wasmtime 15.0.1 → 16.0.0

data/ext/cargo-vendor/cranelift-codegen-0.102.1/src/ir/pcc.rs

@@ -1,1682 +0,0 @@
-//! Proof-carrying code. We attach "facts" to values and then check
-//! that they remain true after compilation.
-//!
-//! A few key design principle of this approach are:
-//!
-//! - The producer of the IR provides the axioms. All "ground truth",
-//!   such as what memory is accessible -- is meant to come by way of
-//!   facts on the function arguments and global values. In some
-//!   sense, all we are doing here is validating the "internal
-//!   consistency" of the facts that are provided on values, and the
-//!   actions performed on those values.
-//!
-//! - We do not derive and forward-propagate facts eagerly. Rather,
-//!   the producer needs to provide breadcrumbs -- a "proof witness"
-//!   of sorts -- to allow the checking to complete. That means that
-//!   as an address is computed, or pointer chains are dereferenced,
-//!   each intermediate value will likely have some fact attached.
-//!
-//!   This does create more verbose IR, but a significant positive
-//!   benefit is that it avoids unnecessary work: we do not build up a
-//!   knowledge base that effectively encodes the integer ranges of
-//!   many or most values in the program. Rather, we only check
-//!   specifically the memory-access sequences. In practice, each such
-//!   sequence is likely to be a carefully-controlled sequence of IR
-//!   operations from, e.g., a sandboxing compiler (such as
-//!   `cranelift-wasm`) so adding annotations here to communicate
-//!   intent (ranges, bounds-checks, and the like) is no problem.
-//!
-//! Facts are attached to SSA values in CLIF, and are maintained
-//! through optimizations and through lowering. They are thus also
-//! present on VRegs in the VCode. In theory, facts could be checked
-//! at either level, though in practice it is most useful to check
-//! them at the VCode level if the goal is an end-to-end verification
-//! of certain properties (e.g., memory sandboxing).
-//!
-//! Checking facts entails visiting each instruction that defines a
-//! value with a fact, and checking the result's fact against the
-//! facts on arguments and the operand. For VCode, this is
-//! fundamentally a question of the target ISA's semantics, so we call
-//! into the `LowerBackend` for this. Note that during checking there
-//! is also limited forward propagation / inference, but only within
-//! an instruction: for example, an addressing mode commonly can
-//! include an addition, multiplication/shift, or extend operation,
-//! and there is no way to attach facts to the intermediate values
-//! "inside" the instruction, so instead the backend can use
-//! `FactContext::add()` and friends to forward-propagate facts.
-//!
-//! TODO:
-//!
-//! Deployment:
-//! - Add to fuzzing
-//! - Turn on during wasm spec-tests
-//!
-//! More checks:
-//! - Check that facts on `vmctx` GVs are subsumed by the actual facts
-//!   on the vmctx arg in block0 (function arg).
-//!
-//! Generality:
-//! - facts on outputs (in func signature)?
-//! - Implement checking at the CLIF level as well.
-//! - Check instructions that can trap as well?
-//!
-//! Nicer errors:
-//! - attach instruction index or some other identifier to errors
-//!
-//! Text format cleanup:
-//! - make the bitwidth on `max` facts optional in the CLIF text
-//!   format?
-//! - make offset in `mem` fact optional in the text format?
-//!
-//! Bikeshed colors (syntax):
-//! - Put fact bang-annotations after types?
-//!   `v0: i64 ! fact(..)` vs. `v0 ! fact(..): i64`
-
-use crate::ir;
-use crate::ir::types::*;
-use crate::isa::TargetIsa;
-use crate::machinst::{BlockIndex, LowerBackend, VCode};
-use crate::trace;
-use regalloc2::Function as _;
-use std::fmt;
-
-#[cfg(feature = "enable-serde")]
-use serde_derive::{Deserialize, Serialize};
-
-/// The result of checking proof-carrying-code facts.
-pub type PccResult<T> = std::result::Result<T, PccError>;
-
-/// An error or inconsistency discovered when checking proof-carrying
-/// code.
-#[derive(Debug, Clone)]
-pub enum PccError {
-    /// An operation wraps around, invalidating the stated value
-    /// range.
-    Overflow,
-    /// An input to an operator that produces a fact-annotated value
-    /// does not have a fact describing it, and one is needed.
-    MissingFact,
-    /// A derivation of an output fact is unsupported (incorrect or
-    /// not derivable).
-    UnsupportedFact,
-    /// A block parameter claims a fact that one of its predecessors
-    /// does not support.
-    UnsupportedBlockparam,
-    /// A memory access is out of bounds.
-    OutOfBounds,
-    /// Proof-carrying-code checking is not implemented for a
-    /// particular compiler backend.
-    UnimplementedBackend,
-    /// Proof-carrying-code checking is not implemented for a
-    /// particular instruction that instruction-selection chose. This
-    /// is an internal compiler error.
-    UnimplementedInst,
-    /// Access to an invalid or undefined field offset in a struct.
-    InvalidFieldOffset,
-    /// Access to a field via the wrong type.
-    BadFieldType,
-    /// Store to a read-only field.
-    WriteToReadOnlyField,
-    /// Store of data to a field with a fact that does not subsume the
-    /// field's fact.
-    InvalidStoredFact,
-}
-
-/// A fact on a value.
-#[derive(Clone, Debug, Hash, PartialEq, Eq)]
-#[cfg_attr(feature = "enable-serde", derive(Serialize, Deserialize))]
-pub enum Fact {
-    /// A bitslice of a value (up to a bitwidth) is within the given
-    /// integer range.
-    ///
-    /// The slicing behavior is needed because this fact can describe
-    /// both an SSA `Value`, whose entire value is well-defined, and a
-    /// `VReg` in VCode, whose bits beyond the type stored in that
-    /// register are don't-care (undefined).
-    Range {
-        /// The bitwidth of bits we care about, from the LSB upward.
-        bit_width: u16,
-        /// The minimum value that the bitslice can take
-        /// (inclusive). The range is unsigned: the specified bits of
-        /// the actual value will be greater than or equal to this
-        /// value, as evaluated by an unsigned integer comparison.
-        min: u64,
-        /// The maximum value that the bitslice can take
-        /// (inclusive). The range is unsigned: the specified bits of
-        /// the actual value will be less than or equal to this value,
-        /// as evaluated by an unsigned integer comparison.
-        max: u64,
-    },
-
-    /// A value bounded by a global value.
-    ///
-    /// The range is in `(min_GV + min_offset)..(max_GV +
-    /// max_offset)`, inclusive on the lower and upper bound.
-    DynamicRange {
-        /// The bitwidth of bits we care about, from the LSB upward.
-        bit_width: u16,
-        /// The lower bound, inclusive.
-        min: Expr,
-        /// The upper bound, inclusive.
