ghostscope_compiler/ebpf/

dwarf_bridge.rs

//! DWARF debugging information bridge
//!
//! This module handles integration with DWARF debug information for
//! variable type resolution and evaluation result processing.

use super::context::{CodeGenError, EbpfContext, Result};
use ghostscope_dwarf::{
    ComputeStep, DirectValueResult, EvaluationResult, LocationResult, MemoryAccessSize, TypeInfo,
    VariableWithEvaluation,
};
use ghostscope_process::cookie;
use inkwell::values::{BasicValueEnum, IntValue, PointerValue};
use tracing::{debug, warn};

impl<'ctx> EbpfContext<'ctx> {
    /// Compute a stable cookie for a module when per-PID offsets are unavailable (via coordinator).
    fn fallback_cookie_from_module_path(&self, module_path: &str) -> u64 {
        cookie::from_path(module_path)
    }

    /// Compute section code for an address within a module (text=0, rodata=1, data=2, bss=3).
    fn section_code_for_address(&mut self, module_path: &str, link_addr: u64) -> u8 {
        if let Some(analyzer_ptr) = self.process_analyzer {
            let analyzer = unsafe { &mut *analyzer_ptr };
            if let Some(st) = analyzer.classify_section_for_address(module_path, link_addr) {
                return match st {
                    ghostscope_dwarf::core::SectionType::Text => 0,
                    ghostscope_dwarf::core::SectionType::Rodata => 1,
                    ghostscope_dwarf::core::SectionType::Data => 2,
                    ghostscope_dwarf::core::SectionType::Bss => 3,
                    _ => 2,
                };
            }
        }
        2
    }

    /// Compute cookie for module using coordinator policy.
    fn cookie_for_module_or_fallback(&mut self, module_path: &str) -> u64 {
        self.fallback_cookie_from_module_path(module_path)
    }
    /// Helper: unwrap typedef/qualified wrappers to the underlying type
    fn unwrap_type_aliases(mut t: &TypeInfo) -> &TypeInfo {
        loop {
            match t {
                TypeInfo::TypedefType {
                    underlying_type, ..
                } => t = underlying_type.as_ref(),
                TypeInfo::QualifiedType {
                    underlying_type, ..
                } => t = underlying_type.as_ref(),
                _ => break,
            }
        }
        t
    }

    /// Helper: determine if a DWARF type represents an aggregate (struct/union/array)
    fn is_aggregate_type(&self, t: &TypeInfo) -> bool {
        matches!(
            Self::unwrap_type_aliases(t),
            TypeInfo::StructType { .. } | TypeInfo::UnionType { .. } | TypeInfo::ArrayType { .. }
        )
    }
    /// Convert EvaluationResult to LLVM value
    pub fn evaluate_result_to_llvm_value(
        &mut self,
        evaluation_result: &EvaluationResult,
        dwarf_type: &TypeInfo,
        var_name: &str,
        pc_address: u64,
    ) -> Result<BasicValueEnum<'ctx>> {
        debug!(
            "Converting EvaluationResult to LLVM value for variable: {}",
            var_name
        );
        debug!("Evaluation context PC address: 0x{:x}", pc_address);

        // Get pt_regs parameter
        let pt_regs_ptr = self.get_pt_regs_parameter()?;

        match evaluation_result {
            EvaluationResult::DirectValue(direct) => {
                self.generate_direct_value(direct, pt_regs_ptr)
            }
            EvaluationResult::MemoryLocation(location) => {
                self.generate_memory_location(location, pt_regs_ptr, dwarf_type)
            }
            EvaluationResult::Optimized => {
                debug!("Variable {} is optimized out", var_name);
                // Return a placeholder value for optimized out variables
                Ok(self.context.i64_type().const_zero().into())
            }
            EvaluationResult::Composite(members) => {
                debug!(
                    "Variable {} is composite with {} members",
                    var_name,
                    members.len()
                );
                // For now, just return the first member if available
                if let Some(first_member) = members.first() {
                    self.evaluate_result_to_llvm_value(
                        &first_member.location,
                        dwarf_type,
                        var_name,
                        pc_address,
                    )
                } else {
                    Ok(self.context.i64_type().const_zero().into())
                }
            }
        }
    }

    /// Variant that allows passing an explicit module hint for offsets lookup
    pub fn evaluation_result_to_address_with_hint(
        &mut self,
        evaluation_result: &EvaluationResult,
        status_ptr: Option<PointerValue<'ctx>>,
        module_hint: Option<&str>,
    ) -> Result<IntValue<'ctx>> {
        // Policy note:
        // - Link-time addresses (DW_OP_addr or constant-foldable address expressions) are
        //   always rebased using per-module section offsets (ASLR) to get a runtime address.
        // - Runtime-derived addresses (register/stack-relative or computed via dereference)
        //   are used as-is and are NOT rebased.
        // The caller signals which path we are on by providing the original evaluation_result.
        let pt_regs_ptr = self.get_pt_regs_parameter()?;
        // Default assumption: offsets are available unless a lookup proves otherwise.
        self.store_offsets_found_const(true)?;

        match evaluation_result {
            EvaluationResult::MemoryLocation(LocationResult::Address(addr)) => {
                // Unified: always attempt runtime rebasing via proc_module_offsets
                let ctx = self.get_compile_time_context()?;
                let module_for_offsets = module_hint
                    .map(|s| s.to_string())
                    .or_else(|| self.current_resolved_var_module_path.clone())
                    .unwrap_or_else(|| ctx.module_path.clone());
                let st_code = self.section_code_for_address(&module_for_offsets, *addr);
                let cookie = self.cookie_for_module_or_fallback(&module_for_offsets);
                let link_val = self.context.i64_type().const_int(*addr, false);
                let (rt_addr, found_flag) =
                    self.generate_runtime_address_from_offsets(link_val, st_code, cookie)?;
                if let Some(sp) = status_ptr {
                    let is_miss = self
                        .builder
                        .build_int_compare(
                            inkwell::IntPredicate::EQ,
                            found_flag,
                            self.context.bool_type().const_zero(),
                            "is_off_miss",
                        )
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    let cur_status = self
                        .builder
                        .build_load(self.context.i8_type(), sp, "cur_status")
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    let is_ok = self
                        .builder
                        .build_int_compare(
                            inkwell::IntPredicate::EQ,
                            cur_status.into_int_value(),
                            self.context.i8_type().const_zero(),
                            "status_is_ok",
                        )
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    let should_store = self
                        .builder
                        .build_and(is_miss, is_ok, "store_offsets_unavail")
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    let new_status = self
                        .builder
                        .build_select(
                            should_store,
                            self.context
                                .i8_type()
                                .const_int(
                                    ghostscope_protocol::VariableStatus::OffsetsUnavailable as u64,
                                    false,
                                )
                                .into(),
                            cur_status,
                            "new_status",
                        )
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    self.builder
                        .build_store(sp, new_status)
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                }
                self.store_offsets_found_flag(found_flag)?;
                self.current_resolved_var_module_path = None;
                Ok(rt_addr)
            }
            EvaluationResult::MemoryLocation(LocationResult::RegisterAddress {
                register,
                offset,
                ..
            }) => {
                let reg_val = self.load_register_value(*register, pt_regs_ptr)?;
                if let BasicValueEnum::IntValue(reg_i) = reg_val {
                    if let Some(ofs) = offset {
                        let ofs_val = self.context.i64_type().const_int(*ofs as u64, true);
                        let sum = self
                            .builder
                            .build_int_add(reg_i, ofs_val, "addr_with_offset")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        Ok(sum)
                    } else {
                        Ok(reg_i)
                    }
                } else {
                    Err(CodeGenError::RegisterMappingError(
                        "Register value is not integer".to_string(),
                    ))
                }
            }
            EvaluationResult::MemoryLocation(LocationResult::ComputedLocation { steps }) => {
                // Try to fold constant-only address expressions (e.g., global + const offset)
                // If foldable, treat as link-time address and apply ASLR offsets via map.
                let mut const_stack: Vec<i64> = Vec::new();
                let mut foldable = true;
                for s in steps.iter() {
                    match s {
                        ComputeStep::PushConstant(v) => const_stack.push(*v),
                        ComputeStep::Add => {
                            if const_stack.len() >= 2 {
                                let b = const_stack.pop().unwrap();
                                let a = const_stack.pop().unwrap();
                                const_stack.push(a.saturating_add(b));
                            } else {
                                foldable = false;
                                break;
                            }
                        }
                        // Any register load or deref means runtime-derived address; not foldable
                        ComputeStep::LoadRegister(_) | ComputeStep::Dereference { .. } => {
                            foldable = false;
                            break;
                        }
                        _ => {
                            // Unknown/non-add op: treat as non-foldable
                            foldable = false;
                            break;
                        }
                    }
                }

                if foldable && const_stack.len() == 1 {
                    let link_addr_u = const_stack[0] as u64;
                    let ctx = self.get_compile_time_context()?;
                    let module_for_offsets = module_hint
                        .map(|s| s.to_string())
                        .or_else(|| self.current_resolved_var_module_path.clone())
                        .unwrap_or_else(|| ctx.module_path.clone());
                    let st_code = self.section_code_for_address(&module_for_offsets, link_addr_u);
                    let cookie = self.cookie_for_module_or_fallback(&module_for_offsets);
                    let link_val = self.context.i64_type().const_int(link_addr_u, false);
                    let (rt_addr, found_flag) =
                        self.generate_runtime_address_from_offsets(link_val, st_code, cookie)?;
                    if let Some(sp) = status_ptr {
                        let is_miss = self
                            .builder
                            .build_int_compare(
                                inkwell::IntPredicate::EQ,
                                found_flag,
                                self.context.bool_type().const_zero(),
                                "is_off_miss",
                            )
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        let cur_status = self
                            .builder
                            .build_load(self.context.i8_type(), sp, "cur_status")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        let is_ok = self
                            .builder
                            .build_int_compare(
                                inkwell::IntPredicate::EQ,
                                cur_status.into_int_value(),
                                self.context.i8_type().const_zero(),
                                "status_is_ok",
                            )
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        let should_store = self
                            .builder
                            .build_and(is_miss, is_ok, "store_offsets_unavail")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        let new_status = self
                            .builder
                            .build_select(
                                should_store,
                                self.context
                                    .i8_type()
                                    .const_int(
                                        ghostscope_protocol::VariableStatus::OffsetsUnavailable
                                            as u64,
                                        false,
                                    )
                                    .into(),
                                cur_status,
                                "new_status",
                            )
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        self.builder
                            .build_store(sp, new_status)
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    }
                    self.current_resolved_var_module_path = None;
                    return Ok(rt_addr);
                }

