rucc-lower 0.10.38

//! The per-function level of the walk: statements and expressions.
//!
//! Design: `spec/08-ir.md` section 8.9.
//!
//! # The cursor
//!
//! There is one place instructions are appended to, and it is [`Body::at`]. It is an option
//! because unreachable code exists: after a `return` there is no block to append to, and the
//! IR has no room for one, since the verifier rejects a block nothing branches to. So `at`
//! goes to [`None`] at a terminator and comes back when a construct starts a block that
//! something does branch to. A statement lowered while it is `None` is lowered to nothing.
//!
//! Every block a construct might need is created only when something is about to branch to it.
//! The join of an `if` whose arms both return is never created, and the block after a loop
//! nothing breaks out of and whose condition is `1` is never created either. That is not an
//! optimization, it is what keeps the CFG legal.
//!
//! # Where a variable lives
//!
//! A local is a value in [`Ssa`] unless something takes its address or it is not the kind of
//! thing a register holds, and then it is a stack slot. That decision is made once, before the
//! walk, by [`Scan`], because it has to be made for the whole function at once: the `alloca`
//! for a slot belongs in the entry block, and by the time the walk meets `&x` it is far too
//! late to put one there.

use std::collections::{HashMap, HashSet};
use std::iter;

use rucc_ast::{AsmQuals, BinaryOp, UnaryOp};
use rucc_base::float::{Float as Real, Format};
use rucc_diag::Span;
use rucc_ir::{
    AsmInfo, AttrSet, Block, BlockCall, Builder, CallInfo, Extra, Flags, FloatPred, Func, Inst,
    InstData, IntPred, MemInfo, MemOrder, Opcode, PrefetchHint, Restrict, RmwOp, Signature, Type,
    VaInfo, Value,
};
use rucc_sema::{
    AtomicOp, BitCount, Classify, Const, Conversion, DeclId, ExprId, ExprKind, ExprList, InitEntry,
    Ordering, OverflowOp, Rmw, Sign, Stmt, StmtId, StorageDuration, Tast,
};
use rucc_target::{Pass, TargetInfo};
use rucc_types::{
    ArrayLen, Qualifiers, RecordId, RecordKind, TypeId, TypeKind, Types, VlaId, pointee,
};

use crate::abi::{self, Plan, Travel};
use crate::bits::{Piece, Run, shifted};
use crate::repr;
use crate::restrict::Scopes;
use crate::ssa::{Ssa, Var};
use crate::unit::{Protector, Unit};

/// Builds the body of one function definition into `func`.
///
/// The plan is how the call travels, which is what says the entry block's parameters: one per
/// C parameter for the ones that travel as themselves, several for one taken apart into
/// registers, none at all for one with no bytes in it, and a hidden first one when the return
/// value is written through a pointer the caller passes.
pub(crate) fn lower(unit: &mut Unit<'_>, decl: DeclId, func: &mut Func, plan: &Plan) {
    let tast = unit.tast;
    let Some(root) = tast[decl].body else { return };
    let params = tast[decl].params;
    let span = tast.decl_span(decl);
    if tast[params].len() != plan.args.len() {
        // A definition written without a prototype, `int f(a) int a; { }`, whose type says
        // nothing about what it takes. The entry block's parameters have to be the signature's
        // and here they are not, so the function is left as a declaration.
        unit.unsupported("a function definition without a prototype", span);
        return;
    }

    let entry = func.create_block();
    let address = repr::address_type(unit.target);
    let mut body = Body {
        unit,
        func,
        ssa: Ssa::new(address),
        at: Some(entry),
        vars: HashMap::new(),
        labels: HashMap::new(),
        taken: Vec::new(),
        loops: Vec::new(),
        next_var: 0,
        address,
        ret: plan.ret.clone(),
        sret: None,
        vlas: HashMap::new(),
        shared: None,
        marks: Vec::new(),
        next_scope: 0,
        landings: HashMap::new(),
        jumps: Vec::new(),
        grows: false,
        aligned: HashMap::new(),
        restrict: Scopes::default(),
    };
    body.ssa.seal(body.func, entry);

    // What the whole function needs decided before any of it is walked.
    let mut scan = Scan {
        tast,
        escaped: HashSet::new(),
        locals: Vec::new(),
        statics: Vec::new(),
        taken: Vec::new(),
    };
    scan.stmt(root);
    let Scan { escaped, locals, statics, taken, .. } = scan;
    // A label whose address is taken and which is never defined was reported by the checking,
    // and there is no block for one, so it is not somewhere a jump can arrive.
    body.taken = taken.iter().filter_map(|&label| tast[label].stmt).collect();
    for decl in statics {
        body.unit.local_static(decl);
    }

    // The slots first, so that every `alloca` is at the top of the entry block, and then the
    // parameters, whose stores have to come after the slots they store into.
    let params = tast[params].to_vec();
    // Which `restrict` pointers the function declares, before anything in it is walked, because
    // the scope a parameter's promise covers is the whole body and the numbers have to be settled
    // before the first access carries one.
    body.restrict = Scopes::of_params(tast, body.unit.types, &params, &mut body.unit.cliques);
    // Whether anything in the function grows the stack, which decides what a `goto` can do.
    let declared: Vec<TypeId> = params.iter().chain(locals.iter()).map(|&d| tast[d].ty).collect();
    body.grows = declared.iter().any(|&ty| repr::is_variable_length(body.types(), ty));
    // Before the walk, because it is a question about what the function declares rather than about
    // what it does, and the scan above is where that is already known. What the attribute then
    // costs the function is a slot in its frame and a comparison before each of its returns.
    if protects(&body, &locals, &escaped) {
        body.func.attrs.set |= AttrSet::STACK_PROTECT;
    }
    // And what the command line said about fusing a multiply and an addition, which is a fact about
    // the compilation rather than about this function and is written onto it because the place that
    // would act on it is the code generator, which runs long after the command line is gone. Only a
    // function with a body gets it: there is nothing to fuse in a declaration, and an attribute
    // saying what may be done to code that is not here would be a claim about somebody else's file.
    body.func.attrs.fp_contract = body.unit.contract;
    for &param in &params {
        body.declare(param, escaped.contains(&param));
    }
    for &local in &locals {
        body.declare(local, escaped.contains(&local));
    }
    // The address the return value is written to, which is the first thing the caller passes
    // and therefore the first parameter, before anything the program wrote.
    if plan.returns_through_memory() {
        body.sret = Some(body.func.append_param(entry, Type::PTR));
    }
    for (index, &param) in params.iter().enumerate() {
        let Some(travel) = plan.args.get(index) else { continue };
        body.parameter(entry, param, travel, span);
    }

    // A parameter can be declared with a variably modified type, `void f(int n, int a[][n])`,
    // and the size in it is evaluated where the declaration is, which for a parameter is here.
    // Everything the body does with `a` reads the value taken now and not `n` as it is then.
    //
    // The type walked is the one the parameter was written as where that differs, because the
    // adjustment to a pointer throws the outermost length away and `void f(int i, int a[i++])`
    // still performs the increment. In declaration order, which is what `pr77767.c` pins down,
    // and after the stores above, so the expression reads the parameters the call passed.
    for &param in &params {
        let ty = tast.adjusted_from(param).unwrap_or_else(|| tast[param].ty);
        body.measure(ty);
    }

    body.stmt(root);
    body.settle();
    body.finish(decl, span);

    // A label is somewhere any `goto` in the function can branch to, so the block one starts
    // gets its last predecessor only when the last statement has been walked. A `case` was
    // sealed by its `switch`, which is why this asks rather than seals.
    let blocks: Vec<Block> = body.labels.values().copied().collect();
    for block in blocks {
        body.seal_once(block);
    }

    let Body { ssa, .. } = body;
    ssa.finish(func);
    prune(func);
}

/// How many bytes of array make a buffer worth protecting, which is gcc's `ssp-buffer-size` and
/// which has been eight since the flag was written.
const BUFFER: u64 = 8;

/// Whether this function gets a stack protector, which is a question about the locals it declares.
///
/// A canary catches a write that runs off the end of something and keeps going, so what decides is
/// whether the function has anything to run off the end of. The three answers are gcc's and so are
/// the rules, because a build that has been compiled with one of these for twenty years is
/// entitled to the same set of protected functions from a compiler claiming to be compatible: the
/// ones left out are the ones an exploit goes looking for.
///
/// ```text
///   -fstack-protector          a local array of eight bytes or more, or a stack that grows
///   -fstack-protector-strong   any local array, anything holding one, or an address taken
///   -fstack-protector-all      every function
/// ```
///
/// The address taken case is what makes the middle one the one every distribution builds with. A
/// local whose address escapes is one an overflow can reach through a pointer nothing here can
/// follow, and the plain flag misses every single one of them.
fn protects(body: &Body<'_, '_>, locals: &[DeclId], escaped: &HashSet<DeclId>) -> bool {
    let want = body.unit.protector;
    match want {
        Protector::None => return false,
        Protector::All => return true,
        Protector::Buffers | Protector::Strong => {}
    }
    // A stack that grows while the function runs is a variably modified type or an `alloca`, and
    // it is the case the original flag was written for: nothing knows where the top of one of
    // those is, so nothing can bound a write into it.
    if body.grows {
        return true;
    }
    let types = body.types();
    let target = body.target();
    let tast = body.tast();
    locals.iter().any(|&local| {
        let ty = tast[local].ty;
        match want {
            Protector::Strong => escaped.contains(&local) || holds_array(types, ty),
            _ => is_array(types, ty) && repr::size_of(types, target, ty) >= BUFFER,
        }
    })
}

/// Whether an object of that type is an array.
fn is_array(types: &Types, ty: TypeId) -> bool {
    matches!(types.kind(types.canonical(ty)), TypeKind::Array { .. })
}

/// Whether an object of that type has an array anywhere in it.
///
/// A `struct` holding one is something to overflow just as much as a bare array is, and the member
/// need not be at the end: writing past a `char[4]` in the middle of a structure reaches the rest
/// of the structure first and the return address soon after. A union counts for the same reason,
/// and a pointer to an array does not, because what is being asked is what this frame holds.
fn holds_array(types: &Types, ty: TypeId) -> bool {
    match types.kind(types.canonical(ty)) {
        TypeKind::Array { .. } => true,
        TypeKind::Record(id) => {
            let fields = &types.record_info(id).fields;
            fields.iter().any(|field| holds_array(types, field.ty))
        }
        _ => false,
    }
}

/// What a jump made in `from` has to do to the stack to land where a label in `to` is.
///
/// The two are paths of scopes from the top of the function down, so the scopes they share are
/// the ones both are inside and the rest are the ones the jump leaves. Restoring the oldest
/// stack pointer among those gives back everything the newer ones took as well, which is why one
/// restore is enough however many scopes are left at once.
///
/// A scope is shared only when it is the same scope and grew the stack at the same point. That
/// second half is what makes `L: int a[n]; goto L;` give the array back: the label was passed
/// before the array was made, so it is a place where the array does not exist, and jumping there
/// leaves its scope even though the block is the same one.
fn landing(from: &[Mark], to: &[Mark]) -> Landing {
    if to.iter().enumerate().any(|(at, mark)| mark.saved.is_some() && from.get(at) != Some(mark)) {
        return Landing::Enters;
    }
    let leaving = from.iter().enumerate().find_map(|(at, mark)| {
        let saved = mark.saved?;
        (to.get(at) != Some(mark)).then_some(saved)
    });
    match leaving {
        Some(saved) => Landing::Restore(saved),
        None => Landing::Same,
    }
}

/// Takes out the blocks nothing reaches, which is what a label in unreachable code can leave.
///
/// `int f(void) { return 1; spare: return 2; }` is a legal function with a block in it that
/// nothing branches to, and the verifier turns down a function with one of those in it. Which
/// labels turn out to be dead is not known until the whole body has been walked, since the
/// `goto` that reaches one is allowed to be the last statement in the function, so it is
/// answered here and not while the walk is going on.
fn prune(func: &mut Func) {
    let Some(entry) = func.entry() else { return };
    let mut reached = vec![false; func.counts().blocks];
    reached[entry.index()] = true;
    let mut stack = vec![entry];
    while let Some(block) = stack.pop() {
        let insts: Vec<Inst> = func.insts(block).collect();
        for inst in insts {
            for call in func.target_list(inst).iter() {
                let to = func[call].block;
                if !reached[to.index()] {
                    reached[to.index()] = true;
                    stack.push(to);
                }
            }
        }
    }

    let blocks: Vec<Block> = func.blocks().collect();
    for block in blocks {
        if !reached[block.index()] {
            func.remove_block(block);
        }
    }
}

/// Where a local variable lives.
#[derive(Debug, Clone, Copy)]
enum Local {
    /// In a register, as a value the SSA construction keeps track of.
    Value(Var),
    /// In a stack slot, whose address this is.
    Slot(Value),
}

/// An object the walk can read or write: either a variable or an address.
#[derive(Debug, Clone, Copy)]
struct Place {
    /// Where it is.
    at: Where,
    /// Its C type, which is what says how wide the access is and how aligned.
    ty: TypeId,
    /// Whether it is a member of a union, or a member of something that is.
    ///
    /// The one thing about a place that its type does not say. Every member of a union starts at
    /// the same byte, so an access to one of them is an access to bytes that some other member may
    /// have been written through, and C 6.5.2.3 permits reading them back that way. What that means
    /// for an access through it is [`Body::info_of`].
    punned: bool,
    /// How many bytes of its record it owns, counting the padding after it.
    ///
    /// Zero for a place that is not a member of one, and zero when nothing asked. What it is for
    /// is [`rucc_ir::MemInfo::owns`], which is section 9.3 of
    /// `spec/safe-memory/09-type-init-and-races.md` and which only a store through a member
    /// carries anything in.
    owns: u32,
    /// Which `restrict` scope the access is in and which pointer it went through.
    ///
    /// Worked out from the names the place was written with, which is what
    /// [`restrict`](mod@crate::restrict) does, and read by layer 5 of the alias analysis.
    restrict: Restrict,
}

impl Place {
    /// A place that is not a member of a union, which is every place but the ones [`Body::member`]
    /// builds out of one.
    const fn new(at: Where, ty: TypeId) -> Self {
        Self { at, ty, punned: false, owns: 0, restrict: Restrict::NONE }
    }
}

/// The three kinds of place there are.
#[derive(Debug, Clone, Copy)]
enum Where {
    /// A variable with no address, which a load and a store are a read and a write of.
    Var(Var),
    /// An address, which a load and a store are a load and a store of.
    Addr(Value),
    /// A run of bits after an address, which is a bit-field. A read of one is a load and a
    /// shift and a write is a load, a mask and a store, both of which [`crate::bits`] says
    /// the shape of.
    Bits(Value, Run),
}

/// How far one step over a type moves, which is a number of bytes for every type but a
/// variably modified one, whose is a value the walk worked out where the declaration was.
#[derive(Debug, Clone, Copy)]
enum Stride {
    /// So many bytes, which is what `sizeof` answers with.
    Bytes(u64),
    /// This many, which is what the sizes of a variable length array multiplied out to.
    Value(Value),
}

/// What a read modify write of an atomic object does to the value it found there.
///
/// It is the operation on its own and not the expression it came from, because the two things
/// that ask for one are a compound assignment and a `++` and the two arrive with the operation
/// already worked out. Keeping it apart is what lets [`Body::atomic_update`] decide between the
/// one instruction and the loop once rather than twice.
#[derive(Debug, Clone, Copy)]
enum Step {
    /// An operator in a computation type, which is what `a op= b` is: the value found is
    /// converted into that type, the operator is applied there, and the answer is converted back.
    Arithmetic { op: BinaryOp, right: Value, computation: TypeId },
    /// An address a number of elements further on, which is what pointer arithmetic is and what
    /// `++` on a pointer is.
    Walk { steps: Value, signed: bool, size: Stride, back: bool },
}

/// One loop or `switch`, and where its `break` and its `continue` go.
#[derive(Debug, Clone, Copy)]
struct Frame {
    /// Which of the two it is, since a `continue` inside a `switch` belongs to the loop around
    /// it and a `break` there belongs to the `switch`.
    kind: FrameKind,
    /// Where `break` goes, created when the first one needs it.
    brk: Option<Block>,
    /// Where `continue` goes, created when the first one needs it.
    cont: Option<Block>,
    /// How many scopes were open when it was pushed, which is what a `break` or a `continue`
    /// leaving it has to give the stack back down to.
    depth: usize,
}

/// What a frame was pushed for.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum FrameKind {
    /// A loop, which both statements leave.
    Loop,
    /// A `switch`, which only `break` leaves.
    Switch,
}

/// The walk over one function body.
struct Body<'a, 'u> {
    unit: &'a mut Unit<'u>,
    func: &'a mut Func,
    ssa: Ssa,
    /// The block instructions are appended to, absent in unreachable code.
    at: Option<Block>,
    vars: HashMap<DeclId, Local>,
    /// The block a labelled statement starts, for the labels met so far.
    labels: HashMap<StmtId, Block>,
    /// The labelled statements the function takes the address of, in the order it takes them,
    /// which is where a `goto *p` can arrive. Collected before the walk starts, since the
    /// address of a label can be taken after the jump that uses it.
    taken: Vec<StmtId>,
    loops: Vec<Frame>,
    next_var: u32,
    /// The integer type an address is as wide as.
    address: Type,
    /// How the return value comes back, which every `return` in the function has to build.
    ret: Travel,
    /// The address the return value is written to, for a function that returns through one.
    sret: Option<Value>,
    /// What each variable length array met so far is long, keyed by the expression it was
    /// written as. C says that expression is evaluated where the declaration having it is
    /// reached and not again, so `int a[n]; n = 0;` leaves `sizeof a` what it was.
    vlas: HashMap<ExprId, Value>,
    /// The node a conditional's condition and its first arm are both written out of, and what it
    /// is worth. GNU's `a ?: b` evaluates `a` once, which the checking says by keeping one node
    /// for it, so meeting that node again while lowering the arm is meeting the same node and not
    /// a second read.
    shared: Option<(ExprId, Value)>,
    /// One entry per open scope, outermost first.
    marks: Vec<Mark>,
    /// How many scopes have been opened, which is what gives the next one a name of its own.
    next_scope: u32,
    /// What each label the walk has reached is inside, which is what a jump to it has to put the
    /// stack back to. Only collected for a function that grows the stack, since nothing else
    /// asks.
    landings: HashMap<StmtId, Vec<Mark>>,
    /// The jumps whose stack is not settled yet, which is all of them until the walk knows where
    /// every label is.
    jumps: Vec<Jump>,
    /// Whether anything the function declares is an array whose length is not a constant, which
    /// is what makes the stack move under it.
    grows: bool,
    /// What an address is known to be aligned to, for the addresses something worked it out for.
    ///
    /// An access ordinarily assumes the alignment of the type it goes through, because that is
    /// what C 6.2.8 gives an object of that type. Packing takes that away: a member of a record
    /// written `packed` or under a `#pragma pack` sits wherever the layout put it, and an `int`
    /// there is aligned to one byte and not to four. So the addresses whose alignment the layout
    /// settled are recorded on the way down, and [`Body::info_of`] takes the smaller of that and
    /// the type's.
    ///
    /// Only the addresses that are less aligned than their type are worth anything, but all of
    /// them go in, because an entry that agrees with the type costs one lookup and leaving it out
    /// would mean deciding what the type's answer is twice.
    ///
    /// An address that is not in here is one nothing worked out, and the type's alignment is what
    /// an access through it assumes. That is the assumption `spec/safe-memory/04-safety-model.md`
    /// judgement J1 tests at run time rather than one this pass has to prove: a pointer that was
    /// cast from a narrower type and lost its low bits is row S7 of document 03, and the check is
    /// what finds it.
    aligned: HashMap<Value, u32>,
    /// The `restrict` pointers the function declares, which is what an access carries a clique
    /// and a base from. Empty for a function that declares none, which is nearly all of them.
    restrict: Scopes,
}

/// One open scope, and the stack pointer as it was before anything in it grew the stack.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
struct Mark {
    /// What tells this scope apart from every other one. Two scopes that have grown nothing look
    /// alike otherwise, and a jump has to know which of them it is leaving.
    scope: u32,
    /// The stack pointer saved on the way through it, absent until something in it grows the
    /// stack and absent for good in the scopes that never do.
    saved: Option<Value>,
}

/// Where an exact overflow check is sending its answer.
///
/// The two halves of the destination type that the arithmetic in [`Body::overflow_exactly`] asks
/// about, carried together because every step of it asks about both at once: how many bits there
/// are to fit into, and whether one of them is the sign.
#[derive(Debug, Clone, Copy)]
struct Destination {
    /// The type of the value being stored, which the exact answer is narrowed to.
    ty: Type,
    /// Whether that type has a sign, which decides both what the narrowing extends back as and
    /// which side of zero the answer is allowed to reach further on.
    signed: bool,
}

/// A jump whose stack cannot be settled where it is built.
///
/// A `goto` is allowed to name a label the walk has not reached yet, so what the stack should be
/// on arrival is not known there. What is left behind is the branch and the scopes the jump was
/// made in, and [`Body::settle`] puts the restore in front of the branch once every label has
/// been reached.
#[derive(Debug)]
struct Jump {
    /// The branch, which the restore goes in front of.
    inst: Inst,
    /// The scopes the jump was made in.
    from: Vec<Mark>,
    /// The labelled statements control can arrive at, which is one for a `goto` and every label
    /// whose address the function takes for a computed one.
    targets: Vec<StmtId>,
    /// What to call it in the message, for the shapes that are still turned down.
    what: &'static str,
    /// Where it was written.
    span: Span,
}

/// What a jump has to do to the stack to land where a label is.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum Landing {
    /// Nothing. Everything the label expects to be on the stack is already there.
    Same,
    /// Put the stack pointer back to this, which gives back every scope the jump leaves. The
    /// oldest of them is enough, since restoring it takes back what the newer ones did too.
    Restore(Value),
    /// The label is inside a scope that grew the stack and the jump is not in that scope, so
    /// arriving there means arriving somewhere an object was never made. C does not allow it,
    /// and the checking turns a `goto` that does it down before the walk runs, so what is left
    /// here is a computed one.
    Enters,
}

impl std::fmt::Debug for Body<'_, '_> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("Body").field("at", &self.at).field("vars", &self.vars.len()).finish()
    }
}

impl<'u> Body<'_, 'u> {
    // Building blocks.

    /// The typed tree.
    ///
    /// The reference is copied out of the unit rather than reborrowed from it, which is what
    /// makes reading a node and then building something not two borrows of the walk at once.
    fn tast(&self) -> &'u Tast {
        self.unit.tast
    }

    /// The type table, copied out for the same reason.
    fn types(&self) -> &'u Types {
        self.unit.types
    }

    /// What the target is, copied out for the same reason.
    fn target(&self) -> &'u TargetInfo {
        self.unit.target
    }

    /// What an arithmetic instruction in a signed type says about overflowing, which is that it
    /// does not unless the command line said otherwise.
    ///
    /// Unsigned arithmetic says nothing, because C defines what it does and there is nothing to
    /// assume. `-fwrapv` makes the signed answer the unsigned one: the instruction is the same
    /// instruction and the machine gives the same bits, and all that changes is that no pass may
    /// reason from an overflow being impossible.
    fn signed_overflow(&self, signed: bool) -> Flags {
        if signed && !self.unit.wrapping.signed { Flags::NSW } else { Flags::NONE }
    }

    /// The same for the multiply that turns a number of elements into a number of bytes, which is
    /// pointer arithmetic rather than the program's own.
    ///
    /// `p[i]` says nothing about `i * sizeof *p` in the source, and what licenses the assumption is
    /// that the result has to land inside the object `p` points into or one past its end. That is
    /// what `-fwrapv-pointer` withdraws, and it is a separate flag from `-fwrapv` because it is a
    /// separate assumption: a program can mean its signed arithmetic to wrap and still never walk a
    /// pointer off an object.
    fn stride_overflow(&self) -> Flags {
        if self.unit.wrapping.pointer { Flags::NONE } else { Flags::NSW }
    }

    /// The two letters the runtime spells this width with, or nothing for a width it has no
    /// checked routine for.
    ///
    /// The routines are named after the machine mode of what they work on, so an `int` is `si`, a
    /// `long long` is `di` and an `__int128` is `ti`. There is nothing narrower and nothing
    /// narrower is needed, because C promotes a `char` and a `short` to an `int` before any
    /// operator sees them and the addition that could overflow is at `int` by the time it is
    /// lowered. A vector has no routine either, and gcc checks no vector.
    ///
    /// The widest of the three is named for completeness rather than because it works today: the
    /// back end cannot pass a 128 bit value in registers yet, so a call to that routine is
    /// reported as not lowered. That is where 128 bit arithmetic stands generally and not
    /// something this flag introduces, and the name is right for when it moves.
    fn trapping_width(ty: Type) -> Option<&'static str> {
        if !ty.is_int() || !ty.is_scalar() {
            return None;
        }
        match ty.bits() {
            32 => Some("si"),
            64 => Some("di"),
            128 => Some("ti"),
            _ => None,
        }
    }

    /// A call to the runtime routine that does an operation and stops if it overflowed, which is
    /// what `-ftrapv` turns the operation into.
    ///
    /// The routine does the arithmetic, works out whether the answer is the right one and calls
    /// `abort` where it is not, so what comes back is the value the instruction would have
    /// produced and stopping is the routine's own business rather than something written here.
    /// These are libgcc's names and libgcc is already linked, which is what makes this a call to a
    /// name rather than a comparison written out: an object rucc compiled and an object gcc
    /// compiled stop the same way in the same program.
    fn trapping(&mut self, routine: &str, args: &[Value], ty: Type, span: Span) -> Value {
        let params = vec![ty; args.len()];
        let symbol = self.unit.names.intern(routine);
        let sig =
            self.func.add_signature(Signature::new().with_params(&params).with_returns(&[ty]));
        let inst = self.build(span).call_varargs(symbol, sig, args, &[]);
        self.func[inst].results().next().expect("a checked routine gives back its answer")
    }

    /// The call one signed operation becomes where the build asked for it to be checked, or
    /// nothing where it asked for nothing or where this is not one of the operations checked.
    ///
    /// The operations gcc checks are the four that can overflow in a signed type: an add, a
    /// subtract, a multiply and a negation, the last of which has a routine of its own and is
    /// [`Self::signed_negate`]. A shift is not among them and neither is a divide, for the reason
    /// gcc leaves them alone as well: what a shift that moves a bit past the top does is undefined
    /// for a reason of its own, and the one division that overflows already stops on the hardware.
    fn checked_binary(
        &mut self,
        opcode: Opcode,
        lhs: Value,
        rhs: Value,
        signed: bool,
        span: Span,
    ) -> Option<Value> {
        if !signed || !self.unit.wrapping.trap {
            return None;
        }
        let name = match opcode {
            Opcode::Add => "add",
            Opcode::Sub => "sub",
            Opcode::Mul => "mul",
            _ => return None,
        };
        let ty = self.func[lhs].ty;
        let width = Self::trapping_width(ty)?;
        Some(self.trapping(&format!("__{name}v{width}3"), &[lhs, rhs], ty, span))
    }

    /// A negation, which is zero minus the value, or the call the build asked for instead.
    ///
    /// Written once because both the scalar and the vector lane path want the same thing, and
    /// because the checked form is a routine of its own rather than a subtract from zero: gcc
    /// emits `__negvsi2` where it emits `__subvsi3` for a subtraction, and the two are different
    /// names for the same answer only because the runtime wrote them both.
    fn signed_negate(&mut self, value: Value, signed: bool, span: Span) -> Value {
        let out = self.func[value].ty;
        if signed && self.unit.wrapping.trap {
            if let Some(width) = Self::trapping_width(out) {
                return self.trapping(&format!("__negv{width}2"), &[value], out, span);
            }
        }
        let flags = self.signed_overflow(signed);
        let mut build = self.build(span);
        let zero = build.iconst(out, 0);
        build.binary(Opcode::Sub, zero, value, flags)
    }

    /// The block being appended to.
    fn block(&self) -> Block {
        self.at.expect("nothing is built while the cursor is in unreachable code")
    }

    /// A builder on that block, with that span on everything it makes.
    fn build(&mut self, span: Span) -> Builder<'_> {
        let block = self.block();
        Builder::new(self.func, block).at(span)
    }

    /// A fresh block, which nothing branches to yet.
    fn new_block(&mut self) -> Block {
        self.func.create_block()
    }

    /// An unconditional branch to a block, which leaves the cursor in unreachable code.
    fn jump(&mut self, target: Block, span: Span) -> Inst {
        let inst = self.build(span).jump(target, &[]);
        self.ssa.branch(self.func, inst);
        self.at = None;
        inst
    }

    /// A two-way branch, which leaves the cursor in unreachable code.
    fn br_if(&mut self, cond: Value, then: Block, otherwise: Block, span: Span) {
        let inst = self.build(span).br_if(cond, then, &[], otherwise, &[]);
        self.ssa.branch(self.func, inst);
        self.at = None;
    }

    /// A variable number nothing else uses, for a temporary the program did not declare.
    fn temp(&mut self) -> Var {
        let var = Var::new(self.next_var);
        self.next_var += 1;
        var
    }

    /// Decides where a local lives and makes its slot when it needs one.
    fn declare(&mut self, decl: DeclId, escaped: bool) {
        let tast = self.tast();
        let ty = tast[decl].ty;
        if tast[decl].duration != StorageDuration::Automatic {
            // A `static` in a function is a global, and a reference to it goes through its
            // name like any other. Nothing here holds it.
            return;
        }
        if repr::is_variable_length(self.types(), ty) {
            // Nothing here: an object whose size is not known until the walk reaches the
            // declaration cannot have its slot made in advance, so it is made there.
            return;
        }
        let value = repr::value_type(self.types(), self.target(), ty);
        // An atomic object always gets a slot, whether or not the program takes its address.
        // What makes an access to one atomic is the instruction that reaches memory, and a
        // variable held in a register has no such instruction and nothing to be atomic about.
        // Nothing could tell the difference, since no other thread can name a local whose
        // address never leaves the function, and gcc keeps the slot as well rather than
        // reasoning about what a program is able to observe.
        if !escaped && !self.is_atomic(ty) && value.is_some() {
            let var = self.temp();
            self.vars.insert(decl, Local::Value(var));
            return;
        }
        let span = tast.decl_span(decl);
        let size = repr::size_of(self.types(), self.target(), ty);
        let align =
            tast[decl].alignment.unwrap_or_else(|| repr::align_of(self.types(), self.target(), ty));
        let align = repr::local_align(self.types(), self.target(), ty, align);
        let slot = self.alloca(size, align, span);
        self.vars.insert(decl, Local::Slot(slot));
    }

    /// A stack slot of a fixed size, in the entry block where the verifier wants it.
    fn alloca(&mut self, size: u64, align: u32, span: Span) -> Value {
        let mut build = self.build(span);
        let info = MemInfo {
            size,
            align,
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        };
        let mem = build.func().add_mem(info);
        build.value(InstData { extra: Extra::Mem(mem), ..InstData::new(Opcode::Alloca) }, Type::PTR)
    }

