sixty four with each operand extended the way its
    /// own signedness says: the unsigned one zero extended, the signed one sign extended. Sign
    /// extending the unsigned one would turn three billion into a negative number before the
    /// addition ever saw it.
    #[test]
    fn an_overflow_check_is_done_at_a_type_that_holds_every_operand() {
        let text = body(
            "int f(unsigned a, int b, long long *r) { return __builtin_add_overflow(a, b, r); }\n",
        );
        assert!(text.contains("%3 = zext.i64 %0"), "the unsigned operand keeps its value: {text}");
        assert!(text.contains("%4 = sext.i64 %1"), "and so does the signed one: {text}");
        assert!(text.contains("sadd_overflow.(i64, i1) %3, %4"), "{text}");

        // Three types that agree need no extension at all, which is what nearly every real call
        // is written as.
        let text = body(
            "int f(long long a, long long b, long long *r) { return __builtin_mul_overflow(a, b, r); }\n",
        );
        assert!(text.contains("smul_overflow.(i64, i1) %0, %1"), "{text}");
        assert!(!text.contains("sext."), "{text}");
        // The one widening left is the answer, which is a bit becoming the `int` C says it is.
        assert!(!text.contains("zext.i64"), "{text}");
    }

    /// The wrapped answer is written through the pointer whether or not it fit.
    ///
    /// That is gcc's rule and it is what makes the builtin usable as a wrapping add with a flag on
    /// the side. A destination narrower than the arithmetic is narrowed and widened back, and the
    /// answer being different is the second half of the test: the instruction says whether the
    /// arithmetic itself needed more room, and the round trip says whether what came out survived
    /// the trip down to where it was going.
    #[test]
    fn an_overflow_check_writes_the_wrapped_answer_whether_or_not_it_fit() {
        let text =
            body("int f(int a, int b, char *r) { return __builtin_sub_overflow(a, b, r); }\n");
        assert!(text.contains("%3, %4 = ssub_overflow.(i32, i1) %0, %1"), "{text}");
        assert!(text.contains("%5 = trunc.i8 %3"), "narrowed to where it goes: {text}");
        assert!(text.contains("%6 = sext.i32 %5"), "and back: {text}");
        assert!(text.contains("%7 = icmp ne %6, %3"), "which is whether it fit: {text}");
        assert!(text.contains("store %5 -> %2"), "the narrowed value is stored either way: {text}");
        assert!(text.contains("%8 = or %4, %7"), "and either bit is an overflow: {text}");
    }

    /// A call needing more than the widest type there is compiles, by not asking for such a type.
    ///
    /// One way to reach it: an unsigned `__int128` mixed with a signed type, which needs a hundred
    /// and twenty nine bits to represent both and so has nowhere left to go. That used to be refused
    /// by name. It is done now by carrying the sign of each operand alongside its value rather than
    /// inside it, which is what gcc does, so all three of the family compile for that mix.
    #[test]
    fn a_call_needing_more_than_the_widest_type_still_compiles() {
        for name in ["add", "sub", "mul"] {
            let source = format!(
                "int f(unsigned __int128 a, long long b, __int128 *r) {{\n    \
                 return __builtin_{name}_overflow(a, b, r);\n}}\n"
            );
            let mut opts = options();
            opts.emit = EmitKind::MirFinal;
            assert!(!run(&opts, &source).failed(), "{name} was refused or stopped the back end");
        }
    }

    /// An operand that is not an integer at all is the older message, from the type checking every
    /// type generic builtin shares.
    #[test]
    fn an_overflow_check_over_something_that_is_not_an_integer_says_so() {
        let messages =
            errors("int f(double a, int b, int *r) { return __builtin_add_overflow(a, b, r); }\n");
        assert!(messages.iter().any(|line| line.contains("E0671")), "{messages:?}");

        let messages =
            errors("int f(int a, int b, double *r) { return __builtin_add_overflow(a, b, r); }\n");
        assert!(messages.iter().any(|line| line.contains("E0671")), "{messages:?}");
    }

    /// An ordered access is an ordered access in the IR, with the ordering the program wrote.
    ///
    /// Which is the point of the node existing at all. An ordering is not an argument anything is
    /// passed, it is a thing the IR says about an access, so the number in the source is read once
    /// in the front end and after that the ordering travels on the instruction where every pass
    /// that moves code can see it.
    ///
    /// SQLite is why these are done: `AtomicLoad` and `AtomicStore` in `sqlite3.c` are
    /// `__atomic_load_n` and `__atomic_store_n` at the relaxed ordering, and there are thirty five
    /// calls to the pair.
    #[test]
    fn an_ordered_access_is_ordered_in_the_ir() {
        let text = body("int f(int *p) { return __atomic_load_n(p, 0); }\n");
        assert!(text.contains("atomic_load.i32 %0, align 4, relaxed"), "{text}");

        let text = body("long f(long *p) { return __atomic_load_n(p, 2); }\n");
        assert!(text.contains("atomic_load.i64 %0, align 8, acquire"), "{text}");

        let text = body("void f(int *p, int v) { __atomic_store_n(p, v, 3); }\n");
        assert!(text.contains("atomic_store %1 -> %0, align 4, release"), "{text}");

        let text = body("void f(int *p, int v) { __atomic_store_n(p, v, 5); }\n");
        assert!(text.contains("atomic_store %1 -> %0, align 4, seq_cst"), "{text}");

        // The value is converted to what the pointer points at before it is stored, which is what
        // the call would have done if it had a prototype to convert against.
        let text = body("void f(char *p, int v) { __atomic_store_n(p, v, 0); }\n");
        assert!(text.contains("trunc.i8 %1"), "{text}");
        assert!(text.contains("atomic_store %2 -> %0, align 1, relaxed"), "{text}");
    }

    /// On this machine the ordered access is the plain instruction, except at the strongest
    /// ordering of a store.
    ///
    /// x86-64 is total store order: every load is already an acquire and every store is already a
    /// release, and an aligned access no wider than a word is indivisible whether or not anybody
    /// asked. So the whole family is `mov` and the one thing the machine does not give away is a
    /// store staying in front of a later load, which is `mfence` behind the store. Every line below
    /// is what gcc 16.2.0 writes for the same function.
    #[test]
    fn an_ordered_access_is_the_plain_instruction_on_this_machine() {
        let text = asm("int f(int *p) { return __atomic_load_n(p, 5); }\n");
        assert!(text.contains("movl\t(%rdi), %eax"), "{text}");
        assert!(!text.contains("mfence"), "a load needs no barrier here: {text}");

        let text = asm("void f(int *p, int v) { __atomic_store_n(p, v, 3); }\n");
        assert!(text.contains("movl\t%esi, (%rdi)"), "{text}");
        assert!(!text.contains("mfence"), "a release store needs no barrier here: {text}");

        let text = asm("void f(int *p, int v) { __atomic_store_n(p, v, 5); }\n");
        let (before, after) = text.split_once("mfence").expect("a barrier: {text}");
        assert!(before.contains("movl\t%esi, (%rdi)"), "the store comes first: {text}");
        assert!(!after.contains("movl"), "and nothing else is between them: {text}");
    }

    /// A barrier is one instruction at the strongest ordering and no instruction below it.
    ///
    /// The same reasoning the other way round. An acquire, a release and an acquire release fence
    /// are already true of every program running on this machine, and what a program wanted from
    /// one is that the compiler not move accesses across it, which is already so by the time any
    /// instruction is picked. Sequential consistency is the one that costs something.
    ///
    /// `__sync_synchronize` is the older family's spelling of the strongest one and compiles to
    /// exactly the same instruction, which is what SQLite calls twice in `sqlite3.c`.
    #[test]
    fn a_barrier_is_one_instruction_at_the_strongest_ordering_and_none_below_it() {
        assert!(asm("void f(void) { __atomic_thread_fence(5); }\n").contains("mfence"));
        assert!(asm("void f(void) { __sync_synchronize(); }\n").contains("mfence"));

        for weaker in ["1", "2", "3", "4"] {
            let source = format!("void f(void) {{ __atomic_thread_fence({weaker}); }}\n");
            assert!(!asm(&source).contains("mfence"), "{weaker} costs nothing here");
        }
    }

    /// The three x86 fences under gcc's names are that same barrier at that same ordering.
    ///
    /// Exact for `mfence` and stronger than asked for the other two, which is a safe answer: a
    /// program that wanted its stores ordered gets that and more. Narrowing the two is worth doing
    /// once an instruction can be named from there, which is the note the shipped `xmmintrin.h`
    /// already carries at `_mm_sfence`.
    ///
    /// Each carries a signature, so an argument written on one is reported like an argument
    /// written on any other call, which is the whole reason they have one.
    #[test]
    fn the_three_x86_fences_are_the_barrier_the_strongest_ordering_gives() {
        for name in ["__builtin_ia32_sfence", "__builtin_ia32_lfence", "__builtin_ia32_mfence"] {
            let source = format!("void f(void) {{ {name}(); }}\n");
            assert!(asm(&source).contains("mfence"), "{name} is a barrier");
            let text = body(&source);
            assert!(text.contains("fence seq_cst"), "{name}: {text}");
        }

        let result = run(&options(), "void f(void) { __builtin_ia32_sfence(1); }\n");
        assert_eq!(result.messages.len(), 1, "{:?}", result.messages);
        assert!(result.messages[0].contains("too many arguments"), "{:?}", result.messages);
    }

    /// The four compare and exchange names are one IR instruction producing two values.
    ///
    /// Which of the two the expression answers is the difference between three of the four names,
    /// and the fourth difference is the C11 pair writing what they found back through the pointer
    /// they were handed, which is the branch after the instruction.
    #[test]
    fn a_compare_and_exchange_is_one_instruction_answering_two_things() {
        // The older family, whose two names are the same instruction read two ways. Neither has a
        // memory order argument and both are a full barrier, which is what `seq_cst` says.
        let text =
            body("int f(int *p, int e, int d) { return __sync_val_compare_and_swap(p, e, d); }\n");
        assert!(text.contains("%3, %4 = cmpxchg.(i32, i1) %0, %1, %2, align 4, seq_cst"), "{text}");
        assert!(text.contains("return %3"), "the value it found: {text}");

        let text =
            body("int f(int *p, int e, int d) { return __sync_bool_compare_and_swap(p, e, d); }\n");
        assert!(text.contains("%3, %4 = cmpxchg.(i32, i1) %0, %1, %2, align 4, seq_cst"), "{text}");
        assert!(text.contains("zext.i32 %4"), "whether it happened: {text}");

        // The C11 form, whose value expected arrives by pointer and is read before the exchange,
        // and whose answer is whether it happened. The write back is on the path where it did not.
        let text = body(
            "int f(int *p, int *e, int d) { return __atomic_compare_exchange_n(p, e, d, 0, 4, 2); }\n",
        );
        assert!(text.contains("%3 = load.i32 %1, align 4"), "{text}");
        assert!(text.contains("%4, %5 = cmpxchg.(i32, i1) %0, %3, %2, align 4, acq_rel"), "{text}");
        assert!(text.contains("br_if %5, block2, block1"), "{text}");
        assert!(text.contains("store %4 -> %1, align 4"), "{text}");

        // And the form that takes the value to put there by pointer as well, which is one more
        // read and is otherwise the same node.
        let text = body(
            "int f(int *p, int *e, int *d) { return __atomic_compare_exchange(p, e, d, 0, 5, 5); }\n",
        );
        assert!(text.contains("%3 = load.i32 %1, align 4"), "{text}");
        assert!(text.contains("%4 = load.i32 %2, align 4"), "{text}");
        assert!(text.contains("%5, %6 = cmpxchg.(i32, i1) %0, %3, %4, align 4, seq_cst"), "{text}");
    }

    /// On this machine it is `lock cmpxchg`, at the width of the object and at every ordering.
    ///
    /// The `lock` is what makes the whole of it one step as far as every other processor is
    /// concerned, and it is also what makes the instruction a full barrier, which is why the
    /// ordering the program wrote changes nothing in what is written here. Every line below is what
    /// gcc 16.2.0 writes for the same function.
    #[test]
    fn a_compare_and_exchange_is_a_locked_instruction_at_the_width_of_the_object() {
        let widths = [("char", "b", "%dl"), ("short", "w", "%dx"), ("int", "l", "%edx")];
        for (ty, suffix, reg) in widths {
            let source = format!(
                "int f({ty} *p, {ty} e, {ty} d) {{ return __sync_bool_compare_and_swap(p, e, d); }}\n"
            );
            let text = asm(&source);
            assert!(text.contains("\tlock\n"), "{ty}: {text}");
            assert!(text.contains(&format!("cmpxchg{suffix}\t{reg}, (%rdi)")), "{ty}: {text}");
            assert!(text.contains("sete\t"), "{ty}: {text}");
        }
        let source =
            "int f(long *p, long e, long d) { return __sync_bool_compare_and_swap(p, e, d); }\n";
        assert!(asm(source).contains("cmpxchgq\t%rdx, (%rdi)"), "{}", asm(source));

        // The ordering the program asked for changes nothing, because a locked instruction on this
        // machine orders everything whatever it was asked for, so there is never a barrier beside
        // it either.
        for order in ["0", "2", "3", "4", "5"] {
            let call = format!("__atomic_compare_exchange_n(p, e, d, 0, {order}, 0)");
            let source = format!("int f(int *p, int *e, int d) {{ return {call}; }}\n");
            let text = asm(&source);
            assert!(text.contains("cmpxchgl\t"), "{order}: {text}");
            assert!(!text.contains("mfence"), "{order} needs no barrier here: {text}");
        }
    }

    /// A read modify write is one IR instruction, and a name that asks for the value afterwards is
    /// that instruction and one more operation.
    ///
    /// The instruction answers what was there before, which is the convention every machine and
    /// every language in this area uses. Half the names in the family ask for the value afterwards
    /// instead, and that is the answer and the operand put together again, which is arithmetic on
    /// two values already in registers rather than a second flavour of the instruction.
    ///
    /// The two lock names are here too. They are not read modify writes in the same sense: one is
    /// an exchange and the other is a store of a zero, and what makes them a pair is the ordering,
    /// which is the one place in the older family that is not sequential consistency.
    #[test]
    fn a_read_modify_write_is_one_instruction_and_the_arithmetic_a_name_asks_for() {
        let text = body("int f(int *p, int v) { return __atomic_fetch_add(p, v, 5); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 add %0, %1, align 4, seq_cst"), "{text}");
        assert!(text.contains("return %2"), "the value that was there: {text}");

        let text = body("int f(int *p, int v) { return __atomic_add_fetch(p, v, 5); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 add %0, %1, align 4, seq_cst"), "{text}");
        assert!(text.contains("%3 = add %2, %1"), "and the value afterwards: {text}");

        let text = body("int f(int *p, int v) { return __atomic_sub_fetch(p, v, 5); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 sub %0, %1, align 4, seq_cst"), "{text}");
        assert!(text.contains("%3 = sub %2, %1"), "{text}");

        // The older family, which passes no ordering and is a full barrier.
        let text = body("int f(int *p, int v) { return __sync_fetch_and_sub(p, v); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 sub %0, %1, align 4, seq_cst"), "{text}");

        // The exchange, and the older family's spelling of it, which is taking a lock and so is an
        // acquire rather than the full barrier the rest of that family is.
        let text = body("int f(int *p, int v) { return __atomic_exchange_n(p, v, 5); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 xchg %0, %1, align 4, seq_cst"), "{text}");

        let text = body("int f(int *p, int v) { return __sync_lock_test_and_set(p, v); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 xchg %0, %1, align 4, acquire"), "{text}");

        // Giving the lock back, which is one of the two names in the family that is handed no value
        // to put there, because what it puts there is a zero.
        let text = body("void f(int *p) { __sync_lock_release(p); }\n");
        assert!(text.contains("release"), "{text}");
        assert!(text.contains("%1 = iconst.i32 0"), "{text}");

        // And with something after the pointer, which is the list of variables the call promises to
        // protect rather than a value to write. Reading it as a value would store whatever the
        // caller happened to name there, which is the one thing giving a lock back must not do.
        let text = body("void f(int *p, int guard) { __sync_lock_release(p, guard); }\n");
        assert!(text.contains("%2 = iconst.i32 0"), "{text}");
        assert!(text.contains("atomic_store %2 -> %0, align 4, release"), "{text}");

        // The bitwise four, which look no different here from the arithmetic ones: what the machine
        // has an instruction for is a question further down and this level does not ask it.
        let text = body("int f(int *p, int v) { return __atomic_fetch_and(p, v, 5); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 and %0, %1, align 4, seq_cst"), "{text}");

        let text = body("int f(int *p, int v) { return __sync_or_and_fetch(p, v); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 or %0, %1, align 4, seq_cst"), "{text}");
        assert!(text.contains("%3 = or %2, %1"), "and the value afterwards: {text}");

        // The nand, which is the one of the six that is two operations. The flip is an exclusive or
        // against every bit set because the IR has no not and that is what one is.
        let text = body("int f(int *p, int v) { return __atomic_nand_fetch(p, v, 5); }\n");
        assert!(text.contains("%2 = atomic_rmw.i32 nand %0, %1, align 4, seq_cst"), "{text}");
        assert!(text.contains("%3 = and %2, %1"), "{text}");
        assert!(text.contains("%4 = iconst.i32 -1"), "{text}");
        assert!(text.contains("%5 = xor %3, %4"), "{text}");
    }

    /// The four operations with no instruction on this machine are a loop around `lock cmpxchg`.
    ///
    /// The shape is the one every architecture manual writes out by hand: read the word, work out
    /// what should be there instead, put it back if nothing else got in first, and go round again
    /// when something did. What is checked is that the loop is there at every width, that the
    /// operation is inside it, and that no `xchg` or `xadd` got used for something neither of them
    /// does.
    ///
    /// gcc 16.2.0 writes the same loop for the same functions, down to which register holds the
    /// value that was read.
    #[test]
    fn a_bitwise_read_modify_write_is_a_loop_around_the_compare_and_exchange() {
        let widths = [("char", "b", "%dl"), ("short", "w", "%dx"), ("int", "l", "%edx")];
        for (ty, suffix, reg) in widths {
            for (name, call, insn) in [
                ("and", "__atomic_fetch_and(p, v, 5)", "and"),
                ("or", "__sync_fetch_and_or(p, v)", "or"),
                ("xor", "__atomic_xor_fetch(p, v, 5)", "xor"),
            ] {
                let source = format!("{ty} f({ty} *p, {ty} v) {{ return {call}; }}\n");
                let text = asm(&source);
                assert!(text.contains("\tlock\n"), "{ty} {name}: {text}");
                assert!(
                    text.contains(&format!("cmpxchg{suffix}\t{reg}, (%rdi)")),
                    "{ty} {name}: {text}"
                );
                assert!(text.contains(&format!("{insn}{suffix}\t")), "{ty} {name}: {text}");
                // The tab matters on the second of these, since `cmpxchg` ends in the other name.
                assert!(!text.contains("\txadd"), "{ty} {name} is not an add: {text}");
                assert!(!text.contains("\txchg"), "{ty} {name} is not an exchange: {text}");
            }
        }
        let source = "long f(long *p, long v) { return __atomic_fetch_or(p, v, 5); }\n";
        assert!(asm(source).contains("cmpxchgq\t%rdx, (%rdi)"), "{}", asm(source));