-        max: Expr,
-    },
-
-    /// A pointer to a memory type.
-    Mem {
-        /// The memory type.
-        ty: ir::MemoryType,
-        /// The minimum offset into the memory type, inclusive.
-        min_offset: u64,
-        /// The maximum offset into the memory type, inclusive.
-        max_offset: u64,
-        /// This pointer can also be null.
-        nullable: bool,
-    },
-
-    /// A pointer to a memory type, dynamically bounded. The pointer
-    /// is within `(GV_min+offset_min)..(GV_max+offset_max)`
-    /// (inclusive on both ends) in the memory type.
-    DynamicMem {
-        /// The memory type.
-        ty: ir::MemoryType,
-        /// The lower bound, inclusive.
-        min: Expr,
-        /// The upper bound, inclusive.
-        max: Expr,
-        /// This pointer can also be null.
-        nullable: bool,
-    },
-
-    /// A definition of a value to be used as a symbol in
-    /// BaseExprs. There can only be one of these per value number.
-    ///
-    /// Note that this differs from a `DynamicRange` specifying that
-    /// some value in the program is the same as `value`. A `def(v1)`
-    /// fact is propagated to machine code and serves as a source of
-    /// truth: the value or location labeled with this fact *defines*
-    /// what `v1` is, and any `dynamic_range(64, v1, v1)`-labeled
-    /// values elsewhere are claiming to be equal to this value.
-    ///
-    /// This is necessary because we don't propagate SSA value labels
-    /// down to machine code otherwise; so when referring symbolically
-    /// to addresses and expressions derived from addresses, we need
-    /// to introduce the symbol first.
-    Def {
-        /// The SSA value this value defines.
-        value: ir::Value,
-    },
-
-    /// A comparison result between two dynamic values with a
-    /// comparison of a certain kind.
-    Compare {
-        /// The kind of comparison.
-        kind: ir::condcodes::IntCC,
-        /// The left-hand side of the comparison.
-        lhs: Expr,
-        /// The right-hand side of the comparison.
-        rhs: Expr,
-    },
-
-    /// A "conflict fact": this fact results from merging two other
-    /// facts, and it can never be satisfied -- checking any value
-    /// against this fact will fail.
-    Conflict,
-}
-
-/// A bound expression.
-#[derive(Clone, Debug, Hash, PartialEq, Eq)]
-#[cfg_attr(feature = "enable-serde", derive(Serialize, Deserialize))]
-pub struct Expr {
-    /// The dynamic (base) part.
-    pub base: BaseExpr,
-    /// The static (offset) part.
-    pub offset: i64,
-}
-
-/// The base part of a bound expression.
-#[derive(Clone, Debug, Hash, PartialEq, Eq)]
-#[cfg_attr(feature = "enable-serde", derive(Serialize, Deserialize))]
-pub enum BaseExpr {
-    /// No dynamic part (i.e., zero).
-    None,
-    /// A global value.
-    GlobalValue(ir::GlobalValue),
-    /// An SSA Value as a symbolic value. This can be referenced in
-    /// facts even after we've lowered out of SSA: it becomes simply
-    /// some symbolic value.
-    Value(ir::Value),
-    /// Top of the address space. This is "saturating": the offset
-    /// doesn't matter.
-    Max,
-}
-
-impl BaseExpr {
-    /// Is one base less than or equal to another? (We can't always
-    /// know; in such cases, returns `false`.)
-    fn le(lhs: &BaseExpr, rhs: &BaseExpr) -> bool {
-        // (i) reflexivity; (ii) 0 <= x for all (unsigned) x; (iii) x <= max for all x.
-        lhs == rhs || *lhs == BaseExpr::None || *rhs == BaseExpr::Max
-    }
-
-    /// Compute some BaseExpr that will be less than or equal to both
-    /// inputs. This is a generalization of `min` (but looser).
-    fn min(lhs: &BaseExpr, rhs: &BaseExpr) -> BaseExpr {
-        if lhs == rhs {
-            lhs.clone()
-        } else if *lhs == BaseExpr::Max {
-            rhs.clone()
-        } else if *rhs == BaseExpr::Max {
-            lhs.clone()
-        } else {
-            BaseExpr::None // zero is <= x for all (unsigned) x.
-        }
-    }
-
-    /// Compute some BaseExpr that will be greater than or equal to
-    /// both inputs.
-    fn max(lhs: &BaseExpr, rhs: &BaseExpr) -> BaseExpr {
-        if lhs == rhs {
-            lhs.clone()
-        } else if *lhs == BaseExpr::None {
-            rhs.clone()
-        } else if *rhs == BaseExpr::None {
-            lhs.clone()
-        } else {
-            BaseExpr::Max
-        }
-    }
-}
-
-impl Expr {
-    /// Constant value.
-    pub fn constant(offset: i64) -> Self {
-        Expr {
-            base: BaseExpr::None,
-            offset,
-        }
-    }
-
-    /// The value of an SSA value.
-    pub fn value(value: ir::Value) -> Self {
-        Expr {
-            base: BaseExpr::Value(value),
-            offset: 0,
-        }
-    }
-
-    /// The value of a global value.
-    pub fn global_value(gv: ir::GlobalValue) -> Self {
-        Expr {
-            base: BaseExpr::GlobalValue(gv),
-            offset: 0,
-        }
-    }
-
-    /// Is one expression definitely less than or equal to another?
-    /// (We can't always know; in such cases, returns `false`.)
-    fn le(lhs: &Expr, rhs: &Expr) -> bool {
-        if rhs.base == BaseExpr::Max {
-            true
-        } else {
-            BaseExpr::le(&lhs.base, &rhs.base) && lhs.offset <= rhs.offset
-        }
-    }
-
-    /// Generalization of `min`: compute some Expr that is less than
-    /// or equal to both inputs.
-    fn min(lhs: &Expr, rhs: &Expr) -> Expr {
-        if lhs.base == BaseExpr::None && lhs.offset == 0 {
-            lhs.clone()
-        } else if rhs.base == BaseExpr::None && rhs.offset == 0 {
-            rhs.clone()
-        } else {
-            Expr {
-                base: BaseExpr::min(&lhs.base, &rhs.base),
-                offset: std::cmp::min(lhs.offset, rhs.offset),
-            }
-        }
-    }
-
-    /// Generalization of `max`: compute some Expr that is greater
-    /// than or equal to both inputs.
-    fn max(lhs: &Expr, rhs: &Expr) -> Expr {
-        if lhs.base == BaseExpr::None && lhs.offset == 0 {
-            rhs.clone()
-        } else if rhs.base == BaseExpr::None && rhs.offset == 0 {
-            lhs.clone()
-        } else {
-            Expr {
-                base: BaseExpr::max(&lhs.base, &rhs.base),
-                offset: std::cmp::max(lhs.offset, rhs.offset),
-            }
-        }
-    }
-
-    /// Add one expression to another.