    /// A stack slot in the entry block, wherever the walk has got to.
    ///
    /// The scratch a call needs is not known before the walk reaches the call, and an `alloca`
    /// of a fixed size belongs at the top of the function however late it was decided on: one in
    /// a loop is a stack that grows every time round. So it is built detached and put in front
    /// of whatever the entry block starts with.
    fn scratch(&mut self, size: u64, align: u32, span: Span) -> Value {
        let entry = self.func.entry().expect("a body being walked has an entry block");
        let info = MemInfo {
            size,
            align,
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        };
        let mem = self.func.add_mem(info);
        let data = InstData { extra: Extra::Mem(mem), ..InstData::new(Opcode::Alloca) };
        let first = self.func.insts(entry).next();
        match first {
            Some(first) => {
                let inst = self.func.create_inst(data, &[Type::PTR], span);
                self.func.insert_before(inst, first);
                self.func[inst].results().next().expect("an alloca produces its address")
            }
            None => Builder::new(self.func, entry).at(span).value(data, Type::PTR),
        }
    }

    /// A stack slot whose size is not known until the walk gets there, which is what an object
    /// of a variably modified type lives in.
    ///
    /// It is where the declaration is rather than in the entry block, because that is where the
    /// size is known and because C says the object comes into existence there. The stack it
    /// takes is given back at the end of the scope it was declared in.
    fn dynamic(&mut self, size: Value, align: u32, span: Span) -> Value {
        self.mark(span);
        let info = MemInfo {
            size: 0,
            align,
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        };
        let mut build = self.build(span);
        let mem = build.func().add_mem(info);
        let args = build.func().push_values(&[size]);
        build.value(
            InstData { args, extra: Extra::Mem(mem), ..InstData::new(Opcode::Alloca) },
            Type::PTR,
        )
    }

    /// Saves the stack pointer for the scope the walk is in, if it has not been saved already.
    ///
    /// The save is where the first thing that grows the stack is rather than at the top of the
    /// scope, which is the same pointer and one instruction fewer in a scope that turns out to
    /// grow nothing. A scope that grows the stack twice saves once and gives both back together.
    fn mark(&mut self, span: Span) {
        let Some(scope) = self.marks.last().copied() else { return };
        if scope.saved.is_some() {
            return;
        }
        let saved = self.build(span).value(InstData::new(Opcode::StackSave), Type::PTR);
        if let Some(last) = self.marks.last_mut() {
            last.saved = Some(saved);
        }
    }

    /// Opens a scope, which is a block of statements the stack is given back at the end of.
    fn open(&mut self) {
        let scope = self.next_scope;
        self.next_scope += 1;
        self.marks.push(Mark { scope, saved: None });
    }

    /// Closes the innermost scope, giving back what it grew the stack by.
    fn close(&mut self, span: Span) {
        let mark = self.marks.pop().expect("a scope is closed by whoever opened it");
        self.restore(mark.saved, span);
    }

    /// Gives the stack back down to what it was at `depth` scopes, for a `break` or a
    /// `continue` that leaves several scopes at once.
    ///
    /// The outermost of the marks being left is the one to restore, since it is the oldest
    /// stack pointer of them and restoring it takes back everything the inner ones did too.
    fn unwind(&mut self, depth: usize, span: Span) {
        let saved =
            self.marks.get(depth..).and_then(|open| open.iter().find_map(|mark| mark.saved));
        self.restore(saved, span);
    }

    /// One `stackrestore`, if there is a pointer to restore and somewhere to put it.
    fn restore(&mut self, saved: Option<Value>, span: Span) {
        let (Some(saved), Some(_)) = (saved, self.at) else { return };
        let mut build = self.build(span);
        let args = build.func().push_values(&[saved]);
        build.inst(InstData { args, ..InstData::new(Opcode::StackRestore) }, &[]);
    }

    /// One `stackrestore` in front of a branch, which is where a jump out of a scope gives back
    /// what that scope grew the stack by.
    fn restore_before(&mut self, saved: Value, branch: Inst, span: Span) {
        let args = self.func.push_values(&[saved]);
        let data = InstData { args, ..InstData::new(Opcode::StackRestore) };
        let inst = self.func.create_inst(data, &[], span);
        self.func.insert_before(inst, branch);
    }

    /// The object of a declaration whose type is variably modified, built where the walk
    /// reaches it.
    fn variable_length(&mut self, decl: DeclId) {
        let tast = self.tast();
        let ty = tast[decl].ty;
        let span = tast.decl_span(decl);
        // The sizes first, and once: they are what the object is as long as, and what every
        // `sizeof` of it and every step over its rows answers with afterwards.
        self.measure(ty);
        if !repr::is_variable_length(self.types(), ty) {
            // A declaration of a variably modified type that is not an array itself, `int
            // (*p)[n]`, whose object is an ordinary pointer with its slot already made. The
            // sizes in it still had to be evaluated here, which is what the measuring above is.
            return;
        }
        if tast[decl].duration != StorageDuration::Automatic || self.at.is_none() {
            // A variably modified object with static storage is reported by the checking, since
            // there is no run time at file scope to work its size out in.
            return;
        }
        let size = self.size_value(ty, span);
        let align =
            tast[decl].alignment.unwrap_or_else(|| repr::align_of(self.types(), self.target(), ty));
        let slot = self.dynamic(size, align, span);
        self.vars.insert(decl, Local::Slot(slot));
    }

    /// Evaluates the sizes in a type, where the declaration carrying it was reached.
    ///
    /// A type is a tree and the sizes in it are the leaves: `int (*p)[n][m]` has two of them,
    /// and both are evaluated here even though nothing has asked what `p` points at yet. Doing
    /// it any later would be reading `n` at the wrong time, which is the whole point of the
    /// rule that says the size of a variable length array is worked out where its declaration
    /// is and not where it is used.
    fn measure(&mut self, ty: TypeId) {
        let canonical = self.types().canonical(ty);
        match self.types().kind(canonical) {
            TypeKind::Pointer(pointee) => self.measure(pointee),
            TypeKind::Array { elem, len } => {
                if let ArrayLen::Variable(vla) = len {
                    self.count(vla);
                }
                self.measure(elem);
            }
            _ => {}
        }
    }

    /// How many elements one variable length array has, evaluated once and remembered.
    fn count(&mut self, vla: VlaId) -> Value {
        let expr = self.tast().vla_size(vla);
        if let Some(&value) = self.vlas.get(&expr) {
            return value;
        }
        let value = self.value(expr);
        self.vlas.insert(expr, value);
        value
    }

    /// How many bytes an object of this type is, as a value.
    ///
    /// A constant for every type but a variably modified one, which is a multiplication of what
    /// its sizes turned out to be by what its element is.
    fn size_value(&mut self, ty: TypeId, span: Span) -> Value {
        let address = self.address;
        let canonical = self.types().canonical(ty);
        let TypeKind::Array { elem, len } = self.types().kind(canonical) else {
            let size = repr::size_of(self.types(), self.target(), ty);
            return self.build(span).iconst(address, i128::from(size));
        };
        let count = match len {
            ArrayLen::Variable(vla) => {
                let value = self.count(vla);
                let ty = self.tast()[self.tast().vla_size(vla)].ty;
                let signed = repr::is_signed(self.types(), self.target(), ty);
                self.widen(value, signed, address, span)
            }
            ArrayLen::Fixed(count) => self.build(span).iconst(address, i128::from(count)),
            // An array of an unknown length has no size, and one of these is only reached
            // through a type the checking would have turned down.
            ArrayLen::Unknown | ArrayLen::Star => self.build(span).iconst(address, 0),
        };
        let elem = self.size_value(elem, span);
        self.build(span).binary(Opcode::Mul, count, elem, Flags::NSW)
    }

    /// How far one step over a type moves.
    fn stride(&mut self, ty: TypeId, span: Span) -> Stride {
        if repr::is_variable_length(self.types(), ty) {
            return Stride::Value(self.size_value(ty, span));
        }
        Stride::Bytes(repr::size_of(self.types(), self.target(), ty))
    }

    /// One of the function's own parameters, in whatever form the call brought it.
    fn parameter(&mut self, entry: Block, decl: DeclId, travel: &Travel, span: Span) {
        let ty = self.tast()[decl].ty;
        let local = self.vars.get(&decl).copied();
        match travel.pass {
            // An object with no bytes in it, which travels nowhere and has nothing to store.
            Pass::Ignore => {}
            Pass::Direct => {
                let value = self.func.append_param(entry, travel.types[0]);
                // What arrived and what the body reads are the same type wherever a prototype
                // said what the parameter is. In an old style definition they are not: the call
                // promotes what it passes, because there is no prototype for it to convert the
                // argument to, so `f(c) unsigned char c;` is handed an `int` for a parameter the
                // body reads as an `unsigned char`. Storing that `int` unconverted is how
                // `f(-1)` sees something other than 255, and how a `float` parameter given a
                // promoted `double` builds IR the verifier refuses.
                let value = self.coerce(value, travel.ty, ty, span);
                match local {
                    Some(Local::Value(var)) => self.ssa.write(var, entry, value),
                    Some(Local::Slot(slot)) => {
                        let info = self.access(ty);
                        self.build(span).store(value, slot, info, Flags::NONE);
                    }
                    None => {}
                }
            }
            Pass::Pieces(_) => {
                let types = travel.types.clone();
                let values: Vec<Value> =
                    types.iter().map(|ty| self.func.append_param(entry, *ty)).collect();
                if let Some(Local::Slot(slot)) = local {
                    self.store_slots(slot, travel, &values, span);
                }
            }
            // The caller passed the address of a copy, or of the bytes it put in the argument
            // area. Either way the object the body works on is the parameter's own slot, so
            // what arrives is copied into it and nothing else in the walk has to know.
            Pass::Reference | Pass::Memory => {
                let addr = self.func.append_param(entry, Type::PTR);
                if let Some(Local::Slot(slot)) = local {
                    self.memcpy(slot, addr, travel.size, travel.align, span);
                }
            }
        }
    }

    /// Writes the registers an aggregate travelled in into the object.
    fn store_slots(&mut self, addr: Value, travel: &Travel, values: &[Value], span: Span) {
        // A register holding the last few bytes of an object is as wide as a register and not as
        // wide as what is left, so storing it straight into the object would write past the end
        // of it. What that takes is a buffer wide enough for the registers, which the object is
        // then copied out of.
        let reach = travel.reach();
        let wide = reach > travel.size;
        let into = if wide { self.scratch(reach, travel.align, span) } else { addr };
        let slots: Vec<rucc_target::Slot> = travel.slots().to_vec();
        for (slot, value) in slots.iter().zip(values) {
            let at = self.offset(into, slot.offset(), span);
            let info = self.piece_info(travel.align, slot.offset());
            self.build(span).store(*value, at, info, Flags::NONE);
        }
        if wide {
            self.memcpy(addr, into, travel.size, travel.align, span);
        }
    }

    /// Reads the object into the registers it travels in.
    fn load_slots(&mut self, addr: Value, travel: &Travel, span: Span) -> Vec<Value> {
        let reach = travel.reach();
        let from = if reach > travel.size {
            // The same three bytes past the end of a five byte object, read this time.
            let buffer = self.scratch(reach, travel.align, span);
            self.memcpy(buffer, addr, travel.size, travel.align, span);
            buffer
        } else {
            addr
        };
        let slots: Vec<rucc_target::Slot> = travel.slots().to_vec();
        let types = travel.types.clone();
        let mut values = Vec::with_capacity(slots.len());
        for (slot, ty) in slots.iter().zip(types) {
            let at = self.offset(from, slot.offset(), span);
            let info = self.piece_info(travel.align, slot.offset());
            values.push(self.build(span).load(ty, at, info, Flags::NONE));
        }
        values
    }

    /// How aligned one register's worth of an object is, which is what its offset leaves of the
    /// object's own alignment.
    fn piece_info(&self, align: u32, offset: u64) -> MemInfo {
        let at = if offset == 0 { align } else { align.min(1 << offset.trailing_zeros().min(16)) };
        MemInfo {
            size: 0,
            align: at.max(1),
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        }
    }

    /// How an object of that type is accessed: how wide, how aligned, and through what type.
    ///
    /// The type is the node layer 3 of the alias analysis walks, and it is the one place a load or
    /// a store gets one, so every access that goes through a C type gets it and every access that
    /// does not goes without. The copies are the ones that go without: a `memcpy` is bytes moving
    /// and the bytes have a type at each end rather than one in the middle.
    fn access(&mut self, ty: TypeId) -> MemInfo {
        MemInfo { tbaa: self.unit.alias_node(ty), ..self.shape(ty) }
    }

    /// Everything about an access except which type it goes through.
    ///
    /// Split out so that a caller which has already decided what the access names does not build
    /// the node for the type it would otherwise have named. A node nothing points at is an entry
    /// every later reader of the metadata table carries around for nothing.
    fn shape(&self, ty: TypeId) -> MemInfo {
        MemInfo {
            // Zero, because a load takes its width from the type it produces and a store from
            // the value it writes. The field is for the copies, which have no such type.
            size: 0,
            align: repr::align_of(self.types(), self.target(), ty),
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        }
    }

    /// The same for a place, which knows the one thing about an access its type does not.
    ///
    /// A member of a union names bytes that another member may have been written through, and
    /// C 6.5.2.3 permits reading them back that way, so an access to one of them carries the root
    /// of the aliasing tree rather than the node for the member's own type. The root is the node
    /// that conflicts with everything, which is the conservative answer layer 3 of the alias
    /// analysis needs and the one the type plane needs too.
    ///
    /// The optimizer would have been right without this, because layer 4 settles two accesses to
    /// one object on their offsets before the types are looked at. The type plane has no layer 4:
    /// it is a byte and a number, the number travels into a program's memory, and a store through
    /// one member followed by a read through another is exactly the shape a check against it would
    /// refuse. So the front end says so once, here, and both readers get the same answer.
    ///
    /// What it does not cover is a member reached through a pointer taken earlier, since
    /// `float *q = &u.f` is a place with no union in sight by the time it is read through. That is
    /// the residual hole in the punning story and it wants the pointer's own provenance rather than
    /// the name of the access.
    fn info_of(&mut self, place: Place) -> MemInfo {
        let info = if place.punned {
            MemInfo { tbaa: self.unit.alias_root(), ..self.shape(place.ty) }
        } else {
            self.access(place.ty)
        };
        let info = MemInfo { owns: place.owns, restrict: place.restrict, ..info };
        // The smaller of what the type would give the access and what the layout left the address
        // with, for an address the layout settled. They differ only where something was packed.
        let Where::Addr(addr) = place.at else { return info };
        match self.alignment(addr) {
            Some(known) => MemInfo { align: info.align.min(known), ..info },
            None => info,
        }
    }

    /// The flags an access to that type carries.
    fn flags(&self, ty: TypeId) -> Flags {
        if self.types().quals(ty).has(Qualifiers::VOLATILE) { Flags::VOLATILE } else { Flags::NONE }
    }

    /// Whether the type has `_Atomic` on it.
    fn is_atomic(&self, ty: TypeId) -> bool {
        matches!(self.types().kind(self.types().canonical(ty)), TypeKind::Atomic(_))
    }

    /// The type under the `_Atomic`, which is the type itself where there is none.
    fn underlying(&self, ty: TypeId) -> TypeId {
        match self.types().kind(self.types().canonical(ty)) {
            TypeKind::Atomic(inner) => inner,
            _ => ty,
        }
    }

    /// Whether an access to that type has to be an ordered one, reporting where it has to be one
    /// this compiler cannot make.
    ///
    /// C11 6.5.16p3 and 5.1.2.4 make a plain read or a plain write of an atomic object a
    /// sequentially consistent one, which is the strongest ordering there is and the only one the
    /// language spells without a call. A program that wants a weaker one asks for it by name
    /// through `<stdatomic.h>`.
    ///
    /// What this compiler cannot make is an access to an object that is not one value the machine
    /// reaches in one instruction: a structure, or something wider than a machine word. gcc calls
    /// into libatomic for those, which takes a lock out of a table keyed by the address, and a
    /// program half of whose accesses take that lock and half of which do not is not atomic at
    /// all. So the ones there is no instruction for are refused rather than done without a lock.
    fn atomic_access(&mut self, ty: TypeId, span: Span) -> bool {
        if !self.is_atomic(ty) {
            return false;
        }
        let inner = self.underlying(ty);
        let size = repr::size_of(self.types(), self.target(), ty);
        let single = repr::value_type(self.types(), self.target(), ty).is_some()
            && !rucc_types::is_vector(self.types(), inner);
        if single && matches!(size, 1 | 2 | 4 | 8) {
            return true;
        }
        self.unsupported("an atomic object this compiler cannot reach in one instruction", span);
        false
    }

    /// The IR type of a C type, reporting once for one that has none.
    fn value_type(&mut self, ty: TypeId, span: Span) -> Type {
        match repr::value_type(self.types(), self.target(), ty) {
            Some(ty) => ty,
            None => {
                self.unit.unsupported("a value of this type", span);
                Type::PTR
            }
        }
    }

    /// A value to carry on with after something was reported.
    fn poison(&mut self, ty: Type, span: Span) -> Value {
        let address = self.address;
        if ty.is_ptr() {
            let zero = self.build(span).iconst(address, 0);
            return self.build(span).unary(Opcode::IntToPtr, zero, Type::PTR);
        }
        if ty.lane().is_float() {
            return self.build(span).fconst(ty, 0);
        }
        self.build(span).iconst(ty, 0)
    }

    // Statements.

    /// One statement.
    fn stmt(&mut self, id: StmtId) {
        if self.at.is_none() {
            self.unreachable_stmt(id);
            return;
        }
        let tast = self.tast();
        let span = tast.stmt_span(id);
        match tast[id] {
            Stmt::Error | Stmt::Empty => {}
            Stmt::Expr(expr) => self.discard(expr),
            Stmt::Block(list) => {
                self.open();
                for index in 0..tast[list].len() {
                    let stmt = tast[list][index];
                    self.stmt(stmt);
                }
                self.close(span);
            }
            Stmt::Decls(list) => {
                for index in 0..tast[list].len() {
                    let decl = tast[list][index];
                    // A declaration of a variably modified type is the point where the sizes in
                    // it are evaluated, whether it declares an object, a pointer to one or a
                    // name for the type.
                    self.variable_length(decl);
                    self.init(decl);
                }
            }
            Stmt::If { cond, then, otherwise } => self.if_stmt(cond, then, otherwise, span),
            Stmt::While { cond, body } => self.while_stmt(cond, body, span),
            Stmt::DoWhile { body, cond } => self.do_while(body, cond, span),
            Stmt::For { init, cond, step, body } => self.for_stmt(init, cond, step, body, span),
            Stmt::Break => self.leave(true, span),
            Stmt::Continue => self.leave(false, span),
            Stmt::Return(value) => self.return_stmt(value, span),
            Stmt::Switch { cond, body, cases, default } => {
                self.switch_stmt(cond, body, cases, default, span);
            }
            Stmt::Case { body, .. } | Stmt::Default { body } | Stmt::Label { body, .. } => {
                self.labelled(body, span);
            }
            Stmt::Goto(label) => self.goto(label, span),
            Stmt::IndirectGoto(target) => self.indirect_goto(target, span),
            Stmt::Asm(asm) => self.asm(asm, span),
        }
    }

    /// A statement in unreachable code, which is lowered to nothing unless there is a label in
    /// it.
    ///
    /// That label is the whole reason this exists. In `switch (x) { case 1: break; case 2: f(); }`
    /// there is no way to reach the second case except through the `switch`, and in
    /// `if (x) goto out; return 1; out: return 2;` there is no way to reach `out` except through
    /// the `goto`, so the walk arrives at both with no block to append to and has to start one
    /// rather than drop what follows. The statements a label can be reached through are walked,
    /// and the rest are dropped.
    ///
    /// A label somewhere the walk cannot start, which is inside a loop or an `if` that is itself
    /// unreachable, is reported. Control there jumps into the middle of a construct the walk only
    /// knows how to build from the top, and lowering it to the construct without the jump would
    /// be a miscompile. Duff's device is not this: there the `do` is what the first `case`
    /// labels, so it is reached from the top and the labels inside it are ordinary edges.
    fn unreachable_stmt(&mut self, id: StmtId) {
        let tast = self.tast();
        match tast[id] {
            Stmt::Block(list) => {
                for index in 0..tast[list].len() {
                    let stmt = tast[list][index];
                    self.stmt(stmt);
                }
            }
            Stmt::Case { body, .. } | Stmt::Default { body } | Stmt::Label { body, .. } => {
                let span = tast.stmt_span(id);
                self.labelled(body, span);
            }
            _ => {
                if holds_a_label(tast, id, true) {
                    // A label inside a loop or an `if` that nothing falls into. The construct
                    // still has to be built, because control arrives in the middle of it and
                    // leaves through the parts around it, so a block nothing branches to is
                    // started and the walk goes on from there as if the statement were
                    // reachable. What that builds ahead of the label is reached by nothing and
                    // is taken out with the other unreachable blocks at the end.
                    self.at = Some(self.new_block());
                    self.stmt(id);
                }
            }
        }
    }

    /// `__builtin_va_arg(list, T)`, which is one argument off a variable argument list.
    ///
    /// It stays an intrinsic rather than becoming the loads and the branch it is on the way to
    /// the machine, because which of those it is is the target's answer and this is not where
    /// the target's answers are kept. The list arrives as a pointer, which is what every
    /// target's `va_list` has decayed to by the time anything reads it.
    fn va_arg(&mut self, list: ExprId, ty: TypeId, span: Span) -> Option<Value> {
        let list = self.value(list);
        let result = repr::value_type(self.types(), self.target(), ty)?;
        let mut build = self.build(span);
        let args = build.func().push_values(&[list]);
        Some(build.value(InstData { args, ..InstData::new(Opcode::VaArg) }, result))
    }

    /// The same thing where what is read is a structure or a union, which answers where the
    /// object is rather than what it is.
    ///
    /// An aggregate is not a value and there is nothing for the result of [`Opcode::VaArg`] to
    /// be, so the object form is a second instruction and not a wider reading of the first. The
    /// size and the alignment travel with it because they are what the algorithm steps the list
    /// on by and what a target that has to put registers somewhere needs to know.
    ///
    /// The classification travels with it too, and it is done here rather than in the backend
    /// because it is the answer to a question about a C type and this is the last place that
    /// still has one. An object it sent to the argument area carries no slots, which is what
    /// says the backend has nothing to look for in the register save area.
    fn va_object(&mut self, list: ExprId, ty: TypeId, span: Span) -> Value {
        let list = self.value(list);
        let size = repr::size_of(self.types(), self.target(), ty);
        let align = repr::align_of(self.types(), self.target(), ty);
        let info = MemInfo {
            size,
            align,
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        };
        let slots = abi::va_slots(self.types(), self.target(), ty);
        let mut build = self.build(span);
        let mem = build.func().add_mem(info);
        let slots = build.func().push_slots(&slots);
        let object = build.func().add_va_object(VaInfo { mem, slots });
        let args = build.func().push_values(&[list]);
        let data =
            InstData { args, extra: Extra::VaObject(object), ..InstData::new(Opcode::VaObject) };
        build.value(data, Type::PTR)
    }

    /// `__builtin_va_start`, `__builtin_va_end` and `__builtin_va_copy`, which are the three of
    /// the family that read nothing and answer nothing.
    ///
    /// Each of them is one instruction over the address of a list, for the reason `va_arg` is
    /// one: what the target does to a list is the target's answer. `va_end` is nothing at all on
    /// every psABI in this compiler, and it is still emitted, because it is what says the list
    /// stops being read here and something later may want to know that.
    fn va_effect(&mut self, opcode: Opcode, lists: &[ExprId], span: Span) {
        let lists: Vec<Value> = lists.iter().map(|&list| self.value(list)).collect();
        let mut build = self.build(span);
        let args = build.func().push_values(&lists);
        build.inst(InstData { args, ..InstData::new(opcode) }, &[]);
    }

    /// The statements of a `({ ... })`, with the one that produced its value left undone.
    ///
    /// The scope is opened here and closed by the caller, since the value has to be taken out
    /// before the objects the block declared are given back: `({ int a[n]; a[0]; })` reads the
    /// array while it is still there. What is answered is the last statement when it is an
    /// expression statement, which is where the value of one of these comes from, and nothing
    /// when it is anything else, which is what makes `({ })` and `({ int x; })` both `void`.
    ///
    /// The cursor is left somewhere whatever the statements did, so that the expression this
    /// sits in has a block to be built in. `({ return 1; 0; })` leaves it in a block nothing
    /// branches to, which is what the rest of that expression is, and which is taken out with
    /// the other unreachable blocks at the end.
    fn statements(&mut self, id: StmtId) -> Option<ExprId> {
        let tast = self.tast();
        self.open();
        let mut value = None;
        match tast[id] {
            Stmt::Block(list) => {
                let count = tast[list].len();
                for index in 0..count {
                    let stmt = self.tast()[list][index];
                    match self.tast()[stmt] {
                        Stmt::Expr(expr) if index + 1 == count => value = Some(expr),
                        _ => self.stmt(stmt),
                    }
                }
            }
            // Not a block, which the parser does not build and the checking gives `void`.
            _ => self.stmt(id),
        }
        if self.at.is_none() {
            let dead = self.new_block();
            self.ssa.seal(self.func, dead);
            self.at = Some(dead);
        }
        value
    }

    /// `name:`, `case value:` or `default:`, which is a block whatever reaches the label
    /// branches to.
    ///
    /// It is a block even when control also falls into it from the statement before, because
    /// something branches to it and a block is what a branch needs. The key is the statement the
    /// label labels, which is what the case table and the label table both hold, so the block a
    /// `switch` or a `goto` was built with and the block the walk arrives at are the same one.
    fn labelled(&mut self, body: StmtId, span: Span) {
        let block = self.label_block(body);
        if self.grows {
            // The scopes control lands in, which is what a jump to this label has to put the
            // stack back to. Taken before the labelled statement is walked, since a scope that
            // statement opens is one the label is outside of.
            self.landings.insert(body, self.marks.clone());
        }
        if self.at.is_some() {
            self.jump(block, span);
        }
        self.at = Some(block);
        self.stmt(body);
    }

    /// `goto name;`, which is a jump to the block the label starts.
    ///
    /// The block is made here when the `goto` comes first, which is the common direction, and
    /// found when the label does. Either way it is one entry in the same table, so a label with
    /// twenty `goto`s to it is one block with twenty edges into it.
    ///
    /// What the stack should be on arrival is decided by where the label is, which is not known
    /// here when the label is further down, so the branch is remembered and the restore in front
    /// of it is built at the end.
    fn goto(&mut self, label: rucc_sema::LabelId, span: Span) {
        let Some(body) = self.tast()[label].stmt else {
            // A label used and never defined, which the checking reported. There is nowhere to
            // jump to, and what follows is as unreachable as it would have been.
            self.at = None;
            return;
        };
        let block = self.label_block(body);
        let inst = self.jump(block, span);
        self.pending(inst, vec![body], "a goto in a function with a variable length array", span);
        self.at = None;
    }

    /// Remembers a jump whose stack is settled once the walk knows where its labels are.
    ///
    /// Nothing is remembered for a function whose stack does not move, which is nearly all of
    /// them: there is no restore to build anywhere in one, so there is nothing to come back for.
    fn pending(&mut self, inst: Inst, targets: Vec<StmtId>, what: &'static str, span: Span) {
        if self.grows {
            self.jumps.push(Jump { inst, from: self.marks.clone(), targets, what, span });
        }
    }

    /// Puts the stack back where each jump's label expects it, now that every label is known.
    ///
    /// The restore goes in front of the branch, which is where it would have been built if the
    /// answer had been available there. A computed `goto` gets one restore for all of its
    /// labels, so its labels have to want the same one, and one that lands inside a scope it is
    /// not in is turned down: which label it arrives at is not known until the program runs.
    fn settle(&mut self) {
        let jumps = std::mem::take(&mut self.jumps);
        for jump in jumps {
            let mut wanted = None;
            for target in &jump.targets {
                let arriving = self.landings.get(target).map_or([].as_slice(), Vec::as_slice);
                let wants = landing(&jump.from, arriving);
                wanted = match wanted {
                    // Two labels that want different stacks. One restore cannot be right for
                    // both of them and which one control arrives at is not known here, so this
                    // is turned down for the same reason a jump into a scope is.
                    Some(first) if first != wants => Some(Landing::Enters),
                    _ => Some(wants),
                };
            }
            match wanted {
                Some(Landing::Restore(saved)) => {
                    self.restore_before(saved, jump.inst, jump.span);
                }
                Some(Landing::Enters) => self.unsupported(jump.what, jump.span),
                Some(Landing::Same) | None => {}
            }
        }
    }

    /// `&&name`, GNU's address of a label, which is a value a computed `goto` can jump to.
    ///
    /// The block is the one the label starts, made here when the label has not been reached
    /// yet, and the address of it is not an edge into it: nothing arrives where the address is
    /// taken. The edges are at the `goto *` that uses it.
    fn label_addr(&mut self, label: rucc_sema::LabelId, span: Span) -> Option<Value> {
        let Some(body) = self.tast()[label].stmt else {
            // A label whose address is taken and which is never defined, which the checking
            // reported. There is no block, so there is no address either.
            return Some(self.poison(Type::PTR, span));
        };
        let block = self.label_block(body);
        Some(self.build(span).block_addr(block))
    }

    /// `goto *expr;`, GNU's computed goto, which is a branch to every label the function takes
    /// the address of.
    ///
    /// Which of them it arrives at is the address's business and not the walk's, so all of them
    /// are listed. That is the conservative answer and the only one available: the address can
    /// have been through a table, a parameter or a global on the way here.
    fn indirect_goto(&mut self, target: ExprId, span: Span) {
        let address = self.value(target);
        let taken = self.taken.clone();
        let blocks: Vec<Block> = taken.iter().map(|&body| self.label_block(body)).collect();
        if blocks.is_empty() {
            // Nothing in the function took the address of a label, so the address came from
            // somewhere else, and a jump to a label in another function is undefined. The
            // expression is still evaluated, since it can have side effects in it.
            self.build(span).unreachable();
            self.at = None;
            return;
        }
        let inst = self.build(span).indirect_br(address, &blocks);
        self.ssa.branch(self.func, inst);
        let what = "a computed goto in a function with a variable length array";
        self.pending(inst, taken, what, span);
        self.at = None;
    }

    /// `asm(...)`, GNU's inline assembly.
    ///
    /// The instruction carries one comma separated constraint list in the order the template
    /// numbers its operands, which is the outputs and then the inputs, so `%2` is the third
    /// entry of that list whatever each entry turned out to be. Reading it back is a scan: an
    /// entry that is an output travelling in a register takes the next result, and every other
    /// entry takes the next operand, which is a value for an input and an address for anything
    /// in memory. An output written `+` is read as well as written and so takes both.
    ///
    /// An `asm goto` is a terminator, and its first target is where control arrives when the
    /// assembly does not jump. That is what makes the outputs work: they are written into their
    /// objects in that block, so a label the assembly jumps to is somewhere they never happened,
    /// which is what gcc promises and what the register allocator will have to be told later.
    fn asm(&mut self, id: rucc_sema::AsmId, span: Span) {
        let tast = self.tast();
        let node = tast[id];
        let goto = !tast[node.labels].is_empty();
        if goto && self.grows {
            // The same reason a `goto` is turned down: where the stack should be on arrival
            // depends on the scope the label is in, which the walk does not collect.
            self.unsupported("an asm goto in a function with a variable length array", span);
            return;
        }

