jdc_core/

convert.rs

//! Region tree → Stmt tree conversion.
//!
//! Responsibilities:
//! * weave in per-block statements and terminals (return/throw),
//! * resolve `Goto{target}` nodes against the enclosing loop/switch scope
//!   stack into `break` / `continue` / labeled goto,
//! * classify loops into while / do-while / infinite forms,
//! * assemble try/catch with exception parameter variables.

use crate::fx::{FxHashMap as HashMap, FxHashSet as HashSet};

use crate::cfg::Cfg;
use crate::ir::build::{BlockResult, Term};
use crate::ir::expr::{BinOp, ConstVal, Expr, UnOp};
use crate::ir::stmt::{Catch, Stmt};
use crate::structure::Region;

/// A named Java statement for `break`/`continue` targets.
#[derive(Debug)]
pub enum Jump {
    Break(Option<String>),
    Continue(Option<String>),
    /// Continue of the loop at the given depth-from-innermost, prefixed by
    /// an emission of the target block's own statements (the jump re-runs
    /// a shared statement-bearing tail that flows back into the header;
    /// a bare Continue would skip those statements).
    ContinueVia(usize, Option<String>),
    /// Unstructured: emit `label:` + goto as comments (best effort).
    RawGoto(usize),
}

#[derive(Debug)]
struct LoopCtx {
    header: usize,
    exits: HashSet<usize>,
    label: String,
}

#[derive(Debug)]
struct SwitchCtx {
    follow: Option<usize>,
    label: String,
    /// Loop-stack depth when the switch was entered: a `break` from a case
    /// body only needs a label when the jump sits inside a loop that was
    /// opened WITHIN the switch (an enclosing loop does not intercept it).
    loops_depth: usize,
}

pub struct Converter<'a> {
    pub cfg: &'a Cfg,
    pub results: &'a Vec<BlockResult>,
    pub groups: std::borrow::Cow<'a, [crate::structure::TryGroup]>,
    /// Dominators over the full method graph (for goto fallback decisions).
    pub dom: std::borrow::Cow<'a, crate::structure::DomInfo>,
    /// Block whose statements are currently being converted (for postdom
    /// checks in goto resolution).
    cur_block: usize,
    loops: Vec<LoopCtx>,
    switches: Vec<SwitchCtx>,
    /// Labels actually referenced by break/continue statements.
    used_labels: HashSet<String>,
    /// Follow block of each enclosing If region; a goto to the innermost
    /// follow is natural structured flow and disappears.
    if_follows: Vec<usize>,
    label_counter: usize,
    /// True while converting the last element of a Seq (a trailing Goto
    /// there may be inlined as a copy instead of an unemittable jump).
    goto_is_last: bool,
    /// The block whose emission IMMEDIATELY follows the current position:
    /// the innermost enclosing If's follow while converting its arms, or
    /// the next Seq sibling's head. A RawGoto may elide to fallthrough
    /// ONLY when its target is this block — the old stack-wide
    /// `if_follows.contains` check elided jumps to OUTER follows whose
    /// emission was separated by intervening follow/copy emissions
    /// (jdk17 DatagramChannelImpl.receive: the b15 fall arm's Goto{SET}
    /// elided into cur=14's follow emission, skipping
    /// `sender = sourceSocketAddress()` on the n==0&&isOpen path;
    /// sun.net.www.protocol.http HttpURLConnection.getInputStream0: the
    /// clone arms' Goto{addToCache} fell into the post-loop tail — the
    /// documented addToCache-skip residual).
    expect_next: std::cell::Cell<Option<usize>>,
    /// Set while converting a Seq element that DIRECTLY follows a
    /// CopyStmts of that same block: the back-edge-stub pattern
    /// [CopyStmts{b}, Goto{b}] already emitted b's statements, so the
    /// Goto must not inline them again (jdk11 HttpURLConnection
    /// getInputStream0: the clone tail rendered the clone/removeFromCache
    /// block twice — the second removeFromCache removed the just-cloned
    /// entry from the auth cache; a header-adjacent b would also make
    /// ContinueVia re-emit b's statements after the copy).
    prev_copy: std::cell::Cell<Option<usize>>,
    /// Heads of copy-walked shared tails (from the structurer).
    copied_tails: HashSet<usize>,
    /// Collected label emissions: block target -> label name (for `Label` stmts).
    pub pending_labels: HashMap<usize, String>,
    /// Names of FINAL fields of the class being decompiled. A shared
    /// terminator block whose statements write one of them must never be
    /// inlined/copied at extra arrival sites: javac rejects a second
    /// assignment to a final field (sun.security.util.Debug `hexDigits`).
    final_fields: HashSet<String>,
}

/// Remove a trailing `Goto` whose target is the natural continuation.
fn stmt_has_throw(s: &Stmt) -> bool {
    match s {
        Stmt::Throw(_) => true,
        Stmt::Block(v) => v.iter().any(stmt_has_throw),
        _ => false,
    }
}

fn strip_trailing_goto(s: &mut Stmt, follow: Option<usize>) {
    let Some(f) = follow else { return };
    let items = match s {
        Stmt::Block(v) => v,
        Stmt::Goto(t) if *t as usize == f => {
            *s = Stmt::Block(vec![]);
            return;
        }
        _ => return,
    };
    // Single descent, no iteration: every arm either strips or stops
    // (clippy::never_loop was right — this was a while-let in name
    // only; `if let` states the actual control flow).
    if let Some(last) = items.last_mut() {
        match last {
            Stmt::Goto(t) if *t as usize == f => {
                items.pop();
            }
            Stmt::Block(inner) if !inner.is_empty() => {
                // descend into the trailing block one level
                let n = inner.len();
                if matches!(inner[n - 1], Stmt::Goto(t) if t as usize == f) {
                    inner.pop();
                }
            }
            _ => {}
        }
    }
}

impl<'a> Converter<'a> {
    pub fn with_copied_tails(mut self, tails: HashSet<usize>) -> Self {
        self.copied_tails = tails;
        self
    }

    pub fn with_final_fields(mut self, finals: HashSet<String>) -> Self {
        self.final_fields = finals;
        self
    }

    /// True when any statement assigns a final field of this class.
    fn stmts_write_final(&self, v: &[Stmt]) -> bool {
        v.iter().any(|s| match s {
            Stmt::ExprStmt(Expr::Assign { target, .. }) => {
                matches!(&**target, Expr::Field { name, .. } if self.final_fields.contains(name.as_ref()))
            }
            _ => false,
        })
    }

    /// Chain-aware twin of stmts_write_final for a tail HEAD: walks the
    /// linear single-succ Fall/Goto chain (bounded) so a blank-final write
    /// PAST the head still rejects the inline term-copy (URICertStore
    /// clinit's two-field tail; mirrors structure's
    /// terminator_writes_final chain probe).
    fn tail_chain_writes_final(&self, t: usize) -> bool {
        if self.final_fields.is_empty() {
            return false;
        }
        let mut x = t;
        let mut seen: HashSet<usize> = HashSet::default();
        for _ in 0..8 {
            if !seen.insert(x) {
                return false;
            }
            if self.stmts_write_final(&self.results[x].stmts) {
                return true;
            }
            if !matches!(self.results[x].term, Term::Fallthrough | Term::Goto) {
                return false;
            }
            let succs = &self.cfg.blocks[x].succ;
            if succs.len() != 1 {
                return false;
            }
            x = succs[0];
        }
        false
    }

    pub fn new(cfg: &'a Cfg, results: &'a Vec<BlockResult>) -> Self {
        let universe: HashSet<usize> = (0..cfg.blocks.len()).collect();
        let dom = crate::structure::compute_dominators(cfg, &universe, cfg.entry);
        let groups = crate::structure::group_exceptions_with(cfg, Some(results));
        Self::from_parts(
            cfg,
            results,
            std::borrow::Cow::Owned(groups),
            std::borrow::Cow::Owned(dom),
        )
    }

    /// `new` with the group set and dominator tree precomputed and shared
    /// with the Structurer (see `Structurer::with_precomputed_groups`).
    pub fn with_precomputed(
        cfg: &'a Cfg,
        results: &'a Vec<BlockResult>,
        groups: Vec<crate::structure::TryGroup>,
        dom: crate::structure::DomInfo,
    ) -> Self {
        Self::from_parts(
            cfg,
            results,
            std::borrow::Cow::Owned(groups),
            std::borrow::Cow::Owned(dom),
        )
    }

    /// `with_precomputed` borrowing the shared groups/dominators instead
    /// of taking clones: ddc computes both once per method and feeds the
    /// SAME data to the Structurer and (per retry) the Converter — three
    /// deep clones (groups twice, idom vec once) per method vanished.
    pub fn with_precomputed_ref(
        cfg: &'a Cfg,
        results: &'a Vec<BlockResult>,
        groups: &'a [crate::structure::TryGroup],
        dom: &'a crate::structure::DomInfo,
    ) -> Self {
        Self::from_parts(
            cfg,
            results,
            std::borrow::Cow::Borrowed(groups),
            std::borrow::Cow::Borrowed(dom),
        )
    }

    fn from_parts(
        cfg: &'a Cfg,
        results: &'a Vec<BlockResult>,
        groups: std::borrow::Cow<'a, [crate::structure::TryGroup]>,
        dom: std::borrow::Cow<'a, crate::structure::DomInfo>,
    ) -> Self {
        Converter {
            cfg,
            results,
            groups,
            dom,
            cur_block: usize::MAX,
            loops: Vec::new(),
            switches: Vec::new(),
            if_follows: Vec::new(),
            used_labels: HashSet::default(),
            label_counter: 0,
            goto_is_last: false,
            expect_next: std::cell::Cell::new(None),
            prev_copy: std::cell::Cell::new(None),
            copied_tails: HashSet::default(),
            pending_labels: HashMap::default(),
            final_fields: HashSet::default(),
        }
    }

    fn next_label(&mut self) -> String {
        self.label_counter += 1;
        format!("L{}", self.label_counter)
    }

    fn groups_end(&self, gi: usize) -> Option<u32> {
        self.groups.get(gi).map(|g| g.end)
    }