-    fn add(lhs: &Expr, rhs: &Expr) -> Option<Expr> {
-        if lhs.base == rhs.base {
-            Some(Expr {
-                base: lhs.base.clone(),
-                offset: lhs.offset.checked_add(rhs.offset)?,
-            })
-        } else if lhs.base == BaseExpr::None {
-            Some(Expr {
-                base: rhs.base.clone(),
-                offset: lhs.offset.checked_add(rhs.offset)?,
-            })
-        } else if rhs.base == BaseExpr::None {
-            Some(Expr {
-                base: lhs.base.clone(),
-                offset: lhs.offset.checked_add(rhs.offset)?,
-            })
-        } else {
-            Some(Expr {
-                base: BaseExpr::Max,
-                offset: 0,
-            })
-        }
-    }
-
-    /// Add a static offset to an expression.
-    pub fn offset(lhs: &Expr, rhs: i64) -> Option<Expr> {
-        let offset = lhs.offset.checked_add(rhs)?;
-        Some(Expr {
-            base: lhs.base.clone(),
-            offset,
-        })
-    }
-
-    /// Is this Expr a BaseExpr with no offset? Return it if so.
-    pub fn without_offset(&self) -> Option<&BaseExpr> {
-        if self.offset == 0 {
-            Some(&self.base)
-        } else {
-            None
-        }
-    }
-}
-
-impl fmt::Display for BaseExpr {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match self {
-            BaseExpr::None => Ok(()),
-            BaseExpr::Max => write!(f, "max"),
-            BaseExpr::GlobalValue(gv) => write!(f, "{gv}"),
-            BaseExpr::Value(value) => write!(f, "{value}"),
-        }
-    }
-}
-
-impl BaseExpr {
-    /// Does this dynamic_expression take an offset?
-    pub fn is_some(&self) -> bool {
-        match self {
-            BaseExpr::None => false,
-            _ => true,
-        }
-    }
-}
-
-impl fmt::Display for Expr {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        write!(f, "{}", self.base)?;
-        match self.offset {
-            offset if offset > 0 && self.base.is_some() => write!(f, "+{offset:#x}"),
-            offset if offset > 0 => write!(f, "{offset:#x}"),
-            offset if offset < 0 => {
-                let negative_offset = -i128::from(offset); // upcast to support i64::MIN.
-                write!(f, "-{negative_offset:#x}")
-            }
-            0 if self.base.is_some() => Ok(()),
-            0 => write!(f, "0"),
-            _ => unreachable!(),
-        }
-    }
-}
-
-impl fmt::Display for Fact {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match self {
-            Fact::Range {
-                bit_width,
-                min,
-                max,
-            } => write!(f, "range({bit_width}, {min:#x}, {max:#x})"),
-            Fact::DynamicRange {
-                bit_width,
-                min,
-                max,
-            } => {
-                write!(f, "dynamic_range({bit_width}, {min}, {max})")
-            }
-            Fact::Mem {
-                ty,
-                min_offset,
-                max_offset,
-                nullable,
-            } => {
-                let nullable_flag = if *nullable { ", nullable" } else { "" };
-                write!(
-                    f,
-                    "mem({ty}, {min_offset:#x}, {max_offset:#x}{nullable_flag})"
-                )
-            }
-            Fact::DynamicMem {
-                ty,
-                min,
-                max,
-                nullable,
-            } => {
-                let nullable_flag = if *nullable { ", nullable" } else { "" };
-                write!(f, "dynamic_mem({ty}, {min}, {max}{nullable_flag})")
-            }
-            Fact::Def { value } => write!(f, "def({value})"),
-            Fact::Compare { kind, lhs, rhs } => {
-                write!(f, "compare({kind}, {lhs}, {rhs})")
-            }
-            Fact::Conflict => write!(f, "conflict"),
-        }
-    }
-}
-
-impl Fact {
-    /// Create a range fact that specifies a single known constant value.
-    pub fn constant(bit_width: u16, value: u64) -> Self {
-        debug_assert!(value <= max_value_for_width(bit_width));
-        // `min` and `max` are inclusive, so this specifies a range of
-        // exactly one value.
-        Fact::Range {
-            bit_width,
-            min: value,
-            max: value,
-        }
-    }
-
-    /// Create a dynamic range fact that points to the base of a dynamic memory.
-    pub fn dynamic_base_ptr(ty: ir::MemoryType) -> Self {
-        Fact::DynamicMem {
-            ty,
-            min: Expr::constant(0),
-            max: Expr::constant(0),
-            nullable: false,
-        }
-    }
-
-    /// Create a fact that specifies the value is exactly an SSA value.
-    ///
-    /// Note that this differs from a `def` fact: it is not *defining*
-    /// a symbol to have the value that this fact is attached to;
-    /// rather it is claiming that this value is the same as whatever
-    /// that symbol is. (In other words, the def should be elsewhere,
-    /// and we are tying ourselves to it.)
-    pub fn value(bit_width: u16, value: ir::Value) -> Self {
-        Fact::DynamicRange {
-            bit_width,
-            min: Expr::value(value),
-            max: Expr::value(value),
-        }
-    }
-
-    /// Create a fact that specifies the value is exactly an SSA value plus some offset.
-    pub fn value_offset(bit_width: u16, value: ir::Value, offset: i64) -> Self {
-        Fact::DynamicRange {
-            bit_width,
-            min: Expr::offset(&Expr::value(value), offset).unwrap(),
-            max: Expr::offset(&Expr::value(value), offset).unwrap(),
-        }
-    }
-
-    /// Create a fact that specifies the value is exactly the value of a GV.
-    pub fn global_value(bit_width: u16, gv: ir::GlobalValue) -> Self {
-        Fact::DynamicRange {
-            bit_width,
-            min: Expr::global_value(gv),
-            max: Expr::global_value(gv),
-        }
-    }
-
-    /// Create a fact that specifies the value is exactly the value of a GV plus some offset.
-    pub fn global_value_offset(bit_width: u16, gv: ir::GlobalValue, offset: i64) -> Self {
-        Fact::DynamicRange {
-            bit_width,
-            min: Expr::offset(&Expr::global_value(gv), offset).unwrap(),
-            max: Expr::offset(&Expr::global_value(gv), offset).unwrap(),
-        }
-    }
-
-    /// Create a range fact that specifies the maximum range for a
-    /// value of the given bit-width.
-    pub const fn max_range_for_width(bit_width: u16) -> Self {
-        match bit_width {
-            bit_width if bit_width < 64 => Fact::Range {
-                bit_width,
-                min: 0,
-                max: (1u64 << bit_width) - 1,
-            },
-            64 => Fact::Range {
-                bit_width: 64,
-                min: 0,
-                max: u64::MAX,
-            },
-            _ => panic!("bit width too large!"),
-        }
-    }
-
-    /// Create a range fact that specifies the maximum range for a
-    /// value of the given bit-width, zero-extended into a wider
-    /// width.