                // Attempt: if steps start with PushConstant(base) and first dynamic op is Dereference
                // (with no LoadRegister before it), apply ASLR offsets to base and continue
                if let Some(ComputeStep::PushConstant(base_const)) = steps.first() {
                    // Scan until first Dereference or LoadRegister
                    let mut saw_reg = false;
                    let mut saw_deref = false;
                    for s in &steps[1..] {
                        match s {
                            ComputeStep::LoadRegister(_) => {
                                saw_reg = true;
                                break;
                            }
                            ComputeStep::Dereference { .. } => {
                                saw_deref = true;
                                break;
                            }
                            _ => {}
                        }
                    }
                    if saw_deref && !saw_reg {
                        let link_addr_u = *base_const as u64;
                        let ctx = self.get_compile_time_context()?;
                        let module_for_offsets = module_hint
                            .map(|s| s.to_string())
                            .or_else(|| self.current_resolved_var_module_path.clone())
                            .unwrap_or_else(|| ctx.module_path.clone());
                        let st_code =
                            self.section_code_for_address(&module_for_offsets, link_addr_u);
                        let cookie = self.cookie_for_module_or_fallback(&module_for_offsets);
                        let link_val = self.context.i64_type().const_int(link_addr_u, false);
                        let (rt, found_flag) =
                            self.generate_runtime_address_from_offsets(link_val, st_code, cookie)?;
                        if let Some(sp) = status_ptr {
                            let is_miss = self
                                .builder
                                .build_int_compare(
                                    inkwell::IntPredicate::EQ,
                                    found_flag,
                                    self.context.bool_type().const_zero(),
                                    "is_off_miss",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            let cur_status = self
                                .builder
                                .build_load(self.context.i8_type(), sp, "cur_status")
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            let is_ok = self
                                .builder
                                .build_int_compare(
                                    inkwell::IntPredicate::EQ,
                                    cur_status.into_int_value(),
                                    self.context.i8_type().const_zero(),
                                    "status_is_ok",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            let should_store = self
                                .builder
                                .build_and(is_miss, is_ok, "store_offsets_unavail")
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            let new_status = self
                                .builder
                                .build_select(
                                    should_store,
                                    self.context
                                        .i8_type()
                                        .const_int(
                                            ghostscope_protocol::VariableStatus::OffsetsUnavailable
                                                as u64,
                                            false,
                                        )
                                        .into(),
                                    cur_status,
                                    "new_status",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            self.builder
                                .build_store(sp, new_status)
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        }
                        // Execute remaining steps with rt pre-pushed as base
                        let rest = &steps[1..];
                        let val = self.generate_compute_steps(
                            rest,
                            pt_regs_ptr,
                            None,
                            status_ptr,
                            Some(rt),
                        )?;
                        if let BasicValueEnum::IntValue(i) = val {
                            return Ok(i);
                        } else {
                            return Err(CodeGenError::LLVMError(
                                "Computed location did not produce integer".to_string(),
                            ));
                        }
                    }
                }

                // Fallback: execute steps at runtime and use the result directly (no offsets)
                let val =
                    self.generate_compute_steps(steps, pt_regs_ptr, None, status_ptr, None)?;
                if let BasicValueEnum::IntValue(i) = val {
                    Ok(i)
                } else {
                    Err(CodeGenError::LLVMError(
                        "Computed location did not produce integer".to_string(),
                    ))
                }
            }
            _ => Err(CodeGenError::NotImplemented(
                "Unable to compute address from evaluation result".to_string(),
            )),
        }
    }

    /// Convert DWARF type size to MemoryAccessSize
    fn dwarf_type_to_memory_access_size(&self, dwarf_type: &TypeInfo) -> MemoryAccessSize {
        let size = Self::get_dwarf_type_size(dwarf_type);
        match size {
            1 => MemoryAccessSize::U8,
            2 => MemoryAccessSize::U16,
            4 => MemoryAccessSize::U32,
            8 => MemoryAccessSize::U64,
            _ => MemoryAccessSize::U64, // Default to U64 for unknown sizes
        }
    }

    /// Generate LLVM IR for direct value result
    fn generate_direct_value(
        &mut self,
        direct: &DirectValueResult,
        pt_regs_ptr: PointerValue<'ctx>,
    ) -> Result<BasicValueEnum<'ctx>> {
        match direct {
            DirectValueResult::Constant(value) => {
                debug!("Generating constant: {}", value);
                Ok(self
                    .context
                    .i64_type()
                    .const_int(*value as u64, true)
                    .into())
            }

            DirectValueResult::ImplicitValue(bytes) => {
                debug!("Generating implicit value: {} bytes", bytes.len());
                // Convert bytes to integer value (little-endian)
                let mut value: u64 = 0;
                for (i, &byte) in bytes.iter().enumerate().take(8) {
                    value |= (byte as u64) << (i * 8);
                }
                Ok(self.context.i64_type().const_int(value, false).into())
            }

            DirectValueResult::RegisterValue(reg_num) => {
                debug!("Generating register value: {}", reg_num);
                let reg_value = self.load_register_value(*reg_num, pt_regs_ptr)?;
                Ok(reg_value)
            }

            DirectValueResult::ComputedValue { steps, result_size } => {
                debug!("Generating computed value: {} steps", steps.len());
                let status_ptr = if self.condition_context_active {
                    Some(self.get_or_create_cond_error_global())
                } else {
                    None
                };
                self.generate_compute_steps(
                    steps,
                    pt_regs_ptr,
                    Some(*result_size),
                    status_ptr,
                    None,
                )
            }
        }
    }

    /// Generate LLVM IR for memory location result
    fn generate_memory_location(
        &mut self,
        location: &LocationResult,
        pt_regs_ptr: PointerValue<'ctx>,
        dwarf_type: &TypeInfo,
    ) -> Result<BasicValueEnum<'ctx>> {
        match location {
            // Policy note:
            // We decide ASLR rebasing based on the DWARF evaluation RESULT SHAPE, not a
            // "global variable" tag. Whenever DWARF yields a link-time address
            // (LocationResult::Address) — including file-scope globals, static locals,
            // rodata/data/bss, or any constant-folded address — we MUST apply per-module
            // section offsets (.text/.rodata/.data/.bss) to obtain the runtime address.
            // Conversely, for runtime-derived addresses (RegisterAddress or computed from
            // registers/dereferences), we DO NOT rebase.
            LocationResult::Address(addr) => {
                debug!("Generating absolute address: 0x{:x}", addr);
                // Convert link-time address to runtime address using ASLR offsets when available
                let module_hint = self.current_resolved_var_module_path.clone();
                let status_ptr = if self.condition_context_active {
                    Some(self.get_or_create_cond_error_global())
                } else {
                    None
                };
                let eval = ghostscope_dwarf::EvaluationResult::MemoryLocation(
                    ghostscope_dwarf::LocationResult::Address(*addr),
                );
                let rt_addr = self.evaluation_result_to_address_with_hint(
                    &eval,
                    status_ptr,
                    module_hint.as_deref(),
                )?;
                // Aggregate types (struct/union/array) are represented as pointers in expressions
                if self.is_aggregate_type(dwarf_type) {
                    let ptr_ty = self.context.ptr_type(inkwell::AddressSpace::default());
                    let as_ptr = self
                        .builder
                        .build_int_to_ptr(rt_addr, ptr_ty, "aggregate_addr_as_ptr")
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    return Ok(as_ptr.into());
                }
                // Use DWARF type size for memory access
                let access_size = self.dwarf_type_to_memory_access_size(dwarf_type);
                if self.condition_context_active {
                    self.generate_memory_read_with_status(rt_addr, access_size)
                } else {
                    self.generate_memory_read(rt_addr, access_size)
                }
            }

            LocationResult::RegisterAddress {
                register,
                offset,
                size,
            } => {
                debug!(
                    "Generating register address: reg{} {:+}",
                    register,
                    offset.unwrap_or(0)
                );

                // Load register value
                let reg_value = self.load_register_value(*register, pt_regs_ptr)?;