    pub fn convert(&mut self, r: Region) -> Stmt {
        let mut st = self.conv(r);
        prune_unused_labels(&mut st, &self.used_labels);
        st
    }

    fn conv(&mut self, r: Region) -> Stmt {
        match r {
            Region::Empty => Stmt::Block(vec![]),
            Region::Basic { block } => {
                self.cur_block = block;
                if crate::dbg_flag!("JCDC_DBG_BLOCKS") {
                    eprintln!(
                        "conv Basic {} ({} stmts)",
                        block,
                        self.results[block].stmts.len()
                    );
                }
                self.block_stmts(block)
            }
            Region::CopyStmts { block } => {
                // Copies include the block's terminator when it is a
                // return/throw (shared terminator blocks are inlined at
                // every arrival site).
                let mut v = self.results[block].stmts.clone();
                match &self.results[block].term {
                    Term::Return(e) => v.push(Stmt::Return(e.clone())),
                    Term::Throw(e) => v.push(Stmt::Throw(e.clone())),
                    _ => {}
                }
                if v.len() == 1 {
                    v.into_iter().next().unwrap()
                } else {
                    Stmt::Block(v)
                }
            }
            Region::Seq(v) => {
                let mut out = Vec::new();
                let n = v.len();
                let heads: Vec<usize> = v.iter().map(crate::structure::region_head_block).collect();
                let prev_copies: Vec<Option<usize>> = (0..n)
                    .map(|k| {
                        if k > 0 {
                            match &v[k - 1] {
                                Region::CopyStmts { block } => Some(*block),
                                _ => None,
                            }
                        } else {
                            None
                        }
                    })
                    .collect();
                for (k, x) in v.into_iter().enumerate() {
                    let save = self.goto_is_last;
                    self.goto_is_last = k + 1 == n;
                    let save_pc = self.prev_copy.get();
                    self.prev_copy.set(prev_copies[k]);
                    let save_exp = self.expect_next.get();
                    // Only override when the next emission is KNOWN: a
                    // headless tail (Goto/Empty — a jump out) must keep
                    // the inherited expectation, or a nested arm's Goto
                    // would elide against a phantom (jdk17 dci: Basic17's
                    // MAX head erased the follow expectation and Goto{16}
                    // elided past the SET).
                    if k + 1 < n && heads[k + 1] != usize::MAX {
                        self.expect_next.set(Some(heads[k + 1]));
                    }
                    out.push(self.conv(x));
                    self.expect_next.set(save_exp);
                    self.prev_copy.set(save_pc);
                    self.goto_is_last = save;
                }
                Stmt::Block(out)
            }
            Region::If {
                block,
                cond,
                then_r,
                else_r,
                follow,
                ternary,
            } => {
                self.cur_block = block;
                let mut head = self.block_stmts_no_term(block);
                if let Some((_tv, _fv)) = ternary {
                    // Pure value diamond: the folded conditional flows into
                    // the merge block's rebuilt input stack; nothing to emit
                    // here (branch blocks are statement-free by definition).
                    let _ = cond;
                } else {
                    if let Some(f) = follow {
                        self.if_follows.push(f);
                    }
                    let save_exp = self.expect_next.get();
                    // follow=None keeps the inherited expectation: the
                    // flow leaving this If's arms continues to whatever
                    // follows the If itself.
                    self.expect_next.set(follow.or(save_exp));
                    let then_stmt = self.conv(*then_r);
                    let else_stmt = self.conv(*else_r);
                    self.expect_next.set(save_exp);
                    if follow.is_some() {
                        self.if_follows.pop();
                    }
                    let if_stmt = Stmt::If {
                        cond,
                        then_stmt: Box::new(then_stmt),
                        else_stmt: if else_stmt.is_empty_block() {
                            None
                        } else {
                            Some(Box::new(else_stmt))
                        },
                    };
                    head.push(if_stmt);
                }
                if head.len() == 1 {
                    head.pop().unwrap()
                } else {
                    Stmt::Block(head)
                }
            }
            Region::Loop {
                header,
                body,
                members,
                exits,
            } => {
                let label = self.next_label();
                self.loops.push(LoopCtx {
                    header,
                    exits: exits.iter().copied().collect(),
                    label: label.clone(),
                });
                let body_stmt = self.conv(*body);
                let ctx = self.loops.pop().unwrap();
                let _ = members;
                let mut st = self.classify_loop(header, body_stmt, ctx);
                if crate::dbg_flag!("JCDC_DBG_LOOP") {
                    let kind = match &st {
                        Stmt::While { .. } => "While".to_string(),
                        Stmt::DoWhile { .. } => "DoWhile".to_string(),
                        Stmt::For { .. } => "For".to_string(),
                        Stmt::Block(b) => format!(
                            "Block{}[{}]",
                            b.len(),
                            b.iter()
                                .map(|x| match x {
                                    Stmt::DoWhile { .. } => "DoWhile",
                                    Stmt::While { .. } => "While",
                                    Stmt::Break(_) => "Break",
                                    Stmt::Return(_) => "Return",
                                    _ => "_",
                                })
                                .collect::<Vec<_>>()
                                .join(",")
                        ),
                        Stmt::Labeled { .. } => "Labeled".to_string(),
                        _ => "Other".to_string(),
                    };
                    eprintln!("CLASSIFY-OUT header={} -> {}", header, kind);
                }
                // ALWAYS wrap; prune_unused_labels (post-convert) strips
                // the wrapper when no break/continue ended up using it.
                // Deciding at region-close missed breaks born in copied
                // regions AFTER the loop popped (results[..].stmts
                // clones / tail copies) — orphan `break L5` with no `L5:`
                // (weixin 未定义的标签 ×687).
                st = Stmt::Labeled {
                    label,
                    body: Box::new(st),
                };
                st
            }
            Region::Switch {
                block,
                selector,
                cases,
                default,
                follow,
            } => {
                self.cur_block = block;
                let sw_label = self.next_label();
                self.switches.push(SwitchCtx {
                    follow,
                    label: sw_label.clone(),
                    loops_depth: self.loops.len(),
                });
                let mut case_groups = Vec::new();
                for (vals, r) in cases {
                    let s = self.conv(r);
                    case_groups.push(crate::ir::stmt::CaseGroup {
                        labels: vals,
                        string_labels: vec![],
                        enum_labels: vec![],
                        raw_labels: vec![],
                        guard: None,
                        body: stmt_to_vec(s),
                    });
                }
                let default_stmt = default.map(|d| Box::new(self.conv(*d)));
                self.switches.pop();
                let mut head = self.block_stmts_no_term(block);
                let mut sw = Stmt::Switch {
                    selector,
                    cases: case_groups,
                    default: default_stmt,
                    on_string: false,
                };
                {
                    sw = Stmt::Labeled {
                        label: sw_label,
                        body: Box::new(sw),
                    };
                }
                head.push(sw);
                if head.len() == 1 {
                    head.pop().unwrap()
                } else {
                    Stmt::Block(head)
                }
            }
            Region::Try {
                group_idx,
                body,
                catches,
            } => {
                let mut body_stmt = self.conv(*body);
                // Natural exits of the try body / handlers jump to the block
                // right after the try span; that is structured fallthrough.
                let gend = self.groups_end(group_idx);
                let try_follow = gend.and_then(|e| self.cfg.block_at(e));
                strip_trailing_goto(&mut body_stmt, try_follow);
                let mut catch_stmts = Vec::new();
                for (tys, _hblock, r) in catches {
                    if crate::dbg_flag!("JCDC_DBG_CATCH") {
                        let succs = &self.cfg.blocks[_hblock].succ;
                        let succ_terms: Vec<_> = succs
                            .iter()
                            .map(|&s| (s, self.results[s].term.clone()))
                            .collect();
                        eprintln!(
                            "[catch] gi={} hb={} term={:?} succ={:?} tys={:?} region={:#?}",
                            group_idx, _hblock, self.results[_hblock].term, succ_terms, tys, r
                        );
                    }
                    let mut s = self.conv(*r);
                    if crate::dbg_flag!("JCDC_DBG_CATCH") {
                        eprintln!("[catch] conv'd has_throw={}", stmt_has_throw(&s));
                    }
                    strip_trailing_goto(&mut s, try_follow);
                    catch_stmts.push(Catch {
                        exc: tys,
                        var: u32::MAX, // assigned by the method pipeline (handler store)
                        var_name: None,
                        body: Box::new(s),
                    });
                }
                Stmt::Try {
                    body: Box::new(body_stmt),
                    catches: catch_stmts,
                    finally: None,
                }
            }
            Region::Goto { target } => {
                if crate::dbg_flag!("JCDC_DBG_GOTO") {
                    eprintln!(
                        "conv Goto target={} cur_block={} loops={:?} switches={} if_follows={:?}",
                        target,
                        self.cur_block,
                        self.loops
                            .iter()
                            .map(|l| (l.header, l.exits.len()))
                            .collect::<Vec<_>>(),
                        self.switches.len(),
                        self.if_follows
                    );
                }
                // A jump to an enclosing if's follow that TERMINATES
                // (return/throw) can be inlined: the copy ends this path
                // exactly like the jump would, without needing a label.
                // Same for a jump to a LOOP EXIT that heads a pure
                // terminator chain (stmt-bearing fall-through links