        // The constraints of every operand, in the order the template counts them, which is
        // also the order the operands below are built in.
        let mut written = Vec::new();
        for list in [node.outputs, node.inputs] {
            for index in 0..tast[list].len() {
                written.push(self.asm_text(tast[list][index].constraint));
            }
        }
        let constraints = written.join(",");
        let mut clobbers = Vec::with_capacity(tast[node.clobbers].len());
        for index in 0..tast[node.clobbers].len() {
            clobbers.push(self.asm_text(tast[node.clobbers][index]));
        }
        let clobbers = clobbers.join(",");
        let template = self.asm_text(node.template);
        let template = self.unit.names.intern(&template);
        let constraints = self.unit.names.intern(&constraints);
        let clobbers = self.unit.names.intern(&clobbers);

        let mut args = Vec::new();
        let mut results = Vec::new();
        let mut writes = Vec::new();
        for index in 0..tast[node.outputs].len() {
            let operand = tast[node.outputs][index];
            let at = tast.expr_span(operand.value);
            let place = self.place(operand.value);
            if operand.memory {
                let addr = self.address_of(place, at);
                args.push(addr);
                continue;
            }
            let ty = self.value_type(place.ty, at);
            if written[index].starts_with('+') {
                let value = match self.read(place, at) {
                    Some(value) => value,
                    None => self.poison(ty, at),
                };
                args.push(value);
            }
            results.push(ty);
            writes.push(place);
        }
        for index in 0..tast[node.inputs].len() {
            let operand = tast[node.inputs][index];
            let at = tast.expr_span(operand.value);
            if operand.memory {
                let place = self.place(operand.value);
                let addr = self.address_of(place, at);
                args.push(addr);
            } else {
                let value = self.value(operand.value);
                args.push(value);
            }
        }

        // The fall through first and the labels after it, in the order they were written, which
        // is the order `%l0` counts in. A label that was used and never defined was reported by
        // the checking and has no block, so it is not somewhere control can arrive.
        let mut blocks = Vec::new();
        if goto {
            blocks.push(self.new_block());
            for index in 0..tast[node.labels].len() {
                let label = tast[node.labels][index];
                if let Some(body) = tast[label].stmt {
                    blocks.push(self.label_block(body));
                }
            }
        }
        let calls: Vec<BlockCall> = blocks.iter().map(|&block| BlockCall::to(block)).collect();
        let targets = self.func.push_block_calls(&calls);
        let info = AsmInfo { template, constraints, clobbers, targets };
        let flags = if node.quals.has(AsmQuals::VOLATILE) { Flags::VOLATILE } else { Flags::NONE };
        let inst = self.build(span).inline_asm(info, &args, &results, flags);

        if goto {
            self.ssa.branch(self.func, inst);
            let after = blocks[0];
            self.ssa.seal(self.func, after);
            self.at = Some(after);
        }
        let produced: Vec<Value> = self.func[inst].results().collect();
        for (place, value) in writes.into_iter().zip(produced) {
            self.write(place, value, span);
        }
    }

    /// The text of one of the strings of an assembly statement.
    ///
    /// The elements of a narrow literal are its bytes, and a literal that is not narrow was
    /// reported by the checking, so what comes out of one of those is whatever its elements
    /// spell rather than a second complaint about it.
    fn asm_text(&self, id: rucc_sema::StrId) -> String {
        self.tast()[id].elements.iter().filter_map(|&element| char::from_u32(element)).collect()
    }

    /// The block a labelled statement starts, made the first time the `switch`, the `goto` or
    /// the walk asks for it.
    fn label_block(&mut self, body: StmtId) -> Block {
        match self.labels.get(&body) {
            Some(&block) => block,
            None => {
                let block = self.new_block();
                self.labels.insert(body, block);
                block
            }
        }
    }

    /// `switch (cond) body`.
    ///
    /// The cases are in a table on the statement rather than in the body, so the targets are
    /// known before the body is walked and the branch can be emitted first. The body is then
    /// walked with the cursor in unreachable code, which is what it is: the statements between
    /// the `switch` and its first label are reached by nothing, and every label starts a block
    /// the branch above already points at.
    fn switch_stmt(
        &mut self,
        cond: ExprId,
        body: StmtId,
        cases: rucc_sema::CaseList,
        default: Option<StmtId>,
        span: Span,
    ) {
        let value = self.value(cond);
        let ty = self.func[value].ty;
        let tast = self.tast();
        let table = tast[cases].to_vec();
        let mut blocks = Vec::with_capacity(table.len() + 1);

        // A `switch` with no label in it at all is the controlling expression and nothing else.
        // Control cannot get into the body, so it is walked as the unreachable code it is, and
        // the block after the `switch` is the block the `switch` was reached in rather than a
        // new one nothing would ever branch to twice.
        if table.is_empty() && default.is_none() {
            let resume = self.at;
            self.at = None;
            self.loops.push(Frame {
                kind: FrameKind::Switch,
                brk: None,
                cont: None,
                depth: self.marks.len(),
            });
            self.stmt(body);
            self.loops.pop();
            self.at = resume;
            return;
        }

        // Where a value that matches nothing goes, and where a `break` goes. They are the same
        // block when there is no `default:`, and the one after the `switch` is then reached by
        // the branch itself rather than only by whatever breaks out.
        let (default_block, mut after) = match default {
            Some(stmt) => (self.label_block(stmt), None),
            None => {
                let block = self.new_block();
                (block, Some(block))
            }
        };
        if default.is_some() {
            blocks.push(default_block);
        }

        // GNU's `case 1 ... 9` is a range, and a range is not something a jump table holds: the
        // values in it can be more numerous than the instructions in the function. Each one is
        // tested for before the branch instead, as one subtraction and one unsigned comparison,
        // which is the test for `low <= value && value <= high` in two instructions rather than
        // four. The rest go in the table.
        let mut singles = Vec::with_capacity(table.len());
        for case in &table {
            let block = self.label_block(case.body);
            blocks.push(block);
            if case.low == case.high {
                singles.push((case.low, block));
                continue;
            }
            let next = self.new_block();
            let low = self.build(span).iconst(ty, case.low);
            let base = self.build(span).binary(Opcode::Sub, value, low, Flags::NONE);
            let width = self.build(span).iconst(ty, case.high.wrapping_sub(case.low));
            let inside = self.build(span).icmp(IntPred::Ule, base, width);
            self.br_if(inside, block, next, span);
            self.ssa.seal(self.func, next);
            self.at = Some(next);
        }

        // With nothing left for the table, which is a `switch` whose cases are all ranges or
        // one with no cases at all, what is left is where everything else goes.
        if singles.is_empty() {
            self.jump(default_block, span);
        } else {
            let inst = self.build(span).switch(value, default_block, &singles);
            self.ssa.branch(self.func, inst);
            self.at = None;
        }

        self.loops.push(Frame {
            kind: FrameKind::Switch,
            brk: after,
            cont: None,
            depth: self.marks.len(),
        });
        self.stmt(body);
        let frame = self.loops.pop().expect("the frame that was just pushed");
        after = frame.brk;

        // Falling off the end of the body leaves the `switch` the same way `break` does.
        if self.at.is_some() {
            let block = match after {
                Some(block) => block,
                None => {
                    let block = self.new_block();
                    after = Some(block);
                    block
                }
            };
            self.jump(block, span);
        }

        // Every edge into a case has been made now: the branch above made one and falling out
        // of the case before it made the other, which is why none of these could be sealed any
        // earlier and why a variable a case assigns is read correctly in the case after it.
        for &block in &blocks {
            self.seal_once(block);
        }
        if let Some(block) = after {
            self.seal_once(block);
        }
        self.at = after;
    }

    /// Says a block has all the predecessors it is going to have, unless that has been said.
    ///
    /// Sealing is once per block and the case table is not something this file builds, so the
    /// question is asked rather than assumed. Two labels on one statement would otherwise be a
    /// panic in the compiler over a program that is perfectly legal.
    fn seal_once(&mut self, block: Block) {
        if !self.ssa.is_sealed(block) {
            self.ssa.seal(self.func, block);
        }
    }

    /// `if (cond) then else otherwise`.
    fn if_stmt(&mut self, cond: ExprId, then: StmtId, otherwise: Option<StmtId>, span: Span) {
        let cond = self.condition(cond);
        let then_block = self.new_block();
        let else_block = self.new_block();
        self.br_if(cond, then_block, else_block, span);
        self.ssa.seal(self.func, then_block);
        self.ssa.seal(self.func, else_block);

        let mut join = None;
        self.at = Some(then_block);
        self.stmt(then);
        self.leave_arm(&mut join, span);

        self.at = Some(else_block);
        if let Some(otherwise) = otherwise {
            self.stmt(otherwise);
        }
        self.leave_arm(&mut join, span);

        self.at = join;
        if let Some(join) = join {
            self.ssa.seal(self.func, join);
        }
    }

    /// The end of one arm of an `if`, which branches to the join and makes it if it has to.
    fn leave_arm(&mut self, join: &mut Option<Block>, span: Span) {
        if self.at.is_none() {
            return;
        }
        let target = match *join {
            Some(block) => block,
            None => {
                let block = self.new_block();
                *join = Some(block);
                block
            }
        };
        self.jump(target, span);
    }

    /// `while (cond) body`.
    fn while_stmt(&mut self, cond: ExprId, body: StmtId, span: Span) {
        let header = self.new_block();
        self.jump(header, span);
        self.at = Some(header);

        let value = self.condition(cond);
        let inside = self.new_block();
        let after = self.new_block();
        self.br_if(value, inside, after, span);
        self.ssa.seal(self.func, inside);

        self.at = Some(inside);
        self.loops.push(Frame {
            kind: FrameKind::Loop,
            brk: Some(after),
            cont: Some(header),
            depth: self.marks.len(),
        });
        self.stmt(body);
        self.loops.pop();
        if self.at.is_some() {
            self.jump(header, span);
        }

        // Every edge into the header has been made now, which is the whole reason the header
        // was left unsealed: the back edge is the one a variable the loop changes arrives on.
        self.ssa.seal(self.func, header);
        self.ssa.seal(self.func, after);
        self.at = Some(after);
    }

    /// `do body while (cond);`.
    fn do_while(&mut self, body: StmtId, cond: ExprId, span: Span) {
        let inside = self.new_block();
        self.jump(inside, span);
        self.at = Some(inside);

        self.loops.push(Frame {
            kind: FrameKind::Loop,
            brk: None,
            cont: None,
            depth: self.marks.len(),
        });
        self.stmt(body);
        let frame = self.loops.pop().expect("the frame that was just pushed");

        // The test is the continue target, and it exists only if something reaches it: a body
        // that ends in `return` and has no `continue` never tests the condition again.
        let test = match (frame.cont, self.at.is_some()) {
            (Some(block), _) => Some(block),
            (None, true) => Some(self.new_block()),
            (None, false) => None,
        };
        if let Some(test) = test {
            if self.at.is_some() {
                self.jump(test, span);
            }
            self.ssa.seal(self.func, test);
            self.at = Some(test);
            let value = self.condition(cond);
            let after = match frame.brk {
                Some(block) => block,
                None => self.new_block(),
            };
            self.br_if(value, inside, after, span);
            self.ssa.seal(self.func, inside);
            self.ssa.seal(self.func, after);
            self.at = Some(after);
            return;
        }
        self.ssa.seal(self.func, inside);
        self.at = frame.brk;
        if let Some(after) = self.at {
            self.ssa.seal(self.func, after);
        }
    }

    /// `for (init; cond; step) body`.
    fn for_stmt(
        &mut self,
        init: Option<StmtId>,
        cond: Option<ExprId>,
        step: Option<ExprId>,
        body: StmtId,
        span: Span,
    ) {
        // The declarations in the head of a `for` are in a scope of their own, which is what
        // `for (int a[n]; ;)` needs: the object is one object however many times round it goes.
        self.open();
        if let Some(init) = init {
            self.stmt(init);
        }
        if self.at.is_none() {
            self.close(span);
            return;
        }
        let header = self.new_block();
        self.jump(header, span);
        self.at = Some(header);

        // With no condition the header is the top of the body, and `for (;;)` leaves through a
        // `break` or not at all.
        let mut after = None;
        if let Some(cond) = cond {
            let value = self.condition(cond);
            let inside = self.new_block();
            let exit = self.new_block();
            self.br_if(value, inside, exit, span);
            self.ssa.seal(self.func, inside);
            self.at = Some(inside);
            after = Some(exit);
        }

        // The step is the continue target when there is one, and the header is when there is
        // not, since a `continue` in that case has nothing to run before the next test.
        let cont = if step.is_some() { None } else { Some(header) };
        self.loops.push(Frame { kind: FrameKind::Loop, brk: after, cont, depth: self.marks.len() });
        self.stmt(body);
        let frame = self.loops.pop().expect("the frame that was just pushed");

        if let Some(step) = step {
            let block = match (frame.cont, self.at.is_some()) {
                (Some(block), _) => Some(block),
                (None, true) => Some(self.new_block()),
                (None, false) => None,
            };
            if let Some(block) = block {
                if self.at.is_some() {
                    self.jump(block, span);
                }
                self.ssa.seal(self.func, block);
                self.at = Some(block);
                self.discard(step);
                self.jump(header, span);
            }
        } else if self.at.is_some() {
            self.jump(header, span);
        }

        self.ssa.seal(self.func, header);
        self.at = frame.brk.or(after);
        if let Some(after) = self.at {
            self.ssa.seal(self.func, after);
        }
        // The scope the head opened is closed here, where the loop is left, and closing it is
        // not optional even where it saved nothing. The marks are a stack, so a scope opened and
        // not closed is not one leaked mark, it is every close after it taking the wrong mark
        // off: a body that grew the stack gave nothing back, and the restore that should have
        // been at the end of the body ended up after the loop, restoring a pointer saved in a
        // block that does not reach there. That is what the verifier was refusing on
        // `79_vla_continue.c`.
        self.close(span);
    }

    /// `break;` or `continue;`.
    ///
    /// A `break` leaves the innermost frame whatever it is, and a `continue` leaves the
    /// innermost loop, which is not the same thing inside a `switch` inside a loop.
    fn leave(&mut self, breaking: bool, span: Span) {
        let found = if breaking {
            self.loops.len().checked_sub(1)
        } else {
            self.loops.iter().rposition(|frame| frame.kind == FrameKind::Loop)
        };
        let Some(frame) = found else {
            // A `break` outside a loop is a diagnostic the checking already made.
            self.at = None;
            return;
        };
        // Whatever the scopes being left grew the stack by is given back on the way out, since
        // control is leaving the block the objects were declared in.
        let depth = self.loops[frame].depth;
        self.unwind(depth, span);
        let existing = if breaking { self.loops[frame].brk } else { self.loops[frame].cont };
        let target = match existing {
            Some(block) => block,
            None => {
                let block = self.new_block();
                if breaking {
                    self.loops[frame].brk = Some(block);
                } else {
                    self.loops[frame].cont = Some(block);
                }
                block
            }
        };
        self.jump(target, span);
    }

    /// `return;` or `return expr;`, in whatever form the return value goes back in.
    fn return_stmt(&mut self, value: Option<ExprId>, span: Span) {
        let travel = self.ret.clone();
        let Some(expr) = value else {
            // `return;` from a function that promised a value, which C89 allowed and only made
            // undefined if the caller went on to read what came back. The checking lets it
            // through under that dialect, so there is a value to produce here and nothing was
            // written to produce it. Zero, because the two other answers are worse: leaving the
            // list empty builds a `ret` the verifier refuses, and `unreachable` tells the
            // optimizer this path never runs, which is a claim about the program rather than
            // about the value and would delete the branch that reaches it.
            let returns: Vec<Type> =
                self.func.signature().returns.iter().map(|slot| slot.ty).collect();
            let values: Vec<Value> = returns.into_iter().map(|ty| self.blank(ty, span)).collect();
            self.build(span).ret(&values);
            self.at = None;
            return;
        };
        let values = match travel.pass {
            // `return f();` where `f` returns nothing, which is a `void` expression and not a
            // value: it is evaluated and then there is nothing to hand back.
            Pass::Ignore => {
                self.discard(expr);
                Vec::new()
            }
            Pass::Direct => self.eval(expr).into_iter().collect(),
            Pass::Pieces(_) => {
                let place = self.place(expr);
                let addr = self.address_of(place, span);
                self.load_slots(addr, &travel, span)
            }
            // The caller passed somewhere to put it, so returning is writing it there.
            Pass::Reference | Pass::Memory => {
                let place = self.place(expr);
                let from = self.address_of(place, span);
                if let Some(into) = self.sret {
                    self.memcpy(into, from, travel.size, travel.align, span);
                }
                Vec::new()
            }
        };
        self.build(span).ret(&values);
        self.at = None;
    }

    /// A zero of one IR type, for a place that has to produce a value and has none to produce.
    fn blank(&mut self, ty: Type, span: Span) -> Value {
        if ty.is_float() { self.build(span).fconst(ty, 0) } else { self.build(span).iconst(ty, 0) }
    }

    /// The end of the body, where falling off the end has to become a terminator.
    fn finish(&mut self, decl: DeclId, span: Span) {
        if self.at.is_none() {
            return;
        }
        if self.func.signature().returns.is_empty() {
            self.build(span).ret(&[]);
            self.at = None;
            return;
        }
        let name = self.tast()[decl].name;
        let main = name.is_some_and(|name| self.unit.names.resolve(name) == "main");
        if main {
            // 5.1.2.2.3: reaching the closing brace of `main` returns zero.
            let ty = self.func.signature().returns[0].ty;
            let zero = self.build(span).iconst(ty, 0);
            self.build(span).ret(&[zero]);
            self.at = None;
            return;
        }
        // Falling off the end of a function that returns something and then using the value is
        // undefined, so there is nothing to return and nothing to invent.
        self.build(span).unreachable();
        self.at = None;
    }

    /// The initializer of one declaration in a declaration statement.
    fn init(&mut self, decl: DeclId) {
        let tast = self.tast();
        let ty = tast[decl].ty;
        let Some(init) = tast[decl].init else { return };
        if tast[decl].duration != StorageDuration::Automatic {
            // The image of a `static` was built when the global was, at translation time.
            return;
        }
        let span = tast.decl_span(decl);
        let entries = tast[init].to_vec();
        let place = match self.vars.get(&decl).copied() {
            Some(Local::Value(var)) => Place::new(Where::Var(var), ty),
            Some(Local::Slot(slot)) => Place::new(Where::Addr(slot), ty),
            None => return,
        };

        if let Where::Var(_) = place.at {
            // A scalar in a register, which one initializer entry fills exactly.
            if let Some(entry) = entries.first() {
                if let Some(value) = self.eval(entry.value) {
                    self.write(place, value, span);
                }
            }
            return;
        }

        let size = repr::size_of(self.types(), self.target(), ty);
        let mut covered = 0;
        for entry in &entries {
            covered += self.stored_size(entry);
        }
        if covered < size {
            // What the initializer does not name is zero, and the padding between members is
            // zero as well, which is what makes a partly initialized structure comparable byte
            // for byte with another one.
            let slot = self.address_of(place, span);
            let zero = self.build(span).iconst(Type::int(8), 0);
            let align = repr::align_of(self.types(), self.target(), ty);
            let info = MemInfo {
                size,
                align,
                order: MemOrder::NotAtomic,
                tbaa: None,
                owns: 0,
                restrict: Restrict::NONE,
            };
            let mut build = self.build(span);
            let mem = build.func().add_mem(info);
            let args = build.func().push_values(&[slot, zero]);
            build.inst(
                InstData { args, extra: Extra::Mem(mem), ..InstData::new(Opcode::Memset) },
                &[],
            );
        }
        for entry in entries {
            self.store_entry(place, entry, span);
        }
    }

    /// How many bytes one initializer entry writes.
    fn stored_size(&mut self, entry: &InitEntry) -> u64 {
        if entry.is_bit_field() {
            // A bit-field writes part of a byte and leaves the rest of it alone, so the byte
            // has to have been zeroed first and this entry covers none of the object.
            return 0;
        }
        let tast = self.tast();
        let ty = tast[entry.value].ty;
        let size = repr::size_of(self.types(), self.target(), ty);
        match tast[entry.value].kind {
            // A string literal shorter than the array it initializes writes what it has, and
            // the rest of the array is zero.
            ExprKind::Str(id) => size.min(tast[id].bytes(self.unit.target).len() as u64),
            _ => size,
        }
    }

    /// One entry of an initializer, at its offset into the object.
    fn store_entry(&mut self, place: Place, entry: InitEntry, span: Span) {
        let tast = self.tast();
        let value = entry.value;
        let ty = tast[value].ty;
        let base = self.address_of(place, span);
        let addr = self.offset(base, entry.offset, span);
        if entry.is_bit_field() {
            // Everything this leaves of the bytes it writes was zeroed above, since a
            // bit-field entry counts as covering none of the object.
            let align = repr::align_of(self.types(), self.target(), place.ty);
            let run = Run::at(align, entry.offset, entry.bit_offset, entry.bit_width);
            if let Some(value) = self.eval(value) {
                self.store_bits(addr, run, ty, value, span);
            }
            return;
        }
        if let ExprKind::Str(id) = tast[value].kind {
            let bytes = tast[id].bytes(self.unit.target).len() as u64;
            let size = bytes.min(repr::size_of(self.types(), self.target(), ty));
            let symbol = self.unit.string(id);
            let source = self.global_addr(symbol, span);
            // The array's own alignment, which both sides of this copy have. An array of
            // characters has one and a wide one has the width of its element, and the object the
            // literal lives in is aligned to the same thing for the same reason, so saying one
            // here is a lie about a fact this already knows and costs a wide copy four moves per
            // character.
            let align = repr::align_of(self.types(), self.target(), ty);
            self.memcpy(addr, source, size, align, span);
            return;
        }
        if repr::value_type(self.types(), self.target(), ty).is_none() {
            // An aggregate initializing part of an aggregate, which is `struct p = q;` and
            // `struct p = (struct point){ 1, 2 };`. It is a copy rather than a store, because
            // an aggregate is not a value the IR can hold.
            let source = self.place(value);
            let source = self.address_of(source, span);
            let size = repr::size_of(self.types(), self.target(), ty);
            let align = repr::align_of(self.types(), self.target(), ty);
            self.memcpy(addr, source, size, align, span);
            return;
        }
        let Some(value) = self.eval(value) else { return };
        let info = self.access(ty);
        let flags = self.flags(ty);
        self.build(span).store(value, addr, info, flags);
    }

    /// A copy of a fixed number of bytes from one address to another.
    fn memcpy(&mut self, to: Value, from: Value, size: u64, align: u32, span: Span) {
        if size == 0 {
            return;
        }
        let info = MemInfo {
            size,
            align,
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        };
        let mut build = self.build(span);
        let mem = build.func().add_mem(info);
        let args = build.func().push_values(&[to, from]);
        build.inst(InstData { args, extra: Extra::Mem(mem), ..InstData::new(Opcode::Memcpy) }, &[]);
    }

    // Places.

    /// Where an lvalue is.
    fn place(&mut self, expr: ExprId) -> Place {
        let tast = self.tast();
        let span = tast.expr_span(expr);
        let ty = tast[expr].ty;
        match tast[expr].kind {
            ExprKind::Decl(decl) => match self.vars.get(&decl).copied() {
                Some(Local::Value(var)) => Place::new(Where::Var(var), ty),
                Some(Local::Slot(slot)) => Place::new(Where::Addr(slot), ty),
                None if tast[decl].duration == StorageDuration::Automatic => {
                    // A variable length array whose declaration the walk has not reached, which
                    // a `goto` over it can arrange. The object does not exist yet, so there is
                    // no address to answer with.
                    self.unsupported("a variable length array used before its declaration", span);
                    let addr = self.poison(Type::PTR, span);
                    Place::new(Where::Addr(addr), ty)
                }
                None => {
                    // Not a local, so it is an object with a name the linker knows: a global,
                    // a `static` in some function, or a function.
                    let symbol = self.unit.symbol_of(decl);
                    let addr = self.global_addr(symbol, span);
                    Place::new(Where::Addr(addr), ty)
                }
            },
            ExprKind::Str(id) => {
                let symbol = self.unit.string(id);
                let addr = self.global_addr(symbol, span);
                Place::new(Where::Addr(addr), ty)
            }
            ExprKind::Unary { op: UnaryOp::Deref, operand } => self.place_of_deref(operand, ty),
            // `__real__ z` and `__imag__ z`, which name the two halves of whatever object `z`
            // names. Only a complex operand arrives here, because the checking makes one of
            // these an lvalue only for a complex operand and nothing else asks where a value is.
            ExprKind::Unary { op: op @ (UnaryOp::Real | UnaryOp::Imag), operand } => {
                let addr = self.complex_addr(operand, span);
                self.half_place(addr, op == UnaryOp::Imag, ty, span)
            }
            ExprKind::Member { base, field } => self.member(base, field, ty, span),
            ExprKind::Subscript { base, index } => {
                let addr = self.element(base, index, ty, span);
                let through = self.through(base);
                Place { restrict: through, ..Place::new(Where::Addr(addr), ty) }
            }
            // An aggregate is read by address rather than by value, so the conversion that
            // reads one is the identity and the place under it is the answer.
            ExprKind::Convert { kind: Conversion::Lvalue, operand } => self.place(operand),
            // `f().x` and `p = f()`, where what the call produced has to be somewhere before
            // anything can be read out of it. The call writes into a temporary and that is the
            // object, which is what C means by the value of a call having automatic storage
            // duration until the end of the full expression.
            ExprKind::Call { callee, args } => {
                let size = repr::size_of(self.types(), self.target(), ty);
                let align = repr::align_of(self.types(), self.target(), ty);
                let at = self.scratch(size, align, span);
                self.call_into(callee, args, Some(at), span);
                Place::new(Where::Addr(at), ty)
            }
            ExprKind::CompoundLiteral(decl) => self.literal(decl, ty),
            // `(struct S)s`, gcc's cast of a record to its own type, which does nothing at all.
            // Sema lets one through only where the two types are compatible, so the object is
            // the one that was cast rather than a copy of it, the same as the read above. tcc's
            // struct initializer test writes one and so does c-testsuite's copy of it.
            ExprKind::Cast(operand)
                if matches!(self.types().kind(self.types().canonical(ty)), TypeKind::Record(_)) =>
            {
                self.place(operand)
            }
            // One of these whose value is an object rather than a number, `({ s; })` where `s`
            // is a structure. The object is the one the last statement named and not a copy of
            // it, which is what makes `({ s; }).x` read `s`.
            ExprKind::StmtExpr(body) => {
                let last = self.statements(body);
                let at = match last {
                    Some(last) => self.place(last).at,
                    None => {
                        self.unsupported("a statement expression with no value as an object", span);
                        Where::Addr(self.poison(Type::PTR, span))
                    }
                };
                self.close(span);
                Place::new(at, ty)
            }
            ExprKind::Cond { cond, then, otherwise } => {
                self.conditional_place(cond, then, otherwise, ty, span)
            }
            // One that reads a structure or a union, which answers where the object is. That is
            // an address and so it is a place already, and nothing is copied out of it here:
            // whatever wanted the object reads it where it is, which is the assignment that
            // copies it into a variable or the call that loads it into the registers it travels
            // in.
            ExprKind::VaArg { list } => Place::new(Where::Addr(self.va_object(list, ty, span)), ty),
            // `d = e = a[0] = c` where each of the four is a structure. What an assignment is
            // worth is the value it stored, and the value of an object is the object, so the
            // answer is the place it wrote to rather than a copy of it. That makes a chain of
            // them a sequence of copies out of the one source and needs no temporary anywhere.
            //
            // Only a plain assignment reaches here. A compound one is arithmetic and there is
            // none on an aggregate for it to be, so its value has a type a value can have and
            // nothing asks where that is.
            ExprKind::Assign { op: None, lhs, rhs, .. } => {
                let ty = self.tast()[lhs].ty;
                let into = self.place(lhs);
                self.copy(into, rhs, ty, span);
                into
            }
            // A vector that is not already an object, which is what every operator over one
            // produces. It has no value type, so the only place a computed vector can be is
            // memory, and this is where it is put. That is the same answer a call gets above
            // and it is given for the same reason.
            _ if rucc_types::is_vector(self.types(), ty) => {
                let size = repr::size_of(self.types(), self.target(), ty);
                let align = repr::align_of(self.types(), self.target(), ty);
                let at = self.scratch(size, align, span);
                self.vector_into(at, expr, ty, span);
                Place::new(Where::Addr(at), ty)
            }
            // A complex value that is not already an object, which is the answer to every
            // operator over one. It has no value type for the same reason a vector has none, so
            // it is given somewhere to be and built there.
            _ if rucc_types::is_complex(self.types(), ty) => {
                let size = repr::size_of(self.types(), self.target(), ty);
                let align = repr::align_of(self.types(), self.target(), ty);
                let at = self.scratch(size, align, span);
                self.complex_into(at, expr, ty, span);
                Place::new(Where::Addr(at), ty)
            }
            _ => {
                // Which is now asked in three places rather than one: an assignment writes
                // through it, and an aggregate passed or returned by value is read through it.
                self.unsupported("this as an object to read or write", span);
                let addr = self.poison(Type::PTR, span);
                Place::new(Where::Addr(addr), ty)
            }
        }
    }