-    pub const fn max_range_for_width_extended(from_width: u16, to_width: u16) -> Self {
-        debug_assert!(from_width <= to_width);
-        match from_width {
-            from_width if from_width < 64 => Fact::Range {
-                bit_width: to_width,
-                min: 0,
-                max: (1u64 << from_width) - 1,
-            },
-            64 => Fact::Range {
-                bit_width: to_width,
-                min: 0,
-                max: u64::MAX,
-            },
-            _ => panic!("bit width too large!"),
-        }
-    }
-
-    /// Try to infer a minimal fact for a value of the given IR type.
-    pub fn infer_from_type(ty: ir::Type) -> Option<&'static Self> {
-        static FACTS: [Fact; 4] = [
-            Fact::max_range_for_width(8),
-            Fact::max_range_for_width(16),
-            Fact::max_range_for_width(32),
-            Fact::max_range_for_width(64),
-        ];
-        match ty {
-            I8 => Some(&FACTS[0]),
-            I16 => Some(&FACTS[1]),
-            I32 => Some(&FACTS[2]),
-            I64 => Some(&FACTS[3]),
-            _ => None,
-        }
-    }
-
-    /// Does this fact "propagate" automatically, i.e., cause
-    /// instructions that process it to infer their own output facts?
-    /// Not all facts propagate automatically; otherwise, verification
-    /// would be much slower.
-    pub fn propagates(&self) -> bool {
-        match self {
-            Fact::Mem { .. } => true,
-            _ => false,
-        }
-    }
-
-    /// Is this a constant value of the given bitwidth? Return it as a
-    /// `Some(value)` if so.
-    pub fn as_const(&self, bits: u16) -> Option<u64> {
-        match self {
-            Fact::Range {
-                bit_width,
-                min,
-                max,
-            } if *bit_width == bits && min == max => Some(*min),
-            _ => None,
-        }
-    }
-
-    /// Is this fact a single-value range with a symbolic Expr?
-    pub fn as_symbol(&self) -> Option<&Expr> {
-        match self {
-            Fact::DynamicRange { min, max, .. } if min == max => Some(min),
-            _ => None,
-        }
-    }
-
-    /// Merge two facts. We take the *intersection*: that is, we know
-    /// both facts to be true, so we can intersect ranges. (This
-    /// differs from the usual static analysis approach, where we are
-    /// merging multiple possibilities into a generalized / widened
-    /// fact. We want to narrow here.)
-    pub fn intersect(a: &Fact, b: &Fact) -> Fact {
-        match (a, b) {
-            (
-                Fact::Range {
-                    bit_width: bw_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                },
-                Fact::Range {
-                    bit_width: bw_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                },
-            ) if bw_lhs == bw_rhs && max_lhs >= min_rhs && max_rhs >= min_lhs => Fact::Range {
-                bit_width: *bw_lhs,
-                min: std::cmp::max(*min_lhs, *min_rhs),
-                max: std::cmp::min(*max_lhs, *max_rhs),
-            },
-
-            (
-                Fact::DynamicRange {
-                    bit_width: bw_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                },
-                Fact::DynamicRange {
-                    bit_width: bw_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                },
-            ) if bw_lhs == bw_rhs && Expr::le(min_rhs, max_lhs) && Expr::le(min_lhs, max_rhs) => {
-                Fact::DynamicRange {
-                    bit_width: *bw_lhs,
-                    min: Expr::max(min_lhs, min_rhs),
-                    max: Expr::min(max_lhs, max_rhs),
-                }
-            }
-
-            (
-                Fact::Mem {
-                    ty: ty_lhs,
-                    min_offset: min_offset_lhs,
-                    max_offset: max_offset_lhs,
-                    nullable: nullable_lhs,
-                },
-                Fact::Mem {
-                    ty: ty_rhs,
-                    min_offset: min_offset_rhs,
-                    max_offset: max_offset_rhs,
-                    nullable: nullable_rhs,
-                },
-            ) if ty_lhs == ty_rhs
-                && max_offset_lhs >= min_offset_rhs
-                && max_offset_rhs >= min_offset_lhs =>
-            {
-                Fact::Mem {
-                    ty: *ty_lhs,
-                    min_offset: std::cmp::max(*min_offset_lhs, *min_offset_rhs),
-                    max_offset: std::cmp::min(*max_offset_lhs, *max_offset_rhs),
-                    nullable: *nullable_lhs && *nullable_rhs,
-                }
-            }
-
-            (
-                Fact::DynamicMem {
-                    ty: ty_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                    nullable: null_lhs,
-                },
-                Fact::DynamicMem {
-                    ty: ty_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                    nullable: null_rhs,
-                },
-            ) if ty_lhs == ty_rhs && Expr::le(min_rhs, max_lhs) && Expr::le(min_lhs, max_rhs) => {
-                Fact::DynamicMem {
-                    ty: *ty_lhs,
-                    min: Expr::max(min_lhs, min_rhs),
-                    max: Expr::min(max_lhs, max_rhs),
-                    nullable: *null_lhs && *null_rhs,
-                }
-            }
-
-            _ => Fact::Conflict,
-        }
-    }
-}
-
-macro_rules! ensure {
-    ( $condition:expr, $err:tt $(,)? ) => {
-        if !$condition {
-            return Err(PccError::$err);
-        }
-    };
-}
-
-macro_rules! bail {
-    ( $err:tt ) => {{
-        return Err(PccError::$err);
-    }};
-}
-
-/// The two kinds of inequalities: "strict" (`<`, `>`) and "loose"
-/// (`<=`, `>=`), the latter of which admit equality.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum InequalityKind {
-    /// Strict inequality: {less,greater}-than.
-    Strict,
-    /// Loose inequality: {less,greater}-than-or-equal.
-    Loose,
-}
-
-/// A "context" in which we can evaluate and derive facts. This
-/// context carries environment/global properties, such as the machine
-/// pointer width.
-pub struct FactContext<'a> {
-    function: &'a ir::Function,
-    pointer_width: u16,
-}
-
-impl<'a> FactContext<'a> {
-    /// Create a new "fact context" in which to evaluate facts.
-    pub fn new(function: &'a ir::Function, pointer_width: u16) -> Self {
-        FactContext {
-            function,
-            pointer_width,
-        }
-    }
-
-    /// Computes whether `lhs` "subsumes" (implies) `rhs`.
-    pub fn subsumes(&self, lhs: &Fact, rhs: &Fact) -> bool {
-        match (lhs, rhs) {
-            // Reflexivity.