                // Add offset if present
                let final_addr = if let Some(offset) = offset {
                    let offset_value = self.context.i64_type().const_int(*offset as u64, true);
                    if let BasicValueEnum::IntValue(reg_int) = reg_value {
                        self.builder
                            .build_int_add(reg_int, offset_value, "addr_with_offset")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?
                    } else {
                        return Err(CodeGenError::RegisterMappingError(
                            "Register value is not integer".to_string(),
                        ));
                    }
                } else if let BasicValueEnum::IntValue(reg_int) = reg_value {
                    reg_int
                } else {
                    return Err(CodeGenError::RegisterMappingError(
                        "Register value is not integer".to_string(),
                    ));
                };
                // Aggregate types: return pointer instead of reading as scalar
                if self.is_aggregate_type(dwarf_type) {
                    let ptr_ty = self.context.ptr_type(inkwell::AddressSpace::default());
                    let as_ptr = self
                        .builder
                        .build_int_to_ptr(final_addr, ptr_ty, "aggregate_addr_as_ptr")
                        .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                    return Ok(as_ptr.into());
                }
                // Determine memory access size - prefer LocationResult size if available, otherwise use DWARF type
                let access_size = size
                    .map(|s| match s {
                        1 => MemoryAccessSize::U8,
                        2 => MemoryAccessSize::U16,
                        4 => MemoryAccessSize::U32,
                        _ => MemoryAccessSize::U64,
                    })
                    .unwrap_or_else(|| self.dwarf_type_to_memory_access_size(dwarf_type));

                if self.condition_context_active {
                    self.generate_memory_read_with_status(final_addr, access_size)
                } else {
                    self.generate_memory_read(final_addr, access_size)
                }
            }

            LocationResult::ComputedLocation { steps } => {
                debug!("Generating computed location: {} steps", steps.len());
                // Execute steps to compute the address
                let status_ptr = if self.condition_context_active {
                    Some(self.get_or_create_cond_error_global())
                } else {
                    None
                };
                let addr_value =
                    self.generate_compute_steps(steps, pt_regs_ptr, None, status_ptr, None)?;
                if let BasicValueEnum::IntValue(addr) = addr_value {
                    // For aggregate types, return pointer to address instead of loading a value
                    if self.is_aggregate_type(dwarf_type) {
                        let ptr_ty = self.context.ptr_type(inkwell::AddressSpace::default());
                        let as_ptr = self
                            .builder
                            .build_int_to_ptr(addr, ptr_ty, "aggregate_addr_as_ptr")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        return Ok(as_ptr.into());
                    }
                    // Use DWARF type size for memory access
                    let access_size = self.dwarf_type_to_memory_access_size(dwarf_type);
                    if self.condition_context_active {
                        self.generate_memory_read_with_status(addr, access_size)
                    } else {
                        self.generate_memory_read(addr, access_size)
                    }
                } else {
                    Err(CodeGenError::LLVMError(
                        "Address computation must return integer".to_string(),
                    ))
                }
            }
        }
    }

    /// Execute a sequence of compute steps
    fn generate_compute_steps(
        &mut self,
        steps: &[ComputeStep],
        pt_regs_ptr: PointerValue<'ctx>,
        _result_size: Option<MemoryAccessSize>,
        status_ptr: Option<PointerValue<'ctx>>,
        initial_top: Option<IntValue<'ctx>>,
    ) -> Result<BasicValueEnum<'ctx>> {
        // Implement stack-based computation
        let mut stack: Vec<IntValue<'ctx>> = Vec::new();
        // Track a runtime null-pointer flag from dereference steps; when true, subsequent
        // arithmetic will be masked to zero to avoid reads at small offsets from NULL.
        let mut deref_null_flag: Option<inkwell::values::IntValue> = None;
        if let Some(top) = initial_top {
            stack.push(top);
        }

        for step in steps {
            match step {
                ComputeStep::LoadRegister(reg_num) => {
                    let reg_value = self.load_register_value(*reg_num, pt_regs_ptr)?;
                    if let BasicValueEnum::IntValue(int_val) = reg_value {
                        stack.push(int_val);
                    } else {
                        return Err(CodeGenError::RegisterMappingError(format!(
                            "Register {reg_num} did not return integer value"
                        )));
                    }
                }

                ComputeStep::PushConstant(value) => {
                    let const_val = self.context.i64_type().const_int(*value as u64, true);
                    stack.push(const_val);
                }

                ComputeStep::Add => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let sum_val = self
                            .builder
                            .build_int_add(a, b, "add")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        if let Some(nf) = deref_null_flag {
                            let masked_bv = self
                                .builder
                                .build_select::<inkwell::values::BasicValueEnum<'ctx>, _>(
                                    nf,
                                    self.context.i64_type().const_zero().into(),
                                    sum_val.into(),
                                    "add_masked",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            stack.push(masked_bv.into_int_value());
                        } else {
                            stack.push(sum_val);
                        }
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in Add".to_string(),
                        ));
                    }
                }

                ComputeStep::Sub => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_int_sub(a, b, "sub")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in Sub".to_string(),
                        ));
                    }
                }

                ComputeStep::Mul => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_int_mul(a, b, "mul")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in Mul".to_string(),
                        ));
                    }
                }

                ComputeStep::Div => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_int_signed_div(a, b, "div")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in Div".to_string(),
                        ));
                    }
                }

                ComputeStep::And => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_and(a, b, "and")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in BitwiseAnd".to_string(),
                        ));
                    }
                }

                ComputeStep::Or => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_or(a, b, "or")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in BitwiseOr".to_string(),
                        ));
                    }
                }

                ComputeStep::Xor => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_xor(a, b, "xor")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in BitwiseXor".to_string(),
                        ));
                    }
                }

                ComputeStep::Shl => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_left_shift(a, b, "shl")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in ShiftLeft".to_string(),
                        ));
                    }
                }

                ComputeStep::Shr => {
                    if let (Some(b), Some(a)) = (stack.pop(), stack.pop()) {
                        let result = self
                            .builder
                            .build_right_shift(a, b, false, "shr")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        stack.push(result);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in ShiftRight".to_string(),
                        ));
                    }
                }

                ComputeStep::Dereference { size } => {
                    if let Some(addr) = stack.pop() {
                        // Null guard: if addr == 0, set NullDeref (if status_ptr provided and current is Ok)
                        let zero64 = self.context.i64_type().const_zero();
                        let is_null = self
                            .builder
                            .build_int_compare(
                                inkwell::IntPredicate::EQ,
                                addr,
                                zero64,
                                "is_null_deref",
                            )
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;

                        let cur_fn = self
                            .builder
                            .get_insert_block()
                            .unwrap()
                            .get_parent()
                            .unwrap();
                        let null_bb = self.context.append_basic_block(cur_fn, "deref_null");
                        let read_bb = self.context.append_basic_block(cur_fn, "deref_read");
                        let cont_bb = self.context.append_basic_block(cur_fn, "deref_cont");
                        self.builder
                            .build_conditional_branch(is_null, null_bb, read_bb)
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;

                        // Null path: optionally set status=NullDeref if currently Ok, branch to cont
                        self.builder.position_at_end(null_bb);
                        let null_val = self.context.i64_type().const_zero();
                        if let Some(sp) = status_ptr {
                            let cur_status = self
                                .builder
                                .build_load(self.context.i8_type(), sp, "cur_status")
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?
                                .into_int_value();
                            let is_ok = self
                                .builder
                                .build_int_compare(
                                    inkwell::IntPredicate::EQ,
                                    cur_status,
                                    self.context.i8_type().const_zero(),
                                    "status_is_ok",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            let then_val = self.context.i8_type().const_int(
                                ghostscope_protocol::VariableStatus::NullDeref as u64,
                                false,
                            );
                            let new_status_bv = self
                                .builder
                                .build_select::<inkwell::values::BasicValueEnum<'ctx>, _>(
                                    is_ok,
                                    then_val.into(),
                                    cur_status.into(),
                                    "new_status",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            self.builder
                                .build_store(sp, new_status_bv)
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        }
                        self.builder
                            .build_unconditional_branch(cont_bb)
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;

                        // Read path: load pointer-sized value into tmp then branch to cont
                        self.builder.position_at_end(read_bb);
                        let access_size = *size;
                        let loaded_bv = self.generate_memory_read(addr, access_size)?;
                        let loaded_int = if let BasicValueEnum::IntValue(int_val) = loaded_bv {
                            int_val
                        } else {
                            return Err(CodeGenError::LLVMError(
                                "Memory load did not return integer".to_string(),
                            ));
                        };
                        self.builder
                            .build_unconditional_branch(cont_bb)
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;