    /// A vector expression written into the object at `at`, one lane at a time.
    ///
    /// Every operator over a vector is that operator over each of its lanes, so this materializes
    /// the operands once and then walks the lanes, reading one from each and writing one out. The
    /// result is that nothing downstream ever sees a vector: the back end is asked for the lane's
    /// `add`, which it already has a rule for, rather than for a four lane one it does not. That
    /// is slower than the instruction the machine has and is the whole of why `tamnd/rucc#200`
    /// stays open after this.
    ///
    /// Only the shapes that reach it are handled. A vector that is an object never arrives here,
    /// because [`Self::place`] answers that above without asking.
    fn vector_into(&mut self, at: Value, expr: ExprId, ty: TypeId, span: Span) {
        let lane = rucc_types::element(self.types(), ty).expect("a vector");
        let lanes = self.lanes(ty);
        let stride = repr::size_of(self.types(), self.target(), lane);
        match self.tast()[expr].kind {
            // A comparison, whose lanes are not the lanes it reads. The answer is a mask as wide
            // as the operands and the operands may be floats, so the type to read with is theirs
            // and the type to write with is this one, and the two are only the same width by
            // construction.
            //
            // The one bit a comparison gives becomes all ones by being zero extended and then
            // subtracted from zero, rather than by being sign extended, which is the same value
            // by a route every target already has a rule for. A `sext` out of one bit is not
            // something any rule set lowers today and it would be one more rule per target to
            // make it so, for an instruction the optimizer folds this back into anyway.
            ExprKind::Binary { op, lhs, rhs } if op.is_comparison() => {
                let operands = self.tast()[lhs].ty;
                let from = rucc_types::element(self.types(), operands).expect("a vector");
                let width = repr::size_of(self.types(), self.target(), from);
                let left = self.vector_addr(lhs, span);
                let right = self.vector_addr(rhs, span);
                let mask = self.value_type(lane, span);
                // Widened to a word first where the lane is narrower, then truncated back, which
                // is what the lane arithmetic above does and for the same reason: the rule sets
                // are written at the widths a C expression actually computes in, and a mask lane
                // is the one place a value of two bytes would otherwise be asked for.
                let wide = if mask.bits() < 32 { Type::int(32) } else { mask };
                for index in 0..lanes {
                    let a = self.lane(left, index, width, from, span);
                    let b = self.lane(right, index, width, from, span);
                    let bit = self.compare(op, a, b, from, span);
                    let one = self.widen(bit, false, wide, span);
                    let mut build = self.build(span);
                    let zero = build.iconst(wide, 0);
                    let all = build.binary(Opcode::Sub, zero, one, Flags::NONE);
                    let value = self.widen(all, true, mask, span);
                    let into = self.lane_place(at, index, stride, lane, span);
                    self.write(into, value, span);
                }
            }
            ExprKind::Binary { op, lhs, rhs } => {
                let counts = self.count_lane(rhs, lane);
                let left = self.vector_addr(lhs, span);
                let right = self.vector_addr(rhs, span);
                for index in 0..lanes {
                    let a = self.lane(left, index, stride, lane, span);
                    let b = self.shift_count(right, index, counts, lane, span);
                    let value = self.lane_arithmetic(op, a, b, lane, span);
                    let into = self.lane_place(at, index, stride, lane, span);
                    self.write(into, value, span);
                }
            }
            // The scalar beside a vector, which stands for itself in every lane. Sema has
            // already converted it to the lane type, so there is nothing to convert here.
            ExprKind::Convert { kind: Conversion::Broadcast, operand } => {
                let value = self.value(operand);
                for index in 0..lanes {
                    let into = self.lane_place(at, index, stride, lane, span);
                    self.write(into, value, span);
                }
            }
            // `v++` and `++v`, which step the object rather than compute anything, so what
            // lands here is a copy of it. Which copy is the whole of the difference between the
            // two: a prefix one is worth the object after the step and a postfix one is worth
            // what was in it before, so the copy is taken on the other side of the step.
            ExprKind::Unary {
                op: op @ (UnaryOp::PreInc | UnaryOp::PreDec | UnaryOp::PostInc | UnaryOp::PostDec),
                operand,
            } => {
                let place = self.place(operand);
                let target = self.address_of(place, span);
                let size = repr::size_of(self.types(), self.target(), ty);
                let align = repr::align_of(self.types(), self.target(), ty);
                let up = matches!(op, UnaryOp::PreInc | UnaryOp::PostInc);
                if op.is_postfix() {
                    self.memcpy(at, target, size, align, span);
                    self.vector_step(target, up, ty, span);
                } else {
                    self.vector_step(target, up, ty, span);
                    self.memcpy(at, target, size, align, span);
                }
            }
            // `-v` and `~v`, which are the lane's operator over each lane. A unary plus is the
            // identity and sema leaves no node for it.
            ExprKind::Unary { op, operand } => {
                let from = self.vector_addr(operand, span);
                for index in 0..lanes {
                    let a = self.lane(from, index, stride, lane, span);
                    let value = self.negate(op, a, lane, span);
                    let into = self.lane_place(at, index, stride, lane, span);
                    self.write(into, value, span);
                }
            }
            // `w = (v += u)`, where the value of the compound assignment is the one wanted. The
            // assignment happens at the object it names and what lands here is a copy of it.
            ExprKind::Assign { op: Some(op), lhs, rhs, .. } => {
                let into = self.place(lhs);
                let target = self.address_of(into, span);
                self.vector_compound(target, rhs, op, ty, span);
                let size = repr::size_of(self.types(), self.target(), ty);
                let align = repr::align_of(self.types(), self.target(), ty);
                self.memcpy(at, target, size, align, span);
            }
            // `(v4si)u` and `(v4sf)x`, which read the bytes that are already there under another
            // type. Sema lets one through only where the two sizes are equal, so there is
            // nothing to convert: another vector is an object and is copied, and a scalar is a
            // value and is stored where the vector is.
            ExprKind::Cast(operand) => {
                let from = self.tast()[operand].ty;
                if rucc_types::is_vector(self.types(), from) {
                    let source = self.vector_addr(operand, span);
                    let size = repr::size_of(self.types(), self.target(), ty);
                    let align = repr::align_of(self.types(), self.target(), ty);
                    self.memcpy(at, source, size, align, span);
                } else {
                    let value = self.value(operand);
                    self.write(Place::new(Where::Addr(at), from), value, span);
                }
            }
            _ => self.unsupported("this vector expression", span),
        }
    }

    /// `v op= w` performed lane by lane at the object `target` names.
    ///
    /// The right side is worked out before any lane of the left is read, which is what C11
    /// 6.5.16.2 asks for: `E1 op= E2` reads `E1` after `E2`, so `v += f()` where `f` writes `v`
    /// sees what `f` wrote.
    fn vector_compound(
        &mut self,
        target: Value,
        rhs: ExprId,
        op: BinaryOp,
        ty: TypeId,
        span: Span,
    ) {
        let lane = rucc_types::element(self.types(), ty).expect("a vector");
        let lanes = self.lanes(ty);
        let stride = repr::size_of(self.types(), self.target(), lane);
        let counts = self.count_lane(rhs, lane);
        let right = self.vector_addr(rhs, span);
        for index in 0..lanes {
            let a = self.lane(target, index, stride, lane, span);
            let b = self.shift_count(right, index, counts, lane, span);
            let value = self.lane_arithmetic(op, a, b, lane, span);
            let slot = self.lane_place(target, index, stride, lane, span);
            self.write(slot, value, span);
        }
    }

    /// `++v`, `--v`, `v++` and `v--` performed lane by lane at the object `target` names.
    ///
    /// A step of one is the same step in every lane, so this is the scalar rule written over the
    /// lanes rather than anything a vector has of its own. There is no pointer lane for a step to
    /// be scaled by, which is the one case [`Self::step_by_one`] carries that this one does not,
    /// and no value is answered with here: what the expression is worth is a copy of the object
    /// on one side of the step, which is taken by whoever wanted it.
    fn vector_step(&mut self, target: Value, up: bool, ty: TypeId, span: Span) {
        let lane = rucc_types::element(self.types(), ty).expect("a vector");
        let lanes = self.lanes(ty);
        let stride = repr::size_of(self.types(), self.target(), lane);
        for index in 0..lanes {
            let old = self.lane(target, index, stride, lane, span);
            let out = self.func[old].ty;
            let new = if out.lane().is_float() {
                let format = repr::float_format_of(self.types(), self.target(), lane);
                let one = format.map_or(0, |format| Real::from_signed(1, format).0.to_bits());
                let mut build = self.build(span);
                let one = build.fconst(out, one);
                let opcode = if up { Opcode::FAdd } else { Opcode::FSub };
                build.binary(opcode, old, one, Flags::NONE)
            } else {
                let one = self.build(span).iconst(out, 1);
                let op = if up { BinaryOp::Add } else { BinaryOp::Sub };
                self.lane_arithmetic(op, old, one, lane, span)
            };
            let into = self.lane_place(target, index, stride, lane, span);
            self.write(into, new, span);
        }
    }

    /// The lane type of the right side of a lanewise operator, which is the left's everywhere
    /// but a shift.
    ///
    /// A shift is the one operator whose two sides sema does not bring to a single type, since
    /// the right side is a count and not a value, so it may be a vector of another lane and has
    /// to be read as the one it is.
    fn count_lane(&self, rhs: ExprId, lane: TypeId) -> TypeId {
        rucc_types::element(self.types(), self.tast()[rhs].ty).unwrap_or(lane)
    }

    /// One lane of the right side of a lanewise operator, read as its own type and converted to
    /// the type the operation is performed in.
    fn shift_count(
        &mut self,
        addr: Value,
        index: u64,
        from: TypeId,
        lane: TypeId,
        span: Span,
    ) -> Value {
        let width = repr::size_of(self.types(), self.target(), from);
        let value = self.lane(addr, index, width, from, span);
        let want = self.value_type(lane, span);
        if self.func[value].ty == want {
            return value;
        }
        let signed = repr::is_signed(self.types(), self.target(), from);
        self.widen(value, signed, want, span)
    }

    /// One lane under a binary operator, worked out in a width the back end has rules for.
    ///
    /// A lane narrower than an `int` is why this is not [`Self::arithmetic`] on its own. C
    /// promotes a `short` before any operator sees it, so a divide of one is a shape no rule was
    /// ever written for, and a vector of `short` has no promotion to hide behind. The operation
    /// is done at `int` and the answer is truncated back, which is the same answer every time:
    /// the low bits of the wide result are the narrow one for each of these operators, and both
    /// operands fit exactly, so a divide and a remainder are right as well.
    fn lane_arithmetic(
        &mut self,
        op: BinaryOp,
        lhs: Value,
        rhs: Value,
        lane: TypeId,
        span: Span,
    ) -> Value {
        let out = self.func[lhs].ty;
        if out.lane().is_float() || out.bits() >= 32 {
            return self.arithmetic(op, lhs, rhs, lane, span);
        }
        let signed = repr::is_signed(self.types(), self.target(), lane);
        let wide = Type::int(32);
        let a = self.widen(lhs, signed, wide, span);
        let b = self.widen(rhs, signed, wide, span);
        let value = self.arithmetic(op, a, b, lane, span);
        self.widen(value, signed, out, span)
    }

    /// One lane under a unary operator, which is what [`Self::unary`] does to a scalar.
    ///
    /// Written out again rather than called, because that one takes the operand as an expression
    /// and a lane is a value that has already been read out of memory. The two have to agree, so
    /// a negation is `fneg` where the lane is a float and zero minus the lane where it is not,
    /// and the overflow flag is the one a signed lane carries.
    fn negate(&mut self, op: UnaryOp, value: Value, lane: TypeId, span: Span) -> Value {
        let out = self.func[value].ty;
        match op {
            UnaryOp::Minus if out.lane().is_float() => {
                self.build(span).unary(Opcode::FNeg, value, out)
            }
            UnaryOp::Minus => {
                let signed = repr::is_signed(self.types(), self.target(), lane);
                self.signed_negate(value, signed, span)
            }
            UnaryOp::BitNot => {
                let mut build = self.build(span);
                let ones = build.iconst(out, -1);
                build.binary(Opcode::Xor, value, ones, Flags::NONE)
            }
            _ => value,
        }
    }

    /// How many lanes a vector type has, and one for anything else, which nothing asks about.
    fn lanes(&self, ty: TypeId) -> u64 {
        match self.types().kind(self.types().canonical(ty)) {
            TypeKind::Vector { len, .. } => u64::from(len),
            _ => 1,
        }
    }

    /// Where a vector operand lives, computing it into a temporary when it is not already an
    /// object.
    fn vector_addr(&mut self, expr: ExprId, span: Span) -> Value {
        let place = self.place(expr);
        self.address_of(place, span)
    }

    /// One lane of the vector at `addr`, as a place.
    fn lane_place(
        &mut self,
        addr: Value,
        index: u64,
        stride: u64,
        lane: TypeId,
        span: Span,
    ) -> Place {
        let at = self.offset(addr, index * stride, span);
        Place::new(Where::Addr(at), lane)
    }

    /// One lane of the vector at `addr`, read.
    fn lane(&mut self, addr: Value, index: u64, stride: u64, lane: TypeId, span: Span) -> Value {
        let place = self.lane_place(addr, index, stride, lane, span);
        match self.read(place, span) {
            Some(value) => value,
            None => {
                let ty = self.value_type(lane, span);
                self.poison(ty, span)
            }
        }
    }

    // Complex values.

    /// A complex expression written into the object at `at`, one half at a time.
    ///
    /// A complex value is a pair of real ones, and nothing in the IR holds a pair, so it lives in
    /// memory the way a vector does and every operator over one is written out as the operators
    /// over its halves. That is close to what the hardware does anyway: no target here has a
    /// complex add, and the multiply and the divide that no target has either are a call into
    /// libgcc or four products written out, both of which take the operands apart the same way.
    ///
    /// Only the shapes that reach it are handled. One that is already an object never arrives,
    /// because [`Self::place`] answers those above without asking, and that is a variable, a
    /// member, a subscript, a dereference, a call, a compound literal, a conditional, a statement
    /// expression and a plain assignment between them.
    fn complex_into(&mut self, at: Value, expr: ExprId, ty: TypeId, span: Span) {
        let part = self.real_part(ty);
        match self.tast()[expr].kind {
            // A complex constant, which is an imaginary constant or anything the folding made
            // of one. It is two constants here the way it is two of everything else.
            ExprKind::Const(value) => {
                let Some(out) = repr::value_type(self.types(), self.target(), part) else {
                    self.unsupported("this complex constant", span);
                    return;
                };
                // Each half is built the way its own type is built, which is the bits of a
                // floating value and the number itself where the halves are integers.
                let halves = match self.tast()[value] {
                    Const::Complex { real, imag } => {
                        [real, imag].map(|half| self.build(span).fconst(out, half.to_bits()))
                    }
                    Const::ComplexInt { real, imag } => {
                        [real, imag].map(|half| self.build(span).iconst(out, half))
                    }
                    _ => {
                        self.unsupported("this complex constant", span);
                        return;
                    }
                };
                for (imaginary, value) in [false, true].into_iter().zip(halves) {
                    let into = self.half_place(at, imaginary, part, span);
                    self.write(into, value, span);
                }
            }
            // `z + w` and `z - w`, which are the real operator on each half. Sema has converted
            // both operands to this type already, so there is no widening left to do here.
            ExprKind::Binary { op: op @ (BinaryOp::Add | BinaryOp::Sub), lhs, rhs } => {
                let left = self.complex_addr(lhs, span);
                let right = self.complex_addr(rhs, span);
                for imag in [false, true] {
                    let a = self.half(left, imag, part, span);
                    let b = self.half(right, imag, part, span);
                    let value = self.arithmetic(op, a, b, part, span);
                    let into = self.half_place(at, imag, part, span);
                    self.write(into, value, span);
                }
            }
            // `z * w` and `z / w`, which are one operation over the whole value rather than one
            // over each half. Sema has converted both operands to this type already, the same
            // way it has for the add.
            ExprKind::Binary { op: op @ (BinaryOp::Mul | BinaryOp::Div), lhs, rhs } => {
                let left = self.complex_addr(lhs, span);
                let right = self.complex_addr(rhs, span);
                let mut halves = Vec::with_capacity(4);
                for addr in [left, right] {
                    for imag in [false, true] {
                        halves.push(self.half(addr, imag, part, span));
                    }
                }
                self.complex_product(at, op, &halves, ty, span);
            }
            // `-z`, which is the real negation on each half, and `~z`, the conjugate, which is
            // that negation on the imaginary half and the real half left as it stands.
            ExprKind::Unary { op: op @ (UnaryOp::Minus | UnaryOp::BitNot), operand } => {
                let from = self.complex_addr(operand, span);
                for imag in [false, true] {
                    let mut value = self.half(from, imag, part, span);
                    if imag || op == UnaryOp::Minus {
                        // The arithmetic negation whichever operator was written, since the
                        // conjugate negates the imaginary half rather than flipping its bits.
                        value = self.negate(UnaryOp::Minus, value, part, span);
                    }
                    let into = self.half_place(at, imag, part, span);
                    self.write(into, value, span);
                }
            }
            // `+z`, which is the identity and leaves a node here the way it does on a real
            // operand, and `(z, w)`, whose value is the object the right side named.
            ExprKind::Unary { op: UnaryOp::Plus, operand } => {
                self.complex_copy(at, operand, ty, span);
            }
            ExprKind::Comma { lhs, rhs } => {
                self.discard(lhs);
                self.complex_copy(at, rhs, ty, span);
            }
            // A conversion to a complex type, which is either the other complex type's halves
            // converted or a real value beside a zero. `(_Complex double)x` is written the same
            // way and means the same thing, which is why the cast comes through here as well.
            ExprKind::Convert { kind: Conversion::Arithmetic, operand }
            | ExprKind::Cast(operand) => {
                let from = self.tast()[operand].ty;
                match rucc_types::real_part(self.types(), from) {
                    Some(source) => {
                        let addr = self.complex_addr(operand, span);
                        for imag in [false, true] {
                            let value = self.half(addr, imag, source, span);
                            let value = self.coerce(value, source, part, span);
                            let into = self.half_place(at, imag, part, span);
                            self.write(into, value, span);
                        }
                    }
                    None => {
                        let value = self.value(operand);
                        let value = self.coerce(value, from, part, span);
                        let real = self.half_place(at, false, part, span);
                        self.write(real, value, span);
                        let out = self.value_type(part, span);
                        let zero = self.blank(out, span);
                        let imaginary = self.half_place(at, true, part, span);
                        self.write(imaginary, zero, span);
                    }
                }
            }
            // `w = (z += u)`, where the value of the compound assignment is the one wanted. The
            // assignment happens at the object it names and what lands here is a copy of it.
            ExprKind::Assign { op: Some(op), computation, lhs, rhs } => {
                let into = self.place(lhs);
                let target = self.address_of(into, span);
                self.complex_compound(target, op, computation, rhs, ty, span);
                self.copy_bytes(at, target, ty, span);
            }
            _ => self.unsupported("this complex expression", span),
        }
    }

    /// `z op= w` performed half by half at the object `target` names.
    ///
    /// The computation type is not the object's type where the two differ: `_Complex float z; z
    /// += 1.0;` adds in `_Complex double` and converts back, which is the same rule a real
    /// compound assignment follows and is why the halves are widened and narrowed around the
    /// operator rather than added where they sit.
    fn complex_compound(
        &mut self,
        target: Value,
        op: BinaryOp,
        computation: TypeId,
        rhs: ExprId,
        ty: TypeId,
        span: Span,
    ) {
        let part = self.real_part(ty);
        let wide = self.real_part(computation);
        let right = self.complex_addr(rhs, span);
        // The multiply and the divide are one operation over a whole value rather than one over
        // each half, so there is nothing to do half by half: the four halves are widened, the
        // answer is built from all four, and the answer is narrowed back. Where the two types
        // are the same the answer is built in the object itself, since the four halves are read
        // as values and the loads have already happened by the time anything is written.
        if matches!(op, BinaryOp::Mul | BinaryOp::Div) {
            let mut halves = Vec::with_capacity(4);
            for imag in [false, true] {
                let a = self.half(target, imag, part, span);
                halves.push(self.coerce(a, part, wide, span));
            }
            for imag in [false, true] {
                halves.push(self.half(right, imag, wide, span));
            }
            let narrows = wide != part;
            let at = if narrows {
                let size = repr::size_of(self.types(), self.target(), computation);
                let align = repr::align_of(self.types(), self.target(), computation);
                self.scratch(size, align, span)
            } else {
                target
            };
            self.complex_product(at, op, &halves, computation, span);
            if narrows {
                for imag in [false, true] {
                    let value = self.half(at, imag, wide, span);
                    let value = self.coerce(value, wide, part, span);
                    let slot = self.half_place(target, imag, part, span);
                    self.write(slot, value, span);
                }
            }
            return;
        }
        for imag in [false, true] {
            let a = self.half(target, imag, part, span);
            let a = self.coerce(a, part, wide, span);
            let b = self.half(right, imag, wide, span);
            let value = self.arithmetic(op, a, b, wide, span);
            let value = self.coerce(value, wide, part, span);
            let slot = self.half_place(target, imag, part, span);
            self.write(slot, value, span);
        }
    }

    /// `z * w` and `z / w`, written whichever way this type's halves want them written.
    ///
    /// `halves` is the real and imaginary half of the left operand and then of the right, and `ty`
    /// is the complex type all four have and the answer has. A floating pair goes to the runtime
    /// and an integer pair is written out here, which is the split gcc makes too.
    fn complex_product(
        &mut self,
        at: Value,
        op: BinaryOp,
        halves: &[Value],
        ty: TypeId,
        span: Span,
    ) {
        let part = self.real_part(ty);
        if rucc_types::is_real_floating(self.types(), part) {
            self.complex_call(at, op, halves, ty, span);
        } else {
            self.complex_integer_product(at, op, halves, part, span);
        }
    }

    /// `z * w` and `z / w` where the halves are integers, as the arithmetic both of them are.
    ///
    /// Written out rather than called, because there is no routine to call: libgcc's family is
    /// written over the floating formats and has no member for an integer half. gcc writes both
    /// of these out too, and what is written is what gcc writes rather than the shortest form of
    /// it, because an integer divide truncates and a program can see which truncations happened.
    ///
    /// The multiply is the four products, `(ac - bd) + (ad + bc)i`. The divide is Smith's method,
    /// which divides through by whichever half of the divisor is larger so that the square that
    /// the obvious formula puts underneath is never formed. gcc uses it for an integer divisor as
    /// well as a floating one, so the ratio it starts from is an integer division of its own and
    /// is usually zero, and the answer is not the one the obvious formula would have reached.
    fn complex_integer_product(
        &mut self,
        at: Value,
        op: BinaryOp,
        halves: &[Value],
        part: TypeId,
        span: Span,
    ) {
        let [a, b, c, d] = [halves[0], halves[1], halves[2], halves[3]];
        let (real, imaginary) = if op == BinaryOp::Mul {
            let ac = self.arithmetic(BinaryOp::Mul, a, c, part, span);
            let bd = self.arithmetic(BinaryOp::Mul, b, d, part, span);
            let ad = self.arithmetic(BinaryOp::Mul, a, d, part, span);
            let bc = self.arithmetic(BinaryOp::Mul, b, c, part, span);
            let real = self.arithmetic(BinaryOp::Sub, ac, bd, part, span);
            let imaginary = self.arithmetic(BinaryOp::Add, ad, bc, part, span);
            (real, imaginary)
        } else {
            self.complex_integer_divide(a, b, c, d, part, span)
        };
        for (imag, value) in [(false, real), (true, imaginary)] {
            let into = self.half_place(at, imag, part, span);
            self.write(into, value, span);
        }
    }

    /// `(a + bi) / (c + di)` on integer halves, as the two halves of the answer.
    ///
    /// Smith's method, which is the one gcc writes: it looks at which half of the divisor is
    /// larger, divides the smaller by the larger to get a ratio, and works from there, so that
    /// `c*c + d*d` is never formed and a divisor with one large half does not overflow on the
    /// way. Written with a choice of operands rather than the two arms gcc branches into, which
    /// is the same arithmetic with one copy of it: the two arms differ in which half of each
    /// operand plays which part and in the sign of the imaginary numerator, and nothing else.
    ///
    /// The one division that happens before the choice is made is the ratio, and it is safe for
    /// the same reason gcc's is: its divisor is the larger half, which is zero only when both
    /// halves are, and a divisor of zero is undefined anyway.
    fn complex_integer_divide(
        &mut self,
        a: Value,
        b: Value,
        c: Value,
        d: Value,
        part: TypeId,
        span: Span,
    ) -> (Value, Value) {
        // Which half of the divisor is larger, measured without the sign the way gcc measures
        // it, and unsigned halves have no sign to take off.
        let left = self.integer_magnitude(c, part, span);
        let right = self.integer_magnitude(d, part, span);
        let swap = self.compare(BinaryOp::Lt, left, right, part, span);
        let mut build = self.build(span);
        let small = build.select(swap, c, d);
        let large = build.select(swap, d, c);
        let matched = build.select(swap, a, b);
        let other = build.select(swap, b, a);
        let ratio = self.arithmetic(BinaryOp::Div, small, large, part, span);
        let scaled = self.arithmetic(BinaryOp::Mul, small, ratio, part, span);
        let denominator = self.arithmetic(BinaryOp::Add, scaled, large, part, span);
        let scaled_matched = self.arithmetic(BinaryOp::Mul, matched, ratio, part, span);
        let scaled_other = self.arithmetic(BinaryOp::Mul, other, ratio, part, span);
        let real = self.arithmetic(BinaryOp::Add, scaled_matched, other, part, span);
        let real = self.arithmetic(BinaryOp::Div, real, denominator, part, span);
        // The imaginary numerator is the same difference in either arm and the arms disagree
        // about its sign, so both orders are subtracted and the choice picks one.
        let forward = self.arithmetic(BinaryOp::Sub, scaled_other, matched, part, span);
        let backward = self.arithmetic(BinaryOp::Sub, matched, scaled_other, part, span);
        let imaginary = self.build(span).select(swap, forward, backward);
        let imaginary = self.arithmetic(BinaryOp::Div, imaginary, denominator, part, span);
        (real, imaginary)
    }

    /// An integer with its sign taken off, and the value itself where its type has no sign.
    ///
    /// The negation wraps rather than overflowing, because the one value it can overflow on is
    /// the most negative one and taking the sign off that is what gcc's `ABS_EXPR` does with it.
    fn integer_magnitude(&mut self, value: Value, part: TypeId, span: Span) -> Value {
        if !repr::is_signed(self.types(), self.target(), part) {
            return value;
        }
        let out = self.func[value].ty;
        let mut build = self.build(span);
        let zero = build.iconst(out, 0);
        let negated = build.binary(Opcode::Sub, zero, value, Flags::NONE);
        let below = build.icmp(IntPred::Slt, value, zero);
        build.select(below, negated, value)
    }

    /// `z * w` and `z / w` on floating halves, as the call into the runtime that both of them are.
    ///
    /// The four halves arrive in the order the routines take their four arguments in, which is the
    /// order [`Self::complex_product`] reads them out in.
    ///
    /// A call rather than the four products and the two sums written out here, because neither
    /// operator is those. C annex G says what a multiply does when a half is an infinity and the
    /// other operand has a NaN in it, and what a divide does when the obvious formula overflows in
    /// the middle and the answer it was heading for would have fit, and the naive form gets both
    /// wrong. The routines are libgcc's, libgcc is already on the link line, and gcc compiles the
    /// same two operators into calls to the same names, so an object rucc compiled and an object
    /// gcc compiled agree about the awkward values rather than each having their own opinion.
    ///
    /// The ABI is asked about the call rather than assumed, because a complex value does not travel
    /// the same way in every place one can be written: `_Complex float` is one SSE register on
    /// x86-64 and two halves of one on AArch64, and a `_Complex long double` comes back in memory
    /// on some targets and in registers on others. That is [`abi::plan`]'s question and the
    /// arguments and the answer are moved with the same two helpers a call written in the program
    /// uses.
    fn complex_call(&mut self, at: Value, op: BinaryOp, halves: &[Value], ty: TypeId, span: Span) {
        let part = self.real_part(ty);
        let Some(routine) = self.complex_routine(op, part) else {
            self.unsupported("this complex operator on this type", span);
            return;
        };
        let params = [part; 4];
        let plan = match abi::plan(self.types(), self.target(), ty, &params, &params, false) {
            Ok(plan) => plan,
            Err(what) => {
                self.unsupported(what, span);
                return;
            }
        };
        let mut values = Vec::with_capacity(halves.len() + 1);
        if plan.returns_through_memory() {
            values.push(at);
        }
        values.extend_from_slice(halves);
        let symbol = self.unit.names.intern(&routine);
        let sig = self.func.add_signature(plan.signature.clone());
        let inst = self.build(span).call_varargs(symbol, sig, &values, &[]);
        if plan.returns_through_memory() {
            return;
        }
        let results: Vec<Value> = self.func[inst].results().collect();
        match plan.ret.pass {
            // One register holding the whole value, which is what a target that has no way to
            // take a small object apart says about one.
            Pass::Direct => {
                if let Some(&value) = results.first() {
                    let info = self.piece_info(plan.ret.align, 0);
                    self.build(span).store(value, at, info, Flags::NONE);
                }
            }
            _ => self.store_slots(at, &plan.ret, &results, span),
        }
    }

    /// The runtime routine one complex operator on one real part goes to.
    ///
    /// The names are libgcc's and are spelled after the machine mode of the half rather than after
    /// the C type it was written as, so `long double` is `__mulxc3` where it is the x87 format and
    /// `__multc3` where it is the quadruple one, and the two are different routines on targets that
    /// have both. [`None`] for a format the runtime has no routine for, which is `__bf16` and the
    /// double-double, and neither is a type a complex value can have here anyway.
    fn complex_routine(&self, op: BinaryOp, part: TypeId) -> Option<String> {
        let what = match op {
            BinaryOp::Mul => "mul",
            _ => "div",
        };
        let mode = match repr::float_format_of(self.types(), self.target(), part)? {
            Format::Half => "h",
            Format::Single => "s",
            Format::Double => "d",
            Format::X87Extended => "x",
            Format::Quad => "t",
            Format::BFloat16 | Format::DoubleDouble => return None,
        };
        Some(format!("__{what}{mode}c3"))
    }

    /// `z == w` and `z != w`, as one bit.
    ///
    /// Both halves are compared and the two answers are combined with the operator that matches:
    /// two complex values are equal when both halves are, and unequal when either half is. A NaN
    /// in either half needs nothing said about it, because the unordered comparison the real `!=`
    /// already uses is what makes it unequal to itself here too.
    fn complex_compare(&mut self, op: BinaryOp, lhs: ExprId, rhs: ExprId, span: Span) -> Value {
        let part = self.real_part(self.tast()[lhs].ty);
        let left = self.complex_addr(lhs, span);
        let right = self.complex_addr(rhs, span);
        let a = self.half(left, false, part, span);
        let b = self.half(right, false, part, span);
        let real = self.compare(op, a, b, part, span);
        let a = self.half(left, true, part, span);
        let b = self.half(right, true, part, span);
        let imaginary = self.compare(op, a, b, part, span);
        let opcode = if op == BinaryOp::Eq { Opcode::And } else { Opcode::Or };
        self.build(span).binary(opcode, real, imaginary, Flags::NONE)
    }

    /// Whether a complex value is not zero, which is whether either half is not zero.
    fn complex_truth(&mut self, expr: ExprId, span: Span) -> Value {
        let part = self.real_part(self.tast()[expr].ty);
        let addr = self.complex_addr(expr, span);
        let real = self.half(addr, false, part, span);
        let real = self.is_nonzero(real, span);
        let imaginary = self.half(addr, true, part, span);
        let imaginary = self.is_nonzero(imaginary, span);
        self.build(span).binary(Opcode::Or, real, imaginary, Flags::NONE)
    }

    /// The real half of a complex expression converted to `ty`, and [`None`] where that is not
    /// what is being asked for.
    ///
    /// Going from complex to real keeps the real half and drops the imaginary one, 6.3.1.7p2,
    /// and that is the one direction between the two that answers with a value. The other has
    /// no value form and is [`Self::complex_into`]'s to build, which is why a complex answer
    /// backs out here rather than dropping half of itself.
    fn complex_to_real(&mut self, operand: ExprId, ty: TypeId, span: Span) -> Option<Value> {
        if rucc_types::is_complex(self.types(), ty) {
            return None;
        }
        let from = self.tast()[operand].ty;
        let part = rucc_types::real_part(self.types(), from)?;
        let addr = self.complex_addr(operand, span);
        let value = self.half(addr, false, part, span);
        Some(self.coerce(value, part, ty, span))
    }

    /// A complex value copied into the object at `at` from wherever its own object is, which is
    /// what the shapes that compute nothing of their own need.
    fn complex_copy(&mut self, at: Value, expr: ExprId, ty: TypeId, span: Span) {
        let from = self.complex_addr(expr, span);
        self.copy_bytes(at, from, ty, span);
    }

    /// The address of the object a complex expression's value is in.
    fn complex_addr(&mut self, expr: ExprId, span: Span) -> Value {
        let place = self.place(expr);
        self.address_of(place, span)
    }

    /// One whole object of a type copied from one address to another.
    fn copy_bytes(&mut self, to: Value, from: Value, ty: TypeId, span: Span) {
        let size = repr::size_of(self.types(), self.target(), ty);
        let align = repr::align_of(self.types(), self.target(), ty);
        self.memcpy(to, from, size, align, span);
    }