        // The nand, which puts two instructions inside the loop rather than one. The flip is an
        // exclusive or against every bit set in the IR and the folder turns that into the `not` the
        // machine has, which is what gcc writes here too.
        let text = asm("int f(int *p, int v) { return __sync_fetch_and_nand(p, v); }\n");
        assert!(text.contains("cmpxchgl\t"), "{text}");
        assert!(text.contains("andl\t"), "{text}");
        assert!(text.contains("notl\t"), "{text}");
    }

    /// The three names that pass a value through a pointer are the same access and one plain one.
    ///
    /// They exist for an object too big to come back in a register, and the front end takes them at
    /// their word rather than folding them into the `_n` spellings, because the extra access is real:
    /// the caller handed over somewhere to read from or write into and that is where the value has
    /// to come from or go. Both of those accesses are plain. The object at the end of the caller's
    /// pointer is the caller's own and no other thread has its address, which is what the whole
    /// shape is for.
    #[test]
    fn an_access_through_a_second_pointer_is_the_same_access_and_one_more() {
        let text = body("void f(int *p, int *r) { __atomic_load(p, r, 5); }\n");
        assert!(text.contains("%2 = atomic_load.i32 %0, align 4, seq_cst"), "{text}");
        assert!(text.contains("store %2 -> %1, align 4"), "and out through the place: {text}");

        let text = body("void f(int *p, int *v) { __atomic_store(p, v, 3); }\n");
        assert!(text.contains("%2 = load.i32 %1, align 4"), "in through the place: {text}");
        assert!(text.contains("atomic_store %2 -> %0, align 4, release"), "{text}");

        // The exchange, which reads through one pointer and writes through another and is the same
        // instruction in between as the spelling that takes and answers values.
        let text = body("void f(int *p, int *v, int *r) { __atomic_exchange(p, v, r, 5); }\n");
        assert!(text.contains("%3 = load.i32 %1, align 4"), "{text}");
        assert!(text.contains("%4 = atomic_rmw.i32 xchg %0, %3, align 4, seq_cst"), "{text}");
        assert!(text.contains("store %4 -> %2, align 4"), "{text}");
    }

    /// The flag pair is an exchange of one byte and a store of a zero over the same byte.
    ///
    /// One byte whatever the pointer was written as, which is the standard's reading rather than a
    /// liberty: the object is an `atomic_flag`, there is no other way to read or write one, so the
    /// type the pointer carries says nothing about the access and the width is the implementation's
    /// to fix. gcc 16.2.0 writes `xchgb` here through an `int *` too.
    ///
    /// The answer is a comparison against zero rather than the byte itself, because the type of the
    /// call is `_Bool` and a byte that is neither zero nor one is not one. gcc answers the raw byte,
    /// and the two agree wherever the flag is only ever touched through this pair.
    #[test]
    fn a_flag_is_an_exchange_of_one_byte_and_a_store_of_a_zero_over_the_same_byte() {
        for pointer in ["char", "int", "void"] {
            let source = format!("int f({pointer} *p) {{ return __atomic_test_and_set(p, 5); }}\n");
            let text = body(&source);
            assert!(text.contains("%1 = iconst.i8 1"), "{pointer}: {text}");
            assert!(
                text.contains("%2 = atomic_rmw.i8 xchg %0, %1, align 1, seq_cst"),
                "{pointer}: {text}"
            );
            assert!(text.contains("%4 = icmp ne %2, %3"), "{pointer}: {text}");

            let source = format!("void f({pointer} *p) {{ __atomic_clear(p, 3); }}\n");
            let text = body(&source);
            assert!(text.contains("atomic_store %2 -> %0, align 1, release"), "{pointer}: {text}");
        }

        // And on this machine, where the exchange carries no `lock` because one with memory locks
        // the bus whether it was asked to or not. Both lines are what gcc 16.2.0 writes.
        let text = asm("int f(int *p) { return __atomic_test_and_set(p, 5); }\n");
        assert!(text.contains("xchgb\t%al, (%rdi)"), "{text}");
        assert!(text.contains("setne\t"), "{text}");
    }

    /// On this machine it is `xchg` where the machine has an exchange and `lock xadd` where it has
    /// an add, at the width of the object.
    ///
    /// The exchange carries no prefix and the add carries one, which is the machine rather than an
    /// oversight: an exchange with memory locks the bus whether it is asked to or not. Both are
    /// therefore full barriers whatever ordering the program wrote, so no ordering costs an
    /// `mfence` beside them. Every line below is what gcc 16.2.0 writes for the same function.
    #[test]
    fn a_read_modify_write_is_an_exchange_or_a_locked_add_at_the_width_of_the_object() {
        let widths = [("char", "b", "%sil"), ("short", "w", "%si"), ("int", "l", "%esi")];
        for (ty, suffix, reg) in widths {
            let source =
                format!("{ty} f({ty} *p, {ty} v) {{ return __atomic_fetch_add(p, v, 5); }}\n");
            let text = asm(&source);
            assert!(text.contains("\tlock\n"), "{ty}: {text}");
            assert!(text.contains(&format!("xadd{suffix}\t{reg}, (%rdi)")), "{ty}: {text}");

            let source =
                format!("{ty} f({ty} *p, {ty} v) {{ return __atomic_exchange_n(p, v, 5); }}\n");
            let text = asm(&source);
            assert!(text.contains(&format!("xchg{suffix}\t{reg}, (%rdi)")), "{ty}: {text}");
            assert!(!text.contains("\tlock\n"), "an exchange is locked already: {ty}: {text}");
        }
        let source = "long f(long *p, long v) { return __atomic_fetch_add(p, v, 5); }\n";
        assert!(asm(source).contains("xaddq\t%rsi, (%rdi)"), "{}", asm(source));

        // A subtraction is the same instruction over the negated operand, which is right at every
        // width because the machine's arithmetic wraps.
        let source = "int f(int *p, int v) { return __atomic_fetch_sub(p, v, 5); }\n";
        let text = asm(source);
        assert!(text.contains("negl\t"), "{text}");
        assert!(text.contains("xaddl\t"), "{text}");

        // The ordering changes nothing, for the reason it changes nothing for a compare and
        // exchange: a locked instruction on this machine orders everything whatever it was asked.
        for order in ["0", "2", "3", "4", "5"] {
            let source =
                format!("int f(int *p, int v) {{ return __atomic_fetch_add(p, v, {order}); }}\n");
            let text = asm(&source);
            assert!(text.contains("xaddl\t"), "{order}: {text}");
            assert!(!text.contains("mfence"), "{order} needs no barrier here: {text}");
        }

        // And the lock pair, which is the exchange and a store of a zero. Neither is a barrier
        // instruction: the exchange is one already and the store is a release, which this machine
        // gives away.
        let text = asm("int f(int *p, int v) { return __sync_lock_test_and_set(p, v); }\n");
        assert!(text.contains("xchgl\t%esi, (%rdi)"), "{text}");
        // The zero goes through a register on the way, which is where every constant this
        // compiler stores goes: gcc writes the one instruction because it has a store that takes an
        // immediate and no rule here does. That is a rule this rule set is missing rather than
        // anything about the builtin, and it is the same two instructions a plain `*p = 0` makes.
        let text = asm("void f(int *p) { __sync_lock_release(p); }\n");
        assert!(text.contains("movl\t$0, %eax"), "{text}");
        assert!(text.contains("movl\t%eax, (%rdi)"), "{text}");
        assert!(!text.contains("mfence"), "a release store needs no barrier here: {text}");
    }

    /// The two lock free questions are numbers in the program rather than calls to anything.
    ///
    /// Both answer from the size, which has to be a power of two no wider than the widest access
    /// this compiler writes, and from what the pointer says about the alignment. Sixteen bytes is
    /// no here and is no in gcc without `-mcx16`, because `cmpxchg16b` is not in the baseline and
    /// nothing here writes it. Three bytes is no because there is no three byte access at all.
    ///
    /// The whole point of both names is that the answer is available before the program runs, so
    /// what is checked is that a `mov` of a constant is the whole function and that no call was
    /// left behind. A call would be to `__atomic_is_lock_free` in libatomic, which is not a library
    /// this links against.
    #[test]
    fn the_lock_free_questions_are_answered_as_constants() {
        for size in ["1", "2", "4", "8"] {
            let source =
                format!("int f(void) {{ return __atomic_always_lock_free({size}, 0); }}\n");
            let text = asm(&source);
            assert!(text.contains("movb\t$1, %al"), "{size} bytes is lock free: {text}");
            assert!(!text.contains("call"), "and is not a call: {text}");
        }
        for size in ["3", "16", "sizeof(long double)"] {
            let source = format!("int f(void) {{ return __atomic_is_lock_free({size}, 0); }}\n");
            let text = asm(&source);
            assert!(text.contains("movb\t$0, %al"), "{size} bytes is not: {text}");
            assert!(!text.contains("call"), "and is not a call either: {text}");
        }

        // A size the compiler cannot work out, which is no rather than a refusal, and an object
        // whose type is aligned under the size asked about, which is the whole of what the second
        // argument is for.
        let text = asm("int f(int n) { return __atomic_is_lock_free(n, 0); }\n");
        assert!(text.contains("movb\t$0, %al"), "a size nobody knows is not lock free: {text}");
        let text = asm("int f(int *p) { return __atomic_always_lock_free(8, p); }\n");
        assert!(text.contains("movb\t$0, %al"), "eight bytes at four is not: {text}");
        let text = asm("int f(long *p) { return __atomic_always_lock_free(8, p); }\n");
        assert!(text.contains("movb\t$1, %al"), "and at eight it is: {text}");
    }

    /// A memory order an operation cannot carry is read as the strongest one, and said so about.
    ///
    /// There are three ways the number is not one the operation can take: it is not a constant at
    /// all, it is not one of the six the headers define, or it is one of them and means nothing for
    /// this operation, which is a release load or an acquire store. All three become sequential
    /// consistency, which is stronger than anything the program could have meant, so a program that
    /// wrote nonsense gets a correct answer rather than a fast one. gcc does the same.
    ///
    /// The last two also warn, because the number was written down and is wrong. The first does
    /// not: gcc takes a computed order, and so does the C11 spelling, so a warning there would fire
    /// on correct programs.
    #[test]
    fn a_memory_order_an_operation_cannot_carry_is_read_as_the_strongest() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;

        let acquire_store = run(&opts, "void f(int *p, int v) { __atomic_store_n(p, v, 2); }\n");
        assert!(acquire_store.text().contains("seq_cst"), "{:?}", acquire_store.text());
        assert!(acquire_store.messages[0].contains("[W0333]"), "{:?}", acquire_store.messages);

        let nonsense = run(&opts, "int f(int *p) { return __atomic_load_n(p, 99); }\n");
        assert!(nonsense.text().contains("seq_cst"), "{:?}", nonsense.text());
        assert!(nonsense.messages[0].contains("[W0333]"), "{:?}", nonsense.messages);

        let computed = run(&opts, "int f(int *p, int n) { return __atomic_load_n(p, n); }\n");
        assert!(computed.text().contains("seq_cst"), "{:?}", computed.text());
        assert_eq!(computed.messages, Vec::<String>::new(), "a computed order is not a mistake");
    }

    /// A conversion between a float and the widest unsigned integer, which the machine has not got.
    ///
    /// Every other conversion between a float and an integer is the signed one at some width with a
    /// widening in front or a narrowing behind. These two are not, because there is no signed width
    /// that holds every value of an unsigned sixty four bit integer, so each is the signed
    /// conversion with arithmetic around it that brings the value into range and puts it back.
    ///
    /// What is checked here is that the conversion happens at all and that it happens without a
    /// branch. gcc writes a branch for both; this writes the choice as a mask, because every rewrite
    /// in that pass stays inside the block it started in. The arithmetic itself is checked in
    /// `rucc-codegen`, where it can be run against the answer rather than read in the assembly.
    #[test]
    fn a_conversion_between_a_float_and_the_widest_unsigned_integer_is_written_without_a_branch() {
        let text = asm("double f(unsigned long long x) { return (double)x; }\n");
        assert!(text.contains("cvtsi2sdq"), "the signed conversion is what runs: {text}");
        assert!(text.contains("shrq"), "with the value halved first: {text}");
        assert!(text.contains("addsd"), "and doubled after: {text}");
        assert!(!text.contains("\tj"), "and no branch anywhere: {text}");

        let text = asm("unsigned long long f(double d) { return (unsigned long long)d; }\n");
        assert!(text.contains("cvttsd2siq"), "the signed conversion is what runs: {text}");
        assert!(text.contains("subsd"), "with half the range taken off first: {text}");
        assert!(text.contains("shlq\t$63"), "and the top bit put back: {text}");
        assert!(!text.contains("\tj"), "and no branch anywhere: {text}");
    }

    /// The plain names are the library's only where nothing else has taken them.
    ///
    /// Four ways a program says it means something else. A `static` definition is its own
    /// function and the name outside the file is somebody else's. A declaration of another type
    /// is another function. `-fno-builtin` and `-fno-builtin-<name>` say so outright, and
    /// `-ffreestanding` says there is no C library for the name to be the name of. Every one of
    /// these was measured against gcc 16.2.0, which calls the program's function in all of them.
    ///
    /// The `__builtin_` spelling goes on meaning the library's function through all of it, which
    /// is what the prefix is for and what lets a freestanding build reach one deliberately.
    #[test]
    fn a_plain_name_the_program_took_is_the_programs_own_function() {
        let taken = concat!(
            "static long long llabs(long long b) { return 7; }\n",
            "long long f(long long x) { return llabs(x); }\n",
        );
        assert!(ir(taken).contains("call @llabs"), "a static definition is the program's own");

        let retyped = concat!("int llabs(int b);\n", "int f(int x) { return llabs(x); }\n",);
        assert!(ir(retyped).contains("call @llabs"), "another type is another function");

        let plain = concat!(
            "long long llabs(long long b);\n",
            "long long f(long long x) { return llabs(x); }\n",
        );
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        assert!(!run(&opts, plain).text().contains("call @llabs"), "the library's by default");

        opts.builtins = false;
        assert!(run(&opts, plain).text().contains("call @llabs"), "-fno-builtin");

        opts.builtins = true;
        opts.no_builtin = vec!["llabs".to_owned()];
        assert!(run(&opts, plain).text().contains("call @llabs"), "-fno-builtin-llabs");
        let one = "long labs(long b);\nlong f(long x) { return labs(x); }\n";
        assert!(!run(&opts, one).text().contains("call @labs"), "one name and not the family");

        // `-ffreestanding` reaches the front end as the same answer, which is what the driver
        // does with it in `compile`, and the prefixed spelling is untouched by any of it.
        opts.no_builtin = Vec::new();
        opts.builtins = false;
        let prefixed = "long long f(long long x) { return __builtin_llabs(x); }\n";
        assert!(!run(&opts, prefixed).text().contains("call @llabs"), "the prefix is a promise");
    }

    /// The hint builtins are their first argument, and nothing is left of the hint.
    ///
    /// Which way a branch is expected to go is the whole of what they say, and there is nothing
    /// here that reads a branch weight yet, so what reaches the IR is the value and the hint is
    /// gone. The one thing the prototype has to keep doing is converting: gcc gives both of them
    /// a `long` result, so `sizeof(__builtin_expect((char)1, 1))` is eight and a narrower argument
    /// widens before it is answered with.
    ///
    /// Whether a side effect in the hint happens depends on the first argument, which is gcc's
    /// answer rather than a rule anybody designed. A constant first argument folds the whole call
    /// where it is written and the hint goes with it, and a first argument that is not a constant
    /// leaves the hint standing. Both halves are below and both were measured on gcc 16.2.0.
    #[test]
    fn the_hint_builtins_are_their_first_argument_and_the_hint_leaves_no_trace() {
        let text = ir(concat!(
            "long a = __builtin_expect(7, 1);\n",
            "long b = __builtin_expect_with_probability(9, 1, 0.9);\n",
            "unsigned long c = sizeof(__builtin_expect((char)1, 1));\n",
        ));
        assert!(text.contains("global @a : i64 = 7,"), "{text}");
        assert!(text.contains("global @b : i64 = 9,"), "{text}");
        assert!(text.contains("global @c : i64 = 8,"), "{text}");
        assert!(!text.contains("__builtin_expect"), "it is not a call to anything:\n{text}");

        // A narrower argument is widened by the prototype before it is handed back, and it is
        // widened with its sign, since the parameter is a signed `long`.
        let text = body("long f(char c) { return __builtin_expect(c, 1); }\n");
        assert!(text.contains("sext"), "{text}");

        // The first argument is a constant, so the second is not evaluated and `i` is still zero,
        // and neither is the third. What is left of each statement is the first argument widened,
        // which nothing reads and which the first pass that looks for dead code will take out.
        let one = "block0:\n    %0 = iconst.i32 0\n    %1 = iconst.i32 1\n    %2 = sext.i64 %1\n    return %0\n";
        assert_eq!(body("int f(void) { int i = 0; __builtin_expect(1, i++); return i; }\n"), one);
        let source = "int g(void) { int i = 0; __builtin_expect_with_probability(1, i++, 0.5); return i; }\n";
        assert_eq!(body(source), one);

        // The first argument is not a constant, so the hint runs and `i` comes back one. There is
        // an increment in the body and the value it returns is the load after it, which is what
        // gcc gives for the same program, and the whole of tamnd/rucc#584 is that this used to
        // come out the same as the pair above.
        let kept = body("int f(int n) { int i = 0; __builtin_expect(n, i++); return i; }\n");
        assert!(kept.contains("add.nsw"), "the hint still runs: {kept}");
        assert!(kept.ends_with("return %3\n"), "and the answer is what it left behind: {kept}");
        let both = "int g(int n) { int i = 0; __builtin_expect_with_probability(n, i++, 0.5); return i; }\n";
        assert!(body(both).contains("add.nsw"), "and so does the one with three arguments");
    }

    /// A point control does not arrive at, in both of the ways the compiler has one.
    ///
    /// `__builtin_unreachable()` is the promise written down, and a function whose body can run
    /// off the bottom is the walk arriving at the same place on its own. Neither writes an
    /// instruction, which is what gcc 16.2.0 does at `-O0`: it emits the epilogue and the `ret`
    /// for both of the functions below and nothing else, and the two of them come out byte for
    /// byte the same there.
    ///
    /// The `ret` is the part worth holding on to. It is not there because anything runs it, it is
    /// there because a function whose last instruction is not a return is one that falls into
    /// whatever the assembler puts after it.
    #[test]
    fn a_promise_that_control_does_not_arrive_writes_no_instruction() {
        let promised = "int f(int x) { if (x) return 1; __builtin_unreachable(); }\n";
        let text = ir(promised);
        assert!(text.contains("    unreachable_hint\n"), "{text}");
        assert!(!text.contains("call"), "it is not a call to anything:\n{text}");

        // The statement after it is still lowered. Continuing to translate a path the program
        // promised is dead is one of the things a compiler may do with undefined behaviour, and
        // it is the one that keeps a program built at `-O0` behaving the way it was watched to.
        let after = body("int g(int x) { __builtin_unreachable(); return x; }\n");
        assert!(after.contains("return"), "{after}");