                        // Continue at cont: create PHI to merge null/read values, push once
                        self.builder.position_at_end(cont_bb);
                        let phi = self
                            .builder
                            .build_phi(self.context.i64_type(), "deref_phi")
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        phi.add_incoming(&[(&null_val, null_bb), (&loaded_int, read_bb)]);
                        let merged = phi.as_basic_value().into_int_value();
                        // Update null flag based on loaded pointer value being zero
                        let is_zero_ptr = self
                            .builder
                            .build_int_compare(
                                inkwell::IntPredicate::EQ,
                                merged,
                                self.context.i64_type().const_zero(),
                                "is_zero_ptr",
                            )
                            .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        deref_null_flag = Some(match deref_null_flag {
                            Some(prev) => self
                                .builder
                                .build_or(prev, is_zero_ptr, "null_or")
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?,
                            None => is_zero_ptr,
                        });
                        if let (Some(sp), Some(nf)) = (status_ptr, deref_null_flag) {
                            // Only store NullDeref if currently OK and nf is true
                            let cur_status = self
                                .builder
                                .build_load(self.context.i8_type(), sp, "cur_status")
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?
                                .into_int_value();
                            let is_ok = self
                                .builder
                                .build_int_compare(
                                    inkwell::IntPredicate::EQ,
                                    cur_status,
                                    self.context.i8_type().const_zero(),
                                    "status_is_ok2",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            let should_store = self
                                .builder
                                .build_and(is_ok, nf, "store_null_deref_from_ptr")
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            let then_val = self.context.i8_type().const_int(
                                ghostscope_protocol::VariableStatus::NullDeref as u64,
                                false,
                            );
                            let new_status_bv = self
                                .builder
                                .build_select::<inkwell::values::BasicValueEnum<'ctx>, _>(
                                    should_store,
                                    then_val.into(),
                                    cur_status.into(),
                                    "new_status2",
                                )
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                            self.builder
                                .build_store(sp, new_status_bv)
                                .map_err(|e| CodeGenError::LLVMError(e.to_string()))?;
                        }
                        stack.push(merged);
                    } else {
                        return Err(CodeGenError::LLVMError(
                            "Stack underflow in LoadMemory".to_string(),
                        ));
                    }
                }

                // Add catch-all for unimplemented operations
                _ => {
                    warn!("Unimplemented ComputeStep: {:?}", step);
                    return Err(CodeGenError::NotImplemented(format!(
                        "ComputeStep {step:?} not yet implemented"
                    )));
                }
            }
        }

        if stack.len() == 1 {
            Ok(stack.pop().unwrap().into())
        } else {
            Err(CodeGenError::LLVMError(format!(
                "Invalid stack state after computation: {} elements remaining",
                stack.len()
            )))
        }
    }

    /// Query DWARF for complex expression (supports member access, array access, etc.)
    pub fn query_dwarf_for_complex_expr(
        &mut self,
        expr: &crate::script::Expr,
    ) -> Result<Option<VariableWithEvaluation>> {
        use crate::script::Expr;

        // Expand script alias variables inside the expression so downstream
        // DWARF resolvers see the actual DWARF-based expression tree.
        // Guard against self-referential or cyclic aliases.
        fn expand_aliases(
            ctx: &crate::ebpf::context::EbpfContext<'_>,
            e: &crate::script::Expr,
            visited: &mut std::collections::HashSet<String>,
            depth: usize,
        ) -> std::result::Result<crate::script::Expr, super::context::CodeGenError> {
            use crate::script::Expr as E;
            const MAX_DEPTH: usize = 64;
            if depth > MAX_DEPTH {
                return Err(super::context::CodeGenError::TypeError(
                    "alias expansion depth exceeded (cycle?)".to_string(),
                ));
            }
            Ok(match e {
                E::Variable(name) => {
                    if ctx.alias_variable_exists(name) {
                        if !visited.insert(name.clone()) {
                            return Err(super::context::CodeGenError::TypeError(format!(
                                "alias cycle detected for '{name}'"
                            )));
                        }
                        if let Some(t) = ctx.get_alias_variable(name) {
                            let res = expand_aliases(ctx, &t, visited, depth + 1)?;
                            visited.remove(name);
                            res
                        } else {
                            e.clone()
                        }
                    } else {
                        e.clone()
                    }
                }
                E::MemberAccess(obj, field) => {
                    let base = expand_aliases(ctx, obj, visited, depth + 1)?;
                    E::MemberAccess(Box::new(base), field.clone())
                }
                E::ArrayAccess(arr, idx) => {
                    let base = expand_aliases(ctx, arr, visited, depth + 1)?;
                    let idx2 = expand_aliases(ctx, idx, visited, depth + 1)?;
                    E::ArrayAccess(Box::new(base), Box::new(idx2))
                }
                E::PointerDeref(inner) => {
                    let in2 = expand_aliases(ctx, inner, visited, depth + 1)?;
                    E::PointerDeref(Box::new(in2))
                }
                E::AddressOf(inner) => {
                    let in2 = expand_aliases(ctx, inner, visited, depth + 1)?;
                    E::AddressOf(Box::new(in2))
                }
                E::ChainAccess(chain) => {
                    if chain.is_empty() {
                        return Ok(e.clone());
                    }
                    let head = &chain[0];
                    if ctx.alias_variable_exists(head) {
                        if !visited.insert(head.clone()) {
                            return Err(super::context::CodeGenError::TypeError(format!(
                                "alias cycle detected for '{head}'"
                            )));
                        }
                        if let Some(alias_expr) = ctx.get_alias_variable(head) {
                            // Expand the alias head, then append member segments
                            let mut acc = expand_aliases(ctx, &alias_expr, visited, depth + 1)?;
                            for seg in &chain[1..] {
                                acc = E::MemberAccess(Box::new(acc), seg.clone());
                            }
                            visited.remove(head);
                            acc
                        } else {
                            e.clone()
                        }
                    } else {
                        e.clone()
                    }
                }
                E::BuiltinCall { name, args } => E::BuiltinCall {
                    name: name.clone(),
                    args: args
                        .iter()
                        .map(|a| expand_aliases(ctx, a, visited, depth + 1))
                        .collect::<std::result::Result<Vec<_>, _>>()?,
                },
                E::BinaryOp { left, op, right } => E::BinaryOp {
                    left: Box::new(expand_aliases(ctx, left, visited, depth + 1)?),
                    op: op.clone(),
                    right: Box::new(expand_aliases(ctx, right, visited, depth + 1)?),
                },
                _ => e.clone(),
            })
        }

        let mut visited = std::collections::HashSet::new();
        let expanded = expand_aliases(self, expr, &mut visited, 0)?;

        match &expanded {
            // Simple variable lookup
            Expr::Variable(var_name) => self.query_dwarf_for_variable(var_name),

            // Member access: obj.field
            Expr::MemberAccess(obj_expr, field_name) => {
                self.query_dwarf_for_member_access(obj_expr, field_name)
            }

            // Array access: arr[index]
            Expr::ArrayAccess(array_expr, index_expr) => {
                self.query_dwarf_for_array_access(array_expr, index_expr)
            }

            // Chain access: person.name.first
            Expr::ChainAccess(chain) => self.query_dwarf_for_chain_access(chain),

            // Pointer dereference: *ptr
            Expr::PointerDeref(expr) => self.query_dwarf_for_pointer_deref(expr),

            // Other expression types are not supported for DWARF queries
            _ => Ok(None),
        }
    }

    /// Query DWARF for variable information
    pub fn query_dwarf_for_variable(
        &mut self,
        var_name: &str,
    ) -> Result<Option<VariableWithEvaluation>> {
        if self.process_analyzer.is_none() {
            return Err(CodeGenError::DwarfError(
                "No DWARF analyzer available".to_string(),
            ));
        }

        let context = self.get_compile_time_context()?;
        let pc_address = context.pc_address;
        let module_path = &context.module_path;

        debug!(
            "Querying DWARF for variable '{}' at PC 0x{:x} in module '{}'",
            var_name, pc_address, module_path
        );

        // Query DWARF analyzer for variable
        let analyzer = unsafe { &mut *(self.process_analyzer.unwrap()) };

        let module_address = ghostscope_dwarf::ModuleAddress::new(
            std::path::PathBuf::from(module_path.clone()),
            pc_address,
        );

        let module_path_owned = module_path.clone();
        let lookup_globals = |analyzer: &mut ghostscope_dwarf::DwarfAnalyzer| -> Result<
            Option<(std::path::PathBuf, VariableWithEvaluation)>,
        > {
            debug!(
                "Variable '{}' not found in locals; attempting global lookup",
                var_name
            );
            let mut matches = analyzer.find_global_variables_by_name(var_name);
            if matches.is_empty() {
                return Ok(None);
            }
            // Prefer globals defined in the current module.
            let preferred: Vec<(
                std::path::PathBuf,
                ghostscope_dwarf::core::GlobalVariableInfo,
            )> = matches
                .iter()
                .filter(|(p, _)| p.to_string_lossy() == module_path_owned.as_str())
                .cloned()
                .collect();

            let chosen = if preferred.len() == 1 {
                Some(preferred[0].clone())
            } else if preferred.is_empty() && matches.len() == 1 {
                Some(matches.remove(0))
            } else {
                debug!(
                    "Global '{}' is ambiguous across modules ({} matches)",
                    var_name,
                    matches.len()
                );
                return Err(CodeGenError::DwarfError(format!(
                    "Ambiguous global '{}': {} matches",
                    var_name,
                    matches.len()
                )));
            };

            if let Some((mpath, info)) = chosen {
                let gv = analyzer
                    .resolve_variable_by_offsets_in_module(
                        &mpath,
                        info.unit_offset,
                        info.die_offset,
                    )
                    .map_err(|err| CodeGenError::DwarfError(err.to_string()))?;
                Ok(Some((mpath, gv)))
            } else {
                Ok(None)
            }
        };

        match analyzer.get_all_variables_at_address(&module_address) {
            Ok(vars) => {
                if let Some(var_result) = vars.iter().find(|v| v.name == var_name).or_else(|| {
                    let prefix = format!("{var_name}@");
                    vars.iter().find(|v| v.name.starts_with(&prefix))
                }) {
                    debug!("Found DWARF variable '{}' in locals/params", var_name);
                    Ok(Some(var_result.clone()))
                } else if let Some((mpath, gv)) = lookup_globals(analyzer)? {
                    self.current_resolved_var_module_path =
                        Some(mpath.to_string_lossy().to_string());
                    Ok(Some(gv))
                } else {
                    Ok(None)
                }
            }
            Err(e) => {
                debug!(
                    "DWARF local lookup error for '{}': {e}; falling back to globals",
                    var_name
                );
                if let Some((mpath, gv)) = lookup_globals(analyzer)? {
                    self.current_resolved_var_module_path =
                        Some(mpath.to_string_lossy().to_string());
                    Ok(Some(gv))
                } else {
                    Ok(None)
                }
            }
        }
    }