    /// The type both halves of a complex type have.
    fn real_part(&self, ty: TypeId) -> TypeId {
        rucc_types::real_part(self.types(), ty).expect("a complex type")
    }

    /// One half of the complex object at `addr`, as a place.
    ///
    /// The imaginary half sits one whole real behind the real one, which is what the layout
    /// gives a complex type and what every ABI here already reads it as.
    fn half_place(&mut self, addr: Value, imag: bool, part: TypeId, span: Span) -> Place {
        let stride = repr::size_of(self.types(), self.target(), part);
        let at = self.offset(addr, if imag { stride } else { 0 }, span);
        Place::new(Where::Addr(at), part)
    }

    /// One half of the complex object at `addr`, read.
    fn half(&mut self, addr: Value, imag: bool, part: TypeId, span: Span) -> Value {
        let place = self.half_place(addr, imag, part, span);
        match self.read(place, span) {
            Some(value) => value,
            None => {
                let ty = self.value_type(part, span);
                self.poison(ty, span)
            }
        }
    }

    /// `(T){ ... }`, which is an object like any other and is initialized where it is written.
    ///
    /// Written where it is evaluated rather than once at the top of the function, because an
    /// evaluation of one of these is what initializes it: the same literal in a loop is one
    /// object that starts again each time round, which is what its initializer says.
    fn literal(&mut self, decl: DeclId, ty: TypeId) -> Place {
        match self.vars.get(&decl).copied() {
            Some(Local::Value(var)) => {
                self.init(decl);
                Place::new(Where::Var(var), ty)
            }
            Some(Local::Slot(slot)) => {
                self.init(decl);
                Place::new(Where::Addr(slot), ty)
            }
            None => {
                // One with static storage, which is a global and was written at the module
                // level with its image already in it.
                let span = self.tast().decl_span(decl);
                let symbol = self.unit.symbol_of(decl);
                let addr = self.global_addr(symbol, span);
                Place::new(Where::Addr(addr), ty)
            }
        }
    }

    /// `base.field`, which is the base's address plus the member's offset.
    fn member(&mut self, base: ExprId, field: u32, ty: TypeId, span: Span) -> Place {
        let place = self.place(base);
        let addr = self.address_of(place, span);
        let record = self.types().canonical(self.tast()[base].ty);
        let TypeKind::Record(id) = self.types().kind(record) else {
            return Place {
                punned: place.punned,
                restrict: place.restrict,
                ..Place::new(Where::Addr(addr), ty)
            };
        };
        let (kind, found) = {
            let info = self.types().record_info(id);
            (info.kind, info.fields.get(field as usize).copied())
        };
        // A member of something that is punned is punned too. `u.s.x` names bytes that another
        // member of `u` may have been written through, and how deep in the nesting the name went
        // does not change which bytes they are.
        let punned = place.punned || kind == RecordKind::Union;
        let Some(member) = found else {
            return Place { punned, restrict: place.restrict, ..Place::new(Where::Addr(addr), ty) };
        };
        let byte = member.offset;
        let owns = self.owned(id, record, kind, byte, place.owns);
        // What the record's own address is aligned to, which is the alignment of its type unless
        // the record is itself inside something that knows better. Written down before the member
        // is stepped to, because that is what [`Self::offset`] carries forward: a `packed` record
        // is aligned to one byte, so an `int` member of one is too, and an access through it may
        // not assume the four bytes C would otherwise give it.
        let base =
            self.alignment(addr).unwrap_or(repr::align_of(self.types(), self.target(), record));
        self.aligns(addr, base);
        if let Some(width) = member.bits {
            // The address is of the byte the first of its bits is in, and the run says which
            // bit of that byte it starts at. A member of a record aligned to eight bytes at
            // byte offset four is aligned to four, which is what the run needs to know to say
            // how the loads under it are aligned.
            let addr = self.offset(addr, byte, span);
            let run = Run::at(base, byte, member.bit, width);
            return Place {
                punned,
                owns,
                restrict: place.restrict,
                ..Place::new(Where::Bits(addr, run), ty)
            };
        }
        let addr = self.offset(addr, byte, span);
        Place { punned, owns, restrict: place.restrict, ..Place::new(Where::Addr(addr), ty) }
    }

    /// How many bytes of its record a member at `byte` owns, counting the padding after it.
    ///
    /// The number section 9.3 of `spec/safe-memory/09-type-init-and-races.md` needs and the only
    /// thing `-fsafety-init=nopadding` does. A store through a member records the member's width,
    /// and under that mode it records this instead, so a record filled a member at a time comes
    /// out entirely written and the ordinary reads of one, which are a `memcmp` or a hash or a
    /// `write` of the whole record, are not refused.
    ///
    /// It is the distance to the next member that starts after this one. The last member has no
    /// next one, and then it is the distance to the end of the record, or to the end of whatever
    /// the enclosing place owned where this record is itself a member of something bigger. That
    /// last case is what carries an inner record's trailing padding out to the outer record's, so
    /// `struct { struct { char c; } in; int x; }` has all eight of its bytes written after both
    /// members are.
    ///
    /// A union gets nothing. The bytes after a short member of one are the bytes of a longer
    /// member rather than padding, and saying a store through the short one wrote them would be
    /// saying the longer one holds something nobody put there.
    fn owned(&self, id: RecordId, record: TypeId, kind: RecordKind, byte: u64, outer: u32) -> u32 {
        if !self.unit.padding || kind == RecordKind::Union {
            return 0;
        }
        let next = self
            .types()
            .record_info(id)
            .fields
            .iter()
            .map(|other| other.offset)
            .filter(|offset| *offset > byte)
            .min();
        let end = match next {
            Some(offset) => offset,
            None if outer != 0 => u64::from(outer),
            None => repr::size_of(self.types(), self.target(), record),
        };
        u32::try_from(end.saturating_sub(byte)).unwrap_or(0)
    }

    /// `base[index]`, where the base is already a pointer to the element type.
    fn element(&mut self, base: ExprId, index: ExprId, ty: TypeId, span: Span) -> Value {
        // A vector does not decay, so the base is the vector and the address to step from is
        // the one it lives at. Every other base is a pointer already.
        let pointer = if rucc_types::is_vector(self.types(), self.tast()[base].ty) {
            self.vector_addr(base, span)
        } else {
            self.value(base)
        };
        let steps = self.value(index);
        let size = self.stride(ty, span);
        let signed = repr::is_signed(self.types(), self.target(), self.tast()[index].ty);
        self.step(pointer, steps, signed, size, false, span)
    }

    /// The address of a place, which every object except a variable in a register has.
    fn address_of(&mut self, place: Place, span: Span) -> Value {
        match place.at {
            Where::Addr(addr) => addr,
            // Nothing should ask: a variable whose address is taken was put in a slot before
            // the walk started, and a bit-field has no address for the program to take.
            Where::Var(_) | Where::Bits(..) => {
                self.unsupported("the address of this object", span);
                self.poison(Type::PTR, span)
            }
        }
    }

    /// The address of a global.
    fn global_addr(&mut self, symbol: rucc_base::Symbol, span: Span) -> Value {
        self.build(span).value(
            InstData { extra: Extra::Symbol(symbol), ..InstData::new(Opcode::GlobalAddr) },
            Type::PTR,
        )
    }

    /// An address a constant number of bytes further on.
    fn offset(&mut self, addr: Value, bytes: u64, span: Span) -> Value {
        if bytes == 0 {
            return addr;
        }
        let moved = {
            let address = self.address;
            let mut build = self.build(span);
            let amount = build.iconst(address, bytes as i128);
            let args = build.func().push_values(&[addr, amount]);
            build.value(InstData { args, ..InstData::new(Opcode::PtrAdd) }, Type::PTR)
        };
        // The alignment the offset leaves of whatever the address had, for the addresses anything
        // knows an alignment for. This is what carries a packed record's one byte alignment out to
        // the members of it and to anything inside those.
        if let Some(align) = self.alignment(addr) {
            self.aligns(moved, shifted(align, bytes));
        }
        moved
    }

    /// What an address is known to be aligned to, where the layout settled it.
    fn alignment(&self, addr: Value) -> Option<u32> {
        self.aligned.get(&addr).copied()
    }

    /// Writes down what an address is aligned to, keeping the smaller of two answers.
    ///
    /// Two answers about one address is a thing a walk that meets the same value twice can
    /// produce, and the smaller one is the one an access can rely on.
    fn aligns(&mut self, addr: Value, align: u32) {
        let known = self.aligned.entry(addr).or_insert(align);
        *known = (*known).min(align);
    }

    /// An address a number of elements further on, or back when `back` is set.
    fn step(
        &mut self,
        addr: Value,
        steps: Value,
        signed: bool,
        size: Stride,
        back: bool,
        span: Span,
    ) -> Value {
        let moved = {
            let amount = self.scaled(steps, signed, size, back, span);
            let mut build = self.build(span);
            let args = build.func().push_values(&[addr, amount]);
            build.value(InstData { args, ..InstData::new(Opcode::PtrAdd) }, Type::PTR)
        };
        // A step of a whole number of elements leaves whatever the element width and the address
        // have in common, which is what [`shifted`] works out. How many elements it is does not
        // enter into it, and a width the program computed leaves nothing at all.
        if let Some(align) = self.alignment(addr) {
            let left = match size {
                Stride::Bytes(bytes) => shifted(align, bytes),
                Stride::Value(_) => 1,
            };
            self.aligns(moved, left);
        }
        moved
    }

    /// A number of elements as the number of bytes it is, in the width an address has.
    ///
    /// This is the half of [`Self::step`] that has nothing to do with the address it starts from,
    /// which is what an atomic step needs on its own: the machine adds the bytes to the object
    /// and the address it adds them to is never in a register.
    fn scaled(
        &mut self,
        steps: Value,
        signed: bool,
        size: Stride,
        back: bool,
        span: Span,
    ) -> Value {
        let address = self.address;
        let mut amount = self.widen(steps, signed, address, span);
        let flags = self.stride_overflow();
        match size {
            Stride::Bytes(1) => {}
            Stride::Bytes(bytes) => {
                let mut build = self.build(span);
                let scale = build.iconst(address, i128::from(bytes));
                amount = build.binary(Opcode::Mul, amount, scale, flags);
            }
            Stride::Value(scale) => {
                amount = self.build(span).binary(Opcode::Mul, amount, scale, flags);
            }
        }
        if back {
            let mut build = self.build(span);
            let zero = build.iconst(address, 0);
            amount = build.binary(Opcode::Sub, zero, amount, Flags::NONE);
        }
        amount
    }

    /// An integer in another integer's width, which is the only conversion an index needs.
    fn widen(&mut self, value: Value, signed: bool, to: Type, span: Span) -> Value {
        let from = self.func[value].ty;
        match from.bits().cmp(&to.bits()) {
            std::cmp::Ordering::Equal => value,
            std::cmp::Ordering::Greater => self.build(span).unary(Opcode::Trunc, value, to),
            std::cmp::Ordering::Less => {
                let opcode = if signed { Opcode::SExt } else { Opcode::ZExt };
                self.build(span).unary(opcode, value, to)
            }
        }
    }

    /// Reads a place.
    fn read(&mut self, place: Place, span: Span) -> Option<Value> {
        let ty = repr::value_type(self.types(), self.target(), place.ty)?;
        let ordered = self.atomic_access(place.ty, span);
        match place.at {
            Where::Var(var) => {
                let block = self.block();
                Some(self.ssa.read(self.func, var, block, ty))
            }
            Where::Addr(addr) => {
                // Without the padding, which is a thing a store records and a read has no use
                // for: what a read is about is the bytes it reads, and the verifier turns down a
                // number on an instruction that would never look at it.
                let mut info = MemInfo { owns: 0, ..self.info_of(place) };
                let flags = self.flags(place.ty);
                if !ordered {
                    return Some(self.build(span).load(ty, addr, info, flags));
                }
                info.order = MemOrder::SeqCst;
                Some(self.build(span).atomic_load(ty, addr, info, flags))
            }
            Where::Bits(addr, run) => Some(self.read_bits(addr, run, place.ty, ty, span)),
        }
    }

    /// Writes a place, answering with the bits that went into a bit-field.
    ///
    /// A bit-field is the one place where what was written is not what a read gives back, and
    /// [`Self::write_back`] is what turns those bits into the value that does.
    fn write(&mut self, place: Place, value: Value, span: Span) -> Option<Value> {
        let ordered = self.atomic_access(place.ty, span);
        match place.at {
            Where::Var(var) => {
                let block = self.block();
                self.ssa.write(var, block, value);
                None
            }
            Where::Addr(addr) => {
                let mut info = self.info_of(place);
                let flags = self.flags(place.ty);
                if ordered {
                    info.order = MemOrder::SeqCst;
                    self.build(span).atomic_store(value, addr, info, flags);
                } else {
                    self.build(span).store(value, addr, info, flags);
                }
                None
            }
            Where::Bits(addr, run) => self.store_bits(addr, run, place.ty, value, span),
        }
    }

    /// Writes a place and answers with what a read of it gives back afterwards.
    ///
    /// That is the value written everywhere except in a bit-field, where it is what fits:
    /// `x.b = 9` on a three bit field is 1, and that is the value of the assignment as well as
    /// the value in the field. Building it takes a shift, so a caller with no use for it says
    /// so and gets back what it wrote.
    fn write_back(&mut self, place: Place, value: Value, want: bool, span: Span) -> Value {
        let kept = self.write(place, value, span);
        if !want {
            return value;
        }
        let (Some(kept), Where::Bits(_, run)) = (kept, place.at) else { return value };
        let signed = repr::is_signed(self.types(), self.target(), place.ty);
        let back = if signed { self.narrow(kept, 0, run.width, true, span) } else { kept };
        self.widen(back, signed, self.func[value].ty, span)
    }

    // Bit-fields.

    /// Reads a run of bits as a value of the type the member was declared with.
    fn read_bits(&mut self, addr: Value, run: Run, ty: TypeId, into: Type, span: Span) -> Value {
        if !self.usable(run, span) {
            return self.poison(into, span);
        }
        let unit = Type::int(run.unit());
        let flags = self.flags(ty);
        let mut whole = None;
        for piece in run.pieces() {
            let part = self.load_piece(addr, piece, flags, span);
            let part = self.widen(part, false, unit, span);
            let part = self.shift(Opcode::Shl, part, piece.offset as u32 * 8, span);
            whole = Some(match whole {
                None => part,
                Some(sofar) => self.build(span).binary(Opcode::Or, sofar, part, Flags::NONE),
            });
        }
        let whole = whole.expect("a run of at least one bit lies in at least one byte");
        let signed = repr::is_signed(self.types(), self.target(), ty);
        let value = self.narrow(whole, run.start, run.width, signed, span);
        self.widen(value, signed, into, span)
    }

    /// Writes a run of bits, leaving every byte it has no bit in as it was.
    ///
    /// Answers with what went in, in the width the pieces were assembled in, which is what a
    /// read of the field afterwards gives back once its top bit has been copied up. Nothing
    /// when the run was reported.
    fn store_bits(
        &mut self,
        addr: Value,
        run: Run,
        ty: TypeId,
        value: Value,
        span: Span,
    ) -> Option<Value> {
        if !self.usable(run, span) {
            return None;
        }
        let unit = Type::int(run.unit());
        let flags = self.flags(ty);
        let signed = repr::is_signed(self.types(), self.target(), ty);
        // What the field keeps of the value, cleared above its width rather than sign
        // extended, because those bits belong to whatever else lives in these bytes.
        let wide = self.widen(value, signed, unit, span);
        let kept = self.narrow(wide, 0, run.width, false, span);
        let placed = self.shift(Opcode::Shl, kept, run.start, span);
        for piece in run.pieces() {
            let part = self.shift(Opcode::LShr, placed, piece.offset as u32 * 8, span);
            let part = self.widen(part, false, Type::int(piece.size * 8), span);
            let stored = if piece.whole() {
                // Nothing but the field is in this piece, so what was there does not matter.
                part
            } else {
                let old = self.load_piece(addr, piece, flags, span);
                let ty = self.func[old].ty;
                let keep = self.build(span).iconst(ty, !piece.mask() as i128);
                let old = self.build(span).binary(Opcode::And, old, keep, Flags::NONE);
                self.build(span).binary(Opcode::Or, old, part, Flags::NONE)
            };
            self.store_piece(addr, piece, stored, flags, span);
        }
        Some(kept)
    }

    /// Whether an access to a run can be built, reporting it when it cannot.
    fn usable(&mut self, run: Run, span: Span) -> bool {
        if !self.target().little_endian {
            // The layout numbers a member's bits from the low bit of its lowest byte, which is
            // not where a big-endian target starts counting.
            self.unsupported("a bit-field on a big-endian target", span);
            return false;
        }
        if !run.accessible() {
            self.unsupported("a bit-field that lies in more than eight bytes", span);
            return false;
        }
        true
    }

    /// One of the loads the bytes under a run are read by.
    fn load_piece(&mut self, addr: Value, piece: Piece, flags: Flags, span: Span) -> Value {
        let addr = self.offset(addr, piece.offset, span);
        let info = MemInfo {
            size: 0,
            align: piece.align,
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        };
        self.build(span).load(Type::int(piece.size * 8), addr, info, flags)
    }

    /// One of the stores the bytes under a run are written by.
    fn store_piece(&mut self, addr: Value, piece: Piece, value: Value, flags: Flags, span: Span) {
        let addr = self.offset(addr, piece.offset, span);
        let info = MemInfo {
            size: 0,
            align: piece.align,
            order: MemOrder::NotAtomic,
            tbaa: None,
            owns: 0,
            restrict: Restrict::NONE,
        };
        self.build(span).store(value, addr, info, flags);
    }

    /// The bits of a run taken out of the integer they were loaded in.
    ///
    /// The first of them ends up at the bottom and everything above the last of them is gone,
    /// by copying the top one up when the field is signed and by clearing when it is not.
    fn narrow(&mut self, value: Value, start: u32, width: u32, signed: bool, span: Span) -> Value {
        let bits = self.func[value].ty.bits();
        if signed {
            // Left until the field's top bit is the top bit and then arithmetic right, which
            // is how a value is sign extended from a width no type has.
            let value = self.shift(Opcode::Shl, value, bits - start - width, span);
            return self.shift(Opcode::AShr, value, bits - width, span);
        }
        let value = self.shift(Opcode::LShr, value, start, span);
        if start + width == bits {
            return value;
        }
        let ones = if width >= 128 { u128::MAX } else { (1u128 << width) - 1 };
        let ty = self.func[value].ty;
        let mask = self.build(span).iconst(ty, ones as i128);
        self.build(span).binary(Opcode::And, value, mask, Flags::NONE)
    }

    /// A shift by a constant number of bits, which is the value itself when that is none.
    fn shift(&mut self, opcode: Opcode, value: Value, amount: u32, span: Span) -> Value {
        if amount == 0 {
            return value;
        }
        let ty = self.func[value].ty;
        let mut build = self.build(span);
        let amount = build.iconst(ty, i128::from(amount));
        build.binary(opcode, value, amount, Flags::NONE)
    }

    // Expressions.

    /// An expression evaluated for what it does rather than for what it is worth.
    ///
    /// Only an assignment cares about the difference, and only where it writes a bit-field:
    /// what one of those is worth is the value in the field afterwards, which is not the value
    /// that went in and which a statement has no use for.
    fn discard(&mut self, expr: ExprId) {
        let tast = self.tast();
        if let ExprKind::Assign { op, computation, lhs, rhs } = tast[expr].kind {
            let span = tast.expr_span(expr);
            self.assign(op, computation, lhs, rhs, false, span);
            return;
        }
        // A complex value thrown away, `z + w;` on its own. It has no value form for `eval` to
        // answer with, so it is built where one would live and the object is then dropped on the
        // floor, which is what discarding one means.
        if rucc_types::is_complex(self.types(), tast[expr].ty) {
            self.place(expr);
            return;
        }
        self.eval(expr);
    }

    /// The value of an expression, which is [`None`] only when it has none.
    fn eval(&mut self, expr: ExprId) -> Option<Value> {
        // The size of a variable length array, which was evaluated where the declaration was
        // reached. `sizeof a` is built by the checking out of the very expression the type
        // points at, so meeting it again here is meeting the same node, and what it is worth is
        // what it was worth then rather than what `n` says now.
        if let Some(&value) = self.vlas.get(&expr) {
            return Some(value);
        }
        // The node an `a ?: b` is written out of, whose value was taken before the branch was
        // taken on it. The arm is that node, so this is where the once in "evaluated once" is.
        if let Some((shared, value)) = self.shared {
            if shared == expr {
                return Some(value);
            }
        }
        let tast = self.tast();
        let span = tast.expr_span(expr);
        let ty = tast[expr].ty;
        match tast[expr].kind {
            ExprKind::Error => {
                let ty = repr::value_type(self.types(), self.target(), ty)?;
                Some(self.poison(ty, span))
            }
            ExprKind::Const(id) => self.constant(tast[id], ty, span),
            ExprKind::Str(_)
            | ExprKind::Decl(_)
            | ExprKind::Member { .. }
            | ExprKind::Subscript { .. }
            | ExprKind::CompoundLiteral(_) => {
                let place = self.place(expr);
                self.read(place, span)
            }
            ExprKind::Call { callee, args } => self.call(callee, args, span),
            ExprKind::Unary { op, operand } => self.unary(op, operand, ty, span),
            ExprKind::Binary { op, lhs, rhs } => self.binary(op, lhs, rhs, ty, span),
            ExprKind::Assign { op, computation, lhs, rhs } => {
                self.assign(op, computation, lhs, rhs, true, span)
            }
            ExprKind::Cond { cond, then, otherwise } => {
                self.conditional(cond, then, otherwise, ty, span)
            }
            ExprKind::Comma { lhs, rhs } => {
                self.discard(lhs);
                self.eval(rhs)
            }
            ExprKind::Cast(operand) => {
                let from = tast[operand].ty;
                if matches!(self.types().kind(self.types().canonical(ty)), TypeKind::Void) {
                    self.discard(operand);
                    return None;
                }
                // A cast of a vector to something of its own size, which is the same bytes read
                // under another type rather than a value being converted. The vector is an
                // object, so that is a load of the target type where the object is.
                if rucc_types::is_vector(self.types(), from) {
                    let at = self.vector_addr(operand, span);
                    return self.read(Place::new(Where::Addr(at), ty), span);
                }
                // A cast of a complex value to a real type, which is the same conversion the
                // language performs without being asked and is written out in the same place.
                if let Some(value) = self.complex_to_real(operand, ty, span) {
                    return Some(value);
                }
                let value = self.eval(operand)?;
                Some(self.coerce(value, from, ty, span))
            }
            ExprKind::Convert { kind, operand } => self.convert(kind, operand, ty, span),
            ExprKind::StmtExpr(body) => {
                let last = self.statements(body);
                let value = last.and_then(|last| self.eval(last));
                self.close(span);
                value
            }
            ExprKind::LabelAddr(label) => self.label_addr(label, span),
            ExprKind::VaArg { list } => self.va_arg(list, ty, span),
            ExprKind::VaStart { list } => {
                self.va_effect(Opcode::VaStart, &[list], span);
                None
            }
            ExprKind::VaEnd { list } => {
                self.va_effect(Opcode::VaEnd, &[list], span);
                None
            }
            ExprKind::VaCopy { dst, src } => {
                self.va_effect(Opcode::VaCopy, &[dst, src], span);
                None
            }
            // The one question in the family whose answer is a number, so it is built in the
            // type the node has rather than widened into it.
            ExprKind::Classify { op: Classify::InfiniteSign, lhs, .. } => {
                let into = self.value_type(ty, span);
                Some(self.infinite_sign(lhs, into, span))
            }
            // One bit, and C says the type of the answer is `int`, the same as a comparison.
            ExprKind::Classify { op, lhs, rhs } => {
                let bit = self.classify(op, lhs, rhs, span);
                let into = self.value_type(ty, span);
                Some(self.widen(bit, false, into, span))
            }
            ExprKind::FpClassify { value, answers } => self.fpclassify(value, answers, ty, span),
            ExprKind::Sign { op, lhs, rhs } => Some(self.sign(op, lhs, rhs, span)),
            ExprKind::Abs { operand } => Some(self.abs(operand, span)),
            ExprKind::ByteSwap { operand } => Some(self.byte_swap(operand, span)),
            ExprKind::Expect { value, hint, parts } => Some(self.expect(value, hint, parts, span)),
            // Counted at the operand's width, which is the question, and answered in `int`, which
            // is what C says every one of these is.
            ExprKind::BitCount { operand, count } => {
                let into = self.value_type(ty, span);
                Some(self.bit_count(operand, count, into, span))
            }
            // Done at the type sema picked, which holds every value all three written types can,
            // and then narrowed to the one being written to. The answer is a bit, and C says the
            // type of it is `_Bool`.
            ExprKind::Overflow { op, at, args } => {
                let bit = self.overflow(op, args, at, span);
                let into = self.value_type(ty, span);
                Some(self.widen(bit, false, into, span))
            }
            // An access with an ordering on it, or the ordering by itself. A load answers with what
            // it read and the other two answer with nothing, which is what their type in C says.
            ExprKind::Atomic { op, order, args } => self.atomic(op, order, args, ty, span),
            // A promise and not a computation, so it is written where it was written and read by
            // whoever comes to read promises. The block goes on: what ends a block is a
            // terminator, and this is not one, so the statement after a `__builtin_unreachable()`
            // is lowered the way it would have been without it. That is the conservative half of
            // the pair, and the half that is right until something acts on the promise.
            ExprKind::Unreachable => {
                self.build(span).inst(InstData::new(Opcode::UnreachableHint), &[]);
                None
            }
            // A fact about the machine rather than about the program, so there is nothing under it
            // to lower first and the whole of it is the one instruction the back end writes.
            ExprKind::ThreadPointer => {
                Some(self.build(span).value(InstData::new(Opcode::ThreadPointer), Type::PTR))
            }
            // A hint, so the address under it is lowered for its value and nothing is read through
            // it. It produces nothing, which is why the whole of it answers `None`: a prefetch is
            // void and a program that used it for a value did not get past the checker.
            ExprKind::Prefetch { address, write, locality } => {
                let address = self.value(address);
                self.build(span).prefetch(address, PrefetchHint { write, locality });
                None
            }
        }
    }

    /// The value of an expression that has to have one.
    fn value(&mut self, expr: ExprId) -> Value {
        let span = self.tast().expr_span(expr);
        let ty = self.tast()[expr].ty;
        match self.eval(expr) {
            Some(value) => value,
            None => {
                let ty = self.value_type(ty, span);
                self.poison(ty, span)
            }
        }
    }

    /// A condition, which is one bit however it was written.
    fn condition(&mut self, expr: ExprId) -> Value {
        self.bit(expr)
    }

    /// An expression as the one bit that says whether it is true.
    ///
    /// The point of going through here rather than through [`Body::eval`] is what C says the
    /// type of a comparison is, which is `int` and not `bool`. Lowering `a < b` on its own
    /// widens the bit the comparison produced, and lowering `if (a < b)` would then narrow it
    /// straight back by comparing it against zero. Asking for the bit is what skips both.
    fn bit(&mut self, expr: ExprId) -> Value {
        let tast = self.tast();
        let span = tast.expr_span(expr);
        match tast[expr].kind {
            ExprKind::Binary { op, lhs, rhs } if op.is_comparison() => {
                let operand = tast[lhs].ty;
                if rucc_types::is_complex(self.types(), operand) {
                    return self.complex_compare(op, lhs, rhs, span);
                }
                let left = self.value(lhs);
                let right = self.value(rhs);
                self.compare(op, left, right, operand, span)
            }
            ExprKind::Binary { op: op @ (BinaryOp::LogAnd | BinaryOp::LogOr), lhs, rhs } => {
                self.short_circuit(op, lhs, rhs, span)
            }
            ExprKind::Unary { op: UnaryOp::Not, operand } => {
                let bit = self.bit(operand);
                let mut build = self.build(span);
                let one = build.iconst(Type::I1, 1);
                build.binary(Opcode::Xor, bit, one, Flags::NONE)
            }
            // `isinf_sign` is not here: its answer is a number, so asking whether it is true is
            // asking whether that number is not zero, which is what the last arm does.
            ExprKind::Classify { op, lhs, rhs } if op.answers_a_bit() => {
                self.classify(op, lhs, rhs, span)
            }
            // The conversion the checking wrote on a condition, which is this question asked
            // one node further down.
            ExprKind::Convert { kind: Conversion::Bool, operand } => self.bit(operand),
            // A complex value, which has no value form for the comparison against zero below to
            // be handed, so the question is asked of its two halves instead.
            _ if rucc_types::is_complex(self.types(), tast[expr].ty) => {
                self.complex_truth(expr, span)
            }
            _ => {
                let value = self.value(expr);
                self.is_nonzero(value, span)
            }
        }
    }

    /// Whether a scalar is not zero, as one bit.
    fn is_nonzero(&mut self, value: Value, span: Span) -> Value {
        let ty = self.func[value].ty;
        if ty == Type::I1 {
            // Already the one bit, which is what a `bool` holds and what a comparison
            // produced. Comparing it against zero would answer the same question twice.
            return value;
        }
        let address = self.address;
        if ty.is_ptr() {
            let mut build = self.build(span);
            let zero = build.iconst(address, 0);
            let null = build.unary(Opcode::IntToPtr, zero, Type::PTR);
            return build.icmp(IntPred::Ne, value, null);
        }
        if ty.lane().is_float() {
            let mut build = self.build(span);
            let zero = build.fconst(ty, 0);
            return build.fcmp(FloatPred::Une, value, zero, Flags::NONE);
        }
        let mut build = self.build(span);
        let zero = build.iconst(ty, 0);
        build.icmp(IntPred::Ne, value, zero)
    }

    /// A constant the checking folded.
    fn constant(&mut self, value: Const, ty: TypeId, span: Span) -> Option<Value> {
        let ir = repr::value_type(self.types(), self.target(), ty)?;
        match value {
            Const::Int(number) if ir.is_ptr() => {
                // A null pointer constant, or a program that cast a number to a pointer.
                let address = self.address;
                let mut build = self.build(span);
                let number = build.iconst(address, number);
                Some(build.unary(Opcode::IntToPtr, number, Type::PTR))
            }
            Const::Int(number) => Some(self.build(span).iconst(ir, number)),
            Const::Float(number) => Some(self.build(span).fconst(ir, number.to_bits())),
            // A complex constant has no value type, so the line above answered before this was
            // reached. Where one goes is [`Self::complex_into`]'s to say.
            Const::Complex { .. } | Const::ComplexInt { .. } => None,
            Const::Address(address) => {
                let symbol = match address.base {
                    rucc_sema::Base::Decl(decl) => self.unit.symbol_of(decl),
                    rucc_sema::Base::Str(id) => self.unit.string(id),
                };
                let addr = self.global_addr(symbol, span);
                Some(self.offset(addr, address.offset as u64, span))
            }
        }
    }