        // Both functions are the same instructions, because the hint writes none of them and the
        // terminator underneath it writes none either.
        let text = asm(promised);
        let mine = text.split_once("\nf:\n").expect("a definition").1;
        let mine = mine.split_once("\t.size").expect("a definition").0;
        let plain = asm("int f(int x) { if (x) return 1; }\n");
        let plain = plain.split_once("\nf:\n").expect("a definition").1;
        let plain = plain.split_once("\t.size").expect("a definition").0;
        assert_eq!(mine, plain);
        // The last instruction, rather than the last line, because the unwind record is closed
        // after it and a directive is not something the machine runs.
        let last = mine.lines().rfind(|line| !line.trim_start().starts_with('.'));
        assert_eq!(last.map(str::trim), Some("ret"), "{mine}");
        assert!(!mine.contains("ud2"), "{mine}");
    }

    /// The two names stay apart, which is what having both of them is for.
    ///
    /// The one the program wrote is what the call is checked against and what a diagnostic about
    /// it says, and the one the library defines is what the call ends up carrying. A compiler
    /// that kept only the second would report this against `abort`, which is a function the
    /// program never mentions.
    #[test]
    fn a_library_builtin_is_diagnosed_under_the_name_the_program_wrote() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let messages = run(&opts, "void f(void) { __builtin_abort(1); }\n").messages;
        assert!(
            messages.iter().any(|m| m.contains("__builtin_abort")),
            "expected the written name in {messages:?}"
        );
    }

    /// A builtin nothing lowers is refused where it is written, rather than at the link.
    ///
    /// One name is left, which is the last of the atomic family that is refused and is also the
    /// one whose prefix is not `__builtin_`; its older half has nothing left in it at all, and so
    /// does the half of the family that carries a prototype. What the message has to carry is the
    /// name, because the whole complaint about the link error this replaces is that the name in it
    /// was one the compiler chose.
    #[test]
    fn a_builtin_nothing_lowers_is_refused_by_name() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let builtin = "__atomic_signal_fence";
        let source = format!("int counter;\nint f(void) {{ return ({builtin}(5), 0); }}\n");
        let messages = run(&opts, &source).messages;
        let named = messages.iter().any(|m| m.contains(builtin) && m.contains("E0686"));
        assert!(named, "expected {builtin} to be refused by name in {messages:?}");
    }

    /// The refusal is about a call and not about the name, so a program that defines the name
    /// itself gets the function it wrote.
    ///
    /// That is not the reason the refusal exists, but a definition in front of us is a definition
    /// and the call to it links. It works here because the name is one with no prototype and no
    /// meaning the front end knows, which is what is left once the rest of the family is
    /// implemented: a `__builtin_` name the front end does answer is answered whatever the program
    /// declares, the way gcc answers one.
    #[test]
    fn what_is_refused_is_the_call_and_not_the_name() {
        let text = ir(concat!(
            "void __atomic_signal_fence(int order) { (void)order; }\n",
            "void f(void) { __atomic_signal_fence(5); }\n",
        ));
        assert!(text.contains("call @__atomic_signal_fence"), "{text}");
    }

    /// How many bytes are behind an address is read off the layout, for every shape the walk
    /// covers.
    ///
    /// This is what `_FORTIFY_SOURCE` runs on, so the numbers matter one at a time rather than in
    /// aggregate: a size too small turns a correct copy into an abort, and a size too large turns
    /// a checked copy back into an unchecked one. Every answer here was measured against gcc
    /// 16.2.0 first. They are written as initializers so that each one is a constant in the
    /// output and the test reads as the table it is.
    #[test]
    fn the_object_size_of_an_address_is_what_the_layout_leaves_in_front_of_it() {
        let text = ir(concat!(
            "struct S { char a[8]; int n; char b[12]; };\n",
            "char g[32];\n",
            "struct S gs;\n",
            "unsigned long whole = __builtin_object_size(g, 0);\n",
            "unsigned long moved = __builtin_object_size(g + 4, 0);\n",
            "unsigned long back = __builtin_object_size(g + 30 - 2, 0);\n",
            "unsigned long outer = __builtin_object_size(gs.a, 0);\n",
            "unsigned long inner = __builtin_object_size(gs.a, 1);\n",
            "unsigned long scalar = __builtin_object_size(&gs.n, 1);\n",
            "unsigned long after = __builtin_object_size(&gs.n, 0);\n",
            "unsigned long into = __builtin_object_size(&gs.b[2], 1);\n",
            "unsigned long text = __builtin_object_size(\"hello\", 0);\n",
            "unsigned long dyn = __builtin_dynamic_object_size(gs.b, 1);\n",
        ));
        for (name, size) in [
            ("whole", 32),
            ("moved", 28),
            ("back", 4),
            ("outer", 24),
            ("inner", 8),
            ("scalar", 4),
            ("after", 16),
            ("into", 10),
            ("text", 6),
            ("dyn", 12),
        ] {
            let said = format!("global @{name} : i64 = {size},");
            assert!(text.contains(&said), "expected `{said}` in:\n{text}");
        }
    }

    /// A local is as knowable as a global, which is the whole point of asking on the way into a
    /// copy.
    ///
    /// A fortified header expands around the destination the caller wrote, and the destination a
    /// program most wants checked is the buffer on its own stack. Nothing in the answer depends on
    /// storage duration, unlike in a constant expression, where the address of a local is exactly
    /// what is not allowed.
    #[test]
    fn the_object_behind_an_address_can_be_one_with_automatic_storage() {
        let text = body(concat!(
            "struct S { char a[8]; int n; char b[12]; };\n",
            "unsigned long f(void) {\n",
            "  char loc[20];\n",
            "  struct S ls;\n",
            "  return __builtin_object_size(loc + 3, 0) + __builtin_object_size(ls.b + 2, 1);\n",
            "}\n",
        ));
        assert!(text.contains("iconst.i64 17"), "twenty bytes with three used: {text}");
        assert!(text.contains("iconst.i64 10"), "twelve bytes with two used: {text}");
    }

    /// An address whose object the walk cannot see answers at whichever end of the range the kind
    /// asks for.
    ///
    /// The two bits are a question and the answer has to fit it. A kind wanting the largest object
    /// the address could be in has to name a size nothing is bigger than, and a kind wanting the
    /// smallest has to name a size nothing is smaller than, so the unknown answers are all ones
    /// and zero. That pair is what a fortified header compares against to decide whether to check
    /// at all, and getting either of them the wrong way round turns every unknown copy into an
    /// abort.
    #[test]
    fn an_address_with_no_object_in_sight_answers_at_the_end_of_the_range_its_kind_asks_for() {
        let text = ir(concat!(
            "struct T { int n; char f[]; };\n",
            "extern char *p;\n",
            "extern struct T *t;\n",
            "unsigned long largest = __builtin_object_size(p, 0);\n",
            "unsigned long nearest = __builtin_object_size(p, 1);\n",
            "unsigned long least = __builtin_object_size(p, 2);\n",
            "unsigned long tight = __builtin_object_size(p, 3);\n",
            "unsigned long flex = __builtin_object_size(t->f, 1);\n",
            "int says = __builtin_object_size(p, 0) == (unsigned long)-1;\n",
        ));
        for name in ["largest", "nearest", "flex"] {
            // All ones, printed as the signed rendering of the sixty four bits it is held in.
            // `says` is what pins the pattern itself, since it is the comparison a fortified
            // header writes and it folds only if every bit is set.
            let said = format!("global @{name} : i64 = -1,");
            assert!(text.contains(&said), "expected `{said}` in:\n{text}");
        }
        for name in ["least", "tight"] {
            let said = format!("global @{name} : i64 = 0,");
            assert!(text.contains(&said), "expected `{said}` in:\n{text}");
        }
        assert!(text.contains("global @says : i32 = 1,"), "{text}");
    }

    /// The address is not evaluated, which is the rule `sizeof` follows and for the same reason.
    ///
    /// What the builtin reads is the shape of the expression rather than the value it would
    /// produce, so there is nothing to run. It matters because a fortified header writes the
    /// destination twice, once into the copy and once into the size, and a program whose
    /// destination is `*next()` would advance twice if this evaluated.
    #[test]
    fn the_address_an_object_size_is_asked_about_is_not_evaluated() {
        let text = body(concat!(
            "extern char *side(void);\n",
            "unsigned long f(void) { return __builtin_object_size(side(), 0); }\n",
        ));
        assert!(!text.contains("call"), "nothing is called: {text}");
    }

    /// The kind has to be a constant in range, because it says which of four questions was asked.
    ///
    /// A number that is not known until the program runs decides nothing, and one outside the two
    /// bits names no question at all. gcc refuses both in one sentence and so does this.
    #[test]
    fn a_kind_that_is_not_one_of_the_four_is_refused() {
        for source in [
            "extern char *p;\nextern int k;\nunsigned long f(void) ".to_owned()
                + "{ return __builtin_object_size(p, k); }\n",
            "extern char *p;\nunsigned long f(void) { return __builtin_object_size(p, 4); }\n"
                .to_owned(),
            "extern char *p;\nunsigned long f(void) ".to_owned()
                + "{ return __builtin_dynamic_object_size(p, -1); }\n",
        ] {
            let messages = errors(&source);
            let named = messages.iter().any(|m| m.contains("E0709") && m.contains("0 to 3"));
            assert!(named, "expected a complaint about the kind in {messages:?}");
        }
    }

    /// The pair that saves a place in a function and comes back to it, which is not a call.
    ///
    /// What the IR has to show is one instruction each and no call to anything: there is no
    /// function of either name for a call to reach, and a program that got one would fail to link.
    /// The save answers an `int`, which is the value that says how control got there.
    #[test]
    fn the_pair_that_saves_a_place_lowers_to_the_two_markers() {
        let text = ir(concat!(
            "void *buf[5];\n",
            "int f(void) {\n",
            "  if (__builtin_setjmp(buf)) return 2;\n",
            "  return 1;\n",
            "}\n",
            "void g(void) { __builtin_longjmp(buf, 1); }\n",
        ));
        assert!(text.contains("= setjmp_marker.i32 %0\n"), "the save answers a value: {text}");
        assert!(text.contains("    longjmp_marker %0\n"), "the restore answers nothing: {text}");
        assert!(!text.contains("call @"), "neither of them is a call: {text}");
    }

    /// Every local of a function that saves a place lives in the frame, and not in a value.
    ///
    /// The edge a restore travels is not an edge of the graph, so a local the SSA construction
    /// renamed would answer the write that reached the read along the edges there are rather than
    /// the write that last ran. The second function here is the same code without the save, where
    /// the local is a value and there is no slot at all, which is what makes the first one a rule
    /// about the save and not about the shape of the code.
    #[test]
    fn a_local_of_a_function_that_saves_a_place_gets_a_slot() {
        let text = ir(concat!(
            "void *buf[5];\n",
            "int f(int x) { int a = 0; if (__builtin_setjmp(buf)) return a; a = 1; return x; }\n",
            "int g(int x) { int a = 0; if (x) return a; a = 1; return x; }\n",
        ));
        let (saves, plain) = text.split_once("func @g").expect("both functions");
        assert_eq!(saves.matches("= alloca").count(), 2, "the parameter and the local: {text}");
        assert!(saves.contains("store %9 -> %2"), "the local is written through: {text}");
        assert!(!plain.contains("alloca"), "nothing in the plain one needs a slot: {text}");
    }

    /// What the save writes and where it leaves control, which is a new block.
    ///
    /// Four words: the frame pointer, the address to come back to, the stack pointer, and the
    /// address of the word the answer arrives in, which is this compiler's own and is why the
    /// block after the save opens with a load. The frame pointer is kept although the function
    /// asked for nothing and calls nothing, since the epilogue has to find the caller's frame
    /// after control has come back, and the frame is grown although there is one word in it,
    /// since a function control comes back into cannot use the red zone.
    #[test]
    fn the_save_writes_four_words_and_carries_on_in_a_new_block() {
        let text =
            asm(concat!("void *buf[5];\n", "int f(void) { return __builtin_setjmp(buf); }\n",));
        let body = text.split_once("\nf:\n").expect("the function").1;
        assert!(body.contains("\tmovq\t%rsp, %rbp\n"), "a frame pointer whatever: {text}");
        assert!(body.contains("\tsubq\t$8, %rsp\n"), "no red zone: {text}");
        assert!(body.contains("\tmovq\t%rbp, (%rax)\n"), "the frame pointer: {text}");
        assert!(body.contains("\tmovq\t%rsp, 16(%rax)\n"), "the stack pointer: {text}");
        assert!(body.contains("\tleaq\t.Lf_1(%rip), %rcx\n"), "where to come back to: {text}");
        assert!(body.contains("\tmovq\t%rcx, 8(%rax)\n"), "and that goes in the buffer: {text}");
        let back = body.split_once(".Lf_1:\n").expect("the block control comes back to").1;
        assert!(back.starts_with("\tmovq\t(%rsp), %rax\n"), "the answer is read back: {text}");
    }

    /// Nothing stays in a register across the save, which is said with a write of every one of
    /// them and shows up as the callee-saved registers the function saves and restores.
    ///
    /// The restore puts back two registers and no others, so a function coming back through one
    /// finds every other register holding whatever the code between the two put there. The pushes
    /// are what makes the epilogue right on that path: the values popped are the caller's, off the
    /// stack the restore put back, rather than whatever is in the registers when control arrives.
    #[test]
    fn a_save_destroys_every_register_the_allocator_hands_out() {
        let text =
            asm(concat!("void *buf[5];\n", "int f(void) { return __builtin_setjmp(buf); }\n",));
        for reg in ["%rbx", "%r12", "%r13", "%r14", "%r15"] {
            assert!(text.contains(&format!("\tpushq\t{reg}\n")), "{reg} is saved: {text}");
            assert!(text.contains(&format!("\tpopq\t{reg}\n")), "{reg} is restored: {text}");
        }
    }

    /// The restore puts both registers back before it goes, at every level.
    ///
    /// The jump reads the two of them as well as the address it goes through, which is what keeps
    /// it behind them. Without that the two instructions write registers nothing reads, and the
    /// scheduler at `-O2` puts the jump in front of both and the program comes back to a frame
    /// that is not there.
    #[test]
    fn the_restore_puts_the_frame_back_before_it_jumps() {
        for level in [rucc_session::OptLevel::O0, rucc_session::OptLevel::O2] {
            let mut opts = options();
            opts.emit = EmitKind::Asm;
            opts.opt_level = level;
            let source = "void *buf[5];\nvoid g(void) { __builtin_longjmp(buf, 1); }\n";
            let result = run(&opts, source);
            assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile");
            let text = result.text().to_owned();
            let jump = text.find("\tjmp\t*%").unwrap_or_else(|| panic!("an indirect jump: {text}"));
            let stack = text.find(", %rsp\n").unwrap_or_else(|| panic!("the stack back: {text}"));
            let frame = text.find(", %rbp\n").unwrap_or_else(|| panic!("the frame back: {text}"));
            assert!(stack < jump, "the stack goes back first at {level:?}: {text}");
            assert!(frame < jump, "and so does the frame at {level:?}: {text}");
        }
    }

    /// The second argument of the restore has one allowed value, which gcc 16.2.0 also insists on.
    ///
    /// This pair does not carry a value back the way the library's `longjmp` does, because what
    /// the matching save answers is decided by which way control reached it. So the argument is a
    /// place-holder, and a program that wrote anything else meant the library's function.
    #[test]
    fn a_longjmp_whose_second_argument_is_not_one_is_turned_down() {
        for source in [
            "void *buf[5];\nvoid f(void) { __builtin_longjmp(buf, 0); }\n",
            "void *buf[5];\nextern int v;\nvoid f(void) { __builtin_longjmp(buf, v); }\n",
        ] {
            let messages = errors(source);
            let named = messages.iter().any(|m| m.contains("E0710"));
            assert!(named, "expected a complaint about the value in {messages:?}");
        }
    }

    /// A `static` function nothing refers to is not emitted, and one that is refered to is.
    ///
    /// The pair is written as one program so that the two answers come out of one walk. What
    /// makes the difference is the call in `main` and nothing else about either definition.
    #[test]
    fn a_static_function_nothing_refers_to_is_not_emitted() {
        let text = ir("static int dropped(void) { return 1; }\n\
                       static int kept(void) { return 2; }\n\
                       int main(void) { return kept(); }\n");
        assert!(text.contains("func @kept"), "{text}");
        assert!(!text.contains("dropped"), "{text}");
    }

    /// The set is transitive, so two of them that only call each other are both dropped.
    ///
    /// Counting the references to a name would keep this pair, since each is named once, and
    /// that is the mistake this is here to catch: what decides it is whether a root reaches the
    /// definition, and a root is something the file has a reason to emit on its own.
    #[test]
    fn two_static_functions_that_only_call_each_other_are_both_dropped() {
        let text = ir("static int ping(void);\n\
                       static int pong(void) { return ping(); }\n\
                       static int ping(void) { return pong(); }\n\
                       int main(void) { return 0; }\n");
        assert!(!text.contains("ping"), "{text}");
        assert!(!text.contains("pong"), "{text}");
    }

    /// Everything that names a function keeps it, whether or not the name is being called.
    ///
    /// An address taken in a body, an image that holds one, and a body that is only reached
    /// through another `static` function are three different ways for a definition to be needed
    /// and none of them is a call at the top level of a reachable function.
    #[test]
    fn naming_a_static_function_anywhere_keeps_it() {
        let text = ir("static int by_address(void) { return 1; }\n\
                       static int in_an_image(void) { return 2; }\n\
                       static int deeper(void) { return 3; }\n\
                       static int reaches_deeper(void) { return deeper(); }\n\
                       static int (*table[1])(void) = {in_an_image};\n\
                       int main(void) {\n\
                         int (*p)(void) = by_address;\n\
                         return p() + table[0]() + reaches_deeper();\n\
                       }\n");
        for kept in ["by_address", "in_an_image", "deeper", "reaches_deeper"] {
            assert!(text.contains(&format!("func @{kept}")), "expected {kept} in:\n{text}");
        }
    }

    /// An attribute that says something outside the file reaches it keeps the definition.
    ///
    /// None of the five is implemented as anything else yet, and this is the part of each of
    /// them that a program notices first: a symbol a linker script names or a function the
    /// run-up to `main` calls is not written about anywhere a C file can see.
    #[test]
    fn an_attribute_keeps_a_static_function_nothing_refers_to() {
        for attribute in ["used", "retain", "constructor", "destructor", "__used__"] {
            let source = format!(
                "__attribute__(({attribute})) static int kept(void) {{ return 1; }}\n\
                 int main(void) {{ return 0; }}\n"
            );
            let text = ir(&source);
            assert!(text.contains("func @kept"), "for {attribute}:\n{text}");
        }
    }

    /// A function with external linkage is emitted whatever this file does with it, because
    /// another one may call it, and that is what external linkage is.
    #[test]
    fn a_function_anything_could_call_is_emitted_without_being_called() {
        let text =
            ir("int nobody_here_calls_it(void) { return 1; }\nint main(void) { return 0; }\n");
        assert!(text.contains("func @nobody_here_calls_it"), "{text}");
    }