-            (l, r) if l == r => true,
-
-            (
-                Fact::Range {
-                    bit_width: bw_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                },
-                Fact::Range {
-                    bit_width: bw_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                },
-            ) => {
-                // If the bitwidths we're claiming facts about are the
-                // same, or the left-hand-side makes a claim about a
-                // wider bitwidth, and if the right-hand-side range is
-                // larger than the left-hand-side range, than the LHS
-                // subsumes the RHS.
-                //
-                // In other words, we can always expand the claimed
-                // possible value range.
-                bw_lhs >= bw_rhs && max_lhs <= max_rhs && min_lhs >= min_rhs
-            }
-
-            (
-                Fact::DynamicRange {
-                    bit_width: bw_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                },
-                Fact::DynamicRange {
-                    bit_width: bw_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                },
-            ) => {
-                // Nearly same as above, but with dynamic-expression
-                // comparisons. Note that we require equal bitwidths
-                // here: unlike in the static case, we don't have
-                // fixed values for min and max, so we can't lean on
-                // the well-formedness requirements of the static
-                // ranges fitting within the bit-width max.
-                bw_lhs == bw_rhs && Expr::le(max_lhs, max_rhs) && Expr::le(min_rhs, min_lhs)
-            }
-
-            (
-                Fact::Mem {
-                    ty: ty_lhs,
-                    min_offset: min_offset_lhs,
-                    max_offset: max_offset_lhs,
-                    nullable: nullable_lhs,
-                },
-                Fact::Mem {
-                    ty: ty_rhs,
-                    min_offset: min_offset_rhs,
-                    max_offset: max_offset_rhs,
-                    nullable: nullable_rhs,
-                },
-            ) => {
-                ty_lhs == ty_rhs
-                    && max_offset_lhs <= max_offset_rhs
-                    && min_offset_lhs >= min_offset_rhs
-                    && (*nullable_lhs || !*nullable_rhs)
-            }
-
-            (
-                Fact::DynamicMem {
-                    ty: ty_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                    nullable: nullable_lhs,
-                },
-                Fact::DynamicMem {
-                    ty: ty_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                    nullable: nullable_rhs,
-                },
-            ) => {
-                ty_lhs == ty_rhs
-                    && Expr::le(max_lhs, max_rhs)
-                    && Expr::le(min_rhs, min_lhs)
-                    && (*nullable_lhs || !*nullable_rhs)
-            }
-
-            // Constant zero subsumes nullable DynamicMem pointers.
-            (
-                Fact::Range {
-                    bit_width,
-                    min: 0,
-                    max: 0,
-                },
-                Fact::DynamicMem { nullable: true, .. },
-            ) if *bit_width == self.pointer_width => true,
-
-            // Any fact subsumes a Def, because the Def makes no
-            // claims about the actual value (it ties a symbol to that
-            // value, but the value is fed to the symbol, not the
-            // other way around).
-            (_, Fact::Def { .. }) => true,
-
-            _ => false,
-        }
-    }
-
-    /// Computes whether the optional fact `lhs` subsumes (implies)
-    /// the optional fact `lhs`. A `None` never subsumes any fact, and
-    /// is always subsumed by any fact at all (or no fact).
-    pub fn subsumes_fact_optionals(&self, lhs: Option<&Fact>, rhs: Option<&Fact>) -> bool {
-        match (lhs, rhs) {
-            (None, None) => true,
-            (Some(_), None) => true,
-            (None, Some(_)) => false,
-            (Some(lhs), Some(rhs)) => self.subsumes(lhs, rhs),
-        }
-    }
-
-    /// Computes whatever fact can be known about the sum of two
-    /// values with attached facts. The add is performed to the given
-    /// bit-width. Note that this is distinct from the machine or
-    /// pointer width: e.g., many 64-bit machines can still do 32-bit
-    /// adds that wrap at 2^32.
-    pub fn add(&self, lhs: &Fact, rhs: &Fact, add_width: u16) -> Option<Fact> {
-        let result = match (lhs, rhs) {
-            (
-                Fact::Range {
-                    bit_width: bw_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                },
-                Fact::Range {
-                    bit_width: bw_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                },
-            ) if bw_lhs == bw_rhs && add_width >= *bw_lhs => {
-                let computed_min = min_lhs.checked_add(*min_rhs)?;
-                let computed_max = max_lhs.checked_add(*max_rhs)?;
-                let computed_max = std::cmp::min(max_value_for_width(add_width), computed_max);
-                Some(Fact::Range {
-                    bit_width: *bw_lhs,
-                    min: computed_min,
-                    max: computed_max,
-                })
-            }
-
-            (
-                Fact::Range {
-                    bit_width: bw_max,
-                    min,
-                    max,
-                },
-                Fact::Mem {
-                    ty,
-                    min_offset,
-                    max_offset,
-                    nullable,
-                },
-            )
-            | (
-                Fact::Mem {
-                    ty,
-                    min_offset,
-                    max_offset,
-                    nullable,
-                },
-                Fact::Range {
-                    bit_width: bw_max,
-                    min,
-                    max,
-                },
-            ) if *bw_max >= self.pointer_width
-                && add_width >= *bw_max
-                && (!*nullable || *max == 0) =>
-            {
-                let min_offset = min_offset.checked_add(*min)?;
-                let max_offset = max_offset.checked_add(*max)?;
-                Some(Fact::Mem {
-                    ty: *ty,
-                    min_offset,
-                    max_offset,
-                    nullable: false,
-                })
-            }
-
-            (
-                Fact::Range {
-                    bit_width: bw_static,
-                    min: min_static,
-                    max: max_static,
-                },
-                Fact::DynamicRange {
-                    bit_width: bw_dynamic,
-                    min: ref min_dynamic,
-                    max: ref max_dynamic,
-                },
-            )
-            | (
-                Fact::DynamicRange {
-                    bit_width: bw_dynamic,
-                    min: ref min_dynamic,
-                    max: ref max_dynamic,
-                },
-                Fact::Range {
-                    bit_width: bw_static,
-                    min: min_static,
-                    max: max_static,
-                },
-            ) if bw_static == bw_dynamic => {
-                let min = Expr::offset(min_dynamic, i64::try_from(*min_static).ok()?)?;
-                let max = Expr::offset(max_dynamic, i64::try_from(*max_static).ok()?)?;
-                Some(Fact::DynamicRange {
-                    bit_width: *bw_dynamic,
-                    min,
-                    max,
-                })
-            }
-
-            (
-                Fact::DynamicMem {
-                    ty,
-                    min: min_mem,
-                    max: max_mem,
-                    nullable: false,
-                },
-                Fact::DynamicRange {
-                    bit_width,
-                    min: min_range,
-                    max: max_range,
-                },