                // ending in return/throw): resolve_goto's loop-exit arm
                // would turn it into a bare `break`, silently dropping
                // the chain's statements between the loop end and the
                // shared return (jdk26 Bits.reserveMemory phase-1:
                // `if (interrupted) <goto interrupt-block>; ` rendered
                // as else-break and the Thread.currentThread()
                // .interrupt() vanished — interruption lost). The
                // inlined copy keeps the abrupt ending (no fall-out
                // duplication); a genuine fall-out exit still breaks.
                //
                let inline_terminator = self.if_follows.contains(&target)
                    && matches!(self.results[target].term, Term::Return(_) | Term::Throw(_))
                    && !self.tail_chain_writes_final(target);
                if inline_terminator {
                    // Copy the WHOLE terminator chain: the target's own
                    // statements plus every fall-through link down to
                    // the final return/throw (a single-block chain is
                    // the original if-follow case).
                    let mut v: Vec<Stmt> = Vec::new();
                    let mut t = target;
                    let mut guard = 0;
                    loop {
                        v.extend(self.results[t].stmts.clone());
                        match &self.results[t].term {
                            Term::Return(e) => {
                                v.push(Stmt::Return(e.clone()));
                                break;
                            }
                            Term::Throw(e) => {
                                v.push(Stmt::Throw(e.clone()));
                                break;
                            }
                            Term::Fallthrough | Term::Goto
                                if self.cfg.blocks[t].succ.len() == 1 && guard < 8 =>
                            {
                                t = self.cfg.blocks[t].succ[0];
                                guard += 1;
                            }
                            _ => break,
                        }
                    }
                    return if v.len() == 1 {
                        v.into_iter().next().unwrap()
                    } else {
                        Stmt::Block(v)
                    };
                }
                if let Some(j) = self.resolve_goto(target) {
                    match j {
                        Jump::Break(lbl) => {
                            if let Some(l) = &lbl {
                                self.used_labels.insert(l.clone());
                            }
                            Stmt::Break(lbl)
                        }
                        Jump::Continue(lbl) => {
                            if let Some(l) = &lbl {
                                self.used_labels.insert(l.clone());
                            }
                            Stmt::Continue(lbl)
                        }
                        Jump::ContinueVia(t, lbl) => {
                            if let Some(l) = &lbl {
                                self.used_labels.insert(l.clone());
                            }
                            let mut cv = if self.prev_copy.get() == Some(t) {
                                // Statements already emitted by the
                                // immediately preceding CopyStmts.
                                Vec::new()
                            } else {
                                self.results[t].stmts.clone()
                            };
                            cv.push(Stmt::Continue(lbl));
                            if cv.len() == 1 {
                                cv.into_iter().next().unwrap()
                            } else {
                                Stmt::Block(cv)
                            }
                        }
                        Jump::RawGoto(t) => {
                            if crate::dbg_flag!("JCDC_DBG_GOTO") {
                                eprintln!(
                                    "RAWGOTO t={} copied_tails={:?} if_follows={:?} last={}",
                                    t, self.copied_tails, self.if_follows, self.goto_is_last
                                );
                            }
                            // A Goto region is always the last part of its
                            // walk, so the jump either falls through to the
                            // enclosing merge or must be inlined.
                            let term_copy =
                                matches!(self.results[t].term, Term::Return(_) | Term::Throw(_))
                                    && !self.tail_chain_writes_final(t)
                                    && !self.is_retry_loop_header(t);
                            if term_copy {
                                let mut cv = self.results[t].stmts.clone();
                                match &self.results[t].term {
                                    Term::Return(e) => cv.push(Stmt::Return(e.clone())),
                                    Term::Throw(e) => cv.push(Stmt::Throw(e.clone())),
                                    _ => {}
                                }
                                if cv.len() == 1 {
                                    cv.into_iter().next().unwrap()
                                } else {
                                    Stmt::Block(cv)
                                }
                            } else if self
                                .loops
                                .iter()
                                .any(|l| l.exits.contains(&t) || l.header == t)
                                && (self.goto_is_last || self.if_follows.contains(&t))
                            {
                                // The target is an ENCLOSING LOOP's exit:
                                // inside a loop body, falling out of an if
                                // continues the LOOP — the if-follow
                                // elision would silently drop the jump
                                // (jdk11 ObjectInputStream.readSerialData's
                                // finally-copy retry loop lost its `break`,
                                // the finally's while(true) never completed
                                // normally, and the tail went unreachable —
                                // 无法访问的语句 x2 trees). Materialize the
                                // break (innermost enclosing loop).
                                Stmt::Break(None)
                            } else if !matches!(
                                self.results[t].term,
                                Term::Return(_) | Term::Throw(_)
                            ) && !self.results[t].stmts.is_empty()
                                && !self.copied_tails.contains(&t)
                                && self.prev_copy.get() != Some(t)
                                && self
                                    .expect_next
                                    .get()
                                    .map(|nx| {
                                        // The next emission is a copy that
                                        // STARTS PAST t (at a successor of t
                                        // already in copied_tails): eliding
                                        // would silently skip t's own
                                        // statements, and no emitted copy
                                        // covers them. (sj17 receive:
                                        // Goto{16=SET}, expect=Some(17),
                                        // 17 copied, 16 not.) If t itself is
                                        // in copied_tails, an emitted full
                                        // copy already includes t's stmts —
                                        // inlining would double-emit (w26
                                        // receive: Goto{14}, 14 copied).
                                        let mut x = t;
                                        for _ in 0..8 {
                                            if x == nx {
                                                return x != t;
                                            }
                                            if self.copied_tails.contains(&x) {
                                                return false;
                                            }
                                            match self.cfg.blocks[x].succ.first() {
                                                Some(&n) => x = n,
                                                None => return false,
                                            }
                                        }
                                        false
                                    })
                                    .unwrap_or(false)
                                && (self
                                    .if_follows
                                    .iter()
                                    .any(|f| self.cfg.blocks[t].succ.contains(f)))
                            {
                                // Statement-bearing target FIRST: eliding
                                // (goto_is_last / expect / copy-tail) would
                                // silently skip t's own statements when the
                                // next emission is a copy of t's SUCCESSOR
                                // rather than t itself (jdk17
                                // DatagramChannelImpl.receive: Goto{16=
                                // `sender = sourceSocketAddress()`} elided
                                // via reaches_copy_tail(16->17) into the
                                // arm's Basic(17) copy — the n==0&&isOpen
                                // path returned a null sender). The inline
                                // below emits t's statements and then falls
                                // through to the same continuation.
                                let cv = self.results[t].stmts.clone();
                                if cv.len() == 1 {
                                    cv.into_iter().next().unwrap()
                                } else {
                                    Stmt::Block(cv)
                                }
                            } else if self.goto_is_last
                                || self.expect_next.get() == Some(t)
                                || self.reaches_copy_tail(t)
                            {
                                // Natural fallthrough reaches the same
                                // continuation the jump targeted.
                                Stmt::Block(vec![])
                            } else if !matches!(
                                self.results[t].term,
                                Term::Return(_) | Term::Throw(_)
                            ) && self.prev_copy.get() != Some(t)
                                && (self
                                    .if_follows
                                    .iter()
                                    .any(|f| self.cfg.blocks[t].succ.contains(f)))
                            {
                                // The jump re-enters an already-structured
                                // block whose flow ends at an enclosing
                                // if-follow: inline its statements; the
                                // natural continuation matches the jump's.
                                let cv = self.results[t].stmts.clone();
                                if cv.len() == 1 {
                                    cv.into_iter().next().unwrap()
                                } else {
                                    Stmt::Block(cv)
                                }
                            } else {
                                Stmt::Goto(t as u32)
                            }
                        }
                    }
                } else {
                    Stmt::Block(vec![])
                }
            }
        }
    }