    /// A conversion the language performed.
    fn convert(
        &mut self,
        kind: Conversion,
        operand: ExprId,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        let from = self.tast()[operand].ty;
        match kind {
            Conversion::Lvalue => {
                let place = self.place(operand);
                self.read(place, span)
            }
            Conversion::ArrayDecay | Conversion::FunctionDecay => {
                let place = self.place(operand);
                Some(self.address_of(place, span))
            }
            Conversion::Arithmetic | Conversion::Pointer => {
                if let Some(value) = self.complex_to_real(operand, ty, span) {
                    return Some(value);
                }
                let value = self.eval(operand)?;
                Some(self.coerce(value, from, ty, span))
            }
            Conversion::Bool => Some(self.bit(operand)),
            Conversion::NullPointer => {
                self.eval(operand);
                let address = self.address;
                let mut build = self.build(span);
                let zero = build.iconst(address, 0);
                Some(build.unary(Opcode::IntToPtr, zero, Type::PTR))
            }
            Conversion::Void => {
                self.discard(operand);
                None
            }
            // What this produces is a vector, and a vector has no value form, so the only
            // caller is [`Self::place`] and it answers this without asking here.
            Conversion::Broadcast => {
                self.unsupported("a vector as a value", span);
                None
            }
        }
    }

    /// One scalar type to another, which is what a cast and an argument both do.
    fn coerce(&mut self, value: Value, from: TypeId, to: TypeId, span: Span) -> Value {
        let types = self.unit.types;
        let target = self.unit.target;
        let Some(into) = repr::value_type(types, target, to) else {
            self.unsupported("a conversion to this type", span);
            return value;
        };
        let out = self.func[value].ty;
        if out == into {
            return value;
        }
        let signed = repr::is_signed(types, target, from);
        // A conversion to `bool` is a comparison against zero and not a narrowing, which is
        // what makes `(bool)2` one and not zero.
        if into == Type::I1 {
            return self.is_nonzero(value, span);
        }
        match (out.is_ptr(), out.lane().is_float(), into.is_ptr(), into.lane().is_float()) {
            (true, _, true, _) => value,
            (true, _, false, false) => {
                let address = self.address;
                let number = self.build(span).unary(Opcode::PtrToInt, value, address);
                self.widen(number, false, into, span)
            }
            (false, false, true, _) => {
                let address = self.address;
                let number = self.widen(value, signed, address, span);
                self.build(span).unary(Opcode::IntToPtr, number, Type::PTR)
            }
            (false, false, false, false) => self.widen(value, signed, into, span),
            (false, false, false, true) => {
                let opcode = if signed { Opcode::SIToFP } else { Opcode::UIToFP };
                self.build(span).unary(opcode, value, into)
            }
            (false, true, false, false) => {
                let opcode = if repr::is_signed(types, target, to) {
                    Opcode::FPToSI
                } else {
                    Opcode::FPToUI
                };
                self.build(span).unary(opcode, value, into)
            }
            (false, true, false, true) => {
                let opcode = if into.bits() > out.bits() { Opcode::FPExt } else { Opcode::FPTrunc };
                self.build(span).unary(opcode, value, into)
            }
            _ => {
                self.unsupported("this conversion", span);
                value
            }
        }
    }

    /// A prefix or postfix operator.
    fn unary(&mut self, op: UnaryOp, operand: ExprId, ty: TypeId, span: Span) -> Option<Value> {
        match op {
            UnaryOp::Plus => self.eval(operand),
            UnaryOp::Minus => {
                let value = self.eval(operand)?;
                let out = self.func[value].ty;
                if out.lane().is_float() {
                    return Some(self.build(span).unary(Opcode::FNeg, value, out));
                }
                let signed = repr::is_signed(self.types(), self.target(), ty);
                Some(self.signed_negate(value, signed, span))
            }
            UnaryOp::Not => {
                let bit = self.bit(operand);
                let mut build = self.build(span);
                let one = build.iconst(Type::I1, 1);
                let flipped = build.binary(Opcode::Xor, bit, one, Flags::NONE);
                let into = self.value_type(ty, span);
                Some(self.widen(flipped, false, into, span))
            }
            UnaryOp::BitNot => {
                let value = self.eval(operand)?;
                let out = self.func[value].ty;
                let mut build = self.build(span);
                let ones = build.iconst(out, -1);
                Some(build.binary(Opcode::Xor, value, ones, Flags::NONE))
            }
            UnaryOp::Deref => {
                let place = self.place_of_deref(operand, ty);
                self.read(place, span)
            }
            UnaryOp::AddrOf => {
                let place = self.place(operand);
                Some(self.address_of(place, span))
            }
            UnaryOp::PreInc | UnaryOp::PreDec | UnaryOp::PostInc | UnaryOp::PostDec => {
                self.step_by_one(op, operand, span)
            }
            // `__real__ z` and `__imag__ z`, which are the two halves of the object. gcc takes
            // both on a real operand as well, where the real half is the value itself and the
            // imaginary half is a zero the operand is still evaluated for.
            UnaryOp::Real | UnaryOp::Imag => {
                let imag = op == UnaryOp::Imag;
                let from = self.tast()[operand].ty;
                if let Some(part) = rucc_types::real_part(self.types(), from) {
                    let addr = self.complex_addr(operand, span);
                    return Some(self.half(addr, imag, part, span));
                }
                let value = self.eval(operand)?;
                if !imag {
                    return Some(value);
                }
                let out = self.value_type(ty, span);
                Some(self.blank(out, span))
            }
        }
    }

    /// The place `*p` names.
    fn place_of_deref(&mut self, operand: ExprId, ty: TypeId) -> Place {
        let addr = self.value(operand);
        let through = self.through(operand);
        Place { restrict: through, ..Place::new(Where::Addr(addr), ty) }
    }

    /// The `restrict` scope a pointer this access is about to go through came from.
    ///
    /// Nothing for the great majority of accesses, since a clique of zero is what a function that
    /// declares no `restrict` pointer gives everything in it.
    fn through(&self, pointer: ExprId) -> Restrict {
        self.restrict.value(self.unit.tast, self.unit.types, pointer)
    }

    /// `++x`, `--x`, `x++` and `x--`, which are one read, one add and one write.
    fn step_by_one(&mut self, op: UnaryOp, operand: ExprId, span: Span) -> Option<Value> {
        let ty = self.tast()[operand].ty;
        let up = matches!(op, UnaryOp::PreInc | UnaryOp::PostInc);
        // An object with the qualifier on it, whose step is one operation and not a read, an add
        // and a write: see [`Self::atomic_update`].
        if self.is_atomic(ty) {
            return self.atomic_step(op, operand, ty, span);
        }
        // A vector, which has no value form for the read below to answer with. The step is at
        // the object either way, so it is taken here and nothing is answered: what one of these
        // is worth is a copy of the object, and a copy of one lives in memory like every other
        // computed vector, so the copy is [`Self::place`]'s to make and only where it is asked
        // for. `v++;` on its own asks for none.
        if rucc_types::is_vector(self.types(), ty) {
            let place = self.place(operand);
            let target = self.address_of(place, span);
            self.vector_step(target, up, ty, span);
            return None;
        }
        let place = self.place(operand);
        let old = self.read(place, span)?;
        let out = self.func[old].ty;

        let new = if out.is_ptr() {
            let pointee = match self.types().kind(self.types().canonical(ty)) {
                TypeKind::Pointer(pointee) => pointee,
                _ => ty,
            };
            let size = self.stride(pointee, span);
            let address = self.address;
            let one = self.build(span).iconst(address, 1);
            self.step(old, one, false, size, !up, span)
        } else if out.lane().is_float() {
            let format = repr::float_format_of(self.types(), self.target(), ty);
            let one = format.map_or(0, |format| Real::from_signed(1, format).0.to_bits());
            let mut build = self.build(span);
            let one = build.fconst(out, one);
            let opcode = if up { Opcode::FAdd } else { Opcode::FSub };
            build.binary(opcode, old, one, Flags::NONE)
        } else if out == Type::I1 {
            // A `_Bool`, which is the one type here whose step is not an add at the width of the
            // object. What C says a `b++` is is `b = b + 1` with the usual conversions, so the
            // addition is at `int` and the answer is converted back. For every other integer that
            // conversion is a truncation, and a truncation of a sum is the sum of the truncations,
            // which is why adding at the object's own width above gives the same answer. The
            // conversion to a `_Bool` is a comparison against zero instead, and the two readings
            // differ: one plus one is two, which is a true as a `_Bool` and a false as a one bit
            // sum.
            //
            // So it is written out. Going up leaves a one whatever was there, since one and two
            // are both other than zero. Going down leaves the other value, since a false becomes
            // minus one and a true becomes zero.
            let mut build = self.build(span);
            let one = build.iconst(Type::I1, 1);
            if up { one } else { build.binary(Opcode::Xor, old, one, Flags::NONE) }
        } else {
            let signed = repr::is_signed(self.types(), self.target(), ty);
            let opcode = if up { Opcode::Add } else { Opcode::Sub };
            let one = self.build(span).iconst(out, 1);
            match self.checked_binary(opcode, old, one, signed, span) {
                Some(value) => value,
                None => {
                    let flags = self.signed_overflow(signed);
                    self.build(span).binary(opcode, old, one, flags)
                }
            }
        };
        // What a prefix one is worth is the value in the object afterwards, which in a
        // bit-field is what fits in it: `++b` on a five bit field holding 31 is 0. A postfix
        // one is worth what was there before and has no use for it.
        let new = self.write_back(place, new, !op.is_postfix(), span);
        Some(if op.is_postfix() { old } else { new })
    }

    /// The same four on an atomic object, where the three parts of one are a single step.
    fn atomic_step(
        &mut self,
        op: UnaryOp,
        operand: ExprId,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        if !self.atomic_access(ty, span) {
            return None;
        }
        let place = self.place(operand);
        let Where::Addr(addr) = place.at else {
            // Nothing reaches this. An atomic object always has an address, which is what
            // [`Self::declare`] sees to, and a bit-field cannot carry the qualifier.
            self.unsupported("a step of an object with no address", span);
            return None;
        };
        let up = matches!(op, UnaryOp::PreInc | UnaryOp::PostInc);
        let step = self.one(ty, up, span);
        let (before, after) = self.atomic_update(addr, ty, step, span);
        Some(if op.is_postfix() { before } else { after })
    }

    /// The step a `++` or a `--` takes, which is one element of a pointer and one of anything else.
    fn one(&mut self, ty: TypeId, up: bool, span: Span) -> Step {
        let into = self.value_type(ty, span);
        if into.is_ptr() {
            let pointee = self.pointee(self.underlying(ty));
            let size = self.stride(pointee, span);
            let address = self.address;
            let steps = self.build(span).iconst(address, 1);
            return Step::Walk { steps, signed: false, size, back: !up };
        }
        let op = if up { BinaryOp::Add } else { BinaryOp::Sub };
        let right = if into.lane().is_float() {
            let format = repr::float_format_of(self.types(), self.target(), ty);
            let bits = format.map_or(0, |format| Real::from_signed(1, format).0.to_bits());
            self.build(span).fconst(into, bits)
        } else {
            self.build(span).iconst(into, 1)
        };
        Step::Arithmetic { op, right, computation: ty }
    }

    /// A binary operator.
    fn binary(
        &mut self,
        op: BinaryOp,
        lhs: ExprId,
        rhs: ExprId,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        match op {
            // Both of these answer with one bit, and C says the type of the answer is `int`.
            BinaryOp::LogAnd | BinaryOp::LogOr => {
                let bit = self.short_circuit(op, lhs, rhs, span);
                let into = self.value_type(ty, span);
                Some(self.widen(bit, false, into, span))
            }
            _ if op.is_comparison() => {
                let operand = self.tast()[lhs].ty;
                let bit = if rucc_types::is_complex(self.types(), operand) {
                    self.complex_compare(op, lhs, rhs, span)
                } else {
                    let left = self.value(lhs);
                    let right = self.value(rhs);
                    self.compare(op, left, right, operand, span)
                };
                let into = self.value_type(ty, span);
                Some(self.widen(bit, false, into, span))
            }
            BinaryOp::Add | BinaryOp::Sub if self.is_pointer(ty) => {
                self.pointer_arithmetic(op, lhs, rhs, ty, span)
            }
            BinaryOp::Sub if self.is_pointer(self.tast()[lhs].ty) => {
                self.pointer_difference(lhs, rhs, ty, span)
            }
            _ => {
                let left = self.value(lhs);
                let right = self.value(rhs);
                Some(self.arithmetic(op, left, right, ty, span))
            }
        }
    }

    /// Whether a type is a pointer, which is what tells `+` which `+` it is.
    fn is_pointer(&self, ty: TypeId) -> bool {
        matches!(self.types().kind(self.types().canonical(ty)), TypeKind::Pointer(_))
    }

    /// The element type of a pointer type.
    fn pointee(&self, ty: TypeId) -> TypeId {
        match self.types().kind(self.types().canonical(ty)) {
            TypeKind::Pointer(pointee) => pointee,
            _ => ty,
        }
    }

    /// `p + n`, `n + p` and `p - n`.
    fn pointer_arithmetic(
        &mut self,
        op: BinaryOp,
        lhs: ExprId,
        rhs: ExprId,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        let (pointer, steps) =
            if self.is_pointer(self.tast()[lhs].ty) { (lhs, rhs) } else { (rhs, lhs) };
        let index = self.tast()[steps].ty;
        let base = self.value(pointer);
        let amount = self.value(steps);
        let size = self.stride(self.pointee(ty), span);
        let signed = repr::is_signed(self.types(), self.target(), index);
        Some(self.step(base, amount, signed, size, op == BinaryOp::Sub, span))
    }

    /// `p - q`, which is how many elements apart they are.
    fn pointer_difference(
        &mut self,
        lhs: ExprId,
        rhs: ExprId,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        let pointee = self.pointee(self.tast()[lhs].ty);
        let size = self.stride(pointee, span);
        let left = self.value(lhs);
        let right = self.value(rhs);
        let address = self.address;
        let mut build = self.build(span);
        let left = build.unary(Opcode::PtrToInt, left, address);
        let right = build.unary(Opcode::PtrToInt, right, address);
        let bytes = build.binary(Opcode::Sub, left, right, Flags::NONE);
        let elements = match size {
            Stride::Bytes(0 | 1) => bytes,
            Stride::Bytes(size) => {
                let scale = build.iconst(address, i128::from(size));
                build.binary(Opcode::SDiv, bytes, scale, Flags::EXACT)
            }
            Stride::Value(scale) => build.binary(Opcode::SDiv, bytes, scale, Flags::EXACT),
        };
        let into = self.value_type(ty, span);
        Some(self.widen(elements, true, into, span))
    }

    /// An arithmetic or bitwise operator on two values of one type.
    fn arithmetic(
        &mut self,
        op: BinaryOp,
        lhs: Value,
        mut rhs: Value,
        ty: TypeId,
        span: Span,
    ) -> Value {
        let out = self.func[lhs].ty;
        let float = out.lane().is_float();
        let signed = repr::is_signed(self.types(), self.target(), ty);
        let shift = matches!(op, BinaryOp::Shl | BinaryOp::Shr);
        if shift {
            // The two sides of a shift are promoted apart, so the count arrives in whatever
            // type it was written in and the IR wants both operands alike.
            rhs = self.widen(rhs, false, out, span);
        }
        let opcode = match (op, float, signed) {
            (BinaryOp::Mul, true, _) => Opcode::FMul,
            (BinaryOp::Div, true, _) => Opcode::FDiv,
            (BinaryOp::Rem, true, _) => Opcode::FRem,
            (BinaryOp::Add, true, _) => Opcode::FAdd,
            (BinaryOp::Sub, true, _) => Opcode::FSub,
            (BinaryOp::Mul, false, _) => Opcode::Mul,
            (BinaryOp::Div, false, true) => Opcode::SDiv,
            (BinaryOp::Div, false, false) => Opcode::UDiv,
            (BinaryOp::Rem, false, true) => Opcode::SRem,
            (BinaryOp::Rem, false, false) => Opcode::URem,
            (BinaryOp::Add, false, _) => Opcode::Add,
            (BinaryOp::Sub, false, _) => Opcode::Sub,
            (BinaryOp::Shl, _, _) => Opcode::Shl,
            (BinaryOp::Shr, _, true) => Opcode::AShr,
            (BinaryOp::Shr, _, false) => Opcode::LShr,
            (BinaryOp::BitAnd, _, _) => Opcode::And,
            (BinaryOp::BitXor, _, _) => Opcode::Xor,
            (BinaryOp::BitOr, _, _) => Opcode::Or,
            _ => {
                self.unsupported("this operator", span);
                return lhs;
            }
        };
        // Signed overflow is undefined, so the arithmetic may be assumed not to overflow, and
        // that is what lets a comparison of `i + 1` with `n` be folded. `-fwrapv` is what takes
        // the assumption away, and taking it away is not writing it down. `-ftrapv` is the other
        // answer and is the one that costs something: the operation becomes a call that does it
        // and looks at what it got.
        if let Some(value) = self.checked_binary(opcode, lhs, rhs, signed, span) {
            return value;
        }
        let flags = match opcode {
            Opcode::Add | Opcode::Sub | Opcode::Mul | Opcode::Shl => self.signed_overflow(signed),
            _ => Flags::NONE,
        };
        self.build(span).binary(opcode, lhs, rhs, flags)
    }

    /// A comparison, whose answer is one bit.
    fn compare(
        &mut self,
        op: BinaryOp,
        lhs: Value,
        rhs: Value,
        operand: TypeId,
        span: Span,
    ) -> Value {
        if self.func[lhs].ty.lane().is_float() {
            let pred = match op {
                BinaryOp::Lt => FloatPred::Olt,
                BinaryOp::Gt => FloatPred::Ogt,
                BinaryOp::Le => FloatPred::Ole,
                BinaryOp::Ge => FloatPred::Oge,
                BinaryOp::Eq => FloatPred::Oeq,
                // Not equal is true when the two are unordered, which is what makes
                // `x != x` a test for a NaN.
                _ => FloatPred::Une,
            };
            return self.build(span).fcmp(pred, lhs, rhs, Flags::NONE);
        }
        let signed = repr::is_signed(self.types(), self.target(), operand);
        let pred = match (op, signed) {
            (BinaryOp::Lt, true) => IntPred::Slt,
            (BinaryOp::Lt, false) => IntPred::Ult,
            (BinaryOp::Gt, true) => IntPred::Sgt,
            (BinaryOp::Gt, false) => IntPred::Ugt,
            (BinaryOp::Le, true) => IntPred::Sle,
            (BinaryOp::Le, false) => IntPred::Ule,
            (BinaryOp::Ge, true) => IntPred::Sge,
            (BinaryOp::Ge, false) => IntPred::Uge,
            (BinaryOp::Eq, _) => IntPred::Eq,
            _ => IntPred::Ne,
        };
        self.build(span).icmp(pred, lhs, rhs)
    }

    /// One of the floating point classification builtins, whose answer is one bit.
    ///
    /// Every one of them is a comparison, because there is nothing else for it to be. The family
    /// exists so that a program can ask about a value without calling anything, and `math.h`
    /// defines the macros of these names as exactly these builtins, so there is no function of
    /// any of those names to reach. `isunordered` and `islessgreater` are predicates the IR's
    /// comparison already has, and the two that ask about a magnitude are written against the
    /// infinities, which are the one constant that is exact in every format and so need no
    /// arithmetic to build.
    ///
    /// The operand is evaluated once however many times it is compared, which is the whole
    /// reason these are nodes rather than a rewriting in the front end: `isnan(f())` calls `f`
    /// once and `f() != f()` calls it twice.
    ///
    /// `signbit` is the one that is not a question about the value. A negative zero compares
    /// equal to a positive one and its sign bit is set, so the question is about the bits, and
    /// the answer is whether the number they spell is negative.
    fn classify(&mut self, op: Classify, lhs: ExprId, rhs: Option<ExprId>, span: Span) -> Value {
        let ty = self.tast()[lhs].ty;
        let value = self.value(lhs);
        if let Some(rhs) = rhs {
            let right = self.value(rhs);
            let pred = match op {
                Classify::Unordered => FloatPred::Uno,
                // `a < b || a > b`, which the IR has in one predicate. Not `a != b`, which is
                // true when the two are unordered and so is true of a NaN.
                _ => FloatPred::One,
            };
            return self.build(span).fcmp(pred, value, right, Flags::NONE);
        }
        let ir = self.func[value].ty;
        if op == Classify::SignBit {
            let bits = Type::int(ir.lane().bits());
            let mut build = self.build(span);
            let number = build.unary(Opcode::Bitcast, value, bits);
            let zero = build.iconst(bits, 0);
            return build.icmp(IntPred::Slt, number, zero);
        }
        if op == Classify::Nan {
            // Unordered with itself, which no other value is.
            return self.build(span).fcmp(FloatPred::Uno, value, value, Flags::NONE);
        }
        let Some(format) = repr::float_format_of(self.types(), self.target(), ty) else {
            self.unsupported("classifying a value of this type", span);
            return self.poison(Type::I1, span);
        };
        self.compares(op, value, format, span)
    }

    /// The three questions that are a comparison against a constant of the format.
    ///
    /// A value rather than an expression, because `fpclassify` asks all three of one value and
    /// the value is evaluated once however many times it is asked about.
    fn compares(&mut self, op: Classify, value: Value, format: Format, span: Span) -> Value {
        if op == Classify::Normal {
            return self.normal(value, format, span);
        }
        let ir = self.func[value].ty;
        let up = Real::infinity(format, false).to_bits();
        let down = Real::infinity(format, true).to_bits();
        let mut build = self.build(span);
        let up = build.fconst(ir, up);
        let down = build.fconst(ir, down);
        match op {
            Classify::Infinite => {
                let above = build.fcmp(FloatPred::Oeq, value, up, Flags::NONE);
                let below = build.fcmp(FloatPred::Oeq, value, down, Flags::NONE);
                build.binary(Opcode::Or, above, below, Flags::NONE)
            }
            // Strictly between the two infinities. A NaN is neither, because an ordered
            // comparison against one is false, which is what makes this one test and not two.
            _ => {
                let above = build.fcmp(FloatPred::Olt, down, value, Flags::NONE);
                let below = build.fcmp(FloatPred::Olt, value, up, Flags::NONE);
                build.binary(Opcode::And, above, below, Flags::NONE)
            }
        }
    }

    /// `isnormal`, which is the magnitude at or above the smallest normal of the format and
    /// below the infinity.
    ///
    /// The comparisons are on the bits and not on the value. The encoding of a floating point
    /// number with its sign clear rises with the number in every format there is, so an
    /// unsigned comparison between two of them answers what an ordered one would, and the
    /// magnitude is an integer already because clearing the sign bit is what produced it. A nan
    /// is above the infinity in that order and so is out, which is what an ordered comparison
    /// would have done for its own reason.
    fn normal(&mut self, value: Value, format: Format, span: Span) -> Value {
        let magnitude = self.magnitude(value, span);
        let bits = self.func[magnitude].ty;
        let low = Real::smallest_normal(format, false).to_bits();
        let high = Real::infinity(format, false).to_bits();
        let mut build = self.build(span);
        // Neither has its sign bit set, so neither is a number the IR's constant cannot hold.
        let low = build.iconst(bits, i128::try_from(low).expect("a magnitude"));
        let high = build.iconst(bits, i128::try_from(high).expect("a magnitude"));
        let above = build.icmp(IntPred::Uge, magnitude, low);
        let below = build.icmp(IntPred::Ult, magnitude, high);
        build.binary(Opcode::And, above, below, Flags::NONE)
    }

    /// `__builtin_isinf_sign`, which is `isinf` with a sign.
    ///
    /// One for a positive infinity, minus one for a negative one and zero for everything else,
    /// which is the two comparisons `isinf` already builds subtracted rather than combined. The
    /// answer is a number and not a bit, so it is built in the type the whole node has rather
    /// than widened into it afterwards.
    fn infinite_sign(&mut self, lhs: ExprId, into: Type, span: Span) -> Value {
        let ty = self.tast()[lhs].ty;
        let value = self.value(lhs);
        let ir = self.func[value].ty;
        let Some(format) = repr::float_format_of(self.types(), self.target(), ty) else {
            self.unsupported("classifying a value of this type", span);
            return self.poison(into, span);
        };
        let up = Real::infinity(format, false).to_bits();
        let down = Real::infinity(format, true).to_bits();
        let mut build = self.build(span);
        let up = build.fconst(ir, up);
        let down = build.fconst(ir, down);
        let above = build.fcmp(FloatPred::Oeq, value, up, Flags::NONE);
        let below = build.fcmp(FloatPred::Oeq, value, down, Flags::NONE);
        let above = self.widen(above, false, into, span);
        let below = self.widen(below, false, into, span);
        self.build(span).binary(Opcode::Sub, above, below, Flags::NONE)
    }

    /// `__builtin_fpclassify(nan, inf, normal, subnormal, zero, x)`.
    ///
    /// The value is asked four questions and the answers are the five the call was handed, with
    /// the subnormal one being whatever is left when the other four say no. The order the tests
    /// go in is the order that makes that true: a NaN and an infinity are neither normal nor a
    /// zero, so they have to be ruled out first, and what remains below the smallest normal and
    /// above zero is a subnormal and nothing else.
    ///
    /// The choosing is a mask and not a branch. All five answers are integer constant
    /// expressions, which is what the checking made sure of, so none of them can have an effect
    /// and building all five costs nothing that a branch would save.
    fn fpclassify(
        &mut self,
        value: ExprId,
        answers: ExprList,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        let into = repr::value_type(self.types(), self.target(), ty)?;
        let float = self.tast()[value].ty;
        let number = self.value(value);
        let ir = self.func[number].ty;
        let Some(format) = repr::float_format_of(self.types(), self.target(), float) else {
            self.unsupported("classifying a value of this type", span);
            return Some(self.poison(into, span));
        };
        let written: Vec<ExprId> = self.tast()[answers].to_vec();
        let answers: Vec<Value> = written.into_iter().map(|answer| self.value(answer)).collect();
        let &[nan, infinite, normal, subnormal, zero] = &answers[..] else {
            unreachable!("the checking accepted a call with five answers");
        };
        // Whatever is left over is a subnormal, so the innermost choice is between that and a
        // zero and every test outside it takes something out of the leftover.
        let is_zero = {
            let mut build = self.build(span);
            let none = build.fconst(ir, 0);
            build.fcmp(FloatPred::Oeq, number, none, Flags::NONE)
        };
        let answer = self.pick(is_zero, zero, subnormal, into, span);
        let is_normal = self.compares(Classify::Normal, number, format, span);
        let answer = self.pick(is_normal, normal, answer, into, span);
        let is_infinite = self.compares(Classify::Infinite, number, format, span);
        let answer = self.pick(is_infinite, infinite, answer, into, span);
        // Unordered with itself, which no other value is.
        let is_nan = self.build(span).fcmp(FloatPred::Uno, number, number, Flags::NONE);
        Some(self.pick(is_nan, nan, answer, into, span))
    }

    /// One of two integers chosen by one bit, without a branch.
    ///
    /// The mask is zero minus the bit, which is every bit or none, so the answer is one side
    /// masked in and the other masked out. There is no select in the IR to write this with and
    /// no case here that wants one, since the only caller is choosing between constants.
    fn pick(&mut self, bit: Value, then: Value, otherwise: Value, into: Type, span: Span) -> Value {
        let one = self.widen(bit, false, into, span);
        let mut build = self.build(span);
        // Zero minus the bit, which is every bit or none. Sign extending it would say the same
        // and there is no rule that lowers a sign extension out of one bit.
        let none = build.iconst(into, 0);
        let mask = build.binary(Opcode::Sub, none, one, Flags::NONE);
        let ones = build.iconst(into, -1);
        let clear = build.binary(Opcode::Xor, mask, ones, Flags::NONE);
        let then = build.binary(Opcode::And, then, mask, Flags::NONE);
        let otherwise = build.binary(Opcode::And, otherwise, clear, Flags::NONE);
        build.binary(Opcode::Or, then, otherwise, Flags::NONE)
    }

    /// The bits of a value with its sign bit cleared, which is its magnitude.
    ///
    /// The bits and not the value, because that is what the magnitude of a nan is: the nan with
    /// its sign cleared, payload and all. The width is the width of the value and not of the
    /// object it sits in, which is the eighty bits of the x87 format and not the ninety six or
    /// hundred and twenty eight an ABI pads them out to.
    fn magnitude(&mut self, value: Value, span: Span) -> Value {
        let float = self.func[value].ty;
        let bits = Type::int(float.lane().bits());
        let rest = (1i128 << (bits.bits() - 1)).wrapping_sub(1);
        let mut build = self.build(span);
        let number = build.unary(Opcode::Bitcast, value, bits);
        let mask = build.iconst(bits, rest);
        build.binary(Opcode::And, number, mask, Flags::NONE)
    }

    /// `__builtin_fabs` and `__builtin_copysign`, which are the sign bit and nothing else.
    ///
    /// Both are in the math library rather than the C one, so a call left behind here would not
    /// link for a program that never asked for `-lm`, and neither one needs anything the library
    /// has. What each is, is a mask: `fabs` clears the sign bit and `copysign` takes it from the
    /// second operand, and every other bit of the first operand goes through untouched.
    ///
    /// The bits and not the value, because that is what the operations are. `fabs` of a nan is
    /// that nan with its sign cleared, payload and all, and a negative zero has a sign bit to
    /// clear while comparing equal to a positive zero, so nothing written with comparisons and
    /// negation gives the right answer for either.
    ///
    /// The one format this has to be careful about is the x87 one, whose value is eighty bits
    /// sitting in an object of sixteen. The bitcast is to an integer as wide as the value, not as
    /// wide as the object, so the padding is not part of what is masked and does not come back.
    fn sign(&mut self, op: Sign, lhs: ExprId, rhs: Option<ExprId>, span: Span) -> Value {
        let value = self.value(lhs);
        let from = match op {
            Sign::Clear => None,
            Sign::Of => Some(self.value(rhs.expect("copysign takes a second operand"))),
        };
        let float = self.func[value].ty;
        let bits = Type::int(float.lane().bits());
        // The sign bit of the format, which is the highest bit of the value in every one of them.
        let top = 1i128 << (bits.bits() - 1);
        let magnitude = self.magnitude(value, span);
        let mut build = self.build(span);
        let whole = match from {
            None => magnitude,
            Some(from) => {
                let number = build.unary(Opcode::Bitcast, from, bits);
                let mask = build.iconst(bits, top);
                let sign = build.binary(Opcode::And, number, mask, Flags::NONE);
                build.binary(Opcode::Or, magnitude, sign, Flags::NONE)
            }
        };
        build.unary(Opcode::Bitcast, whole, float)
    }

    /// `abs`, `labs` and `llabs`, which are the magnitude of a two's complement integer.
    ///
    /// The sign spread over every bit is the value shifted right arithmetically by its width less
    /// one, which is zero for a value that is not negative and all ones for one that is. Exclusive
    /// or with that and then subtract it, which is the value itself in the first case and its
    /// complement plus one in the second. Four instructions, no branch and no condition code,
    /// which is the form every compiler writes when it has no conditional move to reach for.
    ///
    /// The most negative value comes back as itself, because that is what the arithmetic gives and
    /// its magnitude is not representable. C says the result is undefined there and gcc's `neg`
    /// and `cmovns` answer the same way, so nothing is being decided here that gcc has not already
    /// decided.
    ///
    /// The subtraction carries no `nsw`, for that reason: it is the one case that overflows.
    fn abs(&mut self, operand: ExprId, span: Span) -> Value {
        let value = self.value(operand);
        let ty = self.func[value].ty;
        let mut build = self.build(span);
        let width = build.iconst(ty, i128::from(ty.bits()) - 1);
        let sign = build.binary(Opcode::AShr, value, width, Flags::NONE);
        let flipped = build.binary(Opcode::Xor, value, sign, Flags::NONE);
        build.binary(Opcode::Sub, flipped, sign, Flags::NONE)
    }