    /// Get DWARF type size in bytes
    pub fn get_dwarf_type_size(dwarf_type: &TypeInfo) -> u64 {
        match dwarf_type {
            TypeInfo::BaseType { size, .. } => *size,
            TypeInfo::PointerType { size, .. } => *size,
            TypeInfo::ArrayType { total_size, .. } => total_size.unwrap_or(0),
            TypeInfo::StructType { size, .. } => *size,
            TypeInfo::UnionType { size, .. } => *size,
            TypeInfo::EnumType { size, .. } => *size,
            TypeInfo::BitfieldType {
                underlying_type, ..
            } => {
                // Read size equals the storage type size
                Self::get_dwarf_type_size(underlying_type)
            }
            TypeInfo::TypedefType {
                underlying_type, ..
            } => Self::get_dwarf_type_size(underlying_type),
            TypeInfo::QualifiedType {
                underlying_type, ..
            } => Self::get_dwarf_type_size(underlying_type),
            TypeInfo::FunctionType { .. } => 8, // Function pointer size
            TypeInfo::UnknownType { .. } => 0,
            TypeInfo::OptimizedOut { .. } => 0, // Optimized out has no size
        }
    }

    /// Query DWARF for member access (obj.field)
    pub fn query_dwarf_for_member_access(
        &mut self,
        obj_expr: &crate::script::Expr,
        field_name: &str,
    ) -> Result<Option<VariableWithEvaluation>> {
        // Generic path: try to resolve the base expression first and add constant member offset
        if !matches!(obj_expr, crate::script::Expr::Variable(_)) {
            if let Some(base_var) = self.query_dwarf_for_complex_expr(obj_expr)? {
                if let Some(base_ty) = base_var.dwarf_type.as_ref() {
                    fn find_member_offset_and_type(
                        t: &ghostscope_dwarf::TypeInfo,
                        field: &str,
                    ) -> Option<(u64, ghostscope_dwarf::TypeInfo)> {
                        match t {
                            ghostscope_dwarf::TypeInfo::StructType { members, .. }
                            | ghostscope_dwarf::TypeInfo::UnionType { members, .. } => {
                                for m in members {
                                    if m.name == field {
                                        return Some((m.offset, m.member_type.clone()));
                                    }
                                }
                                None
                            }
                            ghostscope_dwarf::TypeInfo::TypedefType {
                                underlying_type, ..
                            }
                            | ghostscope_dwarf::TypeInfo::QualifiedType {
                                underlying_type, ..
                            } => find_member_offset_and_type(underlying_type, field),
                            _ => None,
                        }
                    }
                    // Optional auto-deref for pointer-to-aggregate
                    let mut effective_ty = base_ty.clone();
                    let mut effective_eval = base_var.evaluation_result.clone();
                    // unwrap typedef/qualifier for pointer detection
                    fn unwrap_typedef(
                        mut t: &ghostscope_dwarf::TypeInfo,
                    ) -> &ghostscope_dwarf::TypeInfo {
                        while let ghostscope_dwarf::TypeInfo::TypedefType {
                            underlying_type, ..
                        }
                        | ghostscope_dwarf::TypeInfo::QualifiedType {
                            underlying_type,
                            ..
                        } = t
                        {
                            t = underlying_type.as_ref();
                        }
                        t
                    }
                    let unwrapped = unwrap_typedef(&effective_ty);
                    if let ghostscope_dwarf::TypeInfo::PointerType { target_type, .. } = unwrapped {
                        // Insert a dereference step into evaluation
                        effective_eval = self.compute_pointer_dereference(&effective_eval)?;
                        effective_ty = *target_type.clone();
                    }

                    if let Some((member_off, member_ty)) =
                        find_member_offset_and_type(&effective_ty, field_name)
                    {
                        use ghostscope_dwarf::{
                            ComputeStep as CS, EvaluationResult as ER, LocationResult as LR,
                        };
                        let new_eval = match &effective_eval {
                            ER::MemoryLocation(LR::Address(a)) => {
                                ER::MemoryLocation(LR::Address(a + member_off))
                            }
                            ER::MemoryLocation(LR::ComputedLocation { steps }) => {
                                let mut s = steps.clone();
                                s.push(CS::PushConstant(member_off as i64));
                                s.push(CS::Add);
                                ER::MemoryLocation(LR::ComputedLocation { steps: s })
                            }
                            ER::MemoryLocation(LR::RegisterAddress {
                                register,
                                offset,
                                size,
                            }) => {
                                let new_off = offset.unwrap_or(0).saturating_add(member_off as i64);
                                ER::MemoryLocation(LR::RegisterAddress {
                                    register: *register,
                                    offset: Some(new_off),
                                    size: *size,
                                })
                            }
                            _ => {
                                return Err(CodeGenError::NotImplemented(
                                    "Member access on non-addressable expression".to_string(),
                                ))
                            }
                        };
                        let name = format!("{}.{}", base_var.name, field_name);
                        let v = VariableWithEvaluation {
                            name,
                            type_name: member_ty.type_name(),
                            dwarf_type: Some(member_ty),
                            evaluation_result: new_eval,
                            scope_depth: base_var.scope_depth,
                            is_parameter: base_var.is_parameter,
                            is_artificial: base_var.is_artificial,
                        };
                        return Ok(Some(v));
                    }
                }
            }
            // Try a planner-based chain if generic path missed and base is a pure identifier chain
            {
                fn flatten_ident_chain<'a>(
                    e: &'a crate::script::Expr,
                    out: &mut Vec<&'a str>,
                ) -> bool {
                    match e {
                        crate::script::Expr::Variable(name) => {
                            out.push(name.as_str());
                            true
                        }
                        crate::script::Expr::MemberAccess(obj, field) => {
                            if flatten_ident_chain(obj, out) {
                                out.push(field.as_str());
                                true
                            } else {
                                false
                            }
                        }
                        _ => false,
                    }
                }
                let mut segs: Vec<&str> = Vec::new();
                if flatten_ident_chain(obj_expr, &mut segs) && !segs.is_empty() {
                    let mut chain: Vec<String> = segs.into_iter().map(|s| s.to_string()).collect();
                    chain.push(field_name.to_string());
                    return self.query_dwarf_for_chain_access(&chain);
                }
            }
            // fall through to legacy variable-only behavior
        }
        // Support simple variable base and fall back to global/static lowering
        if let crate::script::Expr::Variable(base_name) = obj_expr {
            let Some(analyzer_ptr) = self.process_analyzer else {
                return Err(CodeGenError::DwarfError(
                    "No DWARF analyzer available".to_string(),
                ));
            };
            let analyzer = unsafe { &mut *analyzer_ptr };
            let ctx = self.get_compile_time_context()?;
            let module_address = ghostscope_dwarf::ModuleAddress::new(
                std::path::PathBuf::from(ctx.module_path.clone()),
                ctx.pc_address,
            );
            // Try current module at PC first
            match analyzer.plan_chain_access(&module_address, base_name, &[field_name.to_string()])
            {
                Ok(Some(var)) => return Ok(Some(var)),
                Ok(None) => {}
                Err(e) => {
                    tracing::debug!("member planner miss at current module: {}", e);
                }
            }

            // Strict cross-module chain planning via analyzer API
            match analyzer
                .plan_global_chain_access(
                    &std::path::PathBuf::from(ctx.module_path.clone()),
                    base_name,
                    &[field_name.to_string()],
                )
                .map_err(|e| CodeGenError::DwarfError(e.to_string()))?
            {
                Some((mpath, v)) => {
                    self.current_resolved_var_module_path =
                        Some(mpath.to_string_lossy().to_string());
                    Ok(Some(v))
                }
                None => {
                    // Friendly unknown-member message for globals: try to resolve the base's type
                    // and list available members.
                    // We only attempt this for globals to avoid scanning locals aggressively.
                    let mut matches = analyzer.find_global_variables_by_name(base_name);
                    if !matches.is_empty() {
                        // Prefer current module
                        let preferred: Vec<(
                            std::path::PathBuf,
                            ghostscope_dwarf::core::GlobalVariableInfo,
                        )> = matches
                            .iter()
                            .filter(|(p, _)| p.to_string_lossy() == ctx.module_path.as_str())
                            .cloned()
                            .collect();
                        let chosen = if preferred.len() == 1 {
                            Some(preferred[0].clone())
                        } else if preferred.is_empty() && matches.len() == 1 {
                            Some(matches.remove(0))
                        } else {
                            None
                        };
                        if let Some((mp, info)) = chosen {
                            if let Ok(var) = analyzer.resolve_variable_by_offsets_in_module(
                                &mp,
                                info.unit_offset,
                                info.die_offset,
                            ) {
                                if let Some(ty) = var.dwarf_type.as_ref() {
                                    // Unwrap aliases
                                    let mut t = ty;
                                    loop {
                                        match t {
                                            ghostscope_dwarf::TypeInfo::TypedefType {
                                                underlying_type,
                                                ..
                                            } => t = underlying_type.as_ref(),
                                            ghostscope_dwarf::TypeInfo::QualifiedType {
                                                underlying_type,
                                                ..
                                            } => t = underlying_type.as_ref(),
                                            _ => break,
                                        }
                                    }
                                    let mut kind: Option<&'static str> = None;
                                    let mut member_names: Vec<String> = Vec::new();
                                    match t {
                                        ghostscope_dwarf::TypeInfo::StructType {
                                            members, ..
                                        } => {
                                            kind = Some("struct");
                                            member_names =
                                                members.iter().map(|m| m.name.clone()).collect();
                                        }
                                        ghostscope_dwarf::TypeInfo::UnionType {
                                            members, ..
                                        } => {
                                            kind = Some("union");
                                            member_names =
                                                members.iter().map(|m| m.name.clone()).collect();
                                        }
                                        _ => {}
                                    }
                                    if let Some(k) = kind {
                                        // Form friendly message consistent with tests
                                        // Example: Unknown member 'no_such_member' in struct 'G_STATE'. Known members: a, b, c
                                        member_names.sort();
                                        member_names.dedup();
                                        let list = if member_names.is_empty() {
                                            "<none>".to_string()
                                        } else {
                                            member_names.join(", ")
                                        };
                                        let msg = format!(
                                            "Unknown member '{field_name}' in {k} '{base_name}' (known members: {list})"
                                        );
                                        return Err(CodeGenError::TypeError(msg));
                                    }
                                }
                            }
                        }
                    }
                    Ok(None)
                }
            }
        } else {
            Err(CodeGenError::NotImplemented(
                "MemberAccess base must be a simple variable (use chain access)".to_string(),
            ))
        }
    }