    /// Statements of a block including its terminal (return/throw), but NOT
    /// the structural terminals (cond/switch/goto — handled by regions).
    fn block_stmts(&mut self, block: usize) -> Stmt {
        let mut v = self.block_stmts_no_term(block);
        match &self.results[block].term {
            Term::Return(e) => v.push(Stmt::Return(e.clone())),
            Term::Throw(e) => v.push(Stmt::Throw(e.clone())),
            Term::Jsr | Term::Ret => v.push(Stmt::Comment("// jsr/ret not supported".into())),
            _ => {}
        }
        if v.len() == 1 {
            v.pop().unwrap()
        } else {
            Stmt::Block(v)
        }
    }

    fn block_stmts_no_term(&self, block: usize) -> Vec<Stmt> {
        // Monitor markers are kept; synchronized reconstruction happens later.
        self.results[block].stmts.clone()
    }

    /// Resolve a goto target against the scope stack.
    fn resolve_goto(&mut self, target: usize) -> Option<Jump> {
        // continue: innermost loop whose header == target
        if let Some(i) = (0..self.loops.len())
            .rev()
            .find(|&i| self.loops[i].header == target)
        {
            let depth = self.loops.len() - 1 - i;
            return Some(if depth == 0 {
                Jump::Continue(None)
            } else {
                Jump::Continue(Some(self.loops[i].label.clone()))
            });
        }
        // break out of a loop whose exit set contains the target; pick the
        // OUTERMOST such loop — an exit of nested loops (e.g. `break outer`)
        // belongs to every enclosing loop's exit set, and breaking only the
        // innermost would wrongly re-enter the outer loop.
        if let Some(li) = (0..self.loops.len()).find(|&i| self.loops[i].exits.contains(&target)) {
            // RESTART-STUB exit: the target chains through statement-free
            // stubs back into an enclosing-or-self loop HEADER — the jump
            // re-iterates THAT loop, it does not break out of anything
            // (jdk11/17/26 ConcurrentLinkedQueue.poll's p==q arm `goto
            // restartFromHead`: exit 12 is the `goto 0` stub; rendering
            // break+break fell to the post-loop tail and returned the
            // STALE item instead of restarting from head). The broad
            // walk-side continue-stub precedence was reverted once
            // (Pattern.clazz: switch-case goto stubs must stay
            // RawGoto-elided so the emitter re-appends case breaks) —
            // this form is scoped to genuine loop exits with no open
            // switch on the stack.
            if self.switches.is_empty() {
                let mut x = target;
                let mut guard = 0;
                let header_hit = loop {
                    if let Some(hi) = self.loops.iter().position(|l| l.header == x) {
                        if hi <= li {
                            break Some(hi);
                        }
                    }
                    if guard >= 8 {
                        break None;
                    }
                    let r = &self.results[x];
                    let stub = r.stmts.is_empty()
                        && r.out_stack.is_empty()
                        && matches!(r.term, Term::Fallthrough | Term::Goto)
                        && self.cfg.blocks[x].succ.len() == 1;
                    if !stub {
                        break None;
                    }
                    x = self.cfg.blocks[x].succ[0];
                    guard += 1;
                };
                if let Some(hi) = header_hit {
                    let depth = self.loops.len() - 1 - hi;
                    return Some(if depth == 0 {
                        Jump::Continue(None)
                    } else {
                        Jump::Continue(Some(self.loops[hi].label.clone()))
                    });
                }
            }
            // switches opened after that loop intercept a plain `break`
            let crosses_switch = !self.switches.is_empty();
            return Some(if li + 1 == self.loops.len() && !crosses_switch {
                Jump::Break(None)
            } else {
                Jump::Break(Some(self.loops[li].label.clone()))
            });
        }
        if let Some(si) = (0..self.switches.len())
            .rev()
            .find(|&i| self.switches[i].follow == Some(target))
        {
            return Some(
                if si + 1 == self.switches.len()
                    && self.loops.len() == self.switches[si].loops_depth
                {
                    Jump::Break(None)
                } else {
                    Jump::Break(Some(self.switches[si].label.clone()))
                },
            );
        }
        // Natural flow to the enclosing if's merge point: no statement.
        // Only the INNERMOST open follow qualifies — eliding a jump to an
        // outer follow would silently skip the statements between (e.g. a
        // shared throw at the end of an else-branch).
        if self.if_follows.last() == Some(&target) {
            return None;
        }
        // Inside a loop, a jump to an already-structured block that flows
        // back into the loop is a CONTINUE of the innermost such loop: the
        // target's statements were emitted earlier in this body, and the
        // natural continuation after this region is the loop bottom (an
        // if-follow or a fall-out exit), never the target. Eliding it as
        // fallthrough (the RawGoto `goto_is_last` arm) silently dropped the
        // iteration: jdk11/17 InstantPrinterParser.format's second loop
        // copy emitted `if (i >= fractionalDigits) {}` with no way out --
        // the digit append + back edge vanished (semantically an infinite
        // loop; javac: 缺少返回语句 on the method tail).
        // A target that is a loop EXIT keeps its RawGoto resolution (the
        // conv arm materializes the break): Pattern.clazz's switch-case
        // `break` targets sit on the loop-bottom path AND name exits —
        // continuing there made every switch exit abrupt and the post-
        // switch tail unreachable (无法访问的语句 x3 trees).
        let is_any_exit = self.loops.iter().any(|l| l.exits.contains(&target));
        if !is_any_exit && self.switches.is_empty() {
            // STUB-TARGET continue: a statement-free confluence stub that
            // can reach an enclosing header re-iterates that loop (its own
            // flow was emitted earlier in this body copy; IPP's can_reach
            // targets t=43/18/96/89/114/21/7 are all stubs).
            // HEADER-ADJACENT statement-bearing target: the jump re-runs a
            // shared tail whose statements were NOT emitted on this path —
            // inline them and continue (jdk11 BigInteger.nextProbablePrime
            // sieve arms: Goto{result=result.add(TWO)} flowing straight to
            // the header; a bare Continue skipped the advance and left
            // while(true) as the method's only completion: 缺少返回语句).
            // Statement-bearing targets with a BRANCHING or statement
            // bearing chain to the header keep RawGoto resolution (huc
            // getInputStream0's clone/getValue tails flow through shared
            // forward code — continuing there would skip it).
            let mut via_label: Option<Option<String>> = None;
            if self.results[target].stmts.is_empty() {
                if let Some(i) = (0..self.loops.len()).rev().find(|&i| {
                    crate::structure::can_reach_cfg(self.cfg, target, self.loops[i].header, 4096)
                }) {
                    let depth = self.loops.len() - 1 - i;
                    via_label = Some(if depth == 0 {
                        None
                    } else {
                        Some(self.loops[i].label.clone())
                    });
                }
            } else {
                let mut x = target;
                for _ in 0..8 {
                    if let Some(hi) = self.loops.iter().position(|l| l.header == x) {
                        let depth = self.loops.len() - 1 - hi;
                        via_label = Some(if depth == 0 {
                            None
                        } else {
                            Some(self.loops[hi].label.clone())
                        });
                        break;
                    }
                    if !self.results[x].stmts.is_empty() && x != target {
                        break;
                    }
                    if self.cfg.blocks[x].succ.len() != 1 {
                        break;
                    }
                    x = self.cfg.blocks[x].succ[0];
                }
            }
            if let Some(lbl) = via_label {
                return Some(if self.results[target].stmts.is_empty() {
                    Jump::Continue(lbl)
                } else {
                    Jump::ContinueVia(target, lbl)
                });
            }
        }
        // Inside a loop, a forward escape that cannot reach back into the
        // loop is a break of the innermost loop.
        if !self.loops.is_empty()
            && !crate::structure::can_reach_cfg(
                self.cfg,
                target,
                self.loops[self.loops.len() - 1].header,
                4096,
            )
        {
            return Some(Jump::Break(None));
        }
        // Unstructured jump.
        Some(Jump::RawGoto(target))
    }

    /// True if `a` post-dominates `b` (every path from b exits through a).
    /// True when a jump to `t` is equivalent to natural fallthrough: `t`
    /// (or the end of a chain of statement-free blocks starting at `t`) is
    /// a copied shared tail or an open if-follow that the enclosing flow
    /// will emit next anyway.
    /// True when `t` is the head of a javac retry loop: some exception
    /// handler protecting `t` has no normal preds and flows straight back
    /// to `t` (`catch (InterruptedException e) { ..; goto head }`). A Goto
    /// to such a header re-executes the protected body — inlining the
    /// body's terminator as a "shared tail copy" drops it out of its try
    /// (jdk26 Future.exceptionNow: the IE catch got `get(); throw ISE`
    /// unprotected — 未报告的异常错误 InterruptedException).
    fn is_retry_loop_header(&self, t: usize) -> bool {
        self.cfg.exc_edges.iter().any(|e| {
            e.from == t
                && e.to != t
                && self.cfg.blocks[e.to].pred.is_empty()
                && self.cfg.blocks[e.to].succ.len() == 1
                && self.cfg.blocks[e.to].succ[0] == t
        })
    }

    fn reaches_copy_tail(&self, t: usize) -> bool {
        let mut x = t;
        for _ in 0..8 {
            if self.copied_tails.contains(&x) || self.if_follows.contains(&x) {
                return true;
            }
            if !self.results[x].stmts.is_empty() {
                return false;
            }
            match &self.results[x].term {
                Term::Fallthrough | Term::Goto => match self.cfg.blocks[x].succ.first() {
                    Some(&n) => x = n,
                    None => return false,
                },
                _ => return false,
            }
        }
        false
    }

    #[allow(dead_code)]
    fn postdominates(&self, a: usize, b: usize, universe: &HashSet<usize>) -> bool {
        // BFS from b avoiding a; if no exit block is reachable, a post-dominates.
        let mut seen = HashSet::default();
        let mut q = std::collections::VecDeque::new();
        q.push_back(b);
        seen.insert(b);
        while let Some(x) = q.pop_front() {
            for &s in &self.cfg.blocks[x].succ {
                if s == a {
                    continue;
                }
                if !universe.contains(&s) {
                    continue;
                }
                if seen.insert(s) {
                    q.push_back(s);
                }
            }
            if self.cfg.blocks[x].succ.is_empty() && x != a && x != b {
                // reached an exit without passing through a
                return false;
            }
        }
        // also treat blocks leaving the universe as exits
        true
    }

    /// Classify a loop region into while / do-while / infinite and assemble
    /// the final statement.
    fn classify_loop(&mut self, header: usize, body_stmt: Stmt, ctx: LoopCtx) -> Stmt {
        let out = self.classify_loop_impl(header, body_stmt, ctx);
        if crate::dbg_flag!("JCDC_DBG_LOOP") {
            fn shape(s: &Stmt) -> String {
                fn short(e: &Expr) -> String {
                    format!("{:?}", e).chars().take(90).collect()
                }
                match s {
                    Stmt::While { cond, body } => {
                        format!("While({}) body={}", short(cond), shape(body))
                    }
                    Stmt::DoWhile { cond, .. } => format!("DoWhile({})", short(cond)),
                    Stmt::For { cond, .. } => {
                        format!("For({})", cond.as_ref().map(short).unwrap_or_default())
                    }
                    Stmt::Block(v) => format!(
                        "Block[{}]",
                        v.iter()
                            .take(4)
                            .map(|x| match x {
                                Stmt::ExprStmt(_) => "expr".to_string(),
                                Stmt::LocalDef { .. } => "def".to_string(),
                                Stmt::If { cond, .. } => format!("if({})", short(cond)),
                                Stmt::While { cond, .. } => format!("while({})", short(cond)),
                                Stmt::DoWhile { .. } => "do".to_string(),
                                Stmt::Break(_) => "break".to_string(),
                                Stmt::Continue(l) => format!("cont{:?}", l),
                                Stmt::Return(_) => "ret".to_string(),
                                Stmt::Throw(_) => "throw".to_string(),
                                Stmt::Try { .. } => "try".to_string(),
                                _ => "…".to_string(),
                            })
                            .collect::<Vec<_>>()
                            .join(",")
                    ),
                    _ => "…".to_string(),
                }
            }
            eprintln!("CLASSIFY-OUT header={} {}", header, shape(&out));
        }
        out
    }

    fn classify_loop_impl(&mut self, header: usize, body_stmt: Stmt, ctx: LoopCtx) -> Stmt {
        let term = self.results[header].term.clone();
        let succs = self.cfg.blocks[header].succ.clone();