    /// One of the byte swaps, as the one instruction the IR has for it.
    ///
    /// The width the bytes are reversed in is the width of the value, which is the type the
    /// prototype converted the argument to, so `__builtin_bswap16` reverses two bytes and
    /// `__builtin_bswap64` reverses eight and nothing here has to look at the name.
    ///
    /// What the instruction becomes is the backend's. On a machine with a byte swap it is that
    /// instruction, and on one without it is the shifts and masks in `rucc_codegen::expand`, which
    /// is the same trade every other instruction in the IR makes.
    fn byte_swap(&mut self, operand: ExprId, span: Span) -> Value {
        let value = self.value(operand);
        let ty = self.func[value].ty;
        self.build(span).unary(Opcode::Bswap, value, ty)
    }

    /// `__builtin_expect`, as the value with what it is expected to be tied to it.
    ///
    /// The hint is lowered first, so that a side effect written in it runs where it ran before this
    /// node existed: what this replaced was a comma with the hint on its left.
    ///
    /// Two operands of the same type, because the prototype converted both to `long`, and a third
    /// holding the probability where the call gave one. The answer is the first operand, and
    /// `rucc_opt::expect` is the pass that says so: it reads the branch this ends up controlling,
    /// writes the hint onto that branch's arms, and replaces the instruction with its first operand
    /// everywhere. Nothing after that pass sees one.
    ///
    /// Operands that did not come out the same type are a program the front end has already
    /// refused, and the instruction is left out rather than built malformed for the verifier to
    /// complain about a second time.
    fn expect(&mut self, value: ExprId, hint: ExprId, parts: Option<u16>, span: Span) -> Value {
        let hint = self.value(hint);
        let value = self.value(value);
        let ty = self.func[value].ty;
        if self.func[hint].ty != ty || !ty.is_int() {
            return value;
        }
        let mut operands = vec![value, hint];
        if let Some(parts) = parts {
            let parts = self.build(span).iconst(ty, i128::from(parts));
            operands.push(parts);
        }
        let args = self.func.push_values(&operands);
        self.build(span).value(InstData { args, ..InstData::new(Opcode::Expect) }, ty)
    }

    /// One of the bit counting builtins, as the instruction the IR has for it and a narrowing.
    ///
    /// Three of the five are one instruction. `__builtin_parity` is the set bit count and its low
    /// bit, because C says the answer is zero or one rather than the count itself. `__builtin_ffs`
    /// is the one that costs a comparison, because it is the only one in the family defined at
    /// zero, and what it is defined to answer there is zero rather than a width.
    ///
    /// Everything is built at the operand's width and narrowed once at the end. Counting at the
    /// width the argument has is the whole question: `__builtin_clz` of a value narrowed to
    /// `unsigned int` is a different number from `__builtin_clzll` of the same value, and the
    /// prototype is what did the narrowing. The answer is an `int` at every width, so what comes
    /// back is one truncation and never a widening, since no supported width is under `int`.
    fn bit_count(&mut self, operand: ExprId, count: BitCount, into: Type, span: Span) -> Value {
        let value = self.value(operand);
        let ty = self.func[value].ty;
        let counted = match count {
            BitCount::Leading => self.build(span).unary(Opcode::Ctlz, value, ty),
            BitCount::Trailing => self.build(span).unary(Opcode::Cttz, value, ty),
            BitCount::Ones => self.build(span).unary(Opcode::Ctpop, value, ty),
            BitCount::Parity => {
                let bits = self.build(span).unary(Opcode::Ctpop, value, ty);
                let mut build = self.build(span);
                let one = build.iconst(ty, 1);
                build.binary(Opcode::And, bits, one, Flags::NONE)
            }
            BitCount::FirstSet => self.first_set(value, ty, span),
        };
        self.widen(counted, false, into, span)
    }

    /// One of the overflow checking builtins: the exact arithmetic, the store, and the answer.
    ///
    /// Five steps, and the order of them is the whole of it. Both operands are converted to the
    /// type sema picked, value preservingly, so a signed one is sign extended and an unsigned one
    /// is zero extended. The checked instruction at that type gives back the wrapped answer and
    /// whether the exact answer needed more bits than that type has. The answer is narrowed to the
    /// type being written to and widened back, and comparing that against what went in is what
    /// says whether it fit there. The narrowed value is stored whether or not it fit, which is
    /// what gcc does and what makes the builtin usable as a wrapping add with a flag. The answer
    /// is either bit being set: the arithmetic itself needed more room than the wide type had, or
    /// the answer did not survive the trip down to the narrow one.
    ///
    /// The second test is exact because of what sema picked. A type that represents every value of
    /// the destination also represents every exact answer that is adjacent to what the destination
    /// can hold, so an answer outside the destination is an answer the round trip changes. There
    /// is no case where the arithmetic wrapped in a way that happens to survive the narrowing.
    ///
    /// All of which rests on sema having found a type that holds every value of all three, and for
    /// one call it cannot. That call goes to [`Body::overflow_exactly`] instead, which is the same
    /// five steps done without such a type.
    fn overflow(&mut self, op: OverflowOp, args: ExprList, at: TypeId, span: Span) -> Value {
        let [lhs, rhs, out] = [self.tast()[args][0], self.tast()[args][1], self.tast()[args][2]];
        let written = pointee(self.types(), self.tast()[out].ty).unwrap_or(at);
        let held = [self.tast()[lhs].ty, self.tast()[rhs].ty, written];
        if held.into_iter().any(|ty| !self.represents(at, ty, span)) {
            return self.overflow_exactly(op, [lhs, rhs, out], at, written, span);
        }
        let wide = self.value_type(at, span);
        let signed = repr::is_signed(self.types(), self.target(), at);
        let left = self.converted(lhs, wide, span);
        let right = self.converted(rhs, wide, span);
        let opcode = match (op, signed) {
            (OverflowOp::Add, true) => Opcode::SAddOverflow,
            (OverflowOp::Add, false) => Opcode::UAddOverflow,
            (OverflowOp::Sub, true) => Opcode::SSubOverflow,
            (OverflowOp::Sub, false) => Opcode::USubOverflow,
            (OverflowOp::Mul, true) => Opcode::SMulOverflow,
            (OverflowOp::Mul, false) => Opcode::UMulOverflow,
        };
        let (exact, wrapped) = self.build(span).checked(opcode, left, right);

        let addr = self.value(out);
        let narrow = self.value_type(written, span);
        let kept = self.widen(exact, signed, narrow, span);
        let back = {
            let signed = repr::is_signed(self.types(), self.target(), written);
            self.widen(kept, signed, wide, span)
        };
        // The round trip is the identity when the two types are the same width, which is what
        // almost every call is written as, and comparing a value against itself is worth not
        // emitting. When it is not the identity, the comparison is the whole of the second test.
        let lost = if back == exact {
            None
        } else {
            Some(self.build(span).icmp(IntPred::Ne, back, exact))
        };
        let _ = self.write(Place::new(Where::Addr(addr), written), kept, span);
        match lost {
            Some(lost) => self.build(span).binary(Opcode::Or, wrapped, lost, Flags::NONE),
            None => wrapped,
        }
    }

    /// An operand of an overflow builtin, in the type the arithmetic happens at.
    ///
    /// The extension is decided by the operand's own signedness and not by the arithmetic's,
    /// because what is being preserved is the value: a `unsigned int` operand of a signed sixty
    /// four bit add is zero extended, and sign extending it would turn three billion into a
    /// negative number before the addition ever saw it.
    fn converted(&mut self, operand: ExprId, wide: Type, span: Span) -> Value {
        let signed = repr::is_signed(self.types(), self.target(), self.tast()[operand].ty);
        let value = self.value(operand);
        self.widen(value, signed, wide, span)
    }

    /// Whether every value of `ty` is a value of `at` as well.
    ///
    /// The usual rule, and the only interesting half of it is the mixed one: a signed type is no
    /// part of an unsigned one at any width, because of the half of it below zero, and an unsigned
    /// type is part of a signed one only if the signed one is strictly wider, because of the bit
    /// the sign costs.
    fn represents(&mut self, at: TypeId, ty: TypeId, span: Span) -> bool {
        let outer = repr::is_signed(self.types(), self.target(), at);
        let inner = repr::is_signed(self.types(), self.target(), ty);
        let wide = self.value_type(at, span).bits();
        let narrow = self.value_type(ty, span).bits();
        match (outer, inner) {
            (true, true) | (false, false) => wide >= narrow,
            (true, false) => wide > narrow,
            (false, true) => false,
        }
    }

    /// One of the overflow checking builtins when no type holds every value in the call.
    ///
    /// There is one shape that gets here, and it is the one that costs a bit more than the widest
    /// type there is: a hundred and twenty eight bit unsigned type beside a signed one. Instead of
    /// widening, each operand is carried as a pair of a low word at the width of the arithmetic and
    /// an extension word that is zero for an unsigned operand and the sign spread out for a signed
    /// one, so the exact value of an operand is `ext * 2^width + low`. The pair is exact where no
    /// single value of one type is. jtckdint is written this way throughout, which is what makes
    /// this worth having rather than a message.
    ///
    /// The add and the subtract carry the pair through the arithmetic, and then ask whether the
    /// exact pair survives the round trip through the type being written to, which is the same
    /// second test the ordinary path makes with the high word added to it. The multiply cannot do
    /// that, because the high word of a product is not something the IR has an instruction for, so
    /// it works on magnitudes instead and compares the magnitude of the product against the bound
    /// of the destination on the side the sign of the product puts it.
    ///
    /// The narrowed value is stored whether or not it fit, exactly as on the ordinary path.
    fn overflow_exactly(
        &mut self,
        op: OverflowOp,
        args: [ExprId; 3],
        at: TypeId,
        written: TypeId,
        span: Span,
    ) -> Value {
        let [lhs, rhs, out] = args;
        let wide = self.value_type(at, span);
        let left = self.extension(lhs, wide, span);
        let right = self.extension(rhs, wide, span);
        let addr = self.value(out);
        let into = Destination {
            ty: self.value_type(written, span),
            signed: repr::is_signed(self.types(), self.target(), written),
        };
        let (kept, bit) = match op {
            OverflowOp::Add | OverflowOp::Sub => self.exact_sum(op, left, right, wide, into, span),
            OverflowOp::Mul => self.exact_product(left, right, wide, into, span),
        };
        let _ = self.write(Place::new(Where::Addr(addr), written), kept, span);
        bit
    }

    /// An operand of an overflow builtin as a low word and an extension word.
    ///
    /// The low word is the operand converted to the width of the arithmetic the way the ordinary
    /// path converts it, which is exact in the low bits whatever the signedness is. The extension
    /// word is what a wider type would have held above those bits: nothing for an unsigned operand,
    /// and the sign bit spread across the whole word for a signed one.
    fn extension(&mut self, operand: ExprId, wide: Type, span: Span) -> [Value; 2] {
        let signed = repr::is_signed(self.types(), self.target(), self.tast()[operand].ty);
        let low = self.converted(operand, wide, span);
        let ext = if signed {
            let top = self.build(span).iconst(wide, i128::from(wide.bits() - 1));
            self.build(span).binary(Opcode::AShr, low, top, Flags::NONE)
        } else {
            self.build(span).iconst(wide, 0)
        };
        [low, ext]
    }

    /// An exact add or subtract of two pairs, and whether the answer fits where it is going.
    ///
    /// The low words are added or subtracted as the unsigned words they are, and what crosses out
    /// of them is a carry or a borrow of one, which is a comparison: an unsigned sum that came out
    /// below the operand it started from carried, and a difference of a smaller word from a larger
    /// one borrowed. The extension words take the same operation and then the crossing bit, which
    /// leaves the exact answer as a pair again.
    ///
    /// The fit test is then the ordinary one asked of the pair rather than of a single value. The
    /// low word is narrowed to the destination and widened back, and the answer fits only if the
    /// low word survived that and the high word is what the destination would have put above it,
    /// which is nothing for an unsigned destination and the sign of what was stored for a signed
    /// one.
    fn exact_sum(
        &mut self,
        op: OverflowOp,
        left: [Value; 2],
        right: [Value; 2],
        wide: Type,
        into: Destination,
        span: Span,
    ) -> (Value, Value) {
        let ([a_low, a_ext], [b_low, b_ext]) = (left, right);
        let opcode = if op == OverflowOp::Add { Opcode::Add } else { Opcode::Sub };
        let low = self.build(span).binary(opcode, a_low, b_low, Flags::NONE);
        let crossed = if op == OverflowOp::Add {
            self.build(span).icmp(IntPred::Ult, low, a_low)
        } else {
            self.build(span).icmp(IntPred::Ult, a_low, b_low)
        };
        let crossed = self.widen(crossed, false, wide, span);
        let high = self.build(span).binary(opcode, a_ext, b_ext, Flags::NONE);
        let high = self.build(span).binary(opcode, high, crossed, Flags::NONE);

        let kept = self.widen(low, into.signed, into.ty, span);
        let back = self.widen(kept, into.signed, wide, span);
        let want = if into.signed {
            let top = self.build(span).iconst(wide, i128::from(wide.bits() - 1));
            self.build(span).binary(Opcode::AShr, back, top, Flags::NONE)
        } else {
            self.build(span).iconst(wide, 0)
        };
        let bit = self.build(span).icmp(IntPred::Ne, high, want);
        // The round trip is the identity when the destination is as wide as the arithmetic, which
        // is most of the calls that get here, and comparing a value against itself is worth not
        // emitting. The high word is where the answer lives in that case.
        let bit = if back == low {
            bit
        } else {
            let lost = self.build(span).icmp(IntPred::Ne, back, low);
            self.build(span).binary(Opcode::Or, bit, lost, Flags::NONE)
        };
        (kept, bit)
    }

    /// An exact multiply of two pairs, and whether the product fits where it is going.
    ///
    /// Done on magnitudes, because that turns the question back into the unsigned check the IR
    /// already has. The magnitude of an operand is the branch free absolute value, and the mask it
    /// wants is the extension word, which is already all ones for a negative operand and zero for
    /// the rest. Every magnitude fits unsigned at this width, including the one of the smallest
    /// signed value there is, which negates to the sign bit standing on its own.
    ///
    /// The two magnitudes go through the unsigned check, which gives their product and whether it
    /// needed more than this width. Negating that product back under the sign of the two operands
    /// gives the low bits of the exact answer, which is what gets stored.
    ///
    /// The product fits in the destination when it needed no more than this width and its magnitude
    /// is within the bound of the destination on the side it is on. A signed destination reaches one
    /// further below zero than above it, which is the one place the sign of the product changes the
    /// bound rather than just the answer. An unsigned destination holds no negative product at all,
    /// so a magnitude that is not zero under a negative sign is over the bound whatever the bound is.
    fn exact_product(
        &mut self,
        left: [Value; 2],
        right: [Value; 2],
        wide: Type,
        into: Destination,
        span: Span,
    ) -> (Value, Value) {
        let ([a_low, a_ext], [b_low, b_ext]) = (left, right);
        let mag_a = self.negated_by(a_low, a_ext, span);
        let mag_b = self.negated_by(b_low, b_ext, span);
        // Zero when the two operands agree in sign and all ones when they do not, which is both the
        // sign of the exact product and the mask that puts the magnitude back under it.
        let mask = self.build(span).binary(Opcode::Xor, a_ext, b_ext, Flags::NONE);
        let (mag, mut bit) = self.build(span).checked(Opcode::UMulOverflow, mag_a, mag_b);
        let low = self.negated_by(mag, mask, span);

        // How many bits of magnitude the destination has room for, which is one less than its width
        // when a bit of it is the sign.
        let room = if into.signed { into.ty.bits() - 1 } else { into.ty.bits() };
        if room < wide.bits() {
            let most = self.build(span).iconst(wide, (1i128 << room).wrapping_sub(1));
            // One more below zero than above it, and the mask is the minus one that adds it.
            let limit = if into.signed {
                self.build(span).binary(Opcode::Sub, most, mask, Flags::NONE)
            } else {
                most
            };
            let over = self.build(span).icmp(IntPred::Ugt, mag, limit);
            bit = self.build(span).binary(Opcode::Or, bit, over, Flags::NONE);
        }
        if !into.signed {
            let held = self.build(span).binary(Opcode::And, mag, mask, Flags::NONE);
            let zero = self.build(span).iconst(wide, 0);
            let below = self.build(span).icmp(IntPred::Ne, held, zero);
            bit = self.build(span).binary(Opcode::Or, bit, below, Flags::NONE);
        }
        let kept = self.widen(low, into.signed, into.ty, span);
        (kept, bit)
    }

    /// A value negated where the mask is all ones and left alone where it is zero.
    ///
    /// The usual spelling of it, which works because exclusive or with all ones is the complement
    /// and subtracting all ones is adding one, and those two together are the negation.
    fn negated_by(&mut self, value: Value, mask: Value, span: Span) -> Value {
        let flipped = self.build(span).binary(Opcode::Xor, value, mask, Flags::NONE);
        self.build(span).binary(Opcode::Sub, flipped, mask, Flags::NONE)
    }

    /// One of the atomic accesses, the barrier, or a compare and exchange.
    ///
    /// Almost the same as the plain access beside it. The address is a value the program computed,
    /// the width comes from the type being read or written, and the alignment is the type's, which
    /// is the one thing the front end knows and the back end cannot work out. What is different is
    /// the ordering, which goes in the access payload, and the opcode, which is the ordered one so
    /// that nothing has to look at the payload before deciding whether a load can be moved.
    ///
    /// A barrier has no address and no width, so it takes neither and is the ordering alone.
    ///
    /// A compare and exchange is one IR instruction producing two values, and which of the two the
    /// expression answers is the whole difference between three of the four names that reach here.
    /// The fourth difference, which is the C11 pair writing what they found back through the pointer
    /// they were handed, is the branch [`Body::exchanged`] writes.
    fn atomic(
        &mut self,
        op: AtomicOp,
        order: Ordering,
        args: ExprList,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        let order = ordering(order);
        if op == AtomicOp::Fence {
            self.build(span).fence(order);
            return None;
        }
        let object = self.tast()[args][0];
        let addr = self.value(object);
        match op {
            AtomicOp::Load => {
                let into = self.value_type(ty, span);
                let mut info = self.access(ty);
                info.order = order;
                let flags = self.flags(ty);
                Some(self.build(span).atomic_load(into, addr, info, flags))
            }
            AtomicOp::Store => {
                let written = self.tast()[args][1];
                let stored = self.tast()[written].ty;
                let value = self.value(written);
                let mut info = self.access(stored);
                info.order = order;
                let flags = self.flags(stored);
                self.build(span).atomic_store(value, addr, info, flags);
                None
            }
            // The same read, and then the value written out through the pointer the caller handed
            // over. That write is a plain one: the object it lands in is the caller's own and no
            // other thread has its address, which is what the whole shape is for.
            AtomicOp::LoadInto => {
                let place = self.tast()[args][1];
                let object = self.pointee(self.tast()[place].ty);
                let into = self.value_type(object, span);
                let plain = self.access(object);
                let mut info = plain;
                info.order = order;
                let flags = self.flags(object);
                let held = self.build(span).atomic_load(into, addr, info, flags);
                let out = self.value(place);
                self.build(span).store(held, out, plain, flags);
                None
            }
            AtomicOp::CompareExchange | AtomicOp::SwapBool | AtomicOp::SwapValue => {
                self.exchanged(op, order, args, addr, span)
            }
            AtomicOp::Exchange | AtomicOp::Fetch(_) | AtomicOp::Update(_) => {
                self.modified(op, order, args, addr, span)
            }
            // The exchange beside it, with what was there written out rather than answered.
            AtomicOp::ExchangeInto => {
                let old = self.modified(AtomicOp::Exchange, order, args, addr, span)?;
                let place = self.tast()[args][2];
                let object = self.pointee(self.tast()[place].ty);
                let plain = self.access(object);
                let flags = self.flags(object);
                let out = self.value(place);
                self.build(span).store(old, out, plain, flags);
                None
            }
            // The exchange again, over the byte the front end made the operand, and then the
            // question the name asks: was anything there before. See `atomic_builtin` in
            // `check/builtin/atomic.rs` for why the byte that goes in is a one.
            //
            // The answer is a comparison against zero rather than the byte itself, because the type
            // of the call is `_Bool` and a byte that is neither zero nor one is not one. gcc answers
            // the raw byte, and the two agree wherever the flag is only ever touched through this
            // pair, which is the only way C says the object may be touched at all.
            AtomicOp::TestAndSet => {
                let old = self.modified(AtomicOp::Exchange, order, args, addr, span)?;
                let byte = self.func[old].ty;
                let none = self.build(span).iconst(byte, 0);
                Some(self.build(span).icmp(IntPred::Ne, old, none))
            }
            AtomicOp::Fence => None,
        }
    }

    /// A read, an operation on what was read and a write back, and whichever of the two values the
    /// name that was written asks for.
    ///
    /// One IR instruction, which answers what was there before, because that is the convention every
    /// machine and every language in this area uses. A name that asks for the value afterwards gets
    /// the operation again over the answer and the operand, which is two values already in
    /// registers and one instruction to combine them, and it is worked out here rather than left to
    /// the back end so that the optimizer sees ordinary arithmetic it can fold.
    ///
    /// # A pointer object
    ///
    /// The object may be a pointer, and the IR's read modify write takes an integer, so a pointer
    /// goes in as its address and comes back as a pointer again. What the operand means is the
    /// surprise worth writing down: gcc adds bytes rather than elements, so
    /// `__atomic_fetch_add(&p, 1, ...)` on an `int *` moves the pointer one byte and not four. That
    /// is not what `p + 1` means anywhere else in C, and it is what gcc 16.2.0 does, so it is what
    /// this does. The front end has already converted the operand to the object's type, which for a
    /// pointer object means it arrives as a pointer, and the conversion to an address here is the
    /// same rename it always is on this machine.
    fn modified(
        &mut self,
        op: AtomicOp,
        order: MemOrder,
        args: ExprList,
        addr: Value,
        span: Span,
    ) -> Option<Value> {
        let written = self.tast()[args][1];
        let object = self.tast()[written].ty;
        let mut info = self.access(object);
        info.order = order;
        let flags = self.flags(object);

        let address = self.address;
        let pointer = self.value_type(object, span).is_ptr();
        let operand = self.value(written);
        let operand = if pointer {
            self.build(span).unary(Opcode::PtrToInt, operand, address)
        } else {
            operand
        };

        let rmw = match op {
            AtomicOp::Exchange => RmwOp::Xchg,
            AtomicOp::Fetch(what) | AtomicOp::Update(what) => match what {
                Rmw::Add => RmwOp::Add,
                Rmw::Sub => RmwOp::Sub,
                Rmw::And => RmwOp::And,
                Rmw::Nand => RmwOp::Nand,
                Rmw::Or => RmwOp::Or,
                Rmw::Xor => RmwOp::Xor,
            },
            _ => return None,
        };
        let old = self.build(span).atomic_rmw(rmw, addr, operand, info, flags);
        // The arithmetic that turns the value before into the value after carries no flags. The
        // access is what may be volatile and the access has already happened; this is a register
        // and a register, and nothing about it is a thing the program can observe twice.
        let answer = match op {
            AtomicOp::Update(what) => self.again(what, old, operand, span),
            _ => old,
        };
        Some(if pointer {
            self.build(span).unary(Opcode::IntToPtr, answer, Type::PTR)
        } else {
            answer
        })
    }

    /// The operation again, over the value that was there before and the operand, which is what a
    /// name that asks for the value afterwards is asking for.
    ///
    /// Five of the six are one instruction. The nand is two, an and and every bit of it flipped,
    /// which is what gcc has meant by the name since 4.4 and is the reading both families agree on.
    /// The flip is an exclusive or against every bit set rather than anything else, because the IR
    /// has no not and this is what one is.
    fn again(&mut self, what: Rmw, old: Value, operand: Value, span: Span) -> Value {
        let opcode = match what {
            Rmw::Add => Opcode::Add,
            Rmw::Sub => Opcode::Sub,
            Rmw::And | Rmw::Nand => Opcode::And,
            Rmw::Or => Opcode::Or,
            Rmw::Xor => Opcode::Xor,
        };
        let answer = self.build(span).binary(opcode, old, operand, Flags::NONE);
        if what != Rmw::Nand {
            return answer;
        }
        let ty = self.func[answer].ty;
        let ones = self.build(span).iconst(ty, -1);
        self.build(span).binary(Opcode::Xor, answer, ones, Flags::NONE)
    }

    /// A compare and exchange, and whichever of its two answers the name that was written asks for.
    ///
    /// The width and the alignment come from the value to put there, which the front end has
    /// already converted to the type of the object, so all three names arrive here the same shape.
    ///
    /// # The value expected
    ///
    /// The older family passes it and the C11 pair passes a pointer to it, which is the one place
    /// the two families really differ rather than differing in spelling. So the pointer is read here
    /// before the exchange, and the read is a plain one: the object it points at is the caller's own
    /// and no other thread has its address, which is what the whole idiom depends on.
    ///
    /// # Writing back
    ///
    /// The C11 pair say that when the object did not hold the expected value, what it did hold is
    /// written into the place the expected value came from, so that a caller can loop without
    /// reading the object again. That is a store that happens on one of the two paths and not on the
    /// other, so it is a branch, and the branch is written rather than the store being made
    /// unconditional. Storing what was found either way would write the same bytes in the case that
    /// succeeded, except when the two pointers are the same object, where it would put the old value
    /// back over the value the exchange had just written. That is a strange program to write and it
    /// is a program C defines.
    fn exchanged(
        &mut self,
        op: AtomicOp,
        order: MemOrder,
        args: ExprList,
        addr: Value,
        span: Span,
    ) -> Option<Value> {
        let wanted = self.tast()[args][1];
        let put = self.tast()[args][2];
        let stored = self.tast()[put].ty;
        let plain = self.access(stored);
        let mut info = plain;
        info.order = order;
        let flags = self.flags(stored);

        let place = self.value(wanted);
        let expected = if op == AtomicOp::CompareExchange {
            let into = self.value_type(stored, span);
            self.build(span).load(into, place, plain, flags)
        } else {
            place
        };
        let desired = self.value(put);
        let (old, exchanged) = self.build(span).cmpxchg(addr, expected, desired, info, flags);

        if op == AtomicOp::SwapValue {
            return Some(old);
        }
        if op == AtomicOp::SwapBool {
            return Some(exchanged);
        }
        let back = self.new_block();
        let join = self.new_block();
        self.br_if(exchanged, join, back, span);
        self.ssa.seal(self.func, back);

        self.at = Some(back);
        self.build(span).store(old, place, plain, flags);
        self.jump(join, span);

        self.ssa.seal(self.func, join);
        self.at = Some(join);
        Some(exchanged)
    }

    /// `__builtin_ffs`, which is one more than the trailing zero count and zero for a zero.
    ///
    /// Written as a mask rather than as a branch. The count and the comparison are both cheap and
    /// neither depends on the other, so a branch here would buy nothing and would cost the two
    /// blocks and the join that every branch costs. `nonzero` is one or zero, subtracting it from
    /// zero spreads it to all ones or none, and the count is kept only when the argument had a bit
    /// in it at all.
    ///
    /// The trailing zero count of a zero is not relied on anywhere here, which matters because that
    /// is the case the builtin leaves undefined and the case a machine instruction may not write an
    /// answer for. Whatever the count is for a zero argument, the mask throws it away.
    fn first_set(&mut self, value: Value, ty: Type, span: Span) -> Value {
        let low = self.build(span).unary(Opcode::Cttz, value, ty);
        let mut build = self.build(span);
        let one = build.iconst(ty, 1);
        let zero = build.iconst(ty, 0);
        let position = build.binary(Opcode::Add, low, one, Flags::NONE);
        let nonzero = build.icmp(IntPred::Ne, value, zero);
        let spread = build.unary(Opcode::ZExt, nonzero, ty);
        let mask = build.binary(Opcode::Sub, zero, spread, Flags::NONE);
        build.binary(Opcode::And, position, mask, Flags::NONE)
    }

    /// `a && b` and `a || b`, whose right side is evaluated only when it decides the answer.
    fn short_circuit(&mut self, op: BinaryOp, lhs: ExprId, rhs: ExprId, span: Span) -> Value {
        let and = op == BinaryOp::LogAnd;
        let left = self.condition(lhs);
        let var = self.temp();
        let block = self.block();
        // The answer if the right side is never evaluated, which is the left side's own value.
        let shortcut = self.build(span).iconst(Type::I1, i128::from(!and));
        self.ssa.write(var, block, shortcut);

        let other = self.new_block();
        let join = self.new_block();
        if and {
            self.br_if(left, other, join, span);
        } else {
            self.br_if(left, join, other, span);
        }
        self.ssa.seal(self.func, other);

        self.at = Some(other);
        let right = self.condition(rhs);
        let block = self.block();
        self.ssa.write(var, block, right);
        self.jump(join, span);

        self.ssa.seal(self.func, join);
        self.at = Some(join);
        self.ssa.read(self.func, var, join, Type::I1)
    }

    /// `cond ? then : otherwise`.
    fn conditional(
        &mut self,
        cond: ExprId,
        then: ExprId,
        otherwise: ExprId,
        ty: TypeId,
        span: Span,
    ) -> Option<Value> {
        let into = repr::value_type(self.types(), self.target(), ty);
        let (var, join) = self.branch(cond, [then, otherwise], span, |body, arm| {
            let value = body.eval(arm);
            // An arm of a type that has no value is evaluated for its effects and has nothing
            // to carry to the join, which is `c ? f() : g()` where both of them answer `void`.
            into.and(value)
        })?;
        let into = into?;
        Some(self.ssa.read(self.func, var, join, into))
    }

    /// One of these whose value is an object, which is a structure or a union.
    ///
    /// The answer is the address of whichever arm was taken and not a copy of it into a third
    /// place. C makes the value an rvalue that may not be assigned to, and the arms are already
    /// objects that outlive the full expression, so a copy would be a copy nothing could
    /// observe. SQLite's parser writes one of these, which is what asked for it.
    fn conditional_place(
        &mut self,
        cond: ExprId,
        then: ExprId,
        otherwise: ExprId,
        ty: TypeId,
        span: Span,
    ) -> Place {
        let at = self.branch(cond, [then, otherwise], span, |body, arm| {
            let place = body.place(arm);
            // An arm that does not come back has no address to answer with, and the branch
            // below is about to throw the arm away rather than join it.
            body.at?;
            Some(body.address_of(place, span))
        });
        let addr = match at {
            Some((var, join)) => self.ssa.read(self.func, var, join, Type::PTR),
            None => self.poison(Type::PTR, span),
        };
        Place::new(Where::Addr(addr), ty)
    }