    /// Four of the classification builtins are operators C already has, and become those.
    ///
    /// What the standard's macro promises over the operator is that it does not raise the
    /// invalid operation exception on a quiet NaN. This compiler does not model floating point
    /// exceptions, so there is nothing left for a node of its own to carry and a second way of
    /// spelling a comparison would be a second thing every pass has to know about.
    #[test]
    fn a_classification_c_has_an_operator_for_is_that_operator() {
        for (builtin, operator) in [
            ("__builtin_isgreater", "binary >"),
            ("__builtin_isgreaterequal", "binary >="),
            ("__builtin_isless", "binary <"),
            ("__builtin_islessequal", "binary <="),
        ] {
            let source = format!("int f(double x, double y) {{ return {builtin}(x, y); }}\n");
            let text = tast(&source);
            assert!(text.contains(&format!("{operator} : int")), "for {builtin}:\n{text}");
        }
    }

    /// The rest of the family are comparisons in the IR and never a call to anything.
    ///
    /// `math.h` defines the macro of each of these names as the builtin of the same name, so
    /// there is no function under any of them for a call to reach. `isunordered` and
    /// `islessgreater` are predicates the IR's comparison already has, `isnan` is the value that
    /// is unordered with itself, and the two that ask about a magnitude are written against the
    /// infinities. `signbit` is the one that is not a question about the value, since a negative
    /// zero compares equal to a positive one, so its answer comes from the bits.
    #[test]
    fn the_classification_builtins_are_comparisons_and_not_calls() {
        let text = body("int f(double x, double y) { return __builtin_isunordered(x, y); }\n");
        assert_eq!(
            text,
            "block0(%0: f64, %1: f64):\n    %2 = fcmp uno %0, %1\n    %3 = zext.i32 \
                          %2\n    return %3\n"
        );

        // Not `x != y`, which is true when the two are unordered and so is true of a NaN.
        let text = body("int f(double x, double y) { return __builtin_islessgreater(x, y); }\n");
        assert!(text.contains("fcmp one %0, %1"), "{text}");

        let text = body("int f(double x) { return __builtin_isnan(x); }\n");
        assert!(text.contains("fcmp uno %0, %0"), "{text}");

        let text = body("int f(double x) { return __builtin_isinf(x); }\n");
        assert!(text.contains("fconst.f64 0x7ff0000000000000"), "{text}");
        assert!(text.contains("fconst.f64 0xfff0000000000000"), "{text}");
        assert!(text.contains("%3 = fcmp oeq %0, %1"), "{text}");
        assert!(text.contains("%4 = fcmp oeq %0, %2"), "{text}");
        assert!(text.contains("%5 = or %3, %4"), "{text}");

        // Strictly between the two infinities, which a NaN is not, because an ordered comparison
        // against either of them is false. That is what makes this one test rather than two.
        let text = body("int f(double x) { return __builtin_isfinite(x); }\n");
        assert!(text.contains("%3 = fcmp olt %2, %0"), "{text}");
        assert!(text.contains("%4 = fcmp olt %0, %1"), "{text}");
        assert!(text.contains("%5 = and %3, %4"), "{text}");

        let text = body("int f(double x) { return __builtin_signbit(x); }\n");
        assert!(text.contains("%1 = bitcast.i64 %0"), "{text}");
        assert!(text.contains("icmp slt %1, %2"), "{text}");

        // The same question of a value in the target's widest format, where the bits are eighty
        // and the object they sit in is sixteen bytes.
        let text = body("int f(long double x) { return __builtin_signbitl(x); }\n");
        assert!(text.contains("%1 = bitcast.i80 %0"), "{text}");

        // The operand is evaluated once however many times it is compared, which is the whole
        // reason these are nodes rather than a rewriting into the operators.
        let text = body("double g(void);\nint f(void) { return __builtin_isnan(g()); }\n");
        assert_eq!(text.matches("call @g()").count(), 1, "{text}");
    }

    /// A spelling that names a width converts its argument before it asks.
    ///
    /// gcc gives `__builtin_isinff` a `float` parameter and `__builtin_isinf` no parameter type
    /// at all, and the difference is visible rather than academic: `1e300` does not fit in a
    /// `float`, so converting it first is an infinity and not converting it is not. Both numbers
    /// here are what gcc 16 gives.
    #[test]
    fn a_classification_spelling_that_names_a_width_converts_before_it_asks() {
        let text = ir(concat!(
            "int a = __builtin_isinff(1e300);\n",
            "int b = __builtin_isinf(1e300);\n",
            // Folded here rather than compared at run time, because a question about a value has
            // an answer as soon as the value is a constant, and an initializer for an object
            // with static storage duration has to have one.
            "int c = __builtin_isnan(0.0);\n",
            "int d = __builtin_signbit(-0.0);\n",
            "int e = __builtin_islessgreater(1.0, 2.0);\n",
        ));
        assert!(text.contains("global @a : i32 = 1,"), "{text}");
        assert!(text.contains("global @b : i32 = 0,"), "{text}");
        assert!(text.contains("global @c : i32 = 0,"), "{text}");
        assert!(text.contains("global @d : i32 = 1,"), "{text}");
        assert!(text.contains("global @e : i32 = 1,"), "{text}");
    }

    /// An argument that is not floating point is refused, in gcc's words.
    #[test]
    fn a_classification_builtin_refuses_an_argument_that_is_not_floating_point() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let source = concat!(
            "int a(int x) { return __builtin_isnan(x); }\n",
            "int b(int x, int y) { return __builtin_isunordered(x, y); }\n",
            "int c(double x) { return __builtin_isnan(x, x); }\n",
        );
        let messages = run(&opts, source).messages;
        assert_eq!(
            messages,
            [
                "/main.c:1:23: error: non-floating-point argument in call to function \
                 '__builtin_isnan' [E0685]",
                "/main.c:2:30: error: non-floating-point arguments in call to function \
                 '__builtin_isunordered' [E0685]",
                "/main.c:3:26: error: too many arguments to function '__builtin_isnan' [E0511]",
            ]
        );
    }

    /// The three of the family that need a constant of the format other than an infinity.
    ///
    /// `isnormal` is the one that needs the smallest normal, and it is asked of the magnitude, so
    /// the sign comes off first and what is left is the same shape as `isfinite`. `isinf_sign` is
    /// the one whose answer is a number: the two comparisons `isinf` builds, subtracted rather
    /// than combined. `fpclassify` is four questions of one value and five answers to pick from,
    /// and the picking is a mask because all five are constants and neither of them can have an
    /// effect.
    #[test]
    fn the_last_three_classification_builtins_are_comparisons_and_not_calls() {
        let text = body("int f(double x) { return __builtin_isnormal(x); }\n");
        // The sign off, which is the magnitude, and then the range, asked of the bits rather than
        // of the number, since the encoding of a value whose sign bit is clear rises with the
        // value in every format this compiles for.
        assert!(text.contains("%1 = bitcast.i64 %0"), "{text}");
        assert!(text.contains("%2 = iconst.i64 9223372036854775807"), "{text}");
        assert!(text.contains("%3 = and %1, %2"), "{text}");
        assert!(text.contains("%4 = iconst.i64 4503599627370496"), "{text}");
        assert!(text.contains("%5 = iconst.i64 9218868437227405312"), "{text}");
        assert!(text.contains("%6 = icmp uge %3, %4"), "{text}");
        assert!(text.contains("%7 = icmp ult %3, %5"), "{text}");
        assert!(text.contains("%8 = and %6, %7"), "{text}");

        // The same question in the target's widest format, where the smallest normal has the
        // leading significand bit stored rather than implied, so its encoding is two bits and not
        // one.
        let text = body("int f(long double x) { return __builtin_isnormal(x); }\n");
        assert!(text.contains("%4 = iconst.i80 27670116110564327424"), "{text}");
        assert!(text.contains("%5 = iconst.i80 604453686435277732577280"), "{text}");

        let text = body("int f(double x) { return __builtin_isinf_sign(x); }\n");
        assert!(text.contains("%3 = fcmp oeq %0, %1"), "{text}");
        assert!(text.contains("%4 = fcmp oeq %0, %2"), "{text}");
        assert!(text.contains("%7 = sub %5, %6"), "{text}");

        let text = body("int f(double x) { return __builtin_fpclassify(0, 1, 2, 3, 4, x); }\n");
        assert!(text.contains("fcmp uno %0, %0"), "{text}");
        assert!(text.contains("fcmp oeq %0, %6"), "{text}");
        // Four questions, each of them a bit widened into the type of the answer and then spread
        // into a mask that picks between the answer and whatever the questions after it settled
        // on. Nothing sign extends, because no rule lowers a sign extension out of one bit.
        assert_eq!(text.matches(" = zext.i32 ").count(), 4, "{text}");
        assert_eq!(text.matches(" = xor ").count(), 4, "{text}");
        assert!(!text.contains("call"), "{text}");

        // The value is evaluated once however many questions are asked of it, which is the whole
        // reason `fpclassify` is a node rather than the chain of tests it turns into.
        let text = body(concat!(
            "double g(void);\n",
            "int f(void) { return __builtin_fpclassify(0, 1, 2, 3, 4, g()); }\n",
        ));
        assert_eq!(text.matches("call @g()").count(), 1, "{text}");
    }

    /// Each of the three answers a constant where its operand is one.
    ///
    /// glibc's `fpclassify` macro is exactly this builtin, so a program that writes
    /// `fpclassify(0.0)` in a static initializer is writing this, and it has to have a value at
    /// translation time or the program is refused rather than merely compiled slowly. Every
    /// number here is what gcc 16 gives.
    #[test]
    fn the_last_three_classification_builtins_fold_where_their_operand_is_a_constant() {
        let text = ir(concat!(
            "int a = __builtin_isnormal(1.0);\n",
            "int b = __builtin_isnormal(0.0);\n",
            "int c = __builtin_isnormal(1.0 / 0.0);\n",
            "int d = __builtin_isinf_sign(-1.0 / 0.0);\n",
            "int e = __builtin_isinf_sign(1.0);\n",
            "int g = __builtin_fpclassify(0, 1, 2, 3, 4, 0.0);\n",
            "int h = __builtin_fpclassify(0, 1, 2, 3, 4, 1.0);\n",
            "int i = __builtin_fpclassify(0, 1, 2, 3, 4, 1.0 / 0.0);\n",
        ));
        assert!(text.contains("global @a : i32 = 1,"), "{text}");
        assert!(text.contains("global @b : i32 = 0,"), "{text}");
        assert!(text.contains("global @c : i32 = 0,"), "{text}");
        assert!(text.contains("global @d : i32 = -1,"), "{text}");
        assert!(text.contains("global @e : i32 = 0,"), "{text}");
        assert!(text.contains("global @g : i32 = 4,"), "{text}");
        assert!(text.contains("global @h : i32 = 2,"), "{text}");
        assert!(text.contains("global @i : i32 = 1,"), "{text}");
    }

    /// `fpclassify` refuses what gcc refuses, in gcc's words.
    ///
    /// The five answers have to be integer constant expressions, because what the builtin does is
    /// pick one of them and a pick between values that are not known here would be a chain of
    /// conditionals over expressions the call has already evaluated.
    #[test]
    fn fpclassify_refuses_an_answer_that_is_not_an_integer_constant() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let source = concat!(
            "int a(double x, int n) { return __builtin_fpclassify(0, 1, n, 3, 4, x); }\n",
            "int b(double x) { return __builtin_fpclassify(0, 1, 2, 3, x); }\n",
            "int c(int x) { return __builtin_fpclassify(0, 1, 2, 3, 4, x); }\n",
        );
        let messages = run(&opts, source).messages;
        assert_eq!(
            messages,
            [
                "/main.c:1:60: error: non-const integer argument 3 in call to function \
                 '__builtin_fpclassify' [E0687]",
                "/main.c:2:26: error: too few arguments to function '__builtin_fpclassify' \
                 [E0511]",
                "/main.c:3:23: error: non-floating-point argument in call to function \
                 '__builtin_fpclassify' [E0685]",
            ]
        );
    }

    /// A builtin whose answer is a constant is one, and is not a call to the library.
    ///
    /// This is the reason the family is answered in the front end at all. `double x =
    /// __builtin_inf();` at file scope initializes an object with static storage duration, so
    /// there is no point in the program at which a call could be made, and a compiler that
    /// lowered it to one would reject a program gcc accepts. Every number here is the encoding
    /// gcc 16 gives on x86-64.
    #[test]
    fn a_builtin_whose_answer_is_a_constant_is_one_and_not_a_call() {
        let text = ir(concat!(
            "double a = __builtin_inf();\n",
            "float b = __builtin_huge_valf();\n",
            "long double c = __builtin_infl();\n",
            "double d = __builtin_huge_val();\n",
        ));
        assert!(text.contains("global @a : f64 = 0x7ff0000000000000,"), "{text}");
        assert!(text.contains("global @b : f32 = 0x7f800000,"), "{text}");
        assert!(text.contains("f80 0x7fff8000000000000000"), "{text}");
        assert!(text.contains("global @d : f64 = 0x7ff0000000000000,"), "{text}");
        assert!(!text.contains("call"), "{text}");
    }

    /// A nan is written with the payload the program asked for.
    ///
    /// The string is read the way `strtoull` reads a number, which is what the library function
    /// of the same name does with it, and a string that is not one at all leaves the call for the
    /// library to answer at run time. A quiet nan has the high fraction bit set and a signalling
    /// one does not, except that a signalling nan with nothing in it would be an infinity, so it
    /// gets the next bit down instead. Every encoding here was measured against gcc 16, the two
    /// `long double` ones on a machine with the x87 format.
    #[test]
    fn a_nan_is_written_with_the_payload_the_program_asked_for() {
        let text = ir(concat!(
            "double a = __builtin_nan(\"\");\n",
            "double b = __builtin_nan(\"0x1\");\n",
            // Octal, since there is a leading zero, so this is eight and not ten.
            "double c = __builtin_nan(\"010\");\n",
            "double d = __builtin_nans(\"\");\n",
            "double e = __builtin_nans(\"0x1\");\n",
            "float f = __builtin_nanf(\"0x1\");\n",
            "float g = __builtin_nansf(\"\");\n",
            "long double h = __builtin_nansl(\"\");\n",
        ));
        assert!(text.contains("global @a : f64 = 0x7ff8000000000000,"), "{text}");
        assert!(text.contains("global @b : f64 = 0x7ff8000000000001,"), "{text}");
        assert!(text.contains("global @c : f64 = 0x7ff8000000000008,"), "{text}");
        assert!(text.contains("global @d : f64 = 0x7ff4000000000000,"), "{text}");
        assert!(text.contains("global @e : f64 = 0x7ff0000000000001,"), "{text}");
        assert!(text.contains("global @f : f32 = 0x7fc00001,"), "{text}");
        assert!(text.contains("global @g : f32 = 0x7fa00000,"), "{text}");
        assert!(text.contains("f80 0x7fffa000000000000000"), "{text}");

        // A payload that is not a number, and one that is not known until run time, are both
        // left to the library, which is the same thing gcc emits for either of them.
        let text = ir(concat!(
            "double f(const char *p) { return __builtin_nan(p); }\n",
            "double g(void) { return __builtin_nans(\"1x\"); }\n",
        ));
        assert_eq!(text.matches("call @nan(").count(), 1, "{text}");
        assert_eq!(text.matches("call @nans(").count(), 1, "{text}");
    }

    /// The length and the order of a string literal are known here.
    ///
    /// A program that asks for either of them is asking about something the translation already
    /// has in front of it, and folding is not only an optimization: `execute/921007-1.c` in the
    /// torture suite calls `__builtin_strcmp` in a file that defines its own `strcmp` with a
    /// different signature, so leaving the call behind is a name collision that gcc does not
    /// have. The comparison is over `unsigned char`, which is why the second one is negative.
    #[test]
    fn the_length_and_the_order_of_a_string_literal_are_known_here() {
        let text = ir(concat!(
            "unsigned long a = __builtin_strlen(\"hello\");\n",
            "unsigned long b = __builtin_strlen(\"a\\0bc\");\n",
            "int c = __builtin_strcmp(\"X\", \"X\\376\") < 0;\n",
            "int d = __builtin_strcmp(\"abc\", \"abc\");\n",
            "int e = __builtin_strcmp(\"abc\", \"ab\") > 0;\n",
        ));
        assert!(text.contains("global @a : i64 = 5,"), "{text}");
        assert!(text.contains("global @b : i64 = 1,"), "{text}");
        assert!(text.contains("global @c : i32 = 1,"), "{text}");
        assert!(text.contains("global @d : i32 = 0,"), "{text}");
        assert!(text.contains("global @e : i32 = 1,"), "{text}");
        assert!(!text.contains("call"), "{text}");

        // An argument that is not a literal is the library's to answer, as it has to be.
        let text = ir("unsigned long f(const char *p) { return __builtin_strlen(p); }\n");
        assert!(text.contains("call @strlen("), "{text}");
    }

    /// A sign builtin is a mask over the bits, and is not a call.
    ///
    /// `fabs` and `copysign` are in the math library rather than the C one, so a program that
    /// only ever wrote the prefixed spelling never asked for `-lm` and a call left behind here
    /// would not link. Neither needs anything the library has: one clears the sign bit and the
    /// other takes it from the second operand, and every other bit goes through untouched.
    #[test]
    fn a_sign_builtin_is_a_mask_over_the_bits_and_not_a_call() {
        let text = body("double f(double x) { return __builtin_fabs(x); }\n");
        assert!(text.contains("bitcast.i64 %0"), "{text}");
        assert!(text.contains("iconst.i64 9223372036854775807"), "{text}");
        assert!(text.contains("and %1, %2"), "{text}");
        assert!(text.contains("bitcast.f64 %3"), "{text}");
        assert!(!text.contains("call"), "{text}");

        let text = body("double f(double x, double y) { return __builtin_copysign(x, y); }\n");
        assert!(text.contains("iconst.i64 -9223372036854775808"), "{text}");
        assert!(text.contains("%8 = or %4, %7"), "{text}");
        assert!(!text.contains("call"), "{text}");

        // The x87 format, whose value is eighty bits sitting in an object of sixteen. The mask is
        // as wide as the value and not as wide as the object, so the padding is not part of it.
        let text = body("long double f(long double x) { return __builtin_fabsl(x); }\n");
        assert!(text.contains("bitcast.i80 %0"), "{text}");
        assert!(text.contains("bitcast.f80"), "{text}");

        // The width a name does not spell out is `double`, so a `float` argument widens first and
        // the answer is a `double`, which is what gcc's declaration of it says.
        let text = body("double f(float x) { return __builtin_fabs(x); }\n");
        assert!(text.contains("fpext.f64 %0"), "{text}");
        assert!(text.contains("bitcast.i64 %1"), "{text}");
    }