        match term {
            Term::Cond { cond } if succs.len() == 2 => {
                let taken = succs[1];
                let fall = succs[0];
                if taken == header && ctx.exits.contains(&fall) {
                    // Self-loop: the header block holds both the body and
                    // the trailing conditional back edge → do-while. The
                    // fallthrough side is the loop exit. (When the fall
                    // side is INTERIOR the self-edge is an in-body retry
                    // jump of a loop with no normal completion at all —
                    // rotating it into a do-while bottom invents an exit
                    // path: jdk11/17/26 DSAParameterGenerator.generatePandQ's
                    // `if (!resultQ.isProbablePrime(..)) goto <Q-gen>`
                    // self-retry falls through into the P-search interior;
                    // the fabricated do-while fell out to the method end —
                    // 缺少返回语句. Those shapes take the interior-diamond
                    // while(true) arm below.)
                    // A compound (multi-test) trailing condition folds first:
                    // `if(c1)continue; .. if(cN)continue; else exit;` becomes
                    // `do{body}while(c1||..||cN); exit`.
                    if let Some((stmts, c, exit)) = extract_compound_do_while(&body_stmt) {
                        // An extracted exit that is the loop's OWN unlabeled
                        // break must be dropped: the do-while condition false
                        // already exits, and re-emitting the break OUTSIDE the
                        // loop is a stray `break;` (compile error). SESE's
                        // explicit `Goto{header}` -> continue makes self-loop
                        // bodies hit this shape (`if (c) continue; else break;`).
                        // return/throw/labeled-break exits stay (real fall-out).
                        if matches!(exit, Stmt::Break(None)) {
                            return Stmt::DoWhile {
                                body: Box::new(Stmt::Block(stmts)),
                                cond: c,
                            };
                        }
                        return Stmt::Block(vec![
                            Stmt::DoWhile {
                                body: Box::new(Stmt::Block(stmts)),
                                cond: c,
                            },
                            exit,
                        ]);
                    }
                    let (stmts, c) = match extract_trailing_do_while(&body_stmt) {
                        Some(x) => x,
                        None => (stmt_to_vec(body_stmt), cond.clone()),
                    };
                    return Stmt::DoWhile {
                        body: Box::new(Stmt::Block(stmts)),
                        cond: c,
                    };
                }
                if fall == header && ctx.exits.contains(&taken) {
                    // Inverted self-loop: `while (!(c)) body` — the taken
                    // side exits, the fallthrough loops back.
                    let inner2 = strip_trailing_continue(body_stmt);
                    // Stale-phi guard: the body's FIRST statement
                    // recomputes the header's condition local (`X =
                    // call(); if (X) {body}` — weixin DatabaseUtils'
                    // allocRow cursor loop, hu4/k iterator). `while (X)`
                    // would read X's PRE-loop value on the first test
                    // (可能尚未初始化变量 / stale register), and a plain
                    // do-while bottom test could read a register the
                    // body interior reused. Inject the else-break and
                    // rotate to do-while(true): the exit test then runs
                    // exactly where the bytecode has it — after the
                    // compute, before the body interior.
                    if cond_var_reassigned_first(&inner2, &cond) {
                        match try_protected_dowhile(inner2, &cond) {
                            Ok(dw) => return dw,
                            Err(inner) => {
                                return Stmt::While {
                                    cond: negate(cond.clone()),
                                    body: Box::new(inner),
                                };
                            }
                        }
                    }
                    return Stmt::While {
                        cond: negate(cond.clone()),
                        body: Box::new(inner2),
                    };
                }
                let taken_is_exit = ctx.exits.contains(&taken);
                if crate::dbg_flag!("JCDC_DBG_LOOP") {
                    eprintln!(
                        "CLASSIFY2 header={} taken={} fall={} exits={:?}",
                        header, taken, fall, ctx.exits
                    );
                }
                if !taken_is_exit && !ctx.exits.contains(&fall) {
                    // Multi-block loop condition. The header's fallthrough
                    // may be a pure condition-continuation test block whose
                    // taken side is the loop exit and whose fall side rejoins
                    // the body (`taken`). javac compiles `while (cH || !cB)`
                    // exactly this way:
                    //   H: if cH goto body;  B: if cB goto exit;  body: ..; goto H
                    // Fold B into the while condition. Without this the body
                    // walk re-emits H and B as empty `if`s inside a
                    // `while(true)`, dropping the exit and leaving an infinite
                    // loop plus an unreachable trailing statement.
                    if self.results[fall].stmts.is_empty() {
                        if let Term::Cond { cond: cb } = &self.results[fall].term {
                            let bs = self.cfg.blocks[fall].succ.clone();
                            if bs.len() == 2 && ctx.exits.contains(&bs[1]) && bs[0] == taken {
                                let combined = Expr::Bin {
                                    op: BinOp::LogOr,
                                    l: Box::new(cond.clone()),
                                    r: Box::new(negate(cb.clone())),
                                    ty: None,
                                };
                                // The body is the converted region
                                // remainder, NOT the taken block's raw
                                // statements: when `taken` is wrapped in
                                // regions (a try/catch group around the
                                // body call), the raw-stmt body silently
                                // drops them (jdk11 SocketChannelImpl
                                // .implCloseSelectableChannel: the
                                // wait()-loop's try/catch(Interrupted
                                // Exception) region vanished — bare
                                // wait() — 未报告的异常错误). The
                                // leading guard If is the condition being
                                // folded here; strip it and keep the rest.
                                let mut parts = stmt_to_vec(body_stmt);
                                if matches!(parts.first(), Some(Stmt::If { .. })) {
                                    parts.remove(0);
                                }
                                let body = if parts.is_empty() {
                                    Stmt::Block(self.results[taken].stmts.clone())
                                } else {
                                    let rest = if parts.len() == 1 {
                                        parts.pop().unwrap()
                                    } else {
                                        Stmt::Block(parts)
                                    };
                                    strip_trailing_continue(rest)
                                };
                                if crate::dbg_flag!("JCDC_DBG_LOOP") {
                                    eprintln!(
                                        "CLASSIFY-CONDCHAIN header={} B={} body={} exits={:?}",
                                        header, fall, taken, ctx.exits
                                    );
                                }
                                return Stmt::While {
                                    cond: combined,
                                    body: Box::new(body),
                                };
                            }
                        }
                    }
                    // Neither successor leaves the loop: the header's Cond
                    // is an interior diamond (e.g. a ternary inside an
                    // infinite `for(;;)` whose back edge targets the header
                    // top), not an exit test. Keep it in the body.
                    return Stmt::While {
                        cond: Expr::Const(ConstVal::Int(1)),
                        body: Box::new(body_stmt),
                    };
                }
                // The body walk re-emitted the header's own If region; unwrap
                // it so the loop reads `while (C) { else-part }`. `stripped`
                // is false when the test was NOT the body's first statement
                // (the header COMPUTES its condition: `v = it.hasNext();
                // if-eqz v`) — the re-emission then stays in the body.
                let (inner, exit_stmts, stripped) = split_leading_if(&body_stmt, &cond);
                // A top test the structurer wrapped in a TRY (the header
                // block sits inside its handler's protected range — jdk26
                // Bits.reserveMemory's backoff retry loop tests
                // tryReserveOrClean(..) throws InterruptedException under
                // its own catch(IE) retry handler): rotating the test into
                // `while (C)` evaluates the call OUTSIDE every handler —
                // 未报告的异常错误InterruptedException. split_leading_if
                // deliberately cannot reach through the Try (the rotated
                // cond would still be unprotected), so keep the test where
                // the bytecode has it and stay on while(true). The earlier
                // implCloseSelectableChannel guard (raw-stmt bodies losing
                // the leading If's statements) does not apply: the If lives
                // intact inside the Try.

                if crate::dbg_flag!("JCDC_DBG_LOOP") {
                    eprintln!(
                        "CLASSIFY header={} taken_is_exit={} exit_stmts={}",
                        header,
                        taken_is_exit,
                        exit_stmts.len()
                    );
                }
                let inner = strip_trailing_continue(inner);
                let while_cond = if taken_is_exit {
                    negate(cond.clone())
                } else {
                    cond.clone()
                };
                let plain_exit = exit_stmts.is_empty()
                    || matches!(exit_stmts.as_slice(), [Stmt::Break(_)])
                    || matches!(exit_stmts.as_slice(), [Stmt::Block(b)] if b.is_empty());
                if taken_is_exit && plain_exit {
                    match try_protected_dowhile(inner, &cond) {
                        Ok(dw) => dw,
                        Err(inner) => {
                            if crate::dbg_flag!("JCDC_DBG_LOOP") {
                                eprintln!(
                                    "STALEDBG arm=taken_plain header={} stripped={} leading={} cond={:?}",
                                    header,
                                    stripped,
                                    leading_test_present(&inner, &cond, true),
                                    cond
                                );
                            }
                            // Strip failed and the header's own test-and-
                            // break is still inside the body: the rotated
                            // cond would re-read the condition local's
                            // STALE pre-loop value — `while (v) {
                            // v = it.hasNext(); ... }` is a definite-
                            // assignment error (可能尚未初始化变量, weixin
                            // ×14k files), and even a pre-initialized v
                            // tests the stale register on entry. The
                            // in-body break is the real exit; while(true)
                            // is the faithful header (same intent as the
                            // TRY-wrapped guard above).
                            let hc = if !stripped && leading_test_present(&inner, &cond, true) {
                                Expr::Const(ConstVal::Int(1))
                            } else {
                                while_cond
                            };
                            Stmt::While {
                                cond: hc,
                                body: Box::new(inner),
                            }
                        }
                    }
                } else if taken_is_exit {
                    // Exit branch runs statements before leaving:
                    // while (true) { if (C_exit) { stmts; break; } body }
                    // `cond` IS the exit test here (the taken side exits —
                    // negate(cond) inverted the guard: jdk17 CHM
                    // comparableClassFor emitted `if (i < len) return null`
                    // inside while(true), inverting the loop). The break is
                    // only appended when the exit statements do not already
                    // terminate (return null + break = unreachable stmt).
                    let mut ex = exit_stmts;
                    let already_term = matches!(
                        ex.last(),
                        Some(Stmt::Return(_)) | Some(Stmt::Throw(_)) | Some(Stmt::Break(_))
                    );
                    if !already_term {
                        ex.push(Stmt::Break(None));
                    }
                    let guard = Stmt::If {
                        cond: cond.clone(),
                        then_stmt: Box::new(Stmt::Block(ex)),
                        else_stmt: None,
                    };
                    let mut v = vec![guard];
                    v.extend(stmt_to_vec(inner));
                    Stmt::While {
                        cond: Expr::Const(ConstVal::Int(1)),
                        body: Box::new(Stmt::Block(v)),
                    }
                } else {
                    // Unusual orientation: the fallthrough side exits.
                    if exit_stmts.is_empty()
                        || matches!(exit_stmts.as_slice(), [Stmt::Break(_)])
                        || matches!(exit_stmts.as_slice(), [Stmt::Block(b)] if b.is_empty())
                    {
                        // then-side was the exit scaffolding; body is `inner`
                        match try_protected_dowhile(inner, &cond) {
                            Ok(dw) => dw,
                            Err(inner) => {
                                // Same stale-phi guard as the taken_is_exit
                                // arm above (this orientation keeps `cond`
                                // un-negated).
                                let hc = if !stripped && leading_test_present(&inner, &cond, false) {
                                    Expr::Const(ConstVal::Int(1))
                                } else {
                                    while_cond
                                };
                                Stmt::While {
                                    cond: hc,
                                    body: Box::new(inner),
                                }
                            }
                        }
                    } else {
                        // then-side carries the body ending with the back
                        // edge; fallthrough exits.
                        let body2 = strip_trailing_continue(stmts_to_stmt(exit_stmts));
                        Stmt::While {
                            cond: while_cond,
                            body: Box::new(body2),
                        }
                    }
                }
            }
            Term::Goto | Term::Fallthrough => {
                // Possibly do-while: the body ends with a conditional jump
                // back to the header (`if (c) continue;` or inverted), or a
                // COMPOUND run of such tests ending in the loop exit.
                if let Some((stmts, c, exit)) = extract_compound_do_while(&body_stmt) {
                    // Same guard as the self-loop compound path above: an
                    // extracted exit that is the loop's OWN unlabeled break
                    // must be dropped — the do-while condition false already
                    // exits, and a `break;` re-emitted OUTSIDE the loop is a
                    // stray (it also makes stmt_terminates treat the sequence
                    // as terminated, so prune_unreachable drops the real
                    // tail: jdk26 Resolver.bind `return this` — 缺少返回语句).
                    // SESE's rotated do-whiles hit this shape: the tail test
                    // block becomes `if (c) continue; else break;`.
                    // return/throw/labeled-break exits stay (real fall-out).
                    if matches!(exit, Stmt::Break(None)) {
                        return Stmt::DoWhile {
                            body: Box::new(Stmt::Block(stmts)),
                            cond: c,
                        };
                    }
                    return Stmt::Block(vec![
                        Stmt::DoWhile {
                            body: Box::new(Stmt::Block(stmts)),
                            cond: c,
                        },
                        exit,
                    ]);
                }
                if let Some((stmts, c)) = extract_trailing_do_while(&body_stmt) {
                    return Stmt::DoWhile {
                        body: Box::new(Stmt::Block(stmts)),
                        cond: c,
                    };
                }
                Stmt::While {
                    cond: Expr::Const(ConstVal::Int(1)),
                    body: Box::new(body_stmt),
                }
            }
            _ => Stmt::While {
                cond: Expr::Const(ConstVal::Int(1)),
                body: Box::new(body_stmt),
            },
        }
    }