    /// The shape both conditionals have: the condition, each arm in a block of its own, and a
    /// join that whichever arms came back branch to.
    ///
    /// What an arm contributes is a value, which is the value of the arm in one case and the
    /// address of the object it names in the other, and it goes into a variable the caller
    /// reads at the join with whatever type it is expecting.
    ///
    /// Answers the variable and the join, and nothing when neither arm reached one, which is
    /// `c ? exit(1) : abort()` where both of them are `_Noreturn`.
    fn branch(
        &mut self,
        cond: ExprId,
        arms: [ExprId; 2],
        span: Span,
        mut of: impl FnMut(&mut Self, ExprId) -> Option<Value>,
    ) -> Option<(Var, Block)> {
        // GNU's `a ?: b`, whose first arm is the node the condition is written out of. Its value
        // is taken here, once, and the bit is that value against zero rather than what asking the
        // condition for a bit would build, since that walk goes under the node and would evaluate
        // what is under it a second time.
        let shared = self.common(cond, arms[0]);
        let outer = self.shared;
        let value = match shared {
            Some(node) => {
                let value = self.value(node);
                self.shared = Some((node, value));
                self.is_nonzero(value, span)
            }
            None => self.condition(cond),
        };
        let then_block = self.new_block();
        let else_block = self.new_block();
        self.br_if(value, then_block, else_block, span);
        self.ssa.seal(self.func, then_block);
        self.ssa.seal(self.func, else_block);

        let var = self.temp();
        let mut join = None;
        for (block, arm) in [then_block, else_block].into_iter().zip(arms) {
            self.at = Some(block);
            let value = of(self, arm);
            if self.at.is_none() {
                continue;
            }
            if let Some(value) = value {
                let at = self.block();
                self.ssa.write(var, at, value);
            }
            let target = match join {
                Some(block) => block,
                None => {
                    let block = self.new_block();
                    join = Some(block);
                    block
                }
            };
            self.jump(target, span);
        }
        self.shared = outer;

        self.at = join;
        let join = join?;
        self.ssa.seal(self.func, join);
        Some((var, join))
    }

    /// The node a conditional's condition and its first arm are both written out of, which is
    /// GNU's `a ?: b` and nothing else.
    ///
    /// The checking keeps one node for `a` and converts it in two directions, to the bit the
    /// branch is taken on and to the type the whole expression has, so what the two have in
    /// common is under whatever conversions were written on each of them rather than being the
    /// arm itself. A written out `a ? a : b` is not this: the second `a` there is a node of its
    /// own and a second read, which is what the language says it is.
    fn common(&self, cond: ExprId, then: ExprId) -> Option<ExprId> {
        self.conversions(then).find(|&node| self.conversions(cond).any(|outer| outer == node))
    }

    /// An expression and what is under each conversion written on it, outermost first.
    fn conversions(&self, expr: ExprId) -> impl Iterator<Item = ExprId> {
        let tast = self.tast();
        iter::successors(Some(expr), move |&expr| match tast[expr].kind {
            ExprKind::Convert { operand, .. } => Some(operand),
            _ => None,
        })
    }

    /// An assignment, plain or compound.
    fn assign(
        &mut self,
        op: Option<BinaryOp>,
        computation: TypeId,
        lhs: ExprId,
        rhs: ExprId,
        want: bool,
        span: Span,
    ) -> Option<Value> {
        let ty = self.tast()[lhs].ty;
        let place = self.place(lhs);
        let Some(op) = op else {
            if repr::value_type(self.types(), self.target(), ty).is_none() {
                return self.copy(place, rhs, ty, span);
            }
            let value = self.eval(rhs)?;
            return Some(self.write_back(place, value, want, span));
        };

        // `a op= b` is not `a = a op b` with the conversions left out: the operation happens in
        // the computation type and the answer is converted back, which is why `i /= 0.5` on an
        // `int` divides in `double`.
        //
        // The right operand is evaluated before the left operand is read, which C11 6.5.16.2
        // settled: `E1 op= E2` is `E1 = E1 op E2` with `E1` evaluated once, and the read of `E1`
        // is sequenced after `E2`. So `x[0] |= foo()` where `foo` writes `x[0]` has to see what
        // `foo` wrote. The address above is still computed first and computed once, because that
        // is the part the standard says happens exactly once, and it is only the load at that
        // address that moves.
        //
        // An object with the qualifier on it is one step and not a read, an operation and a
        // write: see [`Self::atomic_update`].
        if self.is_atomic(ty) {
            return self.atomic_assign(place, op, computation, rhs, span);
        }
        // A vector has no value the operator could be applied to all at once, so it is applied
        // to each lane of the object the place names. Nothing is handed back, because the value
        // of one is a vector and the caller that wants that reads it through `place` instead.
        if rucc_types::is_vector(self.types(), ty) {
            let target = self.address_of(place, span);
            self.vector_compound(target, rhs, op, ty, span);
            return None;
        }
        // A complex value, for the same reason and with the same answer: the operator is applied
        // to the halves of the object the place names, and what one of these is worth is that
        // object, which the caller that wants it reads through `place`.
        if rucc_types::is_complex(self.types(), ty) {
            let target = self.address_of(place, span);
            self.complex_compound(target, op, computation, rhs, ty, span);
            return None;
        }
        let right = self.value(rhs);
        let old = self.read(place, span)?;
        let old = self.coerce(old, ty, computation, span);
        let value = if self.is_pointer(computation) {
            let index = self.tast()[rhs].ty;
            let size = self.stride(self.pointee(computation), span);
            let signed = repr::is_signed(self.types(), self.target(), index);
            self.step(old, right, signed, size, op == BinaryOp::Sub, span)
        } else {
            self.arithmetic(op, old, right, computation, span)
        };
        let value = self.coerce(value, computation, ty, span);
        Some(self.write_back(place, value, want, span))
    }

    /// `a op= b` where the object has the qualifier on it.
    fn atomic_assign(
        &mut self,
        place: Place,
        op: BinaryOp,
        computation: TypeId,
        rhs: ExprId,
        span: Span,
    ) -> Option<Value> {
        let ty = place.ty;
        if !self.atomic_access(ty, span) {
            return None;
        }
        let right = self.value(rhs);
        let Where::Addr(addr) = place.at else {
            // Nothing reaches this, for the reason [`Self::atomic_step`] gives.
            self.unsupported("an operation on an object with no address", span);
            return None;
        };
        let step = if self.is_pointer(computation) {
            let index = self.tast()[rhs].ty;
            let signed = repr::is_signed(self.types(), self.target(), index);
            let pointee = self.pointee(computation);
            let size = self.stride(pointee, span);
            Step::Walk { steps: right, signed, size, back: op == BinaryOp::Sub }
        } else {
            Step::Arithmetic { op, right, computation }
        };
        // What one of these is worth is the value in the object afterwards, and the value before
        // is what a `++` after its operand wants and this does not.
        let (_, after) = self.atomic_update(addr, ty, step, span);
        Some(after)
    }

    /// A read, an operation on what was read and a write back to an atomic object, with nothing
    /// able to get between the three.
    ///
    /// [`Self::read`] and [`Self::write`] are each ordered on their own, and `a op= b` built out
    /// of the pair would still be wrong: another thread could write between them, and the write
    /// back would put that thread's value away again. So a compound assignment and a `++` on one
    /// of these are neither a read nor a write but a third thing, which is the one instruction
    /// the machine has for it where there is one and a loop around a compare and exchange
    /// otherwise.
    ///
    /// It answers the value that was in the object before and the value in it afterwards, since a
    /// caller wants one of the two and which one is the whole difference between `x++` and `++x`.
    fn atomic_update(&mut self, addr: Value, ty: TypeId, step: Step, span: Span) -> (Value, Value) {
        let into = self.value_type(ty, span);
        let mut info = self.access(ty);
        info.order = MemOrder::SeqCst;
        let flags = self.flags(ty);

        if let Some((rmw, opcode, operand)) = self.single(&step, ty, into, span) {
            let old = self.build(span).atomic_rmw(rmw, addr, operand, info, flags);
            // The arithmetic that turns the value before into the value after carries no flags
            // and no ordering. The access is what may be volatile, the access has happened, and
            // this is a register and a register.
            let new = self.build(span).binary(opcode, old, operand, Flags::NONE);
            return (self.as_value(old, into, span), self.as_value(new, into, span));
        }

        // The compare and exchange happens at an integer of the object's width whatever the
        // object's type is, because what it compares is bits and not values. Two zeroes of
        // opposite signs are the same value in two different objects and a quiet NaN is not even
        // equal to itself, so a comparison of values would spin for ever on an object holding
        // one. The machine compares bits, so this is what it is asked about.
        let raw = self.bits_type(into);
        let seen = self.temp();
        let before = self.temp();
        let after = self.temp();

        let held = self.build(span).atomic_load(raw, addr, info, flags);
        let entry = self.block();
        self.ssa.write(seen, entry, held);

        let again = self.new_block();
        self.jump(again, span);
        self.at = Some(again);

        let expected = self.ssa.read(self.func, seen, again, raw);
        let old = self.as_value(expected, into, span);
        let new = self.apply(&step, old, ty, span);
        self.ssa.write(before, again, old);
        self.ssa.write(after, again, new);
        let desired = self.as_bits(new, raw, span);
        let (found, exchanged) = self.build(span).cmpxchg(addr, expected, desired, info, flags);
        self.ssa.write(seen, again, found);

        let done = self.new_block();
        self.br_if(exchanged, done, again, span);
        // Both of the block's predecessors exist now, the one before the loop and the loop's own
        // back edge, so the value the head reads is settled and the block can be closed.
        self.ssa.seal(self.func, again);
        self.ssa.seal(self.func, done);
        self.at = Some(done);
        let old = self.ssa.read(self.func, before, done, into);
        let new = self.ssa.read(self.func, after, done, into);
        (old, new)
    }

    /// The one instruction that does the whole of an atomic read modify write, where the machine
    /// has one, together with the opcode that works the value afterwards out from the value
    /// before.
    ///
    /// A compound assignment happens in the computation type and its answer is converted back to
    /// the object's, so one instruction at the object's own width is the same answer only where
    /// the narrowing and the operation commute. They do for the integer operations here, since no
    /// bit of the answer below the width depends on a bit above it, which is what makes `c += 300`
    /// on a `char` the same object afterwards as `c += 44`. They do not where the computation type
    /// is a floating one and the object is not, because the rounding happens before the narrowing
    /// and not after: `i += 3.7` on an `int` holding -4 leaves 0 and `i += 3` leaves -1.
    ///
    /// The two floating operations are left out even where the types do agree. The machines here
    /// have no instruction for either, and the pass that turns an operation with no instruction
    /// into a loop leaves them alone, so the loop below this is where they belong.
    fn single(
        &mut self,
        step: &Step,
        ty: TypeId,
        into: Type,
        span: Span,
    ) -> Option<(RmwOp, Opcode, Value)> {
        match *step {
            // A pointer object, whose operand is a number of bytes and whose operation is the
            // addition of one. There is nothing to check: pointer arithmetic has no computation
            // type of its own and the only two operators are the two this is.
            Step::Walk { steps, signed, size, back } => {
                let amount = self.scaled(steps, signed, size, back, span);
                Some((RmwOp::Add, Opcode::Add, amount))
            }
            Step::Arithmetic { op, right, computation } => {
                if !into.is_int() || !rucc_types::is_integer(self.types(), computation) {
                    return None;
                }
                let (rmw, opcode) = match op {
                    BinaryOp::Add => (RmwOp::Add, Opcode::Add),
                    BinaryOp::Sub => (RmwOp::Sub, Opcode::Sub),
                    BinaryOp::BitAnd => (RmwOp::And, Opcode::And),
                    BinaryOp::BitOr => (RmwOp::Or, Opcode::Or),
                    BinaryOp::BitXor => (RmwOp::Xor, Opcode::Xor),
                    _ => return None,
                };
                Some((rmw, opcode, self.coerce(right, computation, ty, span)))
            }
        }
    }

    /// The operation over the value that was found, which is what goes back into the object.
    fn apply(&mut self, step: &Step, old: Value, ty: TypeId, span: Span) -> Value {
        match *step {
            Step::Walk { steps, signed, size, back } => {
                self.step(old, steps, signed, size, back, span)
            }
            Step::Arithmetic { op, right, computation } => {
                let old = self.coerce(old, ty, computation, span);
                let value = self.arithmetic(op, old, right, computation, span);
                self.coerce(value, computation, ty, span)
            }
        }
    }

    /// The integer whose bits a value of that type is, which is the type itself where it is one.
    fn bits_type(&self, into: Type) -> Type {
        if into.is_int() {
            into
        } else if into.is_ptr() {
            self.address
        } else {
            Type::int(into.bits())
        }
    }

    /// A value as the bits it is made of.
    fn as_bits(&mut self, value: Value, raw: Type, span: Span) -> Value {
        let from = self.func[value].ty;
        if from == raw {
            return value;
        }
        let opcode = if from.is_ptr() { Opcode::PtrToInt } else { Opcode::Bitcast };
        self.build(span).unary(opcode, value, raw)
    }

    /// The value a run of bits is, which undoes [`Self::as_bits`].
    fn as_value(&mut self, value: Value, into: Type, span: Span) -> Value {
        let from = self.func[value].ty;
        if from == into {
            return value;
        }
        let opcode = if into.is_ptr() { Opcode::IntToPtr } else { Opcode::Bitcast };
        self.build(span).unary(opcode, value, into)
    }

    /// `a = b` where the two are structures, which is a copy and not a value.
    fn copy(&mut self, place: Place, rhs: ExprId, ty: TypeId, span: Span) -> Option<Value> {
        // One with the qualifier on it, which is a copy that would have to happen all at once and
        // cannot. [`Self::atomic_access`] is what reports it, and the copy is made anyway because
        // a reported error is not a reason to build something else on top of it.
        self.atomic_access(ty, span);
        let source = self.place(rhs);
        let source = self.address_of(source, span);
        let destination = self.address_of(place, span);
        let size = repr::size_of(self.types(), self.target(), ty);
        let align = repr::align_of(self.types(), self.target(), ty);
        self.memcpy(destination, source, size, align, span);
        None
    }

    /// A call, whose value is a value when the return type has one.
    fn call(&mut self, callee: ExprId, args: ExprList, span: Span) -> Option<Value> {
        self.call_into(callee, args, None, span)
    }

    /// A call, direct when the callee is a function and indirect when it is a pointer.
    ///
    /// `into` is where a return value that is an object goes, which the caller of this knows and
    /// the call does not: it is the temporary behind `f().x`, or the object of `p = f()`. A call
    /// whose value nobody wants still passes somewhere to put it when the ABI says the callee
    /// writes it, because the callee writes it either way.
    fn call_into(
        &mut self,
        callee: ExprId,
        args: ExprList,
        into: Option<Value>,
        span: Span,
    ) -> Option<Value> {
        if self.missing_builtin(callee, span) {
            return None;
        }
        let tast = self.tast();
        let ty = tast[callee].ty;
        let count = tast[args].len();
        let actual: Vec<TypeId> = (0..count).map(|index| tast[tast[args][index]].ty).collect();
        let plan = self.unit.call_plan(ty, &actual, span)?;

        let mut values = Vec::with_capacity(count + 1);
        let destination = if plan.returns_through_memory() {
            let at = match into {
                Some(at) => at,
                None => self.scratch(plan.ret.size, plan.ret.align, span),
            };
            values.push(at);
            Some(at)
        } else {
            into
        };

        for index in 0..count {
            let arg = tast[args][index];
            let travel = &plan.args[index];
            match travel.pass {
                // Nothing of it travels, and it is still evaluated: `f(g())` calls `g`.
                Pass::Ignore => {
                    self.discard(arg);
                }
                Pass::Direct => {
                    let value = self.value(arg);
                    values.push(value);
                }
                Pass::Pieces(_) => {
                    let place = self.place(arg);
                    let addr = self.address_of(place, span);
                    let slots = self.load_slots(addr, travel, span);
                    values.extend(slots);
                }
                // The callee is given the address of a copy and may write to it, so the copy is
                // made here and the object the program wrote is not what travels.
                Pass::Reference => {
                    let place = self.place(arg);
                    let from = self.address_of(place, span);
                    let copy = self.scratch(travel.size, travel.align, span);
                    self.memcpy(copy, from, travel.size, travel.align, span);
                    values.push(copy);
                }
                // The object's own bytes go in the argument area, which is what `byval` on the
                // parameter says and what the backend does, so what travels is where they are.
                Pass::Memory => {
                    let place = self.place(arg);
                    let addr = self.address_of(place, span);
                    values.push(addr);
                }
            }
        }

        let direct = self.direct(callee, &plan, &actual, span);
        let inst = match direct {
            Some((symbol, settled)) => {
                let sig = self.func.add_signature(settled.signature);
                self.build(span).call_varargs(symbol, sig, &values, &settled.varargs)
            }
            None => {
                let addr = self.value(callee);
                let mut build = self.build(span);
                let sig = build.func().add_signature(plan.signature.clone());
                let varargs = build.func().push_abis(&plan.varargs);
                let info =
                    build.func().add_call(CallInfo { callee: None, signature: sig, varargs });
                let returns: Vec<Type> = build.func()[sig].return_types().collect();
                let mut operands = Vec::with_capacity(values.len() + 1);
                operands.push(addr);
                operands.extend_from_slice(&values);
                let args = build.func().push_values(&operands);
                build.inst(
                    InstData {
                        args,
                        extra: Extra::Call(info),
                        ..InstData::new(Opcode::CallIndirect)
                    },
                    &returns,
                )
            }
        };

        match plan.ret.pass {
            Pass::Ignore => None,
            Pass::Direct => {
                let value = self.func[inst].results().next();
                if let (Some(at), Some(value)) = (destination, value) {
                    let info = self.piece_info(plan.ret.align, 0);
                    self.build(span).store(value, at, info, Flags::NONE);
                }
                value
            }
            // The object came back in registers, which are written into whatever wanted it. A
            // call whose value nobody wants leaves them where they are.
            Pass::Pieces(_) => {
                let at = destination?;
                let results: Vec<Value> = self.func[inst].results().collect();
                self.store_slots(at, &plan.ret, &results, span);
                None
            }
            // The callee wrote it where it was told to, so there is nothing to hand back.
            Pass::Reference | Pass::Memory => None,
        }
    }

    /// The name a call goes to and the signature to call it with, when it goes to a name rather
    /// than through a pointer.
    ///
    /// The two are answered together because they can disagree. `int f();` takes whatever it is
    /// given, so a call written below it is checked against no parameter list at all, and an
    /// `int f(int, int)` further down is what the function ends up with. The call site is not
    /// wrong and neither is the definition, and the signature the call is written with has to be
    /// the function's or the call goes to a function with another one. So the declaration is
    /// asked what it settled on, and where the values travel the same way either the settled
    /// signature is the one used.
    ///
    /// [`None`] when they do not travel the same way, which is `f(1, 2, 3)` against an
    /// `int f(int, int)`. That call is undefined behaviour if control ever arrives at it and
    /// that is the programmer's to answer for; refusing to translate the file is not. It goes
    /// through the function's address with the signature the call site had, which is the shape
    /// a call through a function pointer already needs.
    fn direct(
        &mut self,
        callee: ExprId,
        plan: &Plan,
        actual: &[TypeId],
        span: Span,
    ) -> Option<(rucc_base::Symbol, Plan)> {
        let tast = self.tast();
        let ExprKind::Convert { kind: Conversion::FunctionDecay, operand } = tast[callee].kind
        else {
            return None;
        };
        let ExprKind::Decl(decl) = tast[operand].kind else { return None };
        // The declaration carries the type the whole file settled on and the expression carries
        // the one that was in scope where the call was written, which is how the two differ.
        let declared = self.tast()[decl].ty;
        let settled = self.unit.plan(declared, actual, span)?;
        let alike = settled.args.len() == plan.args.len()
            && travels_alike(&settled.ret, &plan.ret)
            && settled.args.iter().zip(&plan.args).all(|(a, b)| travels_alike(a, b));
        // The travels agreeing is not the whole of it, because an argument past the end of a
        // parameter list travels the same way and still has no parameter to arrive in. So the
        // values are counted against what the signature takes, which is what a call to a name
        // has to hold to and what the verifier reads.
        let passed = usize::from(settled.returns_through_memory())
            + settled.args.iter().map(|travel| travel.types.len()).sum::<usize>();
        let named = settled.signature.params.len();
        let fits = if settled.signature.variadic { passed >= named } else { passed == named };
        if !alike || !fits {
            return None;
        }
        Some((self.unit.symbol_of(decl), settled))
    }

    /// Whether this call goes to a builtin nothing here builds anything for, having reported it.
    ///
    /// A name the walk does not recognise becomes a call to that name, which is right for every
    /// function and wrong for a builtin: no object file defines one, so the program the compiler
    /// wrote down cannot be linked and the name in the linker's complaint is one its author never
    /// typed. Which names those are is [`rucc_sema::unimplemented_builtin`]'s to say, for the
    /// reason [`Unit::library_name`](crate::Unit) asks about a spelling rather than a
    /// declaration: it is a fact about the name and the table it came out of.
    ///
    /// A program that writes its own function with the name gets the function it wrote. That is
    /// not the reason this exists, but a definition in front of us is a definition and the call
    /// to it links.
    fn missing_builtin(&mut self, callee: ExprId, span: Span) -> bool {
        let tast = self.tast();
        let ExprKind::Convert { kind: Conversion::FunctionDecay, operand } = tast[callee].kind
        else {
            return false;
        };
        let ExprKind::Decl(decl) = tast[operand].kind else { return false };
        if tast[decl].body.is_some() {
            return false;
        }
        let Some(name) = tast[decl].name else { return false };
        if !rucc_sema::unimplemented_builtin(self.unit.names.resolve(name)) {
            return false;
        }
        let spelled = self.unit.names.resolve(name).to_string();
        self.unit.missing_builtin(&spelled, span);
        true
    }

    /// Reports a construct the walk does not build IR for yet.
    fn unsupported(&mut self, what: &str, span: Span) {
        self.unit.unsupported(what, span);
    }
}

/// The IR's spelling of an ordering the typed tree carries.
///
/// Two enumerations for one idea, because the crate that checks types does not know what an IR is
/// and the crate that builds one has no business in the front end. This is the one place they are
/// put side by side, and it is total on purpose: an ordering that could not be spelled would be a
/// hole for a wrong answer rather than a compile error.
///
/// There is no arm for the IR's unordered case, because nothing in the front end can ask for one.
/// An access with no ordering is a plain load or store and is not one of these at all.
fn ordering(order: Ordering) -> MemOrder {
    match order {
        Ordering::Relaxed => MemOrder::Relaxed,
        Ordering::Acquire => MemOrder::Acquire,
        Ordering::Release => MemOrder::Release,
        Ordering::AcqRel => MemOrder::AcqRel,
        Ordering::SeqCst => MemOrder::SeqCst,
    }
}

/// Whether two values travel the same way, which is what says a call written with one signature
/// can be made with the other.
///
/// The pass and the IR types are what the values at the call are built from, and the size and
/// the alignment are what a pass that copies the object reads.
fn travels_alike(a: &Travel, b: &Travel) -> bool {
    a.pass == b.pass && a.types == b.types && a.size == b.size && a.align == b.align
}

/// Whether a statement holds a label anywhere inside it that something outside it can reach.
///
/// Asked of a statement in unreachable code, because dropping one with a label in it drops a
/// place a `switch` or a `goto` branches to, and what the branch would then point at is a block
/// with nothing in it. `cases` says whether a `case` or a `default` counts, and it stops
/// counting inside a nested `switch`, since those labels belong to that `switch` and go away
/// with it. A `goto` label is looked for everywhere, because a `goto` can be anywhere in the
/// function.
fn holds_a_label(tast: &Tast, id: StmtId, cases: bool) -> bool {
    match tast[id] {
        Stmt::Label { .. } => true,
        Stmt::Case { body, .. } | Stmt::Default { body } => {
            cases || holds_a_label(tast, body, cases)
        }
        Stmt::Block(list) => {
            (0..tast[list].len()).any(|index| holds_a_label(tast, tast[list][index], cases))
        }
        Stmt::If { then, otherwise, .. } => {
            holds_a_label(tast, then, cases)
                || otherwise.is_some_and(|id| holds_a_label(tast, id, cases))
        }
        Stmt::While { body, .. } | Stmt::DoWhile { body, .. } | Stmt::For { body, .. } => {
            holds_a_label(tast, body, cases)
        }
        Stmt::Switch { body, .. } => holds_a_label(tast, body, false),
        _ => false,
    }
}

/// The pass that decides what the function needs before any of it is walked.
///
/// Two questions, and both have to be answered for the whole body at once. Which locals need a
/// stack slot, because an `alloca` belongs in the entry block and the walk meets `&x` long
/// after it has left. And which declarations inside the body are really globals, because a
/// `static` in a function is emitted at the module level and a reference to it is a reference
/// to a name.
struct Scan<'a> {
    tast: &'a Tast,
    /// The declarations something takes the address of.
    escaped: HashSet<DeclId>,
    /// Every object with automatic storage the body declares, in the order it declares them.
    locals: Vec<DeclId>,
    /// Every object with static storage the body declares.
    statics: Vec<DeclId>,
    /// The labels the body takes the address of, in the order it takes them.
    taken: Vec<rucc_sema::LabelId>,
}

impl Scan<'_> {
    /// One statement and everything under it.
    fn stmt(&mut self, id: StmtId) {
        match self.tast[id] {
            Stmt::Error | Stmt::Empty | Stmt::Break | Stmt::Continue | Stmt::Goto(_) => {}
            Stmt::Expr(expr) => self.expr(expr),
            Stmt::IndirectGoto(expr) => self.expr(expr),
            Stmt::Asm(asm) => self.asm(asm),
            Stmt::Block(list) => {
                for index in 0..self.tast[list].len() {
                    let stmt = self.tast[list][index];
                    self.stmt(stmt);
                }
            }
            Stmt::Decls(list) => {
                for index in 0..self.tast[list].len() {
                    let decl = self.tast[list][index];
                    self.decl(decl);
                }
            }
            Stmt::If { cond, then, otherwise } => {
                self.expr(cond);
                self.stmt(then);
                if let Some(otherwise) = otherwise {
                    self.stmt(otherwise);
                }
            }
            Stmt::While { cond, body } | Stmt::DoWhile { body, cond } => {
                self.expr(cond);
                self.stmt(body);
            }
            Stmt::For { init, cond, step, body } => {
                if let Some(init) = init {
                    self.stmt(init);
                }
                if let Some(cond) = cond {
                    self.expr(cond);
                }
                if let Some(step) = step {
                    self.expr(step);
                }
                self.stmt(body);
            }
            Stmt::Switch { cond, body, .. } => {
                self.expr(cond);
                self.stmt(body);
            }
            Stmt::Case { body, .. } | Stmt::Default { body } | Stmt::Label { body, .. } => {
                self.stmt(body);
            }
            Stmt::Return(value) => {
                if let Some(value) = value {
                    self.expr(value);
                }
            }
        }
    }

    /// One declaration, and the initializer it has.
    fn decl(&mut self, id: DeclId) {
        if self.tast[id].duration == StorageDuration::Automatic {
            self.locals.push(id);
        } else {
            self.statics.push(id);
        }
        if let Some(init) = self.tast[id].init {
            for index in 0..self.tast[init].len() {
                let entry = self.tast[init][index];
                self.expr(entry.value);
            }
        }
    }

    /// One expression and everything under it.
    fn expr(&mut self, id: ExprId) {
        match self.tast[id].kind {
            ExprKind::Error
            | ExprKind::Const(_)
            | ExprKind::Str(_)
            | ExprKind::Decl(_)
            | ExprKind::Unreachable
            | ExprKind::ThreadPointer => {}
            ExprKind::LabelAddr(label) => {
                if !self.taken.contains(&label) {
                    self.taken.push(label);
                }
            }
            ExprKind::Member { base, .. } | ExprKind::Prefetch { address: base, .. } => {
                self.expr(base);
            }
            ExprKind::Subscript { base, index } => {
                self.expr(base);
                self.expr(index);
            }
            ExprKind::Call { callee, args } => {
                self.expr(callee);
                for index in 0..self.tast[args].len() {
                    let arg = self.tast[args][index];
                    self.expr(arg);
                }
            }
            ExprKind::Unary { op: UnaryOp::AddrOf, operand } => {
                self.escape(operand);
                self.expr(operand);
            }
            ExprKind::Unary { operand, .. } => self.expr(operand),
            ExprKind::Binary { lhs, rhs, .. }
            | ExprKind::Expect { value: lhs, hint: rhs, .. }
            | ExprKind::Comma { lhs, rhs } => {
                self.expr(lhs);
                self.expr(rhs);
            }
            ExprKind::Assign { lhs, rhs, .. } => {
                self.expr(lhs);
                self.expr(rhs);
            }
            ExprKind::Cond { cond, then, otherwise } => {
                self.expr(cond);
                self.expr(then);
                self.expr(otherwise);
            }
            ExprKind::Cast(operand) | ExprKind::Convert { operand, .. } => self.expr(operand),
            ExprKind::CompoundLiteral(decl) => self.decl(decl),
            ExprKind::StmtExpr(body) => self.stmt(body),
            ExprKind::VaArg { list } | ExprKind::VaStart { list } | ExprKind::VaEnd { list } => {
                self.escape(list);
                self.expr(list);
            }
            ExprKind::VaCopy { dst, src } => {
                self.escape(dst);
                self.escape(src);
                self.expr(dst);
                self.expr(src);
            }
            ExprKind::Classify { lhs, rhs, .. } | ExprKind::Sign { lhs, rhs, .. } => {
                self.expr(lhs);
                if let Some(rhs) = rhs {
                    self.expr(rhs);
                }
            }
            ExprKind::Abs { operand }
            | ExprKind::ByteSwap { operand }
            | ExprKind::BitCount { operand, .. } => self.expr(operand),
            // The third operand is a pointer the program worked out for itself, so nothing here
            // takes an address that was not already taken.
            ExprKind::Overflow { args, .. } | ExprKind::Atomic { args, .. } => {
                for index in 0..self.tast[args].len() {
                    let arg = self.tast[args][index];
                    self.expr(arg);
                }
            }
            ExprKind::FpClassify { value, answers } => {
                self.expr(value);
                for index in 0..self.tast[answers].len() {
                    let answer = self.tast[answers][index];
                    self.expr(answer);
                }
            }
        }
    }

    /// The operands of an assembly statement, which is where an object needs an address
    /// without anything in the program having written `&`.
    ///
    /// Which operands those are was decided by the checking, so the answer here is the same one
    /// the walk will reach, which is the point: an operand the walk takes the address of has to
    /// be one this gave a stack slot to.
    fn asm(&mut self, id: rucc_sema::AsmId) {
        let node = self.tast[id];
        for list in [node.outputs, node.inputs] {
            for index in 0..self.tast[list].len() {
                let operand = self.tast[list][index];
                if operand.memory {
                    self.escape(operand.value);
                }
                self.expr(operand.value);
            }
        }
    }

    /// Marks the object an address was taken of, if it was taken of one.
    fn escape(&mut self, id: ExprId) {
        match self.tast[id].kind {
            ExprKind::Decl(decl) | ExprKind::CompoundLiteral(decl) => {
                self.escaped.insert(decl);
            }
            // `&s.field` is an address into `s`, so it is `s` that needs one. A subscript is
            // not here on purpose: its base is a pointer and the object it points at is
            // wherever that pointer came from.
            ExprKind::Member { base, .. } => self.escape(base),
            // An array that decayed is the address of the array, which is how a `va_list` that
            // is an array of one arrives at the operators that write it.
            ExprKind::Convert { kind: Conversion::ArrayDecay, operand } => self.escape(operand),
            _ => {}
        }
    }
}