    /// The plain math library names are the same mask, which is what makes a program link.
    ///
    /// `math.h` declares `fabs` and never spells `__builtin_fabs`, so the plain name is the one
    /// every program that includes the header reaches. Recognising only the prefixed spelling
    /// leaves a call to the math library behind, and the math library is not on the link line
    /// unless the program asked for `-lm`. parson is the project that shows it: its makefile has
    /// no `-lm`, it does not need one under gcc, and `undefined reference to 'fabs'` is where the
    /// build stopped. That is issue 630.
    #[test]
    fn the_plain_math_names_are_the_same_mask_and_not_a_call() {
        let text =
            body(concat!("double fabs(double x);\n", "double f(double x) { return fabs(x); }\n",));
        assert!(text.contains("iconst.i64 9223372036854775807"), "{text}");
        assert!(!text.contains("call"), "{text}");

        let text =
            body(concat!("float fabsf(float x);\n", "float f(float x) { return fabsf(x); }\n",));
        assert!(text.contains("bitcast.i32 %0"), "{text}");
        assert!(!text.contains("call"), "{text}");

        let text = body(concat!(
            "double copysign(double x, double y);\n",
            "double f(double x, double y) { return copysign(x, y); }\n",
        ));
        assert!(text.contains("iconst.i64 -9223372036854775808"), "{text}");
        assert!(!text.contains("call"), "{text}");

        let text = body(concat!(
            "float copysignf(float x, float y);\n",
            "float f(float x, float y) { return copysignf(x, y); }\n",
        ));
        assert!(!text.contains("call"), "{text}");

        // The `long double` pair is left alone on purpose. The prefixed spelling of both stops in
        // the back end with `no rule lowers a bitcast producing an i80`, so expanding the plain
        // name would trade a link error for a worse one. They go in with issue 540.
        let text = ir(concat!(
            "long double fabsl(long double x);\n",
            "long double f(long double x) { return fabsl(x); }\n",
        ));
        assert!(text.contains("call @fabsl"), "{text}");
    }

    /// A plain math name the program took is the program's own function.
    ///
    /// The same four ways as the absolute value family next door, asked again here because these
    /// two go through a different path: the plain names of this family are taken after the call
    /// has been checked against the declaration, and the declaration is the whole reason the
    /// question can be answered at all. Measured against gcc 16.2.0, which calls the program's
    /// function in every one of them.
    #[test]
    fn a_plain_math_name_the_program_took_is_the_programs_own_function() {
        let taken = concat!(
            "static double fabs(double b) { return 7; }\n",
            "double f(double x) { return fabs(x); }\n",
        );
        assert!(ir(taken).contains("call @fabs"), "a static definition is the program's own");

        let retyped = concat!("int fabs(int b);\n", "int f(int x) { return fabs(x); }\n");
        assert!(ir(retyped).contains("call @fabs"), "another type is another function");

        let plain = concat!("double fabs(double b);\n", "double f(double x) { return fabs(x); }\n");
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        assert!(!run(&opts, plain).text().contains("call @fabs"), "the library's by default");

        opts.builtins = false;
        assert!(run(&opts, plain).text().contains("call @fabs"), "-fno-builtin");

        opts.builtins = true;
        opts.no_builtin = vec!["fabs".to_owned()];
        assert!(run(&opts, plain).text().contains("call @fabs"), "-fno-builtin-fabs");
        let one = concat!(
            "double copysign(double a, double b);\n",
            "double f(double x) { return copysign(x, 1.0); }\n",
        );
        assert!(!run(&opts, one).text().contains("call @copysign"), "one name and not the family");

        // The prefixed spelling is untouched by any of it, which is what the prefix is for.
        opts.no_builtin = Vec::new();
        opts.builtins = false;
        let prefixed = "double f(double x) { return __builtin_fabs(x); }\n";
        assert!(!run(&opts, prefixed).text().contains("call @fabs"), "the prefix is not a library");
    }

    /// The sign builtins answer a zero and a nan the way the bits say.
    ///
    /// This is why they are described over the bits rather than written with comparisons and
    /// negation. A negative zero compares equal to a positive one and has a sign bit to clear,
    /// and a nan compares equal to nothing at all and keeps its payload through both operations.
    /// `execute/ieee/copysign1.c` in the torture suite is the test that notices, because it
    /// compares its answers with `memcmp`. Every number here is what gcc 16 gives, the two in the
    /// x87 format measured on a machine that has it.
    #[test]
    fn the_sign_builtins_answer_a_zero_and_a_nan_the_way_the_bits_say() {
        let text = ir(concat!(
            "double a = __builtin_fabs(-3.5);\n",
            "double b = __builtin_copysign(1.0, -0.0);\n",
            "double c = __builtin_copysign(0.0, -2.0);\n",
            // The payload survives both, and only the sign bit moves.
            "double d = __builtin_copysign(-__builtin_nan(\"\"), 1.0);\n",
            "double e = __builtin_fabs(-__builtin_nan(\"0x1\"));\n",
            "float g = __builtin_copysignf(-0.0f, 2.0f);\n",
            "long double h = __builtin_copysignl(1.0L, -1.0L);\n",
            "long double i = __builtin_fabsl(-__builtin_infl());\n",
        ));
        assert!(text.contains("global @a : f64 = 0x400c000000000000,"), "{text}");
        assert!(text.contains("global @b : f64 = 0xbff0000000000000,"), "{text}");
        assert!(text.contains("global @c : f64 = 0x8000000000000000,"), "{text}");
        assert!(text.contains("global @d : f64 = 0x7ff8000000000000,"), "{text}");
        assert!(text.contains("global @e : f64 = 0x7ff8000000000001,"), "{text}");
        assert!(text.contains("global @g : f32 = 0x0,"), "{text}");
        assert!(text.contains("f80 0xbfff8000000000000000"), "{text}");
        assert!(text.contains("f80 0x7fff8000000000000000"), "{text}");
    }

    /// The complex builtins are the halves of the value, and are not a call.
    ///
    /// `conj`, `creal` and `cimag` are `~`, `__real__` and `__imag__` under the names `complex.h`
    /// gives them, so there is nothing for the math library to do that the translation cannot do
    /// with the object in front of it. Leaving the call behind would not link either, since all
    /// three are in the math library and a program that wrote one never had a reason to ask for
    /// `-lm`. Measured against gcc 16.2.0, which emits no call for any of them even at `-O0`.
    #[test]
    fn the_complex_builtins_are_the_halves_of_the_value_and_not_a_call() {
        let text = body("double f(_Complex double z) { return __builtin_creal(z); }\n");
        assert!(!text.contains("call"), "{text}");
        let text = body("double f(_Complex double z) { return __builtin_cimag(z); }\n");
        assert!(!text.contains("call"), "{text}");

        // The conjugate is the imaginary half negated and the real half as it stands, so there is
        // one negation in it. A complex negation is the one with two.
        let text = body("_Complex double f(_Complex double z) { return __builtin_conj(z); }\n");
        assert_eq!(text.matches("fneg").count(), 1, "{text}");
        assert!(!text.contains("call"), "{text}");
        let negated = body("_Complex double f(_Complex double z) { return -z; }\n");
        assert_eq!(negated.matches("fneg").count(), 2, "{negated}");

        // `~` on a complex operand is the same operator, which is the spelling the language has
        // had all along and the one a program that never included the header writes.
        let written = body("_Complex double f(_Complex double z) { return ~z; }\n");
        assert_eq!(written, text, "the name and the operator are the same thing");

        // The plain names, which are the ones the header declares and so the ones programs write.
        let text = body(concat!(
            "double creal(_Complex double z);\n",
            "double f(_Complex double z) { return creal(z); }\n",
        ));
        assert!(!text.contains("call"), "{text}");
        let text = body(concat!(
            "_Complex float conjf(_Complex float z);\n",
            "_Complex float f(_Complex float z) { return conjf(z); }\n",
        ));
        assert_eq!(text.matches("fneg").count(), 1, "{text}");
        assert!(!text.contains("call"), "{text}");

        // A program that took the name means its own function, the same four ways the absolute
        // value family next door asks it.
        let taken = concat!(
            "static double creal(_Complex double z) { return 7; }\n",
            "double f(_Complex double z) { return creal(z); }\n",
        );
        assert!(ir(taken).contains("call @creal"), "a static definition is the program's own");
        let retyped = concat!("int cimag(int z);\n", "int f(int z) { return cimag(z); }\n");
        assert!(ir(retyped).contains("call @cimag"), "another type is another function");
        let plain = concat!(
            "double cimag(_Complex double z);\n",
            "double f(_Complex double z) { return cimag(z); }\n",
        );
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.builtins = false;
        assert!(run(&opts, plain).text().contains("call @cimag"), "-fno-builtin");
        opts.builtins = true;
        opts.no_builtin = vec!["cimag".to_owned()];
        assert!(run(&opts, plain).text().contains("call @cimag"), "-fno-builtin-cimag");

        // A constant folds, which is what a static initializer written with one needs.
        let text = ir(concat!(
            "double a = __builtin_creal(1.5 + 2.5i);\n",
            "double b = __builtin_cimag(1.5 + 2.5i);\n",
            "_Complex double c = __builtin_conj(1.5 + 2.5i);\n",
        ));
        assert!(text.contains("global @a : f64 = 0x3ff8000000000000,"), "{text}");
        assert!(text.contains("global @b : f64 = 0x4004000000000000,"), "{text}");
        assert!(
            text.contains("{ f64 0x3ff8000000000000, f64 0xc004000000000000 }"),
            "the conjugate of a constant is the constant with the second half negated: {text}"
        );
        assert!(!text.contains("call"), "{text}");
    }

    /// A math library builtin handed a constant is the answer, and is not a call.
    ///
    /// This is the reason the family is answered in the front end at all. `double x =
    /// __builtin_ceil(1.5);` at file scope initializes an object with static storage duration, so
    /// there is no point in the program at which a call could be made, and a compiler that lowered
    /// it to one would refuse a program gcc accepts. Every number here is the encoding gcc 16.2.0
    /// gives on x86-64, read out of the object file one initializer at a time.
    #[test]
    fn a_math_library_builtin_of_a_constant_is_the_answer_and_not_a_call() {
        let text = ir(concat!(
            "double a = __builtin_ceil(1.5);\n",
            "double b = __builtin_floor(1.5);\n",
            "double c = __builtin_trunc(-1.5);\n",
            // A half goes away from zero and not to even, which is where C and the default
            // rounding of IEEE 754 part company.
            "double d = __builtin_round(2.5);\n",
            // The sign survives a number that rounds away to nothing, so this is a negative zero.
            "double e = __builtin_ceil(-0.5);\n",
            "double f = __builtin_fmax(1.0, 2.0);\n",
            "double g = __builtin_fmin(1.0, 2.0);\n",
            "float h = __builtin_ceilf(1.25f);\n",
            // The plain name is the same answer, which is what a program that included `math.h`
            // and never wrote a prefix reaches.
            "double ceil(double x);\n",
            "double i = ceil(2.25);\n",
        ));
        assert!(text.contains("global @a : f64 = 0x4000000000000000,"), "{text}");
        assert!(text.contains("global @b : f64 = 0x3ff0000000000000,"), "{text}");
        assert!(text.contains("global @c : f64 = 0xbff0000000000000,"), "{text}");
        assert!(text.contains("global @d : f64 = 0x4008000000000000,"), "{text}");
        assert!(text.contains("global @e : f64 = 0x8000000000000000,"), "{text}");
        assert!(text.contains("global @f : f64 = 0x4000000000000000,"), "{text}");
        assert!(text.contains("global @g : f64 = 0x3ff0000000000000,"), "{text}");
        assert!(text.contains("global @h : f32 = 0x40000000,"), "{text}");
        assert!(text.contains("global @i : f64 = 0x4008000000000000,"), "{text}");
        assert!(!text.contains("call"), "{text}");
    }

    /// A math library builtin handed anything else is a call to the library function it is.
    ///
    /// gcc emits `jmp ceil` for `__builtin_ceil` on x86-64 at the default architecture, measured
    /// on gcc 16.2.0, and reaches the `roundsd` instruction only under `-msse4.1`. So the call is
    /// what a program gets from gcc too, and the name on it is the plain one, which is the whole
    /// point of the prefixed spelling: a program writing it reaches the library's function even
    /// where a macro or a definition of its own has taken the short name.
    #[test]
    fn a_math_library_builtin_of_anything_else_is_a_call_to_the_library() {
        let text = ir(concat!(
            "double f(double x) { return __builtin_ceil(x); }\n",
            "float g(float x) { return __builtin_floorf(x); }\n",
            "double h(double x, double y) { return __builtin_fmax(x, y); }\n",
        ));
        assert!(text.contains("call @ceil("), "{text}");
        assert!(text.contains("call @floorf("), "{text}");
        assert!(text.contains("call @fmax("), "{text}");

        // The two the rounding mode decides are calls even when the argument is a constant, since
        // what they answer is not known until the program runs. gcc refuses a static initializer
        // written with one for that reason, so there is nothing to fold here either.
        let text = ir(concat!(
            "double f(void) { return __builtin_rint(2.5); }\n",
            "double g(void) { return __builtin_nearbyint(2.5); }\n",
        ));
        assert!(text.contains("call @rint("), "{text}");
        assert!(text.contains("call @nearbyint("), "{text}");

        // A nan operand is the library's rule rather than the machine's, 7.12.12.2 saying the
        // answer is the other operand, and gcc will not fold that one either.
        let text = ir("double f(void) { return __builtin_fmin(__builtin_nan(\"\"), 1.0); }\n");
        assert!(text.contains("call @fmin("), "{text}");

        // `-fno-builtin-ceil` is a program saying it means its own `ceil`, and it leaves the
        // prefixed spelling alone, which is what writing the prefix is for.
        let plain = concat!("double ceil(double x);\n", "double f(void) { return ceil(2.25); }\n");
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.no_builtin = vec!["ceil".to_owned()];
        assert!(run(&opts, plain).text().contains("call @ceil("), "-fno-builtin-ceil");
    }

    /// A `constexpr` object is a named constant, which is the whole reason the keyword exists.
    ///
    /// C23 6.6p8 puts two of them on the list an integer constant expression is built from: one
    /// of an arithmetic type, and a member of one of a structure or union type. A subscript of
    /// one is not on the list and is a variably modified type in gcc 16 as well, and every
    /// number here is what gcc 16 gives on x86-64.
    #[test]
    fn a_constexpr_object_is_a_constant_wherever_one_is_required() {
        let text = ir(concat!(
            "constexpr int side = 4;\n",
            "constexpr int wider = side + 1;\n",
            "constexpr double half = 1.5;\n",
            "struct point { int x; int y; };\n",
            "constexpr struct point origin = { 5, 6 };\n",
            "int square[side * side];\n",
            "int rectangle[wider];\n",
            "int rounded[(int)half * 2];\n",
            "int across[origin.y];\n",
            "enum named { four = side };\n",
            "int e = four;\n",
        ));
        assert!(text.contains("global @square : bytes 64 ="), "{text}");
        assert!(text.contains("global @rectangle : bytes 20 ="), "{text}");
        assert!(text.contains("global @rounded : bytes 8 ="), "{text}");
        assert!(text.contains("global @across : bytes 24 ="), "{text}");
        assert!(text.contains("global @e : i32 = 4,"), "{text}");

        // A `const` object is not one of them, which is what makes `int a[n];` a variable
        // length array in C and is the distinction the keyword was added to draw.
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let konst = "const int n = 1;\nint a[n];\n";
        let message = "/main.c:2:5: error: variably modified 'a' at file scope [E0538]";
        assert_eq!(run(&opts, konst).messages, [message]);

        // Nor is a subscript of one, which gcc 16 refuses in the same words.
        let subscript = "constexpr int t[3] = { 1, 2, 3 };\nint a[t[1]];\n";
        assert_eq!(run(&opts, subscript).messages, [message]);

        // And `constexpr` implies `const`, so the address of one is an address of a `const`.
        let address = "constexpr int c = 3;\nint *p = &c;\n";
        let warning = "/main.c:2:6: warning: initialization discards 'const' qualifier from \
             pointer target type [E0514]";
        assert_eq!(run(&opts, address).messages, [warning]);
    }

    /// A definition that names its parameters and then declares them under the list.
    ///
    /// The declarations say what the types are, 6.9.1p6, and what the function takes is those
    /// types with the default argument promotions over them, which is what a caller of an
    /// unprototyped function hands over. A prototype already in scope overrules the promoted
    /// types, since a header saying `int narrow(char);` over a definition written this way is
    /// the pairing all the code written this way relies on and 6.7.6.3p15 is read that way by
    /// every compiler.
    #[test]
    fn an_old_style_definition_takes_its_types_from_the_declarations_under_its_list() {
        // C17, since the default dialect is the one that warns about the form and this is
        // about what it means rather than about the warning.
        let mut opts = options();
        opts.std = Std::C17;
        let source = concat!(
            "int add(a, b)\n",
            "int a;\n",
            "int b;\n",
            "{ return a + b; }\n",
            "int promoted(c)\n",
            "char c;\n",
            "{ return c; }\n",
            "int narrow(char);\n",
            "int narrow(c)\n",
            "char c;\n",
            "{ return c; }\n",
            "int first(a)\n",
            "int a[4];\n",
            "{ return a[0]; }\n",
        );
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to compile:\n{source}");
        let text = result.text();
        assert!(text.contains("add : int(int, int) function external defined"), "{text}");
        assert!(text.contains("promoted : int(int) function external defined"), "{text}");
        // The body still sees the `char` it was declared as, whatever the caller hands over.
        assert!(text.contains("c : char object automatic defined"), "{text}");
        assert!(text.contains("narrow : int(char) function external defined"), "{text}");
        // An array parameter is a pointer here as much as it is in a prototype.
        assert!(text.contains("first : int(int *) function external defined"), "{text}");
    }

    /// What the two halves of an old-style parameter list can disagree about.
    ///
    /// Each of these is a sentence gcc 16 has, and every message below is the one it prints,
    /// read off it on x86-64 rather than reasoned about. The last two are the dialect: a name
    /// with no declaration is an `int` in C89 and a diagnostic from C99 on, and the whole form
    /// left the language in C23, where gcc still takes it and warns.
    #[test]
    fn the_two_halves_of_an_old_style_parameter_list_have_to_agree() {
        let mut opts = options();
        opts.std = Std::C17;
        for (source, message) in [
            ("int f(a, a)\nint a;\n{ return a; }\n", "1:10: error: multiple parameters named 'a'"),
            (
                "int f(a)\nint a;\nint b;\n{ return a; }\n",
                "3:5: error: declaration for parameter 'b' but no such parameter",
            ),
            ("int f(a)\nint a;\nint a;\n{ return a; }\n", "3:5: error: redefinition of parameter"),
            ("int f(a)\nint a = 1;\n{ return a; }\n", "2:5: error: parameter 'a' is initialized"),
            (
                "int f(a)\nstatic int a;\n{ return a; }\n",
                "2:12: error: storage class specified for parameter 'a'",
            ),
            (
                "int f(char);\nint f(a)\nshort a;\n{ return a; }\n",
                "2:7: error: argument 'a' doesn't match prototype",
            ),
        ] {
            let result = run(&opts, source);
            assert!(result.failed(), "expected this to fail:\n{source}");
            assert!(result.messages[0].contains(message), "{:?}", result.messages);
        }