    /// True if `target` is inside the loop currently being classified
    /// (approximated: target can reach the header again).
    #[allow(dead_code)]
    fn loop_contains(&self, header: usize, target: usize) -> bool {
        can_reach(self.cfg, target, header, 8192)
    }

    #[allow(dead_code)]
    fn loop_exit_contains(&self, header: usize, target: usize) -> bool {
        // The loop currently being classified is the innermost on the stack
        // BEFORE it was popped; ctx.exits was consumed. Recompute cheaply:
        // target is an exit if it is not reachable-back-to-header within the
        // loop members — approximated by checking the parent scope recorded
        // in loops stack is empty here; use cfg: header's own successors that
        // leave... For the header itself, an exit is any successor that is
        // not dominated by header OR is not in the natural loop. Simple
        // approximation: a successor s is "in loop" if s can reach header
        // again via normal edges.
        can_reach(self.cfg, target, header, 4096).not()
    }
}

#[allow(dead_code)]
trait NotExt {
    fn not(self) -> bool;
}
impl NotExt for bool {
    fn not(self) -> bool {
        !self
    }
}

#[allow(dead_code)]
fn can_reach(cfg: &Cfg, from: usize, to: usize, budget: usize) -> bool {
    if from == to {
        return true;
    }
    let mut seen = HashSet::default();
    let mut q = std::collections::VecDeque::new();
    q.push_back(from);
    seen.insert(from);
    let mut n = 0;
    while let Some(b) = q.pop_front() {
        n += 1;
        if n > budget {
            return false;
        }
        for &s in &cfg.blocks[b].succ {
            if s == to {
                return true;
            }
            if seen.insert(s) {
                q.push_back(s);
            }
        }
    }
    false
}

/// If the body starts with the loop header's own `If` (same condition
/// expression), return (else-branch content, then-branch content).
/// Otherwise return (body, []).
fn stmts_to_stmt(v: Vec<Stmt>) -> Stmt {
    match v.len() {
        0 => Stmt::Block(vec![]),
        1 => v.into_iter().next().unwrap(),
        _ => Stmt::Block(v),
    }
}

/// When the loop's top test lives inside a Try in `inner` (the header
/// block sits in its handler's protected range — jdk26
/// Bits.reserveMemory's backoff retry loop tests
/// `tryReserveOrClean(..) throws InterruptedException` under its own
/// catch(IE) handler), the `while (C)` rotation would evaluate C
/// OUTSIDE every handler — 未报告的异常错误InterruptedException.
/// Rewrite as a do-while instead: inject `break` into the embedded
/// If's EMPTY arm (the exit side — the exit blocks live outside the
/// loop region as its continuation siblings, so the empty arm is the
/// fall-out) and loop unconditionally. The sibling tail then stays
/// reachable as the do-while's natural completion. Returns None when
/// the test is not try-wrapped (plain rotation applies) or when the
/// shape is ambiguous (both If arms materialized).
// The Err payload IS the statement being rejected — boxing it would
// churn every call site for a cold path.
#[allow(clippy::result_large_err)]
fn try_protected_dowhile(inner: Stmt, cond: &Expr) -> Result<Stmt, Stmt> {
    // The exit side of the embedded test: an Empty region conversion
    // (empty block / missing else) or an ALREADY-materialized plain
    // `break` (the merged-span shape walks the sleep region as the
    // then-arm and breaks on the exit side directly).
    fn is_empty(s: &Stmt) -> bool {
        match s {
            Stmt::Block(v) => v.is_empty() || (v.len() == 1 && is_empty(&v[0])),
            Stmt::Break(None) => false,
            _ => false,
        }
    }
    fn inject(s: &mut Stmt, cond: &Expr, ncond: &Expr) -> bool {
        match s {
            Stmt::If {
                cond: c,
                then_stmt,
                else_stmt,
            } if same_test(c, cond) => {
                let then_empty = is_empty(then_stmt);
                let else_empty = else_stmt.as_ref().map(|e| is_empty(e)).unwrap_or(true);
                if then_empty && !else_empty {
                    **then_stmt = Stmt::Break(None);
                    true
                } else if else_empty && !then_empty {
                    *else_stmt = Some(Box::new(Stmt::Break(None)));
                    true
                } else {
                    false
                }
            }
            // Flipped polarity: the emission normalizer dropped an EMPTY
            // exit arm and re-oriented the test (`if (X) {body}` where
            // X = ¬cond — weixin hu4/k `while (hasNext) { hasNext =
            // it.hasNext(); if (hasNext) {…} }`). THEN is the interior
            // and ELSE the exit side; only the missing/empty-else shape
            // is safely fillable (`if (X) {body} else break;`). An empty
            // THEN with a materialized ELSE would need the break AFTER
            // the else statements — this filler cannot express that, so
            // refuse rather than skip the exit path.
            Stmt::If {
                cond: c,
                then_stmt,
                else_stmt,
            } if same_test(c, ncond) => {
                let else_empty = else_stmt.as_ref().map(|e| is_empty(e)).unwrap_or(true);
                if else_empty && !is_empty(then_stmt) {
                    *else_stmt = Some(Box::new(Stmt::Break(None)));
                    true
                } else {
                    false
                }
            }
            Stmt::Try { body, .. } | Stmt::TryWithResources { body, .. } => {
                inject(body, cond, ncond)
            }
            Stmt::Block(v) => {
                for st in v.iter_mut() {
                    match st {
                        // The header's condition computation precedes the
                        // re-emitted test — scan on.
                        Stmt::ExprStmt(_)
                        | Stmt::LocalDef { .. }
                        | Stmt::Comment(_)
                        | Stmt::MonitorEnter(_)
                        | Stmt::MonitorExit(_) => continue,
                        other => return inject(other, cond, ncond),
                    }
                }
                false
            }
            Stmt::Labeled { body, .. } | Stmt::Synchronized { body, .. } => {
                inject(body, cond, ncond)
            }
            _ => false,
        }
    }
    let mut b = inner;
    let ncond = negate(cond.clone());
    let r = inject(&mut b, cond, &ncond);
    if crate::dbg_flag!("JCDC_DBG_LOOP") {
        eprintln!(
            "TPD inject={} cond={} body0={}",
            r,
            format!("{:?}", cond).chars().take(70).collect::<String>(),
            match &b {
                Stmt::Block(v) => v
                    .iter()
                    .take(3)
                    .map(|x| match x {
                        Stmt::If { cond: c, then_stmt, else_stmt } => format!(
                            "if({} )then_empty={} else={}",
                            format!("{:?}", c).chars().take(50).collect::<String>(),
                            matches!(&**then_stmt, Stmt::Block(bb) if bb.is_empty()),
                            else_stmt.is_some()
                        ),
                        Stmt::LocalDef { .. } => "def".to_string(),
                        Stmt::ExprStmt(_) => "expr".to_string(),
                        _ => "other".to_string(),
                    })
                    .collect::<Vec<_>>()
                    .join("|"),
                Stmt::If { cond: c, .. } => format!("topif({:?})", c).chars().take(60).collect(),
                _ => "nonblock".to_string(),
            }
        );
    }
    if r {
        Ok(Stmt::DoWhile {
            body: Box::new(b),
            cond: Expr::Const(ConstVal::Int(1)),
        })
    } else {
        Err(b)
    }
}