-            )
-            | (
-                Fact::DynamicRange {
-                    bit_width,
-                    min: min_range,
-                    max: max_range,
-                },
-                Fact::DynamicMem {
-                    ty,
-                    min: min_mem,
-                    max: max_mem,
-                    nullable: false,
-                },
-            ) if *bit_width == self.pointer_width => {
-                let min = Expr::add(min_mem, min_range)?;
-                let max = Expr::add(max_mem, max_range)?;
-                Some(Fact::DynamicMem {
-                    ty: *ty,
-                    min,
-                    max,
-                    nullable: false,
-                })
-            }
-
-            (
-                Fact::Mem {
-                    ty,
-                    min_offset,
-                    max_offset,
-                    nullable: false,
-                },
-                Fact::DynamicRange {
-                    bit_width,
-                    min: min_range,
-                    max: max_range,
-                },
-            )
-            | (
-                Fact::DynamicRange {
-                    bit_width,
-                    min: min_range,
-                    max: max_range,
-                },
-                Fact::Mem {
-                    ty,
-                    min_offset,
-                    max_offset,
-                    nullable: false,
-                },
-            ) if *bit_width == self.pointer_width => {
-                let min = Expr::offset(min_range, i64::try_from(*min_offset).ok()?)?;
-                let max = Expr::offset(max_range, i64::try_from(*max_offset).ok()?)?;
-                Some(Fact::DynamicMem {
-                    ty: *ty,
-                    min,
-                    max,
-                    nullable: false,
-                })
-            }
-
-            (
-                Fact::Range {
-                    bit_width: bw_static,
-                    min: min_static,
-                    max: max_static,
-                },
-                Fact::DynamicMem {
-                    ty,
-                    min: ref min_dynamic,
-                    max: ref max_dynamic,
-                    nullable,
-                },
-            )
-            | (
-                Fact::DynamicMem {
-                    ty,
-                    min: ref min_dynamic,
-                    max: ref max_dynamic,
-                    nullable,
-                },
-                Fact::Range {
-                    bit_width: bw_static,
-                    min: min_static,
-                    max: max_static,
-                },
-            ) if *bw_static == self.pointer_width && (!*nullable || *max_static == 0) => {
-                let min = Expr::offset(min_dynamic, i64::try_from(*min_static).ok()?)?;
-                let max = Expr::offset(max_dynamic, i64::try_from(*max_static).ok()?)?;
-                Some(Fact::DynamicMem {
-                    ty: *ty,
-                    min,
-                    max,
-                    nullable: false,
-                })
-            }
-
-            _ => None,
-        };
-
-        trace!("add: {lhs:?} + {rhs:?} -> {result:?}");
-        result
-    }
-
-    /// Computes the `uextend` of a value with the given facts.
-    pub fn uextend(&self, fact: &Fact, from_width: u16, to_width: u16) -> Option<Fact> {
-        if from_width == to_width {
-            return Some(fact.clone());
-        }
-
-        let result = match fact {
-            // If the claim is already for a same-or-wider value and the min
-            // and max are within range of the narrower value, we can
-            // claim the same range.
-            Fact::Range {
-                bit_width,
-                min,
-                max,
-            } if *bit_width >= from_width
-                && *min <= max_value_for_width(from_width)
-                && *max <= max_value_for_width(from_width) =>
-            {
-                Some(Fact::Range {
-                    bit_width: to_width,
-                    min: *min,
-                    max: *max,
-                })
-            }
-
-            // If the claim is a dynamic range for the from-width, we
-            // can extend to the to-width.
-            Fact::DynamicRange {
-                bit_width,
-                min,
-                max,
-            } if *bit_width == from_width => Some(Fact::DynamicRange {
-                bit_width: to_width,
-                min: min.clone(),
-                max: max.clone(),
-            }),
-
-            // If the claim is a definition of a value, we can say
-            // that the output has a range of exactly that value.
-            Fact::Def { value } => Some(Fact::value(to_width, *value)),
-
-            // Otherwise, we can at least claim that the value is
-            // within the range of `from_width`.
-            Fact::Range { .. } => Some(Fact::max_range_for_width_extended(from_width, to_width)),
-
-            _ => None,
-        };
-        trace!("uextend: fact {fact:?} from {from_width} to {to_width} -> {result:?}");
-        result
-    }
-
-    /// Computes the `sextend` of a value with the given facts.
-    pub fn sextend(&self, fact: &Fact, from_width: u16, to_width: u16) -> Option<Fact> {
-        match fact {
-            // If we have a defined value in bits 0..bit_width, and
-            // the MSB w.r.t. `from_width` is *not* set, then we can
-            // do the same as `uextend`.
-            Fact::Range {
-                bit_width,
-                // We can ignore `min`: it is always <= max in
-                // unsigned terms, and we check max's LSB below.
-                min: _,
-                max,
-            } if *bit_width == from_width && (*max & (1 << (*bit_width - 1)) == 0) => {
-                self.uextend(fact, from_width, to_width)
-            }
-            _ => None,
-        }
-    }
-
-    /// Computes the bit-truncation of a value with the given fact.
-    pub fn truncate(&self, fact: &Fact, from_width: u16, to_width: u16) -> Option<Fact> {
-        if from_width == to_width {
-            return Some(fact.clone());
-        }
-
-        trace!(
-            "truncate: fact {:?} from {} to {}",
-            fact,
-            from_width,
-            to_width
-        );
-
-        match fact {
-            Fact::Range {
-                bit_width,
-                min,
-                max,
-            } if *bit_width == from_width => {
-                let max_val = (1u64 << to_width) - 1;
-                if *min <= max_val && *max <= max_val {
-                    Some(Fact::Range {
-                        bit_width: to_width,
-                        min: *min,
-                        max: *max,
-                    })
-                } else {
-                    Some(Fact::Range {
-                        bit_width: to_width,
-                        min: 0,
-                        max: max_val,
-                    })
-                }
-            }
-            _ => None,
-        }
-    }
-
-    /// Scales a value with a fact by a known constant.
-    pub fn scale(&self, fact: &Fact, width: u16, factor: u32) -> Option<Fact> {
-        let result = match fact {
-            x if factor == 1 => Some(x.clone()),
-
-            Fact::Range {
-                bit_width,
-                min,
-                max,
-            } if *bit_width == width => {
-                let min = min.checked_mul(u64::from(factor))?;
-                let max = max.checked_mul(u64::from(factor))?;
-                if *bit_width < 64 && max > max_value_for_width(width) {
-                    return None;
-                }
-                Some(Fact::Range {
-                    bit_width: *bit_width,
-                    min,
-                    max,
-                })
-            }
-            _ => None,
-        };
-        trace!("scale: {fact:?} * {factor} at width {width} -> {result:?}");
-        result
-    }
-
-    /// Left-shifts a value with a fact by a known constant.