        // A name the declarations never mention. C89 gave it an `int` and gcc still takes it
        // in that dialect, and every dialect after it made the same line a diagnostic.
        let implicit = "int f(a, b)\nint a;\n{ return a + b; }\n";
        let mut older = options();
        older.std = Std::C89;
        assert!(!run(&older, implicit).failed(), "{:?}", run(&older, implicit).messages);
        let result = run(&opts, implicit);
        assert!(
            result.messages[0].contains("1:10: error: type of 'b' defaults to 'int'"),
            "{:?}",
            result.messages
        );

        // C23 took the form out of the language and gcc kept accepting it with a warning, and
        // a warning is what this is, because the code written this way is not going to be
        // rewritten and refusing it would put the compiler out of reach of it.
        let mut newer = options();
        newer.std = Std::C23;
        let plain = "int f(a)\nint a;\n{ return a; }\n";
        let result = run(&newer, plain);
        assert!(!result.failed(), "{:?}", result.messages);
        assert_eq!(
            result.messages,
            ["/main.c:1:5: warning: old-style function definition [E0412]"]
        );
        assert!(run(&opts, plain).messages.is_empty(), "and nothing to say in the dialects before");
    }

    /// The two obsolete designators, which are silent until `-pedantic` asks about them.
    ///
    /// `[3] 7` is what GCC had for an array before C99 settled on `[3] = 7`, and `x: 7` is the
    /// same era's spelling for a member. Both are still in code written against a compiler of
    /// that era, and gcc 16 takes both without a word unless it is asked to be pedantic, which
    /// is where the columns below come from as well.
    #[test]
    fn the_obsolete_designators_are_taken_and_are_pedantic_warnings() {
        let array = "int a[8] = { [3] 7 };\n";
        let member = "struct s { int x; } v = { x: 7 };\n";
        for source in [array, member] {
            let result = run(&options(), source);
            assert!(!result.failed(), "{:?}", result.messages);
            assert!(result.messages.is_empty(), "nothing to say: {:?}", result.messages);
        }

        let mut asked = options();
        asked.pedantic = true;
        assert_eq!(
            run(&asked, array).messages,
            ["/main.c:1:18: warning: obsolete designator, write `[i] =` instead [E0415]"]
        );
        assert_eq!(
            run(&asked, member).messages,
            ["/main.c:1:27: warning: obsolete designator, write `.field =` instead [E0413]"]
        );
    }

    /// A type nothing is ever an object of is a type `sizeof` still has to answer about, which
    /// is what `991014-1.c` in the gcc.c-torture execution suite asks.
    ///
    /// The limit is `PTRDIFF_MAX` and it is the same one for an array and for a record, so a
    /// record of every byte an object may have is laid out and one byte more is refused. All
    /// four numbers are what gcc 16 gives on x86-64.
    #[test]
    fn a_type_is_refused_when_it_passes_the_largest_object_and_not_before() {
        let text = ir(concat!(
            "struct huge_struct { short buf[(1L << 62) - 256]; int a, b, c, d; };\n",
            "struct brim { char buf[9223372036854775807L]; };\n",
            "struct bitty { char buf[9223372036854775800L]; int x : 1; };\n",
            "unsigned long h = sizeof(struct huge_struct);\n",
            "unsigned long b = sizeof(struct brim);\n",
            "unsigned long y = sizeof(struct bitty);\n",
        ));
        assert!(text.contains("global @h : i64 = 9223372036854775312,"), "{text}");
        assert!(text.contains("global @b : i64 = 9223372036854775807,"), "{text}");
        assert!(text.contains("global @y : i64 = 9223372036854775804,"), "{text}");

        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let over = "struct over { char buf[9223372036854775800L]; char x[8]; };\n";
        let message = "/main.c:1:1: error: type 'struct over' is too large [E0560]";
        assert_eq!(run(&opts, over).messages, [message]);
        let array = "struct wide { short buf[1L << 62]; };\n";
        let message = "/main.c:1:25: error: size of array 'buf' exceeds \
             maximum object size '9223372036854775807' [E0537]";
        assert_eq!(run(&opts, array).messages[0], message);
    }

    /// A byte in the source that is not part of a character, which only a literal may hold.
    ///
    /// The source cannot be a `&str` here, which is the whole point: a file is bytes and only
    /// mostly text.
    fn compile_bytes(source: &[u8]) -> Compiled {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let mut fs = MemoryFileSystem::new();
        fs.insert("/main.c", source.to_vec());
        compile(&opts, "/main.c", &fs)
    }

    /// A raw byte inside a string literal is that byte, which gcc has always taken and which is
    /// the only place in a source file where a byte does not have to be part of a character.
    /// Replacing it would give the object three bytes rather than one, since the replacement
    /// character is three bytes of UTF-8, so the object would not be the one that was written
    /// even where the diagnostic is ignored. Anywhere else the byte is still a mistake, which
    /// is where gcc draws the same line.
    #[test]
    fn a_byte_that_is_not_a_character_is_kept_in_a_literal_and_refused_outside_one() {
        let mut source = b"char s[] = \"a".to_vec();
        source.push(0xff);
        source.extend_from_slice(b"b\";\nchar c = '");
        source.push(0xff);
        source.extend_from_slice(b"';\n");
        let result = compile_bytes(&source);
        assert_eq!(result.messages, Vec::<String>::new(), "a raw byte in a literal is that byte");
        assert!(result.text().contains(r#"bytes "a\ffb\00""#), "{}", result.text());
        // Plain `char` is signed on this target, so the constant is minus one rather than 255.
        assert!(result.text().contains("global @c : i8 = -1,"), "{}", result.text());

        let mut stray = b"int a".to_vec();
        stray.push(0xff);
        stray.extend_from_slice(b" = 1;\n");
        let result = compile_bytes(&stray);
        assert!(
            result.messages.iter().any(|m| m.contains("source is not valid UTF-8 here")),
            "{:?}",
            result.messages
        );
    }

    #[test]
    fn an_object_becomes_a_global_with_an_image_and_a_function_becomes_a_func() {
        let text = ir("int x = 7;\nint add(int a, int b) { return a + b; }\n");
        assert!(text.contains("global @x : i32 = 7, align 4, linkage(external)\n"), "{text}");
        let expected = "\
func @add(i32, i32) -> i32, linkage(external) {
block0(%0: i32, %1: i32):
    %2 = add.nsw %0, %1
    return %2
}
";
        assert!(text.contains(expected), "{text}");
    }

    #[test]
    fn a_local_nothing_takes_the_address_of_is_a_value_and_never_a_stack_slot() {
        let text = body("int f(int n) { int a = n + 1; int b = a * 2; return a + b; }\n");
        assert!(!text.contains("alloca"), "{text}");
        assert!(!text.contains("load"), "{text}");
        assert!(!text.contains("store"), "{text}");
    }

    #[test]
    fn a_local_whose_address_is_taken_gets_a_slot_in_the_entry_block() {
        let text = body("int g(int *);\nint f(void) { int a = 1; return g(&a); }\n");
        let expected = "\
block0:
    %0 = alloca, size 4, align 4
    %1 = iconst.i32 1
    store %1 -> %0, align 4, tbaa !1
    %2 = call @g(%0) : (ptr) -> i32
    return %2
";
        assert_eq!(text, expected);
    }

    #[test]
    fn a_loop_carries_what_it_changes_as_block_parameters() {
        // The whole point of building SSA during the walk rather than after it: `i` and
        // `total` are values that arrive on an edge, and neither has ever been in memory.
        let text = body(
            "int f(int n) {\n  int total = 0;\n  for (int i = 0; i < n; i++) total += i;\n  \
             return total;\n}\n",
        );
        assert!(!text.contains("alloca"), "{text}");
        assert!(text.contains("block1(%3: i32, %4: i32):"), "{text}");
        assert!(text.contains("jump block1("), "{text}");
    }

    #[test]
    fn a_comparison_used_as_a_condition_is_not_widened_and_narrowed_again() {
        let text = body("int f(int a, int b) { if (a < b) return 1; return 0; }\n");
        assert!(text.contains("icmp slt %0, %1"), "{text}");
        assert!(!text.contains("zext"), "{text}");
    }

    #[test]
    fn the_right_side_of_a_short_circuit_is_in_a_block_of_its_own() {
        let text = body("int f(int a, int b) { return a && b; }\n");
        let expected = "\
block0(%0: i32, %1: i32):
    %2 = iconst.i32 0
    %3 = icmp ne %0, %2
    %4 = iconst.i1 0
    br_if %3, block1, block2(%4)

block1:
    %5 = iconst.i32 0
    %6 = icmp ne %1, %5
    jump block2(%6)

block2(%7: i1):
    %8 = zext.i32 %7
    return %8
";
        assert_eq!(text, expected);
    }

    #[test]
    fn code_after_a_return_is_not_built_and_does_not_leave_an_empty_block_behind() {
        let text = body("int f(int a) { if (a) return 1; else return 2; return 3; }\n");
        // Three blocks, the test and the two arms. The join the `return 3` would need is
        // never created, because a block nothing branches to is not a block.
        assert!(!text.contains("block3"), "{text}");
        assert!(!text.contains("iconst.i32 3"), "{text}");
    }

    #[test]
    fn falling_off_the_end_returns_zero_from_main_and_nothing_from_a_void_function() {
        assert!(body("int main(void) { }\n").contains("iconst.i32 0\n    return"));
        assert_eq!(body("void f(void) { }\n"), "block0:\n    return\n");
        assert!(body("int f(void) { }\n").contains("unreachable"));
    }

    #[test]
    fn a_structure_is_copied_rather_than_held_in_a_value() {
        let text = body(
            "struct point { int x, y; };\n\
             int f(void) { struct point p = { 1, 2 }; struct point q = p; return q.x; }\n",
        );
        assert!(text.contains("memcpy"), "{text}");
    }

    #[test]
    fn an_initializer_that_leaves_part_of_an_object_unwritten_zeroes_it_first() {
        let text = body("int f(void) { int a[4] = { 1 }; return a[3]; }\n");
        assert!(text.contains("memset"), "{text}");
    }

    #[test]
    fn a_switch_is_one_branch_and_a_case_that_falls_through_carries_what_it_wrote() {
        let text = body(
            "int f(int x) { int r = 0; switch (x) { case 1: r = 1; case 2: r += 2; break; \
             default: r = 4; } return r; }\n",
        );
        let expected = "\
block0(%0: i32):
    %1 = iconst.i32 0
    switch %0, block1, [1 => block2, 2 => block3(%1)]

block1:
    %2 = iconst.i32 4
    jump block4(%2)

block2:
    %3 = iconst.i32 1
    jump block3(%3)

block3(%4: i32):
    %5 = iconst.i32 2
    %6 = add.nsw %4, %5
    jump block4(%6)

block4(%7: i32):
    return %7
";
        assert_eq!(text, expected);
    }

    #[test]
    fn a_case_range_is_tested_for_rather_than_put_in_the_table() {
        // GNU's `case 1 ... 9`. Nine table entries would be nine here and four billion for the
        // range a program is allowed to write, so it is a subtraction and one unsigned compare.
        let text = body("int f(int x) { switch (x) { case 1 ... 9: return 1; } return 0; }\n");
        assert!(text.contains("%2 = sub %0, %1"), "{text}");
        assert!(text.contains("icmp ule"), "{text}");
        assert!(!text.contains("switch"), "{text}");
    }

    #[test]
    fn break_leaves_the_switch_and_continue_leaves_the_loop_around_it() {
        let text = body(
            "int f(int n) { int t = 0; for (int i = 0; i < n; i++) { switch (i) { \
             case 0: continue; case 1: break; default: t += i; } t++; } return t; }\n",
        );
        // The `continue` goes to the step and the `break` goes to the `t++` after the switch,
        // which is also where the default falls out to.
        assert!(text.contains("switch %3, block4, [0 => block5, 1 => block6]"), "{text}");
        assert!(text.contains("block5:\n    jump block7("), "{text}");
        assert!(text.contains("block6:\n    jump block8("), "{text}");
    }

    #[test]
    fn a_switch_with_nothing_to_branch_on_still_runs_what_comes_after_it() {
        assert_eq!(body("void f(int x) { switch (x) { } }\n"), "block0(%0: i32):\n    return\n");
    }

    #[test]
    fn a_label_a_loop_is_only_entered_through_builds_the_loop_around_it() {
        // A branch into the middle of a loop that nothing else reaches, the Duff's device shape.
        // The `while` is not reached in order, so the walk starts a block nothing branches to and
        // builds it from there. What comes out is the loop with an edge straight into its body,
        // and the header that nothing arrives at is pruned.
        let text = body(
            "int f(int x, int n) { switch (x) { case 1: break; while (n) { case 2: n--; } } \
             return n; }\n",
        );
        // `case 2` lands on the body, `case 1` and the default land on the return, and the test
        // at the bottom of the loop comes back round to the body.
        assert!(text.contains("switch %0, block1(%1), [1 => block2, 2 => block3(%1)]"), "{text}");
        assert!(text.contains("block3(%3: i32):\n    %4 = iconst.i32 1"), "{text}");
        assert!(text.contains("block4:\n    jump block3("), "{text}");
    }

    #[test]
    fn a_goto_into_a_loop_body_enters_it_without_the_test() {
        // The same thing through a `goto`. The first pass through the body runs whatever the
        // label is on, and only then does the loop reach its own test.
        let text = body("int f(int x, int n) { goto in; while (n) { in: n--; } return n; }\n");
        assert!(text.starts_with("block0(%0: i32, %1: i32):\n    jump block1(%1)"), "{text}");
        assert!(text.contains("block1(%2: i32):\n    %3 = iconst.i32 1"), "{text}");
        assert!(text.contains("br_if %6, block2, block3"), "{text}");
    }

    #[test]
    fn a_goto_is_a_jump_to_the_block_the_label_starts() {
        let text = body("int f(int x) { int r = 0; if (x) goto out; r = 1; out: return r; }\n");
        // Both edges into `out` carry what `r` holds on the way, and neither is a stack slot. The
        // block the `goto` jumps out of is empty and hands its edge on, which is what moves `out`
        // up the block list to second place.
        assert!(!text.contains("alloca"), "{text}");
        assert!(text.contains("block2(%4: i32):\n    return %4"), "{text}");
        assert_eq!(text.matches("jump block2(").count(), 2, "{text}");
    }

    #[test]
    fn a_backward_goto_is_a_loop_and_carries_what_it_changes() {
        let text =
            body("int f(int n) { int i = 0; again: if (i < n) { i++; goto again; } return i; }\n");
        assert!(!text.contains("alloca"), "{text}");
        assert!(text.contains("block1(%2: i32):"), "{text}");
        assert!(text.contains("jump block1(%5)"), "{text}");
    }

    #[test]
    fn a_label_nothing_reaches_is_taken_out_rather_than_left_for_the_verifier() {
        // A block nothing branches to is not a legal function, and which labels are dead is not
        // known until the last statement has been walked, since the `goto` is allowed to be it.
        assert_eq!(
            body("int f(int x) { return x; spare: return 0; }\n"),
            "block0(%0: i32):\n    return %0\n"
        );
    }

    #[test]
    fn a_bit_field_is_read_by_loading_the_bytes_it_lies_in_and_shifting() {
        let text = body(
            "struct s { unsigned a : 3; signed b : 5; };\nint f(struct s *p) { return p->b; }\n",
        );
        // One byte holds both fields, and the signed one needs no mask: shifting it down
        // arithmetically is what says its top bit is a sign.
        assert_eq!(
            text,
            "\
block0(%0: ptr):
    %1 = load.i8 %0, align 1
    %2 = iconst.i8 3
    %3 = ashr %1, %2
    %4 = sext.i32 %3
    return %4
"
        );
    }

    #[test]
    fn a_store_to_a_bit_field_does_not_write_a_byte_it_has_no_bit_in() {
        // C11 says an ordinary member beside a bit-field is a memory location of its own, so
        // the four byte store this would take is a data race in a program that has none. The
        // three bytes of `a` go in as two and one, and `c` is not touched.
        let text =
            body("struct s { int a : 24; char c; };\nvoid f(struct s *p, int v) { p->a = v; }\n");
        assert_eq!(
            text,
            "\
block0(%0: ptr, %1: i32):
    %2 = iconst.i32 16777215
    %3 = and %1, %2
    %4 = trunc.i16 %3
    store %4 -> %0, align 2
    %5 = iconst.i32 16
    %6 = lshr %3, %5
    %7 = trunc.i8 %6
    %8 = iconst.i64 2
    %9 = ptr_add %0, %8
    store %7 -> %9, align 1
    return
"
        );
    }

    #[test]
    fn what_an_assignment_to_a_bit_field_is_worth_is_what_fits_in_it() {
        let text =
            body("struct s { unsigned b : 5; };\nunsigned f(struct s *p) { return p->b = 33; }\n");
        // 33 does not fit in five bits, and 1 is both what goes in the field and what the
        // assignment is worth.
        assert!(text.contains("%3 = iconst.i8 31\n    %4 = and %2, %3"), "{text}");
        assert!(text.ends_with("%9 = zext.i32 %4\n    return %9\n"), "{text}");
    }

    #[test]
    fn an_assignment_a_statement_throws_away_builds_none_of_what_it_is_worth() {
        // The value of an assignment to a bit-field takes a shift to build, and a statement
        // has no use for it. Nothing here reads back what was stored.
        let text = body("struct s { signed b : 5; };\nvoid f(struct s *p) { p->b = 3; }\n");
        assert_eq!(text.matches("ashr").count(), 0, "{text}");
        assert!(text.ends_with("store %8 -> %0, align 1\n    return\n"), "{text}");
    }

    #[test]
    fn a_bit_field_in_an_initializer_goes_in_over_bytes_that_were_zeroed_first() {
        // A bit-field writes part of a byte and leaves the rest of it alone, so the object has
        // to be zero before it goes in or what the initializer did not name is whatever the
        // stack held.
        let text = body(
            "struct s { int a : 3; int b; };\nint f(void) { struct s v = { 1 }; return v.b; }\n",
        );
        assert!(text.contains("memset %0, %1, size 8, align 4"), "{text}");
    }

    #[test]
    fn the_image_of_a_static_bit_field_is_the_bytes_the_fields_share() {
        // Two fields in one byte are not two entries in the image, because an image is written
        // in bytes: they are the byte they are both in.
        let text = ir("struct s { unsigned a : 3; unsigned b : 5; } g = { 1, 2 };\n");
        assert!(
            text.contains("global @g : bytes 4 = { bytes \"\\11\", zero 3 }, align 4"),
            "{text}"
        );
    }