/// Unwrap the header's re-emitted `if (cond) {exit} else {body}` from the
/// top of a loop body. The bool reports whether the strip happened: false
/// means the test was NOT the body's first statement (a condition-computing
/// header leads with its Assign) and the re-emission is still inside.
fn split_leading_if(body: &Stmt, cond: &Expr) -> (Stmt, Vec<Stmt>, bool) {
    let items = match body {
        Stmt::Block(v) => v,
        other => {
            return match other {
                Stmt::If {
                    cond: c,
                    then_stmt,
                    else_stmt,
                } if c == cond => (
                    else_stmt
                        .as_ref()
                        .map(|e| (**e).clone())
                        .unwrap_or(Stmt::Block(vec![])),
                    stmt_to_vec((**then_stmt).clone()),
                    true,
                ),
                _ => (other.clone(), vec![], false),
            };
        }
    };
    if let Some(Stmt::If {
        cond: c,
        then_stmt,
        else_stmt,
    }) = items.first()
    {
        {
            if c == cond {
                let inner = if items.len() == 1 {
                    else_stmt
                        .as_ref()
                        .map(|e| (**e).clone())
                        .unwrap_or(Stmt::Block(vec![]))
                } else {
                    let mut rest = vec![else_stmt
                        .as_ref()
                        .map(|e| (**e).clone())
                        .unwrap_or(Stmt::Block(vec![]))];
                    rest.extend(items[1..].iter().cloned());
                    Stmt::Block(rest)
                };
                return (inner, stmt_to_vec((**then_stmt).clone()), true);
            }
        }
    }
    (body.clone(), vec![], false)
}

/// Canonical form of a boolean test for STRUCTURAL comparison. The header
/// Term keeps the raw dex idiom (`X == 0` for if-eqz on a boolean
/// register) while the re-emitted in-body If often carries the simplified
/// `X` / `!X` — raw `==` misses the pair (weixin allocRow cursor-loop
/// family stayed stale-rotated without this). Folds `X == 0` → `!X`,
/// `X != 0` → `X`, and double negations.
fn canon_test(e: &Expr) -> Expr {
    fn is_zero(c: &Expr) -> bool {
        matches!(c, Expr::Const(ConstVal::Int(0)))
    }
    match e {
        Expr::Bin {
            op: BinOp::Eq,
            l,
            r,
            ..
        } => {
            if is_zero(r) {
                Expr::Un {
                    op: UnOp::Not,
                    e: Box::new(canon_test(l)),
                }
            } else if is_zero(l) {
                Expr::Un {
                    op: UnOp::Not,
                    e: Box::new(canon_test(r)),
                }
            } else {
                e.clone()
            }
        }
        Expr::Bin {
            op: BinOp::Ne,
            l,
            r,
            ..
        } => {
            if is_zero(r) {
                canon_test(l)
            } else if is_zero(l) {
                canon_test(r)
            } else {
                e.clone()
            }
        }
        Expr::Un {
            op: UnOp::Not,
            e: inner,
        } => match canon_test(inner) {
            Expr::Un {
                op: UnOp::Not,
                e: x,
            } => *x,
            other => Expr::Un {
                op: UnOp::Not,
                e: Box::new(other),
            },
        },
        _ => e.clone(),
    }
}

/// Structural equality of two boolean tests modulo the zero-comparison
/// idiom (`X == 0` ≡ `!X`).
fn same_test(a: &Expr, b: &Expr) -> bool {
    if a == b {
        return true;
    }
    canon_test(a) == canon_test(b)
}

/// True when the loop body still carries the header block's re-emitted exit
/// test at its leading position: zero or more condition-computing simple
/// statements followed by `if (cond) …` (possibly under region wrappers).
/// The first If/control statement encountered is decisive — a later
/// same-condition diamond deeper in the body does not count.
///
/// `exit_on_taken` orients the test: the taken_is_exit arm of classify_loop
/// has the EXIT on the term's taken side (`if (c) {exit}`), the fall-exit
/// arm has it on the else (`if (c) {interior} else {exit}`). The exit side
/// must TERMINATE (break/return/throw/labeled-continue — recursively
/// through blocks and both-arm-terminating ifs); the interior side may end
/// anywhere (falling to the loop bottom IS the back edge). Without a
/// terminating exit side, `while (true)` would spin forever — the
/// empty-exit-arm shapes belong to try_protected_dowhile's break
/// injection, which runs first.
fn leading_test_present(s: &Stmt, cond: &Expr, exit_on_taken: bool) -> bool {
    fn terminates(t: &Stmt) -> bool {
        match t {
            Stmt::Break(_) | Stmt::Return(_) | Stmt::Throw(_) => true,
            // A LABELED continue targets an enclosing loop — it leaves
            // this one, so the in-body exit is real (weixin aa2/b:
            // `if (!hasNext) continue L1;`). A BARE continue is this
            // loop's own back edge — NOT an exit (while(true) would
            // re-spin the test forever); it must stay on the old path.
            Stmt::Continue(Some(_)) => true,
            Stmt::Block(v) => v.last().map(terminates).unwrap_or(false),
            // An if whose BOTH arms leave the loop terminates too.
            Stmt::If {
                then_stmt,
                else_stmt,
                ..
            } => {
                terminates(then_stmt)
                    && else_stmt
                        .as_ref()
                        .map(|e| terminates(e))
                        .unwrap_or(false)
            }
            Stmt::Labeled { body, .. } => terminates(body),
            _ => false,
        }
    }
    fn term_opt(o: &Option<Box<Stmt>>) -> bool {
        o.as_ref().map(|e| terminates(e)).unwrap_or(false)
    }
    fn go(s: &Stmt, cond: &Expr, ncond: &Expr, exit_on_taken: bool) -> bool {
        match s {
            Stmt::If {
                cond: c,
                then_stmt,
                else_stmt,
            } => {
                let direct = same_test(c, cond);
                let flipped = !direct && same_test(c, ncond);
                if !direct && !flipped {
                    return false;
                }
                // Exit side: a direct-oriented test carries the term's
                // taken side in THEN; a flipped test swaps the arms.
                // `exit_on_taken` says which term side exits in the
                // calling classify arm.
                let exit_is_then = direct == exit_on_taken;
                if exit_is_then {
                    terminates(then_stmt)
                } else {
                    term_opt(else_stmt)
                }
            }
            Stmt::Try { body, .. }
            | Stmt::TryWithResources { body, .. }
            | Stmt::Labeled { body, .. }
            | Stmt::Synchronized { body, .. } => go(body, cond, ncond, exit_on_taken),
            Stmt::Block(v) => {
                for st in v {
                    match st {
                        Stmt::ExprStmt(_)
                        | Stmt::LocalDef { .. }
                        | Stmt::Comment(_)
                        | Stmt::MonitorEnter(_)
                        | Stmt::MonitorExit(_) => continue,
                        other => return go(other, cond, ncond, exit_on_taken),
                    }
                }
                false
            }
            _ => false,
        }
    }
    go(s, cond, &negate(cond.clone()), exit_on_taken)
}

/// True when the body's first meaningful statement assigns the SAME local
/// the header condition tests (`X = call(); …` where cond = ±X) — the
/// compute-then-test shape whose rotated `while (X)` header would read X's
/// stale pre-loop value.
fn cond_var_reassigned_first(s: &Stmt, cond: &Expr) -> bool {
    fn cond_local(c: &Expr) -> Option<u32> {
        match c {
            Expr::Local { var, .. } => Some(*var),
            Expr::Un {
                op: UnOp::Not,
                e,
            } => cond_local(e),
            // boolean-zero idiom: `X == 0` / `0 != X` (dex if-eqz on a
            // boolean register keeps this raw form in the Term).
            Expr::Bin {
                op: BinOp::Eq | BinOp::Ne,
                l,
                r,
                ..
            } => {
                if matches!(&**r, Expr::Const(ConstVal::Int(0))) {
                    cond_local(l)
                } else if matches!(&**l, Expr::Const(ConstVal::Int(0))) {
                    cond_local(r)
                } else {
                    None
                }
            }
            _ => None,
        }
    }
    let Some(v) = cond_local(cond) else {
        return false;
    };
    fn go(s: &Stmt, v: u32) -> bool {
        match s {
            Stmt::ExprStmt(Expr::Assign { target, .. }) => {
                matches!(&**target, Expr::Local { var, .. } if *var == v)
            }
            Stmt::LocalDef {
                var, init: Some(_), ..
            } => *var == v,
            Stmt::Block(b) => b.first().map(|f| go(f, v)).unwrap_or(false),
            Stmt::Try { body, .. }
            | Stmt::TryWithResources { body, .. }
            | Stmt::Labeled { body, .. }
            | Stmt::Synchronized { body, .. } => go(body, v),
            _ => false,
        }
    }
    go(s, v)
}

/// Remove a trailing `continue;` (loop back-edge) from a statement list.
fn strip_trailing_continue(s: Stmt) -> Stmt {
    match s {
        Stmt::Block(mut v) => {
            while matches!(v.last(), Some(Stmt::Continue(None))) {
                v.pop();
            }
            if v.len() == 1 && matches!(v[0], Stmt::Block(_)) {
                let inner = match v.pop().unwrap() {
                    Stmt::Block(inner) => inner,
                    _ => unreachable!(),
                };
                return strip_trailing_continue(Stmt::Block(inner));
            }
            Stmt::Block(v)
        }
        Stmt::Continue(None) => Stmt::Block(vec![]),
        other => other,
    }
}

pub fn negate(e: Expr) -> Expr {
    match e {
        Expr::Un { op: UnOp::Not, e } => *e,
        // De Morgan for the short-circuit operators: !(A && B) =
        // !A || !B, !(A || B) = !A && !B — recursing through negate
        // keeps comparison operands cleanly inverted. An op-only swap
        // (the historical invert() LogAnd<->LogOr mapping) silently
        // changed the condition's meaning: Arrays.equals' folded
        // `a == null || a2 == null` inverted to `a == null && a2 ==
        // null`, NPE-ing the a2==null path.
        Expr::Bin {
            op: op @ (crate::ir::expr::BinOp::LogAnd | crate::ir::expr::BinOp::LogOr),
            l,
            r,
            ty,
        } => {
            let swapped = if matches!(op, crate::ir::expr::BinOp::LogAnd) {
                crate::ir::expr::BinOp::LogOr
            } else {
                crate::ir::expr::BinOp::LogAnd
            };
            Expr::Bin {
                op: swapped,
                l: Box::new(negate(*l)),
                r: Box::new(negate(*r)),
                ty,
            }
        }
        Expr::Bin { op, l, r, ty } => {
            if let Some(inv) = op.invert() {
                Expr::Bin { op: inv, l, r, ty }
            } else {
                Expr::Un {
                    op: UnOp::Not,
                    e: Box::new(Expr::Bin { op, l, r, ty }),
                }
            }
        }
        other => Expr::Un {
            op: UnOp::Not,
            e: Box::new(other),
        },
    }
}