    /// Query DWARF for array access (arr[index])
    pub fn query_dwarf_for_array_access(
        &mut self,
        array_expr: &crate::script::Expr,
        index_expr: &crate::script::Expr,
    ) -> Result<Option<VariableWithEvaluation>> {
        // Prefer planner for simple identifier chains like a.b.c as array base to avoid nested member lookups
        if let crate::script::Expr::MemberAccess(_, _) = array_expr {
            // Try to flatten to a chain of identifiers
            fn flatten_chain<'a>(e: &'a crate::script::Expr, out: &mut Vec<&'a str>) -> bool {
                match e {
                    crate::script::Expr::Variable(name) => {
                        out.push(name.as_str());
                        true
                    }
                    crate::script::Expr::MemberAccess(obj, field) => {
                        if flatten_chain(obj, out) {
                            out.push(field.as_str());
                            true
                        } else {
                            false
                        }
                    }
                    _ => false,
                }
            }
            let mut segs: Vec<&str> = Vec::new();
            if flatten_chain(array_expr, &mut segs) && !segs.is_empty() {
                let Some(analyzer_ptr) = self.process_analyzer else {
                    return Err(CodeGenError::DwarfError(
                        "No DWARF analyzer available".to_string(),
                    ));
                };
                let analyzer = unsafe { &mut *analyzer_ptr };
                let ctx = self.get_compile_time_context()?;
                let module_address = ghostscope_dwarf::ModuleAddress::new(
                    std::path::PathBuf::from(ctx.module_path.clone()),
                    ctx.pc_address,
                );
                let base = segs[0].to_string();
                let rest: Vec<String> = segs[1..].iter().map(|s| s.to_string()).collect();
                if let Ok(Some(var)) = analyzer.plan_chain_access(&module_address, &base, &rest) {
                    // Use planner result as array base
                    let base_var = var;
                    return self.finish_array_access_from_base(base_var, index_expr);
                }
            }
        }

        // Fallback: resolve the base array via generic complex expr path
        let base_var = match self.query_dwarf_for_complex_expr(array_expr)? {
            Some(var) => var,
            None => return Ok(None),
        };

        self.finish_array_access_from_base(base_var, index_expr)
    }

    fn finish_array_access_from_base(
        &mut self,
        base_var: VariableWithEvaluation,
        index_expr: &crate::script::Expr,
    ) -> Result<Option<VariableWithEvaluation>> {
        // Get the array's type
        let array_type = match &base_var.dwarf_type {
            Some(type_info) => type_info,
            None => return Ok(None),
        };

        // Extract element type from array type
        let element_type = match array_type {
            TypeInfo::ArrayType { element_type, .. } => element_type.as_ref().clone(),
            _ => return Ok(None), // Not an array type
        };

        // Calculate element size for address computation
        let element_size = element_type.size();

        // For indexing, create a computed location representing: base + (index * element_size)
        // Only literal integer indices are supported at this stage
        let index_value: i64 = match index_expr {
            crate::script::Expr::Int(v) => *v,
            _ => {
                return Err(CodeGenError::NotImplemented(
                    "Only literal integer array indices are supported (TODO)".to_string(),
                ))
            }
        };
        let element_evaluation_result = match &base_var.evaluation_result {
            EvaluationResult::DirectValue(_) => {
                // If base is a value, we can't do array indexing
                return Ok(None);
            }
            EvaluationResult::MemoryLocation(location) => {
                match location {
                    // Address(base): perform Address arithmetic so ASLR logic applies uniformly
                    LocationResult::Address(addr) => {
                        let offs = (index_value as i128) * (element_size as i128);
                        let new_addr = (*addr as i128).saturating_add(offs);
                        if new_addr < 0 {
                            return Err(CodeGenError::LLVMError(
                                "negative address after indexing".to_string(),
                            ));
                        }
                        EvaluationResult::MemoryLocation(LocationResult::Address(new_addr as u64))
                    }
                    // Register/Computed: build compute steps at runtime
                    _ => {
                        let array_access_steps =
                            self.create_array_access_steps(location, element_size, index_value);
                        EvaluationResult::MemoryLocation(LocationResult::ComputedLocation {
                            steps: array_access_steps,
                        })
                    }
                }
            }
            EvaluationResult::Optimized => {
                return Ok(None);
            }
            EvaluationResult::Composite(_) => {
                // Array access on composite locations is complex, skip for now
                return Ok(None);
            }
        };

        // Build readable element name: base_name[index]
        let elem_name = format!("{}[{}]", base_var.name, index_value);
        let element_var = VariableWithEvaluation {
            name: elem_name,
            type_name: Self::type_info_to_name(&element_type),
            dwarf_type: Some(element_type),
            evaluation_result: element_evaluation_result,
            scope_depth: base_var.scope_depth,
            is_parameter: false,
            is_artificial: false,
        };

        Ok(Some(element_var))
    }

    /// Query DWARF for chain access (person.name.first)
    pub fn query_dwarf_for_chain_access(
        &mut self,
        chain: &[String],
    ) -> Result<Option<VariableWithEvaluation>> {
        if chain.is_empty() {
            return Ok(None);
        }
        // If chain has only one element, treat it as a simple variable and reuse variable lookup.
        if chain.len() == 1 {
            return self.query_dwarf_for_variable(&chain[0]);
        }
        // Planner path only; do not fallback. If planning fails, surface an error.
        let Some(analyzer_ptr) = self.process_analyzer else {
            return Err(CodeGenError::DwarfError(
                "No DWARF analyzer available".to_string(),
            ));
        };
        let analyzer = unsafe { &mut *analyzer_ptr };
        let ctx = self.get_compile_time_context()?;
        // First attempt: current module at current PC (locals/params)
        let module_address = ghostscope_dwarf::ModuleAddress::new(
            std::path::PathBuf::from(ctx.module_path.clone()),
            ctx.pc_address,
        );
        match analyzer.plan_chain_access(&module_address, &chain[0], &chain[1..]) {
            Ok(Some(var)) => return Ok(Some(var)),
            Ok(None) => {}
            Err(e) => {
                // Treat planner errors as a miss and continue to global fallback
                tracing::debug!("chain planner miss at current module: {}", e);
            }
        }

        let base = &chain[0];
        let rest = &chain[1..];
        match analyzer
            .plan_global_chain_access(
                &std::path::PathBuf::from(ctx.module_path.clone()),
                base,
                rest,
            )
            .map_err(|e| CodeGenError::DwarfError(e.to_string()))?
        {
            Some((mpath, v)) => {
                self.current_resolved_var_module_path = Some(mpath.to_string_lossy().to_string());
                Ok(Some(v))
            }
            None => {
                // Friendly message for unknown member on global in simple two-segment chains
                if chain.len() == 2 {
                    let field_name = &chain[1];
                    let mut matches = analyzer.find_global_variables_by_name(base);
                    if !matches.is_empty() {
                        let preferred: Vec<(
                            std::path::PathBuf,
                            ghostscope_dwarf::core::GlobalVariableInfo,
                        )> = matches
                            .iter()
                            .filter(|(p, _)| p.to_string_lossy() == ctx.module_path.as_str())
                            .cloned()
                            .collect();
                        let chosen = if preferred.len() == 1 {
                            Some(preferred[0].clone())
                        } else if preferred.is_empty() && matches.len() == 1 {
                            Some(matches.remove(0))
                        } else {
                            None
                        };
                        if let Some((mp, info)) = chosen {
                            if let Ok(var) = analyzer.resolve_variable_by_offsets_in_module(
                                &mp,
                                info.unit_offset,
                                info.die_offset,
                            ) {
                                if let Some(ty) = var.dwarf_type.as_ref() {
                                    // Unwrap typedef/qualified
                                    let mut t = ty;
                                    loop {
                                        match t {
                                            ghostscope_dwarf::TypeInfo::TypedefType {
                                                underlying_type,
                                                ..
                                            } => t = underlying_type.as_ref(),
                                            ghostscope_dwarf::TypeInfo::QualifiedType {
                                                underlying_type,
                                                ..
                                            } => t = underlying_type.as_ref(),
                                            _ => break,
                                        }
                                    }
                                    let mut kind: Option<&'static str> = None;
                                    let mut member_names: Vec<String> = Vec::new();
                                    match t {
                                        ghostscope_dwarf::TypeInfo::StructType {
                                            members, ..
                                        } => {
                                            kind = Some("struct");
                                            member_names =
                                                members.iter().map(|m| m.name.clone()).collect();
                                        }
                                        ghostscope_dwarf::TypeInfo::UnionType {
                                            members, ..
                                        } => {
                                            kind = Some("union");
                                            member_names =
                                                members.iter().map(|m| m.name.clone()).collect();
                                        }
                                        _ => {}
                                    }
                                    if let Some(k) = kind {
                                        member_names.sort();
                                        member_names.dedup();
                                        let list = if member_names.is_empty() {
                                            "<none>".to_string()
                                        } else {
                                            member_names.join(", ")
                                        };
                                        let msg = format!(
                                            "Unknown member '{field_name}' in {k} '{base}' (known members: {list})"
                                        );
                                        return Err(CodeGenError::TypeError(msg));
                                    }
                                }
                            }
                        }
                    }
                }
                Ok(None)
            }
        }
        // unreachable
    }