    #[test]
    fn an_initialized_flexible_array_member_makes_the_object_larger_than_its_type() {
        // `sizeof` answers without the array and the definition has to hold what was written, so
        // the object is the size of its image. gcc 16 gives these four, three and two bytes and
        // so does this. The image used to be written at the size the type had, which left the
        // verifier looking at twenty bytes going into four.
        let text = ir(concat!(
            "struct a { int i; int j[]; } x = { 1, { 2, 0, 2, 3 } };\n",
            "struct b { char c; char p[]; } y = { 'o', \"wx\" };\n",
            "struct c { char c; char p[]; } z = { '9', { 'e', 'b' } };\n",
            "char s[2] = \"hi\";\n",
        ));
        assert!(
            text.contains("global @x : bytes 20 = { i32 1, i32 2, i32 0, i32 2, i32 3 }"),
            "{text}"
        );
        assert!(text.contains("global @y : bytes 4 = { i8 111, bytes \"wx\\00\" }"), "{text}");
        assert!(text.contains("global @z : bytes 3 = { i8 57, i8 101, i8 98 }"), "{text}");
        // The array with a length of its own still cuts the literal down to it, which is the
        // one case in C where a string initializer drops its terminator.
        assert!(text.contains("global @s : bytes 2 = { bytes \"hi\" }"), "{text}");
    }

    #[test]
    fn a_definition_takes_a_parameter_it_left_unnamed() {
        // The entry block's parameters are the definition's, and one the front end dropped for
        // having no name left the two lists different lengths, which the walk read as an
        // old-style definition and refused. gcc has taken these for far longer than C23 has.
        let text = ir("int f(int a, int) { return a; }\n");
        assert!(text.contains("func @f(i32, i32) -> i32"), "{text}");
        assert!(text.contains("block0(%0: i32, %1: i32):"), "{text}");

        // The unnamed one first, so that the named one is the second parameter of the entry
        // block and not the first: the list says the order and not only how many there are.
        let text = ir("int g(int, int n) { return n; }\n");
        assert!(text.contains("block0(%0: i32, %1: i32):\n    return %1\n"), "{text}");
    }

    #[test]
    fn an_assignment_of_a_structure_is_the_object_it_wrote() {
        // `d = e = c` used to be refused, because the middle assignment is a value of structure
        // type and the walk had nowhere to read one from. What an assignment is worth is the
        // value it stored, so the object it stored into is the answer and the chain is three
        // copies out of the one source with no temporary in it.
        let text = body(concat!(
            "struct s { int f; int g; };\n",
            "void h(struct s *a, struct s *c, struct s *d, struct s *e)\n",
            "{ *d = *e = a[0] = *c; }\n",
        ));
        assert_eq!(text.matches("memcpy").count(), 3, "{text}");
        assert!(text.contains("memcpy %8, %1, size 8, align 4\n"), "{text}");
        assert!(text.contains("memcpy %3, %8, size 8, align 4\n"), "{text}");
        assert!(text.contains("memcpy %2, %3, size 8, align 4\n"), "{text}");
    }

    #[test]
    fn a_string_literal_stops_at_the_end_of_the_array_it_is_filling() {
        // The excess used to be laid into the object anyway, so the row after was written over
        // and the image refused the entry that came to it. C 6.7.10p14 says the terminator goes
        // in only if there is room for it, and gcc discards the rest of a literal that is longer
        // still, which is what the first of these is and why it warns.
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let result = run(
            &opts,
            concat!(
                "const char a[2][3] = { \"1234\", \"xyz\" };\n",
                "static const char b[3][5] = { \"12345\", \"678\", \"9\" };\n",
                "union u { struct { char x[4]; char y[4]; }; struct { char z[8]; }; };\n",
                "const union u c = { { \"1234\", \"567\" } };\n",
            ),
        );
        let text = result.text();
        assert_eq!(
            result.messages,
            ["/main.c:1:24: warning: initializer-string for array of 'const char' is too long \
              (5 chars into 3 available) [E0637]"]
        );
        assert!(text.contains("global @a : bytes 6 = { bytes \"123\", bytes \"xyz\" }"), "{text}");
        assert!(
            text.contains(
                "global @b : bytes 15 = { bytes \"12345\", bytes \"678\\00\", zero 1, \
                 bytes \"9\\00\", zero 3 }"
            ),
            "{text}"
        );
        // The eight bytes are four, three and a terminator, and then the byte the shorter
        // literal left for the string in the other member of the union to end at.
        assert!(
            text.contains("global @c : bytes 8 = { bytes \"1234\", bytes \"567\\00\" }"),
            "{text}"
        );
    }

    #[test]
    fn a_cast_of_a_record_to_its_own_type_is_the_object_that_was_cast() {
        // gcc accepts one and does nothing with it, which sema already had. Lowering asked for
        // the object under it and had no arm for a cast, so `(struct s)x` in an initializer was
        // refused with E0519. It is one copy out of the object named, not two.
        let text = body(concat!(
            "struct s { int a, b; };\nstruct v { struct s s; int t; };\n",
            "void g(struct v *);\n",
            "void f(struct s *p) { struct v w = { (struct s)*p, 5 }; g(&w); }\n",
        ));
        assert_eq!(text.matches("memcpy").count(), 1, "{text}");
    }

    #[test]
    fn a_compound_literal_read_in_a_static_initializer_lays_its_bytes_into_the_image() {
        // C 6.7.11p4 says a compound literal at file scope has static storage duration, which
        // makes it a constant element, and tcc and c-testsuite both write one. Sema used to call
        // it a non constant because reading it is a node of its own and the read was what it
        // looked at, and lowering had no way to put an object where it wanted a number.
        let text = ir(concat!(
            "struct s { int x; };\n",
            "struct t { struct s s; int o; } a = { (struct s){ 2 }, 3 };\n",
            "int n = (int){ 7 };\n",
            "struct u { struct s p; struct s q; } b = { (struct s){ 1 }, (struct s){ } };\n",
        ));
        assert!(text.contains("global @a : bytes 8 = { i32 2, i32 3 }"), "{text}");
        assert!(text.contains("global @n : i32 = 7,"), "{text}");
        // The second literal names nothing, so what it puts in is the zeros of its own size and
        // not the tail of the object it went in, which would have been the same bytes by luck.
        assert!(text.contains("global @b : bytes 8 = { i32 1, zero 4 }"), "{text}");
    }

    #[test]
    fn the_address_of_a_compound_literal_asks_for_the_object_it_points_at() {
        // Nothing declares a compound literal, so the reference is the only thing that can ask
        // for it to be emitted. The image named `.Lanon.0` and the module defined no such
        // symbol, which the link would have been the first to find out.
        let text = ir("struct s { int x; };\nstruct s *q = &(struct s){ 9 };\n");
        assert!(text.contains("global @.Lanon.0 : i32 = 9, align 4, linkage(internal)"), "{text}");
        assert!(text.contains("global @q : bytes 8 = { addr.8 @.Lanon.0 }"), "{text}");
    }

    #[test]
    fn an_object_of_no_size_at_all_has_an_image_with_nothing_in_it() {
        // A zero length array, which gcc allows and real code uses as the tail of a structure.
        // The image is there and holds nothing, which is not the global that has no image at
        // all, and the IR reader used to stop on the empty one.
        let text = ir("unsigned char foo[1][0];\n");
        assert!(text.contains("global @foo : bytes 0 = {}, align 1"), "{text}");
    }

    #[test]
    fn a_null_pointer_in_an_image_is_the_bits_an_address_has_room_for() {
        // `NULL` in a static initializer, which every program has. The IR type is `ptr` and a
        // `ptr` has no width of its own, so the width the bits are cut to is the target's.
        let text = ir("void *p = 0;\nchar *q = (char *) 4096;\n");
        assert!(text.contains("global @p : i64 = 0, align 8"), "{text}");
        assert!(text.contains("global @q : i64 = 4096, align 8"), "{text}");
    }

    #[test]
    fn an_object_another_module_defines_may_be_one_that_cannot_be_written_through() {
        // Which the verifier used to refuse, having read a declaration as a definition with
        // nothing in it. `extern const` is how a program names something in the library's read
        // only data, and glibc and Darwin both have one in a header a real program includes.
        let text = ir("extern const int limit;\nint f(void) { return limit; }\n");
        assert!(
            text.contains("global @limit : bytes 4, align 4, linkage(external), constant"),
            "{text}"
        );
    }

    #[test]
    fn a_conditional_whose_value_is_an_object_answers_where_the_object_is() {
        // A structure is not a value in the IR, so the two arms cannot be joined as one. The
        // addresses can, and the answer is the address of whichever arm was taken rather than
        // a copy of it into a third place: both arms outlive the expression, so a copy would
        // be one nothing could observe. SQLite's parser writes one of these.
        let text = body(
            "\
struct s { int a, b; };
struct s pick(int c, struct s x, struct s y) { return c ? x : y; }
",
        );
        // The join takes an address, each arm hands it the one it has, and nothing is copied.
        assert!(text.contains("block3(%7: ptr)"), "{text}");
        assert!(text.contains("jump block3(%3)") && text.contains("jump block3(%4)"), "{text}");
        assert!(!text.contains("memcpy"), "the arms are joined rather than copied: {text}");
    }

    /// GNU's `a ?: b` evaluates `a` once, and the arm answers the value that was tested.
    ///
    /// The checking keeps one node for `a` and converts it in two directions, to the bit the
    /// branch is taken on and to the type the whole expression has. Walking into the arm used to
    /// reach that node a second time and build a second copy of whatever it says, so `++i ?: 10`
    /// incremented twice and `f() ?: 10` called twice. Measured against gcc 16.2.0, which
    /// increments once.
    #[test]
    fn the_left_side_of_a_conditional_with_no_middle_is_evaluated_once() {
        let text = body("int f(int i) { return ++i ?: 10; }\n");
        assert!(text.contains("jump block3(%2)"), "the arm is the value that was tested: {text}");
        assert_eq!(text.matches("add.nsw").count(), 1, "incremented once: {text}");

        // The arm still converts, since what the whole expression is worth is a `long` here and
        // the node under it is an `int`. What it converts is the value in hand.
        let text = body("long f(int i) { return ++i ?: 10L; }\n");
        assert!(text.contains("%5 = sext.i64 %2"), "the arm widens what was tested: {text}");
        assert_eq!(text.matches("add.nsw").count(), 1, "incremented once: {text}");

        // A call, which is where evaluating twice is a wrong answer rather than a slow one.
        let text = body("int g(void);\nint f(void) { return g() ?: 10; }\n");
        assert_eq!(text.matches("call @g").count(), 1, "called once: {text}");

        // Written out in full it is two reads of `i`, which is what C says it is, so the middle
        // operand being absent is the whole of the difference.
        let text = body("int f(int i) { return ++i ? ++i : 10; }\n");
        assert_eq!(text.matches("add.nsw").count(), 2, "incremented twice: {text}");
    }

    #[test]
    fn a_structure_that_fits_in_registers_travels_as_the_registers_it_fits_in() {
        // `struct pair` is two eightbytes on SysV, one of them integer, so the signature says
        // one `i64` in each direction and the body takes the object apart and puts it back
        // together around the call.
        let text = ir("\
struct pair { int a, b; };
struct pair make(int a, int b);
struct pair twice(struct pair p) { return make(p.a, p.b); }
");
        assert!(text.contains("func @make(i32, i32) -> i64"), "{text}");
        assert!(text.contains("func @twice(i64) -> i64"), "{text}");
    }

    #[test]
    fn a_structure_too_large_for_the_registers_travels_as_where_its_bytes_are() {
        // Over two eightbytes the caller passes the bytes in the argument area, which is
        // `byval`, and passes somewhere to write the return value, which is `sret`. Neither is
        // a parameter the program wrote and both are parameters the function has.
        let text = ir("\
struct big { double v[8]; };
struct big grow(struct big b);
struct big twice(struct big b) { return grow(grow(b)); }
");
        assert!(
            text.contains("func @grow(ptr sret(64, align 8), ptr byval(64, align 8))"),
            "{text}"
        );
        assert!(text.contains("block0(%0: ptr, %1: ptr):"), "{text}");
        // The inner call writes into a slot and the outer one reads the same slot, so the
        // object between the two calls is never copied anywhere.
        assert_eq!(text.matches("call @grow").count(), 2, "{text}");
    }

    #[test]
    fn a_structure_passed_to_a_variadic_function_says_so_at_the_call() {
        // The bytes travel in the argument area the same way they would for a parameter, and
        // `printf` has no parameter there to say it on, so the call says it instead. The one
        // that fits in registers says nothing, because travelling as the registers it fits in
        // is what an argument does when nothing says otherwise.
        let text = ir("\
struct big { double v[8]; };
struct pair { int a, b; };
int p(const char *, ...);
int f(struct big b, struct pair q) { return p(\"\", 1, b, q); }
");
        assert!(
            text.contains("call @p(%4, %5, %2 byval(64, align 8), %6) : (ptr, ...) -> i32"),
            "{text}"
        );
    }

    #[test]
    fn what_a_call_produced_is_somewhere_before_anything_is_read_out_of_it() {
        // `make(1, 2).b` has no object to read a member of until one is made, and what makes it
        // is a slot the returned registers are written to.
        let body = body(
            "\
struct pair { int a, b; };
struct pair make(int a, int b);
int second(void) { return make(1, 2).b; }
",
        );
        assert!(body.starts_with("block0:\n    %0 = alloca, size 8, align 4\n"), "{body}");
        assert!(body.contains("store %3 -> %0, align 4\n"), "{body}");
    }

    #[test]
    fn a_structure_of_floats_travels_in_floating_point_registers_on_aarch64() {
        // The same declaration, classified by a different ABI: three `float` members are an
        // eightbyte of two of them and a half eightbyte of the third on SysV, and three vector
        // registers on AAPCS64.
        let source = "\
struct hfa { float x, y, z; };
int take(struct hfa h);
int give(struct hfa h) { return take(h); }
";
        assert!(ir(source).contains("func @take(f64, f32) -> i32"), "{}", ir(source));
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.target = "aarch64-unknown-linux-gnu".parse::<Triple>().unwrap();
        let result = run(&opts, source);
        assert_eq!(result.messages, Vec::<String>::new());
        assert!(result.text().contains("func @take(f32, f32, f32) -> i32"), "{}", result.text());
    }

    #[test]
    fn an_array_whose_length_is_not_a_constant_is_a_slot_made_where_its_declaration_is() {
        // The size is a multiplication rather than a number, the slot is taken from the stack
        // where the declaration is, and the scope it was declared in gives it back.
        let source = "\
int use(int *);
void f(int n) {
  {
    int a[n];
    use(a);
  }
  use(0);
}
";
        let body = body(source);
        assert!(body.contains("mul.nsw"), "{body}");
        assert!(body.contains("stacksave"), "{body}");
        assert!(body.contains("alloca %"), "{body}");
        assert!(body.contains("stackrestore"), "{body}");
    }

    #[test]
    fn a_goto_out_of_the_scope_of_one_gives_its_stack_back_on_the_way() {
        // The label is outside the block the array is in, so arriving there means the array is
        // gone, and the restore that says so goes in front of the branch. The `goto` is written
        // before the walk knows where the label is, which is why the restore is put there at
        // the end rather than built where the branch was.
        let source = "\
int use(int *);
int f(int n) {
  {
    int a[n];
    if (use(a)) goto out;
    use(0);
  }
out:
  return 0;
}
";
        let body = body(source);
        // Two ways out of the block and a restore on each: the jump and the end of the block.
        assert_eq!(body.matches("stackrestore").count(), 2, "{body}");
        let (_, after) = body.split_once("stackrestore").expect("the stack is given back");
        assert!(after.starts_with(" %4\n    jump block"), "{body}");
    }

    #[test]
    fn a_goto_to_a_label_the_array_is_still_alive_at_leaves_the_stack_alone() {
        // The label is after the declaration and in the same block, so control that arrives
        // there arrives somewhere the array exists. Giving it back would be giving back an
        // object the next statement reads.
        let source = "\
int use(int *);
int f(int n) {
  int a[n];
again:
  if (use(a)) goto again;
  return 0;
}
";
        let body = body(source);
        assert!(body.contains("stacksave"), "{body}");
        assert!(!body.contains("stackrestore"), "{body}");
    }

    #[test]
    fn a_goto_back_to_a_label_in_front_of_one_gives_it_back_every_time_round() {
        // A loop written out of a `goto`, with the array made inside it. The label is in the
        // same block as the declaration and before it, which is a place where the array does
        // not exist yet, so the jump there leaves its scope and has to give the stack back. A
        // compiler that skips this restore grows the stack once per iteration.
        let source = "\
int use(int *);
int f(int n) {
again:
  {
    int a[n];
    if (use(a)) goto again;
  }
  return 0;
}
";
        let body = body(source);
        assert_eq!(body.matches("stacksave").count(), 1, "{body}");
        let (_, after) = body.split_once("stackrestore").expect("the stack is given back");
        assert!(after.starts_with(" %4\n    jump block1\n"), "{body}");
    }

    #[test]
    fn the_head_of_a_for_loop_is_a_scope_that_closes_where_the_loop_is_left() {
        // The scope opened for `for (int a[n];;)` used to stay open, and a scope left open is
        // not one mark nobody reads. The marks are a stack, so the next close took this one
        // instead of its own, and the body of the loop gave back nothing while the block after
        // the loop restored a pointer saved inside it. The verifier refused that, which is how
        // it was found.
        let source = "\
int f(void);
void t(void) {
  int count = 10;
  for (; count--;) {
    int b[f()];
    int i;
    for (i = 0; i < f(); i++) {
      b[i] = count;
    }
  }
}
";
        let body = body(source);
        // One save, in the body, and one restore for it, also in the body: the block the
        // restore is in is the one the inner loop leaves through, and it goes back round the
        // outer loop rather than out of it.
        assert_eq!(body.matches("stacksave").count(), 1, "{body}");
        let (_, after) = body.split_once("stackrestore").expect("the stack is given back");
        // The rest of the block the restore is in, which is the last block here, so there is not
        // always another one after it to split on.
        let next = after.split("\n\n").next().expect("the block the restore is in");
        assert!(next.contains("jump block1("), "{body}");
    }

    #[test]
    fn how_long_one_of_those_is_was_decided_where_it_was_declared_and_not_where_it_is_asked() {
        // What C says about the length being evaluated once: `sizeof a` after `n` changed is
        // still as long as the array is, which is what `n` was when the array came into being.
        let source = "\
unsigned long f(int n) {
  int a[n];
  n = 0;
  return sizeof a;
}
";
        let body = body(source);
        // One read of the parameter, at the declaration, and the answer is built out of it.
        assert_eq!(body.matches("sext.i64 %0").count(), 2, "{body}");
    }

    #[test]
    fn a_block_in_the_middle_of_an_expression_is_walked_where_the_expression_is() {
        // GNU's statement expression: the statements happen where they are written and the last
        // one is the value, so the temporary in it never becomes a slot and never is copied.
        let source = "\
int use(int);
int f(int x) {
  return ({
    int t = use(x);
    t * t;
  });
}
";
        let expected = "\
block0(%0: i32):
    %1 = call @use(%0) : (i32) -> i32
    %2 = mul.nsw %1, %1
    return %2
";
        assert_eq!(body(source), expected);
    }

    #[test]
    fn one_of_those_that_control_never_leaves_is_lowered_and_what_follows_it_is_dropped() {
        // A macro that always jumps, which is what this shape is in real code. The value is
        // never taken, and the block the rest of the expression would have been built in is
        // one nothing branches to, so it goes with the other unreachable blocks.
        let source = "int f(int x) { return ({ return x; 0; }); }\n";
        assert_eq!(body(source), "block0(%0: i32):\n    return %0\n");
    }