-    pub fn shl(&self, fact: &Fact, width: u16, amount: u16) -> Option<Fact> {
-        if amount >= 32 {
-            return None;
-        }
-        let factor: u32 = 1 << amount;
-        self.scale(fact, width, factor)
-    }
-
-    /// Offsets a value with a fact by a known amount.
-    pub fn offset(&self, fact: &Fact, width: u16, offset: i64) -> Option<Fact> {
-        if offset == 0 {
-            return Some(fact.clone());
-        }
-
-        let compute_offset = |base: u64| -> Option<u64> {
-            if offset >= 0 {
-                base.checked_add(u64::try_from(offset).unwrap())
-            } else {
-                base.checked_sub(u64::try_from(-offset).unwrap())
-            }
-        };
-
-        let result = match fact {
-            Fact::Range {
-                bit_width,
-                min,
-                max,
-            } if *bit_width == width => {
-                let min = compute_offset(*min)?;
-                let max = compute_offset(*max)?;
-                Some(Fact::Range {
-                    bit_width: *bit_width,
-                    min,
-                    max,
-                })
-            }
-            Fact::DynamicRange {
-                bit_width,
-                min,
-                max,
-            } if *bit_width == width => {
-                let min = Expr::offset(min, offset)?;
-                let max = Expr::offset(max, offset)?;
-                Some(Fact::DynamicRange {
-                    bit_width: *bit_width,
-                    min,
-                    max,
-                })
-            }
-            Fact::Mem {
-                ty,
-                min_offset: mem_min_offset,
-                max_offset: mem_max_offset,
-                nullable: false,
-            } => {
-                let min_offset = compute_offset(*mem_min_offset)?;
-                let max_offset = compute_offset(*mem_max_offset)?;
-                Some(Fact::Mem {
-                    ty: *ty,
-                    min_offset,
-                    max_offset,
-                    nullable: false,
-                })
-            }
-            Fact::DynamicMem {
-                ty,
-                min,
-                max,
-                nullable: false,
-            } => {
-                let min = Expr::offset(min, offset)?;
-                let max = Expr::offset(max, offset)?;
-                Some(Fact::DynamicMem {
-                    ty: *ty,
-                    min,
-                    max,
-                    nullable: false,
-                })
-            }
-            _ => None,
-        };
-        trace!("offset: {fact:?} + {offset} in width {width} -> {result:?}");
-        result
-    }
-
-    /// Check that accessing memory via a pointer with this fact, with
-    /// a memory access of the given size, is valid.
-    ///
-    /// If valid, returns the memory type and offset into that type
-    /// that this address accesses, if known, or `None` if the range
-    /// doesn't constrain the access to exactly one location.
-    fn check_address(&self, fact: &Fact, size: u32) -> PccResult<Option<(ir::MemoryType, u64)>> {
-        trace!("check_address: fact {:?} size {}", fact, size);
-        match fact {
-            Fact::Mem {
-                ty,
-                min_offset,
-                max_offset,
-                nullable: _,
-            } => {
-                let end_offset: u64 = max_offset
-                    .checked_add(u64::from(size))
-                    .ok_or(PccError::Overflow)?;
-                match &self.function.memory_types[*ty] {
-                    ir::MemoryTypeData::Struct { size, .. }
-                    | ir::MemoryTypeData::Memory { size } => {
-                        ensure!(end_offset <= *size, OutOfBounds)
-                    }
-                    ir::MemoryTypeData::DynamicMemory { .. } => bail!(OutOfBounds),
-                    ir::MemoryTypeData::Empty => bail!(OutOfBounds),
-                }
-                let specific_ty_and_offset = if min_offset == max_offset {
-                    Some((*ty, *min_offset))
-                } else {
-                    None
-                };
-                Ok(specific_ty_and_offset)
-            }
-            Fact::DynamicMem {
-                ty,
-                min: _,
-                max:
-                    Expr {
-                        base: BaseExpr::GlobalValue(max_gv),
-                        offset: max_offset,
-                    },
-                nullable: _,
-            } => match &self.function.memory_types[*ty] {
-                ir::MemoryTypeData::DynamicMemory {
-                    gv,
-                    size: mem_static_size,
-                } if gv == max_gv => {
-                    let end_offset = max_offset
-                        .checked_add(i64::from(size))
-                        .ok_or(PccError::Overflow)?;
-                    let mem_static_size =
-                        i64::try_from(*mem_static_size).map_err(|_| PccError::Overflow)?;
-                    ensure!(end_offset <= mem_static_size, OutOfBounds);
-                    Ok(None)
-                }
-                _ => bail!(OutOfBounds),
-            },
-            _ => bail!(OutOfBounds),
-        }
-    }
-
-    /// Get the access struct field, if any, by a pointer with the
-    /// given fact and an access of the given type.
-    pub fn struct_field<'b>(
-        &'b self,
-        fact: &Fact,
-        access_ty: ir::Type,
-    ) -> PccResult<Option<&'b ir::MemoryTypeField>> {
-        let (ty, offset) = match self.check_address(fact, access_ty.bytes())? {
-            Some((ty, offset)) => (ty, offset),
-            None => return Ok(None),
-        };
-
-        if let ir::MemoryTypeData::Struct { fields, .. } = &self.function.memory_types[ty] {
-            let field = fields
-                .iter()
-                .find(|field| field.offset == offset)
-                .ok_or(PccError::InvalidFieldOffset)?;
-            if field.ty != access_ty {
-                bail!(BadFieldType);
-            }
-            Ok(Some(field))
-        } else {
-            // Access to valid memory, but not a struct: no facts can be attached to the result.
-            Ok(None)
-        }
-    }
-
-    /// Check a load, and determine what fact, if any, the result of the load might have.
-    pub fn load<'b>(&'b self, fact: &Fact, access_ty: ir::Type) -> PccResult<Option<&'b Fact>> {
-        Ok(self
-            .struct_field(fact, access_ty)?
-            .and_then(|field| field.fact()))
-    }
-
-    /// Check a store.
-    pub fn store(
-        &self,
-        fact: &Fact,
-        access_ty: ir::Type,
-        data_fact: Option<&Fact>,
-    ) -> PccResult<()> {
-        if let Some(field) = self.struct_field(fact, access_ty)? {
-            // If it's a read-only field, disallow.
-            if field.readonly {
-                bail!(WriteToReadOnlyField);
-            }
-            // Check that the fact on the stored data subsumes the field's fact.
-            if !self.subsumes_fact_optionals(data_fact, field.fact()) {
-                bail!(InvalidStoredFact);
-            }
-        }
-        Ok(())
-    }
-
-    /// Apply a known inequality to rewrite dynamic bounds using transitivity, if possible.
-    ///
-    /// Given that `lhs >= rhs` (if not `strict`) or `lhs > rhs` (if
-    /// `strict`), update `fact`.