    /// Query DWARF for pointer dereference (*ptr)
    pub fn query_dwarf_for_pointer_deref(
        &mut self,
        expr: &crate::script::Expr,
    ) -> Result<Option<VariableWithEvaluation>> {
        // First, resolve the pointer expression
        let ptr_var = match self.query_dwarf_for_complex_expr(expr)? {
            Some(var) => var,
            None => return Ok(None),
        };

        // Get the pointer's type
        let ptr_type = match &ptr_var.dwarf_type {
            Some(type_info) => type_info,
            None => return Ok(None),
        };

        // Extract pointed-to type from pointer type
        let mut pointed_type = match ptr_type {
            TypeInfo::PointerType { target_type, .. } => target_type.as_ref().clone(),
            _ => return Ok(None), // Not a pointer type
        };

        // Upgrade UnknownType(target_name) using analyzer/type index to get a shallow type.
        // 1) Struct/union/class/enum: try analyzer shallow lookup by name (module-scoped first)
        // 2) Do not guess builtin type sizes — rely only on DWARF base type entries
        if let TypeInfo::UnknownType { name } = &pointed_type {
            let mut candidate_names: Vec<String> = Vec::new();
            if !name.is_empty() && name != "void" {
                candidate_names.push(name.clone());
            }
            // Fallback: derive from pointer variable's pretty type name, e.g., "GlobalState*" => "GlobalState"
            if candidate_names.is_empty() {
                let tn = ptr_var.type_name.trim().to_string();
                if let Some(idx) = tn.find('*') {
                    let mut base = tn[..idx].trim().to_string();
                    // Strip common qualifiers and tags
                    for prefix in [
                        "const ",
                        "volatile ",
                        "restrict ",
                        "struct ",
                        "class ",
                        "union ",
                    ] {
                        if base.starts_with(prefix) {
                            base = base[prefix.len()..].trim().to_string();
                        }
                    }
                    if !base.is_empty() && base != "void" {
                        candidate_names.push(base);
                    }
                }
            }
            if let Some(analyzer_ptr) = self.process_analyzer {
                let analyzer = unsafe { &mut *analyzer_ptr };
                let ctx = self.get_compile_time_context()?;
                let mut alias_used: Option<String> = None;
                for n in candidate_names {
                    // Prefer cross-module definitions first to avoid forward decls with size=0 in current CU
                    let mut upgraded: Option<TypeInfo> = None;
                    // struct/class
                    if let Some(ti) = analyzer.resolve_struct_type_shallow_by_name(&n) {
                        if ti.size() > 0 {
                            upgraded = Some(ti);
                        }
                    }
                    if upgraded.is_none() {
                        if let Some(ti) = analyzer
                            .resolve_struct_type_shallow_by_name_in_module(&ctx.module_path, &n)
                        {
                            if ti.size() > 0 {
                                upgraded = Some(ti);
                            }
                        }
                    }
                    // union
                    if upgraded.is_none() {
                        if let Some(ti) = analyzer.resolve_union_type_shallow_by_name(&n) {
                            if ti.size() > 0 {
                                upgraded = Some(ti);
                            }
                        }
                    }
                    if upgraded.is_none() {
                        if let Some(ti) = analyzer
                            .resolve_union_type_shallow_by_name_in_module(&ctx.module_path, &n)
                        {
                            if ti.size() > 0 {
                                upgraded = Some(ti);
                            }
                        }
                    }
                    // enum
                    if upgraded.is_none() {
                        if let Some(ti) = analyzer.resolve_enum_type_shallow_by_name(&n) {
                            if ti.size() > 0 {
                                upgraded = Some(ti);
                            }
                        }
                    }
                    if upgraded.is_none() {
                        if let Some(ti) = analyzer
                            .resolve_enum_type_shallow_by_name_in_module(&ctx.module_path, &n)
                        {
                            if ti.size() > 0 {
                                upgraded = Some(ti);
                            }
                        }
                    }
                    if let Some(ti) = upgraded {
                        pointed_type = ti;
                        alias_used = Some(n.clone());
                        break;
                    }
                }

                // If we upgraded to an aggregate and have an alias name, wrap it as a typedef
                if let Some(alias) = alias_used {
                    match &pointed_type {
                        TypeInfo::StructType { .. }
                        | TypeInfo::UnionType { .. }
                        | TypeInfo::EnumType { .. } => {
                            pointed_type = TypeInfo::TypedefType {
                                name: alias,
                                underlying_type: Box::new(pointed_type.clone()),
                            };
                        }
                        _ => {}
                    }
                }
            }
        }

        // Create dereferenced variable
        let deref_var = VariableWithEvaluation {
            name: format!("*{}", Self::expr_to_string(expr)),
            type_name: Self::type_info_to_name(&pointed_type),
            dwarf_type: Some(pointed_type),
            evaluation_result: self.compute_pointer_dereference(&ptr_var.evaluation_result)?,
            scope_depth: ptr_var.scope_depth,
            is_parameter: false,
            is_artificial: false,
        };

        Ok(Some(deref_var))
    }

    /// Helper: Compute pointer dereference
    fn compute_pointer_dereference(
        &self,
        ptr_result: &EvaluationResult,
    ) -> Result<EvaluationResult> {
        use ghostscope_dwarf::{ComputeStep, LocationResult, MemoryAccessSize};

        match ptr_result {
            // If the pointer is a memory location, we need to read that location first,
            // then use the result as an address for another read
            EvaluationResult::MemoryLocation(location) => {
                let steps = [
                    self.location_to_compute_steps(location),
                    // Then dereference the pointer (read from the computed address)
                    vec![ComputeStep::Dereference {
                        size: MemoryAccessSize::U64,
                    }],
                ]
                .concat();

                Ok(EvaluationResult::MemoryLocation(
                    LocationResult::ComputedLocation { steps },
                ))
            }
            // If the pointer value is held directly (common for function parameters)
            // interpret the value as an address to the pointed-to object.
            EvaluationResult::DirectValue(dv) => {
                use ghostscope_dwarf::DirectValueResult as DV;
                match dv {
                    DV::RegisterValue(reg) => Ok(EvaluationResult::MemoryLocation(
                        LocationResult::RegisterAddress {
                            register: *reg,
                            offset: None,
                            size: None,
                        },
                    )),
                    DV::Constant(val) => Ok(EvaluationResult::MemoryLocation(
                        LocationResult::Address(*val as u64),
                    )),
                    DV::ImplicitValue(bytes) => {
                        // Assemble up to 8 bytes little-endian into u64
                        let mut v: u64 = 0;
                        for (i, b) in bytes.iter().take(8).enumerate() {
                            v |= (*b as u64) << (8 * i);
                        }
                        Ok(EvaluationResult::MemoryLocation(LocationResult::Address(v)))
                    }
                    DV::ComputedValue { steps, .. } => Ok(EvaluationResult::MemoryLocation(
                        LocationResult::ComputedLocation {
                            steps: steps.clone(),
                        },
                    )),
                }
            }
            _ => Err(CodeGenError::NotImplemented(
                "Unsupported pointer dereference scenario".to_string(),
            )),
        }
    }

    /// Helper: Convert location to compute steps
    fn location_to_compute_steps(&self, location: &LocationResult) -> Vec<ComputeStep> {
        use ghostscope_dwarf::{ComputeStep, LocationResult};

        match location {
            LocationResult::Address(addr) => {
                vec![ComputeStep::PushConstant(*addr as i64)]
            }
            LocationResult::RegisterAddress {
                register, offset, ..
            } => {
                let mut steps = vec![ComputeStep::LoadRegister(*register)];
                if let Some(offset) = offset {
                    steps.push(ComputeStep::PushConstant(*offset));
                    steps.push(ComputeStep::Add);
                }
                steps
            }
            LocationResult::ComputedLocation { steps } => steps.clone(),
        }
    }