    #[test]
    fn one_argument_off_a_variable_argument_list_stays_an_intrinsic() {
        // What it becomes is the target's answer, and this is not where the target's answers
        // are, so the walk writes down which list and which type and leaves it at that. Two of
        // them are two instructions, since each moves the list on.
        let source = "double f(__builtin_va_list ap) { return __builtin_va_arg(ap, double) + __builtin_va_arg(ap, double); }\n";
        let expected = "\
block0(%0: ptr):
    %1 = va_arg.f64 %0
    %2 = va_arg.f64 %0
    %3 = fadd %1, %2
    return %3
";
        assert_eq!(body(source), expected);
    }

    #[test]
    fn one_that_reads_a_structure_answers_where_the_object_is() {
        // An aggregate is not a value, so there is nothing for the result of `va_arg` to be and
        // the object form is a second instruction. What it answers is an address, so it is a
        // place already and the walk copies nothing out of it: the copy here is the one the
        // initializer asks for, into the variable being declared. The size and the alignment
        // travel with it because they are what steps the list on and what a target that has to
        // put registers somewhere needs to know. So does the classification, which says the two
        // halves of this one arrived in general purpose registers: that is an answer about a C
        // type, and this is the last place that still has one.
        //
        // The slot is aligned to sixteen and the copy into it to eight, which is not a
        // disagreement. Sixteen is what a local aggregate of sixteen bytes gets whatever its
        // members ask for, and eight is what the type asks for and so what the copy may assume
        // about the object it is reading from.
        let source = "\
struct s { int a; long b; };
long f(__builtin_va_list ap) { struct s v = __builtin_va_arg(ap, struct s); return v.b; }
";
        let expected = "\
block0(%0: ptr):
    %1 = alloca, size 16, align 16
    %2 = va_object %0, size 16, align 8, in(int 8 at 0, int 8 at 8)
    memcpy %1, %2, size 16, align 8
    %3 = iconst.i64 8
    %4 = ptr_add %1, %3
    %5 = load.i64 %4, align 8, tbaa !1
    return %5
";
        assert_eq!(body(source), expected);
    }

    /// Which register file each eightbyte arrived in is the whole of what the classification adds,
    /// and an object with no slots at all is one it sent to the caller's argument area, which is
    /// what everything over two eightbytes is whatever its members are.
    #[test]
    fn the_classification_says_which_registers_the_object_arrived_in() {
        let source = "\
struct s { double a; double b; };
double f(__builtin_va_list ap) { struct s v = __builtin_va_arg(ap, struct s); return v.a; }
";
        assert!(
            body(source)
                .contains("va_object %0, size 16, align 8, in(float f64 at 0, float f64 at 8)"),
            "{}",
            body(source)
        );

        let big = "\
struct s { long a[4]; };
long f(__builtin_va_list ap) { struct s v = __builtin_va_arg(ap, struct s); return v.a[0]; }
";
        assert!(body(big).contains("va_object %0, size 32, align 8\n"), "{}", body(big));
    }

    #[test]
    fn a_jump_to_an_address_branches_to_every_label_the_function_takes_the_address_of() {
        // GNU's computed goto. Which label the address holds is not known here, so all of them
        // are listed, and the values arriving at one are passed on every edge the same way they
        // are on an ordinary branch.
        let source = "\
int f(int c) {
  void *p = c ? &&one : &&two;
  goto *p;
one:
  return 1;
two:
  return 2;
}
";
        let expected = "\
block0(%0: i32):
    %1 = iconst.i32 0
    %2 = icmp ne %0, %1
    br_if %2, block1, block2

block1:
    %3 = block_addr block3
    jump block4(%3)

block2:
    %4 = block_addr block5
    jump block4(%4)

block3:
    %5 = iconst.i32 1
    return %5

block4(%6: ptr):
    indirect_br %6, block3, block5

block5:
    %7 = iconst.i32 2
    return %7
";
        assert_eq!(body(source), expected);
    }

    #[test]
    fn a_jump_to_an_address_no_label_in_the_function_has_arrives_nowhere() {
        // The address came from outside the function, and a jump to a label in another function
        // is undefined. The expression is still evaluated, since a call in it has to happen.
        let source = "void **next(void);
void f(void) { goto *next(); }
";
        let expected = "\
block0:
    %0 = call @next() : () -> ptr
    unreachable
";
        assert_eq!(body(source), expected);
    }

    #[test]
    fn an_asm_with_no_operands_is_volatile_and_the_clobbers_are_the_whole_of_what_it_says() {
        // Nothing reads a result, so the only thing that keeps it is that it is volatile, which
        // a basic asm implies.
        let source = "void f(void) { __asm__(\"mfence\" ::: \"memory\"); }\n";
        let expected = "\
block0:
    inline_asm.volatile \"mfence\", \"\", \"memory\"()
    return
";
        assert_eq!(body(source), expected);
    }

    #[test]
    fn the_constraints_are_one_list_in_the_order_the_template_counts_the_operands() {
        // The outputs first and then the inputs, which is the numbering `%0` and `%1` use. An
        // output in a register is a result, and one that is read as well is an argument too.
        let source = "\
int f(int x, int y) {
  int r;
  __asm__(\"addl %2, %0\" : \"=r\"(r), \"+r\"(y) : \"r\"(x));
  return r + y;
}
";
        let expected = "\
block0(%0: i32, %1: i32):
    %2, %3 = inline_asm.(i32, i32) \"addl %2, %0\", \"=r,+r,r\", \"\"(%1, %0)
    %4 = add.nsw %2, %3
    return %4
";
        assert_eq!(body(source), expected);
    }

    #[test]
    fn a_memory_operand_travels_as_the_address_of_an_object_that_is_given_a_slot() {
        // The assembly is handed a pointer, so the object cannot live in a value, and the scan
        // that runs before the walk has to have known that or there would be nothing to point
        // at. A structure travels this way whatever else its constraint allows, since there is
        // no register that holds one.
        let source = "\
struct pair { int a, b; };
int f(int x) {
  int slot = x;
  struct pair p = { x, x };
  __asm__(\"incl %0\" : \"+m\"(slot), \"=m\"(p));
  return slot + p.a;
}
";
        let text = body(source);
        assert!(text.contains("inline_asm \"incl %0\", \"+m,=m\", \"\"(%1, %2)\n"), "{text}");
        assert!(text.contains("%1 = alloca, size 4, align 4\n"), "{text}");
        assert!(text.contains("%2 = alloca, size 8, align 4\n"), "{text}");
    }

    #[test]
    fn an_asm_goto_falls_through_to_its_first_target_and_writes_its_outputs_there() {
        // The output is only in scope where the instruction dominates, which is the fall through
        // block, so the edge to the label carries the value the object had before the assembly
        // ran. That is what document 11 asks for and it is what putting the fall through first
        // buys.
        let source = "\
int f(int x) {
  int r = 7;
  __asm__ goto(\"cbnz %0, %l1\" : \"=r\"(r) : \"r\"(x) :: away);
  return r;
away:
  return r;
}
";
        let expected = "\
block0(%0: i32):
    %1 = iconst.i32 7
    %2 = inline_asm.volatile \"cbnz %0, %l1\", \"=r,r\", \"\"(%0), labels [block1, block2]

block1:
    return %2

block2:
    return %1
";
        assert_eq!(body(source), expected);
    }

    #[test]
    fn an_asm_statement_that_is_not_well_formed_is_reported_in_the_words_gcc_uses() {
        // The operands are checked here rather than by the assembler, because by the time the
        // assembler sees the template the operands have become registers and it has nothing left
        // to say about the C that named them.
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        for (source, expected) in [
            (
                "void f(int x) { __asm__(\"\" : \"r\"(x)); }\n",
                "output operand constraint lacks '='",
            ),
            (
                "void f(int x) { __asm__(\"\" : \"=r\"(x + 1)); }\n",
                "lvalue required in 'asm' statement",
            ),
            (
                "const int g = 1;\nvoid f(void) { __asm__(\"\" : \"=r\"(g)); }\n",
                "read-only variable 'g' used as 'asm' output",
            ),
            (
                "void f(int x) { __asm__(\"\" : : \"=r\"(x)); }\n",
                "input operand constraint contains '='",
            ),
            (
                "void f(void) { __asm__(\"\" : : \"m\"(1)); }\n",
                "memory input 0 is not directly addressable",
            ),
            ("void f(void) { __asm__(L\"\"); }\n", "wide string literal in 'asm'"),
            (
                "void f(int x, int y) { __asm__(\"\" : [a] \"=r\"(x) : [a] \"r\"(y)); }\n",
                "duplicate asm operand name 'a'",
            ),
            ("void f(int x) { __asm__(\"%[in]\" : \"=r\"(x)); }\n", "undefined named operand 'in'"),
        ] {
            let result = run(&opts, source);
            assert!(result.failed(), "expected this to be reported:\n{source}");
            assert!(
                result.messages.iter().any(|m| m.contains(expected)),
                "{expected}\n{:?}",
                result.messages
            );
        }
    }

    /// An `asm` at file scope whose template is directives is the whole of what the incbin
    /// header, an alias table and a hand written jump table each write, and what it says is a
    /// section holding named bytes. So it becomes the globals it names, in the order it names
    /// them, which is what `spec/11-asm-objects-debug.md` section 11.2 asks for.
    #[test]
    fn an_asm_at_file_scope_that_is_directives_becomes_the_objects_it_defines() {
        let text = ir(concat!(
            "__asm__(\n",
            "  \".section .rodata\\n\"\n",
            "  \".globl first\\n\"\n",
            "  \".balign 8\\n\"\n",
            "  \"first:\\n\"\n",
            "  \".long 1\\n\"\n",
            "  \".long 2\\n\"\n",
            "  \".globl last\\n\"\n",
            "  \"last:\\n\"\n",
            "  \".quad last - first\\n\");\n",
            "extern const int first[];\n",
            "extern const long last;\n",
        ));
        assert!(text.contains("global @first : bytes 8 = { i32 1, i32 2 }, align 8"), "{text}");
        assert!(text.contains("global @last : i64 = 8"), "{text}");
    }

    /// The distance between two labels is what the incbin header hands a program as the size of
    /// the data, so a declaration of one of the names has to find the definition the template
    /// made rather than turn it back into something the linker is asked for.
    #[test]
    fn a_name_an_asm_at_file_scope_defined_is_not_undone_by_a_declaration_of_it() {
        let text = ir(concat!(
            "__asm__(\".data\\n.globl counter\\ncounter:\\n.long 7\\n\");\n",
            "extern int counter;\n",
            "int read(void) { return counter; }\n",
        ));
        assert!(text.contains("global @counter : i32 = 7"), "{text}");
    }

    /// `.incbin` is the one directive that reads something, and what it reads comes through the
    /// same file system the sources did.
    #[test]
    fn an_incbin_at_file_scope_is_the_bytes_of_the_file_it_names() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let mut fs = MemoryFileSystem::new();
        fs.insert(
            "/main.c",
            b"__asm__(\".data\\n.globl blob\\nblob:\\n.incbin \\\"seed\\\"\\n\");\n".to_vec(),
        );
        fs.insert("seed", b"hi".to_vec());
        let result = compile(&opts, "/main.c", &fs);
        assert_eq!(result.messages, Vec::<String>::new());
        let text = result.text();
        assert!(text.contains("global @blob : bytes 2 = { bytes \"hi\" }"), "{text}");
    }

    /// A file that is not there is the mistake a build makes when it runs the compiler from the
    /// wrong directory, and it is worth saying which file rather than saying the template failed.
    #[test]
    fn an_incbin_naming_a_file_that_is_not_there_says_which_file() {
        let messages = errors("__asm__(\".data\\nb:\\n.incbin \\\"nowhere\\\"\\n\");\n");
        assert!(
            messages
                .iter()
                .any(|m| m.contains("cannot open 'nowhere' for reading") && m.contains("E0702")),
            "{messages:?}"
        );
    }

    /// The line drawn is the same one the `asm` inside a function draws: directives are read and
    /// an instruction waits for an assembler. Refusing by name is what makes the wait visible.
    #[test]
    fn an_instruction_in_an_asm_at_file_scope_is_refused_rather_than_ignored() {
        for source in [
            "__asm__(\".text\\n.globl f\\nf:\\n  ret\\n\");\n",
            "__asm__(\".data\\n.set alias, 4\\n\");\n",
        ] {
            let messages = errors(source);
            assert!(
                messages
                    .iter()
                    .any(|m| m.contains("not supported yet")
                        && m.contains("in an `asm` at file scope")),
                "{source}\n{messages:?}"
            );
        }
    }

    #[test]
    fn what_the_walk_cannot_build_yet_is_reported_rather_than_mislowered() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        for source in [
            "int f(int n) { void *p = &&out; if (n) goto *p; { int a[n]; out: return 1; } }\n",
            "int f(int n) { int a[n]; __asm__ goto(\"\" ::::out); out: return a[0]; }\n",
        ] {
            let result = run(&opts, source);
            assert!(result.failed(), "expected this to be reported:\n{source}");
            assert!(
                result.messages.iter().any(|m| m.contains("not supported yet")),
                "{:?}",
                result.messages
            );
        }
    }

    /// Compiles `source` to IR, reads that back as an input, and gives back both texts.
    fn round_trip(source: &str) -> (String, String) {
        let printed = ir(source);
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let mut fs = MemoryFileSystem::new();
        fs.insert("/main.ir", printed.clone().into_bytes());
        let result = compile_ir(&opts, "/main.ir", &fs);
        assert_eq!(result.messages, Vec::<String>::new(), "expected this to read back:\n{printed}");
        (printed, result.text().to_owned())
    }

    #[test]
    fn ir_that_arrives_as_an_input_is_read_back_and_written_out_the_same() {
        // The other half of the round trip test below, through the driver rather than through
        // the library, which is what makes the property something to run over a real program
        // rather than over the modules a test builds.
        let (printed, again) = round_trip(
            "struct point { int x, y; };\n             static const char greeting[] = \"hi\";\n             int puts(const char *);\n             int f(int n) { struct point p = { n, 1 }; puts(greeting); return p.x; }\n",
        );
        assert_eq!(printed, again);
    }

    #[test]
    fn ir_that_is_not_ir_says_which_line_stopped_it() {
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let mut fs = MemoryFileSystem::new();
        let text = "\
; ModuleID = 'a.c'
; format 0
target triple = \"x86_64-unknown-linux-gnu\"
target datalayout = \"e-p:64:64-i64:64-S128\"

func @f(), linkage(external) {
block0:
    frobnicate
}
";
        fs.insert("/main.ir", text.as_bytes().to_vec());
        let result = compile_ir(&opts, "/main.ir", &fs);
        assert!(result.failed());
        assert!(result.messages[0].contains("/main.ir:8"), "{:?}", result.messages);
    }

    #[test]
    fn ir_that_reads_but_does_not_hold_together_is_reported_by_the_verifier() {
        // A module that a person edited has not been through the verifier, and the return of
        // an `i32` from a function that returns nothing is the kind of thing editing produces.
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        let mut fs = MemoryFileSystem::new();
        let text = "\
; ModuleID = 'a.c'
; format 0
target triple = \"x86_64-unknown-linux-gnu\"
target datalayout = \"e-p:64:64-i64:64-S128\"

func @f(), linkage(external) {
block0:
    %0 = iconst.i32 1
    return %0
}
";
        fs.insert("/main.ir", text.as_bytes().to_vec());
        let result = compile_ir(&opts, "/main.ir", &fs);
        assert!(result.failed());
        assert!(result.messages[0].contains("invalid IR"), "{:?}", result.messages);
    }

    #[test]
    fn a_typed_tree_is_not_something_an_input_of_ir_can_produce() {
        // The C that became this is not here any more, so there is nothing to print a tree of.
        let mut fs = MemoryFileSystem::new();
        fs.insert("/main.ir", Vec::new());
        let result = compile_ir(&options(), "/main.ir", &fs);
        assert!(result.failed());
        assert!(result.messages[0].contains("can only be emitted as IR"), "{:?}", result.messages);
    }

    #[test]
    fn the_printed_ir_reads_back_as_the_same_module() {
        // The M2 exit criterion: the text is the module and nothing about it is lost by
        // writing it down. Anything the printer invents or the parser drops shows up here.
        let text = ir("\
struct point { int x, y; };
static const char greeting[] = \"hi\";
int table[4] = { 1, 2, 3 };
int puts(const char *);
double half(double x) { return x / 2.0; }
int f(int n) {
  int total = 0;
  for (int i = 0; i < n; i++) {
    if (i == 3) continue;
    total += table[i];
  }
  switch (n) {
    case 0: total = 1;
    case 1: total++; break;
    default: total = -total;
  }
  struct point p = { total, 1 };
  int *q = &p.y;
  puts(greeting);
  return p.x + *q;
}
int dispatch(int c) {
  void *p = c ? &&one : &&two;
  goto *p;
one:
  return 1;
two:
  return 2;
}
int assembly(int x, int *p) {
  int r;
  __asm__ volatile(\"xadd %0, %2\" : \"=r\"(r), \"+m\"(*p) : \"0\"(x) : \"cc\");
  __asm__ goto(\"cbnz %0, %l1\" : : \"r\"(r) : : away);
  return r;
away:
  return 0;
}
");
        let mut names = Interner::new();
        let module = rucc_ir::parse(&text, &mut names).expect("the printer writes what it reads");
        assert_eq!(rucc_ir::print(&module, &names), text);
    }

    #[test]
    fn what_save_temps_keeps_is_the_text_that_was_compiled_and_the_assembly_that_was_assembled() {
        // The point of the flag is that these two are the compilation rather than a description
        // of one, so both come out of the run that produced the object rather than out of a
        // second run under different flags.
        let mut opts = options();
        opts.emit = EmitKind::Object;
        opts.save_temps = rucc_session::SaveTemps::Object;
        let result = run(&opts, "#define N 2\nint a[N];\n");
        assert_eq!(result.messages, Vec::<String>::new());
        let text = result.temps.preprocessed.expect("the preprocessed text");
        assert!(text.contains("int a[2];"), "{text}");
        assert!(text.starts_with("# 1 \"/main.c\""), "{text}");
        let asm = result.temps.assembly.expect("the assembly");
        assert!(asm.contains("a:"), "{asm}");
        assert!(matches!(result.artifact, Artifact::Object { .. }), "{:?}", result.artifact);
    }

    #[test]
    fn nothing_is_kept_unless_the_flag_asked_for_it() {
        // A compilation that was not asked to keep anything must not pay for printing text
        // nobody will read, and the empty value is what says so.
        let mut opts = options();
        opts.emit = EmitKind::Object;
        assert_eq!(run(&opts, "int a;\n").temps, Temps::default());
    }

    #[test]
    fn a_compilation_that_stops_before_the_back_end_keeps_the_text_and_no_assembly() {
        // `--emit=ir` never produces any, and the text is worth keeping all the same: it is
        // what a report about the file being read wrongly has to have in it.
        let mut opts = options();
        opts.emit = EmitKind::Ir;
        opts.save_temps = rucc_session::SaveTemps::Cwd;
        let result = run(&opts, "int a;\n");
        assert!(result.temps.preprocessed.is_some());
        assert_eq!(result.temps.assembly, None);
    }
}