/// True for a bare `continue;` (or a block wrapping just one).
fn is_continue_stmt(s: &Stmt) -> bool {
    matches!(s, Stmt::Continue(None))
        || matches!(s, Stmt::Block(v) if v.len() == 1 && matches!(v[0], Stmt::Continue(None)))
}

/// Detect a COMPOUND trailing do-while condition: the body ends with a run of
/// `if (c1) continue;` ... `if (cN) continue; else <exit>;`. javac emits this
/// for `do { body } while (c1 || ... || cN);` followed by the loop exit when
/// the condition is a short-circuit `||` whose tests each jump back to the
/// body head (e.g. `Random.internalNextInt`: `while (r < origin || r >=
/// bound)`). Fold the run into a single do-while whose condition is the `||`
/// of the tests, returning the body statements, that condition, and the exit
/// action (`<exit>`) to emit right after the loop.
fn extract_compound_do_while(body: &Stmt) -> Option<(Vec<Stmt>, Expr, Stmt)> {
    // Flatten nested straight-line blocks: the loop body may group the first
    // condition test(s) inside a nested Block (the self-loop header's region)
    // while later tests are siblings. Splicing pure sequence blocks is safe.
    fn flatten_seq(s: &Stmt) -> Vec<Stmt> {
        match s {
            Stmt::Block(v) => {
                let mut out = Vec::new();
                for x in v {
                    out.extend(flatten_seq(x));
                }
                out
            }
            other => vec![other.clone()],
        }
    }
    let mut stmts = flatten_seq(body);
    // Unnest the rendered if/else-if CHAIN spine: javac's bottom-tested
    // `if (c1) continue; if (c2) continue; ... else exit;` disjunct run
    // converts to ONE nested If whose else arms hold the remaining
    // tests — opaque to the backwards scan below, which would fold only
    // c1 and push the whole c2..cN chain out of the loop as the "exit"
    // (jdk26 ML_DSA.signInternal: `do { expandMask.. } while
    // (vectorNormBound(z,..));` with the c2/hint chain — and its
    // continue/break — stranded after the loop, continue 在 loop 外部
    // ×2). Splitting each continue-then If back into siblings restores
    // the flat run; semantics are identical (the then arm is a bare
    // continue with no fallthrough, and the LAST else is preserved as
    // the final statement's else = the loop's exit route).
    {
        let mut flat: Vec<Stmt> = Vec::new();
        for st in stmts.into_iter() {
            let mut cur = st;
            loop {
                match cur {
                    Stmt::If {
                        cond,
                        then_stmt,
                        else_stmt: Some(e),
                    } if is_continue_stmt(&then_stmt) => {
                        flat.push(Stmt::If {
                            cond,
                            then_stmt,
                            else_stmt: None,
                        });
                        cur = *e;
                    }
                    other => {
                        flat.push(other);
                        break;
                    }
                }
            }
        }
        stmts = flat;
    }
    let n = stmts.len();
    if n < 2 {
        return None;
    }
    // Last statement: `if (c_last) continue; else <exit>` — the exit is the
    // loop's fall-out (a return/throw/break), NOT another continue.
    let (c_last, exit) = match &stmts[n - 1] {
        Stmt::If {
            cond,
            then_stmt,
            else_stmt: Some(e),
        } if is_continue_stmt(then_stmt) && !is_continue_stmt(e) => (cond.clone(), (**e).clone()),
        _ => return None,
    };
    // Walk backwards over preceding `if (ci) continue;` (no else) tests.
    let mut conds = vec![c_last];
    let mut i = n - 1;
    while i >= 1 {
        match &stmts[i - 1] {
            Stmt::If {
                cond,
                then_stmt,
                else_stmt: None,
            } if is_continue_stmt(then_stmt) => {
                conds.push(cond.clone());
                i -= 1;
            }
            _ => break,
        }
    }
    let body_stmts: Vec<Stmt> = stmts[..i].to_vec();
    // cond = c1 || c2 || ... || c_last (conds currently reversed).
    let mut it = conds.into_iter().rev();
    let mut cond = it.next().unwrap();
    for c in it {
        cond = Expr::Bin {
            op: BinOp::LogOr,
            l: Box::new(c),
            r: Box::new(cond),
            ty: None,
        };
    }
    Some((body_stmts, cond, exit))
}

/// Detect a trailing do-while condition at the end of a loop body:
/// `if (c) continue;` → cond c, or `if (c) {} else continue;` → cond !c.
fn extract_trailing_do_while(body: &Stmt) -> Option<(Vec<Stmt>, Expr)> {
    let mut stmts = match body {
        Stmt::Block(v) => v.clone(),
        other => vec![other.clone()],
    };
    if stmts.is_empty() {
        return None;
    }
    let n = stmts.len() - 1;
    if let Stmt::If {
        cond,
        then_stmt,
        else_stmt,
    } = &stmts[n]
    {
        let then_is_cont = |s: &Stmt| {
            matches!(s, Stmt::Continue(None))
                || matches!(s, Stmt::Block(v) if v.len() == 1 && matches!(v[0], Stmt::Continue(None)))
        };
        if then_is_cont(then_stmt) && else_stmt.is_none() {
            let c = cond.clone();
            stmts.pop();
            return Some((stmts, c));
        }
        if else_stmt.as_ref().map(|e| then_is_cont(e)).unwrap_or(false)
            && (matches!(&**then_stmt, Stmt::Block(v) if v.is_empty()))
        {
            let c = negate(cond.clone());
            stmts.pop();
            return Some((stmts, c));
        }
    }
    None
}

/// If the body ends with `if (c) continue;` (Continue(None), no else),
/// strip it and return (body without trailing if, c).
#[allow(dead_code)]
fn extract_trailing_continue_if(body: &Stmt) -> Option<(Vec<Stmt>, Expr)> {
    let mut stmts = match body {
        Stmt::Block(v) => v.clone(),
        other => vec![other.clone()],
    };
    if stmts.is_empty() {
        return None;
    }
    let n = stmts.len() - 1;
    // Direct trailing `if (c) continue;`.
    let is_direct = match &stmts[n] {
        Stmt::If {
            then_stmt,
            else_stmt: None,
            ..
        } => {
            matches!(&**then_stmt, Stmt::Continue(None))
                || matches!(&**then_stmt, Stmt::Block(tb) if tb.len() == 1 && matches!(tb[0], Stmt::Continue(None)))
        }
        _ => false,
    };
    if is_direct {
        if let Stmt::If { cond, .. } = stmts.pop().unwrap() {
            return Some((stmts, cond));
        }
    }
    // Descend into a trailing block.
    if matches!(stmts.last(), Some(Stmt::Block(_))) {
        let last = stmts.pop().unwrap();
        if let Some((inner, c)) = extract_trailing_continue_if(&last) {
            if !inner.is_empty() {
                stmts.push(Stmt::Block(inner));
            }
            return Some((stmts, c));
        } else {
            stmts.push(last);
        }
    }
    None
}

/// Separate the first Basic block's statements from the rest of a body.
/// (Bodies built by `walk` start with the header's statements.)
#[allow(dead_code)]
fn split_first_block(body: Stmt) -> (Stmt, Option<usize>) {
    // The body is whatever the walk produced; we keep it intact — header
    // statements were already woven in by conv(Basic). Return as-is.
    (body, None)
}

fn stmt_to_vec(s: Stmt) -> Vec<Stmt> {
    match s {
        Stmt::Block(v) => v,
        other => vec![other],
    }
}

/// Strip `Labeled` wrappers no Break/Continue ended up referencing.
/// Wrappers are attached unconditionally during conv (a break born in a
/// copied/follow region lands after its loop's region-close, so the
/// at-close used_labels check orphaned it); after the full conversion
/// used_labels is complete and the unused wrappers come off. An unused
/// wrapper's body replaces it in-place (a Block body stays a nested
/// block — downstream cleanup flattens).
fn prune_unused_labels(st: &mut Stmt, used: &HashSet<String>) {
    loop {
        let take = matches!(st, Stmt::Labeled { label, .. } if !used.contains(label));
        if !take {
            break;
        }
        let inner = match std::mem::replace(st, Stmt::Block(Vec::new())) {
            Stmt::Labeled { body, .. } => *body,
            _ => unreachable!(),
        };
        *st = inner;
    }
    match st {
        Stmt::Block(v) => v.iter_mut().for_each(|x| prune_unused_labels(x, used)),
        Stmt::Labeled { body, .. } => prune_unused_labels(body, used),
        Stmt::If { then_stmt, else_stmt, .. } => {
            prune_unused_labels(then_stmt, used);
            if let Some(e) = else_stmt {
                prune_unused_labels(e, used);
            }
        }
        Stmt::While { body, .. }
        | Stmt::DoWhile { body, .. }
        | Stmt::ForEach { body, .. }
        | Stmt::Synchronized { body, .. } => prune_unused_labels(body, used),
        Stmt::For { init, body, .. } => {
            init.iter_mut().for_each(|x| prune_unused_labels(x, used));
            prune_unused_labels(body, used);
        }
        Stmt::Switch { cases, default, .. } => {
            for c in cases.iter_mut() {
                c.body.iter_mut().for_each(|x| prune_unused_labels(x, used));
            }
            if let Some(d) = default {
                prune_unused_labels(d, used);
            }
        }
        Stmt::Try { body, catches, finally }
        | Stmt::TryWithResources { body, catches, finally, .. } => {
            prune_unused_labels(body, used);
            for c in catches.iter_mut() {
                prune_unused_labels(&mut c.body, used);
            }
            if let Some(f) = finally {
                prune_unused_labels(f, used);
            }
        }
        _ => {}
    }
}