-    pub fn apply_inequality(
-        &self,
-        fact: &Fact,
-        lhs: &Fact,
-        rhs: &Fact,
-        kind: InequalityKind,
-    ) -> Fact {
-        let result = match (
-            lhs.as_symbol(),
-            lhs.as_const(self.pointer_width)
-                .and_then(|k| i64::try_from(k).ok()),
-            rhs.as_symbol(),
-            fact,
-        ) {
-            (
-                Some(lhs),
-                None,
-                Some(rhs),
-                Fact::DynamicMem {
-                    ty,
-                    min,
-                    max,
-                    nullable,
-                },
-            ) if rhs.base == max.base => {
-                let strict_offset = match kind {
-                    InequalityKind::Strict => 1,
-                    InequalityKind::Loose => 0,
-                };
-                if let Some(offset) = max
-                    .offset
-                    .checked_add(lhs.offset)
-                    .and_then(|x| x.checked_sub(rhs.offset))
-                    .and_then(|x| x.checked_sub(strict_offset))
-                {
-                    let new_max = Expr {
-                        base: lhs.base.clone(),
-                        offset,
-                    };
-                    Fact::DynamicMem {
-                        ty: *ty,
-                        min: min.clone(),
-                        max: new_max,
-                        nullable: *nullable,
-                    }
-                } else {
-                    fact.clone()
-                }
-            }
-
-            (
-                None,
-                Some(lhs_const),
-                Some(rhs),
-                Fact::DynamicMem {
-                    ty,
-                    min: _,
-                    max,
-                    nullable,
-                },
-            ) if rhs.base == max.base => {
-                let strict_offset = match kind {
-                    InequalityKind::Strict => 1,
-                    InequalityKind::Loose => 0,
-                };
-                if let Some(offset) = max
-                    .offset
-                    .checked_add(lhs_const)
-                    .and_then(|x| x.checked_sub(rhs.offset))
-                    .and_then(|x| x.checked_sub(strict_offset))
-                {
-                    Fact::Mem {
-                        ty: *ty,
-                        min_offset: 0,
-                        max_offset: u64::try_from(offset).unwrap_or(0),
-                        nullable: *nullable,
-                    }
-                } else {
-                    fact.clone()
-                }
-            }
-
-            _ => fact.clone(),
-        };
-        trace!("apply_inequality({fact:?}, {lhs:?}, {rhs:?}, {kind:?} -> {result:?}");
-        result
-    }
-
-    /// Compute the union of two facts, if possible.
-    pub fn union(&self, lhs: &Fact, rhs: &Fact) -> Option<Fact> {
-        let result = match (lhs, rhs) {
-            (lhs, rhs) if lhs == rhs => Some(lhs.clone()),
-
-            (
-                Fact::DynamicMem {
-                    ty: ty_lhs,
-                    min: min_lhs,
-                    max: max_lhs,
-                    nullable: nullable_lhs,
-                },
-                Fact::DynamicMem {
-                    ty: ty_rhs,
-                    min: min_rhs,
-                    max: max_rhs,
-                    nullable: nullable_rhs,
-                },
-            ) if ty_lhs == ty_rhs => Some(Fact::DynamicMem {
-                ty: *ty_lhs,
-                min: Expr::min(min_lhs, min_rhs),
-                max: Expr::max(max_lhs, max_rhs),
-                nullable: *nullable_lhs || *nullable_rhs,
-            }),
-
-            (
-                Fact::Range {
-                    bit_width: bw_const,
-                    min: 0,
-                    max: 0,
-                },
-                Fact::DynamicMem {
-                    ty,
-                    min,
-                    max,
-                    nullable: _,
-                },
-            )
-            | (
-                Fact::DynamicMem {
-                    ty,
-                    min,
-                    max,
-                    nullable: _,
-                },
-                Fact::Range {
-                    bit_width: bw_const,
-                    min: 0,
-                    max: 0,
-                },
-            ) if *bw_const == self.pointer_width => Some(Fact::DynamicMem {
-                ty: *ty,
-                min: min.clone(),
-                max: max.clone(),
-                nullable: true,
-            }),
-
-            (
-                Fact::Range {
-                    bit_width: bw_const,
-                    min: 0,
-                    max: 0,
-                },
-                Fact::Mem {
-                    ty,
-                    min_offset,
-                    max_offset,
-                    nullable: _,
-                },
-            )
-            | (
-                Fact::Mem {
-                    ty,
-                    min_offset,
-                    max_offset,
-                    nullable: _,
-                },
-                Fact::Range {
-                    bit_width: bw_const,
-                    min: 0,
-                    max: 0,
-                },
-            ) if *bw_const == self.pointer_width => Some(Fact::Mem {
-                ty: *ty,
-                min_offset: *min_offset,
-                max_offset: *max_offset,
-                nullable: true,
-            }),
-
-            _ => None,
-        };
-        trace!("union({lhs:?}, {rhs:?}) -> {result:?}");
-        result
-    }
-}
-
-fn max_value_for_width(bits: u16) -> u64 {
-    assert!(bits <= 64);
-    if bits == 64 {
-        u64::MAX
-    } else {
-        (1u64 << bits) - 1
-    }
-}
-
-/// Top-level entry point after compilation: this checks the facts in
-/// VCode.
-pub fn check_vcode_facts<B: LowerBackend + TargetIsa>(
-    f: &ir::Function,
-    vcode: &mut VCode<B::MInst>,
-    backend: &B,
-) -> PccResult<()> {
-    let ctx = FactContext::new(f, backend.triple().pointer_width().unwrap().bits().into());
-
-    // Check that individual instructions are valid according to input
-    // facts, and support the stated output facts.
-    for block in 0..vcode.num_blocks() {
-        let block = BlockIndex::new(block);
-        let mut flow_state = B::FactFlowState::default();
-        for inst in vcode.block_insns(block).iter() {
-            // Check any output facts on this inst.
-            if let Err(e) = backend.check_fact(&ctx, vcode, inst, &mut flow_state) {
-                log::error!("Error checking instruction: {:?}", vcode[inst]);
-                return Err(e);
-            }
-
-            // If this is a branch, check that all block arguments subsume
-            // the assumed facts on the blockparams of successors.
-            if vcode.is_branch(inst) {
-                for (succ_idx, succ) in vcode.block_succs(block).iter().enumerate() {
-                    for (arg, param) in vcode
-                        .branch_blockparams(block, inst, succ_idx)
-                        .iter()
-                        .zip(vcode.block_params(*succ).iter())
-                    {
-                        let arg_fact = vcode.vreg_fact(*arg);
-                        let param_fact = vcode.vreg_fact(*param);
-                        if !ctx.subsumes_fact_optionals(arg_fact, param_fact) {
-                            return Err(PccError::UnsupportedBlockparam);
-                        }
-                    }
-                }
-            }
-        }
-    }
-    Ok(())
-}