    /// Helper: Convert expression to string for debugging
    fn expr_to_string(expr: &crate::script::Expr) -> String {
        use crate::script::Expr;

        match expr {
            Expr::Variable(name) => name.clone(),
            Expr::MemberAccess(obj, field) => format!("{}.{}", Self::expr_to_string(obj), field),
            Expr::ArrayAccess(arr, _) => format!("{}[index]", Self::expr_to_string(arr)),
            Expr::ChainAccess(chain) => chain.join("."),
            Expr::PointerDeref(expr) => format!("*{}", Self::expr_to_string(expr)),
            _ => "expr".to_string(),
        }
    }

    /// Helper: Extract readable name from TypeInfo
    fn type_info_to_name(type_info: &TypeInfo) -> String {
        match type_info {
            TypeInfo::BaseType { name, .. } => name.clone(),
            TypeInfo::PointerType { target_type, .. } => {
                format!("{}*", Self::type_info_to_name(target_type))
            }
            TypeInfo::ArrayType {
                element_type,
                element_count,
                ..
            } => {
                if let Some(count) = element_count {
                    format!("{}[{}]", Self::type_info_to_name(element_type), count)
                } else {
                    format!("{}[]", Self::type_info_to_name(element_type))
                }
            }
            TypeInfo::StructType { name, .. } => format!("struct {name}"),
            TypeInfo::UnionType { name, .. } => format!("union {name}"),
            TypeInfo::EnumType { name, .. } => format!("enum {name}"),
            TypeInfo::BitfieldType {
                underlying_type,
                bit_offset,
                bit_size,
            } => {
                format!(
                    "bitfield<{}:{}> {}",
                    bit_offset,
                    bit_size,
                    Self::type_info_to_name(underlying_type)
                )
            }
            TypeInfo::TypedefType { name, .. } => name.clone(),
            TypeInfo::QualifiedType {
                underlying_type, ..
            } => Self::type_info_to_name(underlying_type),
            TypeInfo::FunctionType { .. } => "function".to_string(),
            TypeInfo::UnknownType { name } => name.clone(),
            TypeInfo::OptimizedOut { name } => format!("<optimized_out> {name}"),
        }
    }

    /// Create computation steps for array access: base_address + (index * element_size)
    fn create_array_access_steps(
        &self,
        base_location: &LocationResult,
        element_size: u64,
        index: i64,
    ) -> Vec<ComputeStep> {
        let mut steps = Vec::new();

        // First, get the base address computation steps
        match base_location {
            LocationResult::Address(addr) => {
                steps.push(ComputeStep::PushConstant(*addr as i64));
            }
            LocationResult::RegisterAddress {
                register, offset, ..
            } => {
                steps.push(ComputeStep::LoadRegister(*register));
                if let Some(offset) = offset {
                    if *offset != 0 {
                        steps.push(ComputeStep::PushConstant(*offset));
                        steps.push(ComputeStep::Add);
                    }
                }
            }
            LocationResult::ComputedLocation { steps: base_steps } => {
                steps.extend(base_steps.clone());
            }
        }

        // Now add array indexing computation: current_address + (index * element_size)
        steps.push(ComputeStep::PushConstant(index)); // literal index
        steps.push(ComputeStep::PushConstant(element_size as i64)); // element_size
        steps.push(ComputeStep::Mul); // index * element_size
        steps.push(ComputeStep::Add); // base_address + (index * element_size)

        steps
    }

    /// Compute a typed pointed-to location for expressions like `ptr +/- K` where K is an element index.
    /// Returns a computed location EvaluationResult along with the pointed-to DWARF type.
    /// The offset is scaled by the element size of the pointer/array target type.
    pub fn compute_pointed_location_with_index(
        &mut self,
        ptr_expr: &crate::script::Expr,
        index: i64,
    ) -> Result<(EvaluationResult, TypeInfo)> {
        use ghostscope_dwarf::{
            ComputeStep, EvaluationResult as ER, LocationResult as LR, TypeInfo,
        };

        // Resolve the pointer expression via DWARF
        let ptr_var = self
            .query_dwarf_for_complex_expr(ptr_expr)?
            .ok_or_else(|| CodeGenError::VariableNotFound(format!("{ptr_expr:?}")))?;

        let ptr_ty = ptr_var.dwarf_type.as_ref().ok_or_else(|| {
            CodeGenError::DwarfError("Expression has no DWARF type information".to_string())
        })?;

        // Unwrap typedef/qualified wrappers
        let mut ty = ptr_ty;
        loop {
            match ty {
                TypeInfo::TypedefType {
                    underlying_type, ..
                } => ty = underlying_type.as_ref(),
                TypeInfo::QualifiedType {
                    underlying_type, ..
                } => ty = underlying_type.as_ref(),
                _ => break,
            }
        }

        // Extract pointed-to (element) type and element size
        let (elem_ty, elem_size) = match ty {
            TypeInfo::PointerType { target_type, .. } => {
                let et = target_type.as_ref().clone();
                let es = et.size();
                let es = if es == 0 { 1 } else { es };
                (et, es)
            }
            TypeInfo::ArrayType { element_type, .. } => {
                let et = element_type.as_ref().clone();
                let es = et.size();
                let es = if es == 0 { 1 } else { es };
                (et, es)
            }
            TypeInfo::FunctionType { .. } => {
                return Err(CodeGenError::TypeError(
                    "Pointer arithmetic is not supported on function pointers".to_string(),
                ))
            }
            _ => {
                return Err(CodeGenError::TypeError(
                    "Pointer arithmetic requires a pointer or array expression".to_string(),
                ))
            }
        };

        // First compute the base pointed-to location for `*ptr_expr`
        let base_loc_eval = self.compute_pointer_dereference(&ptr_var.evaluation_result)?;
        let base_loc = match &base_loc_eval {
            ER::MemoryLocation(loc) => loc,
            _ => {
                return Err(CodeGenError::DwarfError(
                    "Failed to compute base location for pointer arithmetic".to_string(),
                ))
            }
        };

        // Build compute steps: base_address + index * elem_size
        let steps = {
            let mut s = self.location_to_compute_steps(base_loc);
            // scale index by element size (can be negative)
            s.push(ComputeStep::PushConstant(index));
            s.push(ComputeStep::PushConstant(elem_size as i64));
            s.push(ComputeStep::Mul);
            s.push(ComputeStep::Add);
            s
        };

        Ok((ER::MemoryLocation(LR::ComputedLocation { steps }), elem_ty))
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use inkwell::context::Context as LlvmContext;

    #[test]
    fn aggregate_address_returns_pointer_for_struct_and_array() {
        let llctx = LlvmContext::create();
        let opts = crate::CompileOptions::default();
        let mut ctx = EbpfContext::new(&llctx, "agg_ptr", Some(0), &opts).expect("ctx");
        // Ensure we have a function/pt_regs to satisfy builders
        ctx.create_basic_ebpf_function("f").expect("fn");
        // Ensure the ASLR offsets map exists in the module for unified codegen path
        ctx.__test_ensure_proc_offsets_map().expect("map");
        // Allocate per-invocation pm_key on the stack
        ctx.__test_alloc_pm_key().expect("pm_key");
        // Provide a minimal compile-time context so address rebasing has a module path
        ctx.set_compile_time_context(0, "/nonexistent/module".to_string());

        // Struct type
        let st = ghostscope_protocol::TypeInfo::StructType {
            name: "S".to_string(),
            size: 80,
            members: vec![],
        };
        let eval = EvaluationResult::MemoryLocation(LocationResult::Address(0x1000));
        let v = ctx
            .evaluate_result_to_llvm_value(&eval, &st, "S", 0)
            .expect("eval");
        match v {
            BasicValueEnum::PointerValue(_) => {}
            other => panic!("expected PointerValue for struct, got {other:?}"),
        }

        // Array type
        let arr = ghostscope_protocol::TypeInfo::ArrayType {
            element_type: Box::new(ghostscope_protocol::TypeInfo::BaseType {
                name: "int".to_string(),
                size: 4,
                encoding: ghostscope_dwarf::constants::DW_ATE_signed.0 as u16,
            }),
            element_count: Some(4),
            total_size: Some(16),
        };
        let v2 = ctx
            .evaluate_result_to_llvm_value(&eval, &arr, "A", 0)
            .expect("eval2");
        match v2 {
            BasicValueEnum::PointerValue(_) => {}
            other => panic!("expected PointerValue for array, got {other:?}"),
        }
    }

    #[test]
    fn scalar_address_reads_value() {
        let llctx = LlvmContext::create();
        let opts = crate::CompileOptions::default();
        let mut ctx = EbpfContext::new(&llctx, "scalar_val", Some(0), &opts).expect("ctx");
        ctx.create_basic_ebpf_function("f").expect("fn");
        // Ensure the ASLR offsets map exists in the module for unified codegen path
        ctx.__test_ensure_proc_offsets_map().expect("map");
        // Allocate per-invocation pm_key on the stack
        ctx.__test_alloc_pm_key().expect("pm_key");
        // Provide a minimal compile-time context so address rebasing has a module path
        ctx.set_compile_time_context(0, "/nonexistent/module".to_string());

        // Base int type
        let bt = ghostscope_protocol::TypeInfo::BaseType {
            name: "int".to_string(),
            size: 4,
            encoding: ghostscope_dwarf::constants::DW_ATE_signed.0 as u16,
        };
        let eval = EvaluationResult::MemoryLocation(LocationResult::Address(0x2000));
        let v = ctx
            .evaluate_result_to_llvm_value(&eval, &bt, "x", 0)
            .expect("eval");
        match v {
            BasicValueEnum::IntValue(_) => {}
            other => panic!("expected IntValue for scalar, got {other:?}"),
        }
    }
}