_Z23GetScriptForDestinationRKNSt3__17variantIJ14CNoDestination17PubKeyDestination6PKHash10ScriptHash19WitnessV0ScriptHash16WitnessV0KeyHash16WitnessV1Taproot11PayToAnchor14WitnessUnknownEEE:
  167|  4.00k|{
  168|  4.00k|    return std::visit(CScriptVisitor(), dest);
  169|  4.00k|}
addresstype.cpp:_ZNK12_GLOBAL__N_114CScriptVisitorclERK16WitnessV0KeyHash:
  132|  4.00k|    {
  133|  4.00k|        return CScript() << OP_0 << ToByteVector(id);
  134|  4.00k|    }

_ZN16WitnessV0KeyHashC2ERK7uint160:
   82|  4.00k|    explicit WitnessV0KeyHash(const uint160& hash) : BaseHash(hash) {}
_ZN16WitnessV1TaprootC2ERK11XOnlyPubKey:
   91|  6.03k|    explicit WitnessV1Taproot(const XOnlyPubKey& xpk) : XOnlyPubKey(xpk) {}

_ZN4CoinC2Ev:
   55|  17.4k|    Coin() : fCoinBase(false), nHeight(0) { }
_ZNK4Coin7IsSpentEv:
   81|  99.0k|    bool IsSpent() const {
   82|  99.0k|        return out.IsNull();
   83|  99.0k|    }
_ZN4Coin11UnserializeI10DataStreamEEvRT_:
   70|  10.8k|    void Unserialize(Stream &s) {
   71|  10.8k|        uint32_t code = 0;
   72|  10.8k|        ::Unserialize(s, VARINT(code));
  ------------------
  |  |  500|  10.8k|#define VARINT(obj) Using<VarIntFormatter<VarIntMode::DEFAULT>>(obj)
  ------------------
   73|  10.8k|        nHeight = code >> 1;
   74|  10.8k|        fCoinBase = code & 1;
   75|  10.8k|        ::Unserialize(s, Using<TxOutCompression>(out));
   76|  10.8k|    }

_Z17internal_bswap_32j:
   54|   188M|{
   55|   188M|#ifdef bitcoin_builtin_bswap32
   56|   188M|    return bitcoin_builtin_bswap32(x);
  ------------------
  |  |   24|   188M|#      define bitcoin_builtin_bswap32(x) __builtin_bswap32(x)
  ------------------
   57|       |#else
   58|       |    return (((x & 0xff000000U) >> 24) | ((x & 0x00ff0000U) >>  8) |
   59|       |            ((x & 0x0000ff00U) <<  8) | ((x & 0x000000ffU) << 24));
   60|       |#endif
   61|   188M|}
_Z17internal_bswap_64m:
   64|   482k|{
   65|   482k|#ifdef bitcoin_builtin_bswap64
   66|   482k|    return bitcoin_builtin_bswap64(x);
  ------------------
  |  |   27|   482k|#      define bitcoin_builtin_bswap64(x) __builtin_bswap64(x)
  ------------------
   67|       |#else
   68|       |     return (((x & 0xff00000000000000ull) >> 56)
   69|       |          | ((x & 0x00ff000000000000ull) >> 40)
   70|       |          | ((x & 0x0000ff0000000000ull) >> 24)
   71|       |          | ((x & 0x000000ff00000000ull) >> 8)
   72|       |          | ((x & 0x00000000ff000000ull) << 8)
   73|       |          | ((x & 0x0000000000ff0000ull) << 24)
   74|       |          | ((x & 0x000000000000ff00ull) << 40)
   75|       |          | ((x & 0x00000000000000ffull) << 56));
   76|       |#endif
   77|   482k|}

_Z16htole16_internalt:
   19|  3.41k|{
   20|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_16(host_16bits);
   21|  3.41k|        else return host_16bits;
   22|  3.41k|}
_Z16le16toh_internalt:
   29|  27.2k|{
   30|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_16(little_endian_16bits);
   31|  27.2k|        else return little_endian_16bits;
   32|  27.2k|}
_Z16htobe32_internalj:
   34|  3.81M|{
   35|  3.81M|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_32(host_32bits);
   36|       |        else return host_32bits;
   37|  3.81M|}
_Z16htole32_internalj:
   39|  14.6M|{
   40|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_32(host_32bits);
   41|  14.6M|        else return host_32bits;
   42|  14.6M|}
_Z16be32toh_internalj:
   44|   184M|{
   45|   184M|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_32(big_endian_32bits);
   46|       |        else return big_endian_32bits;
   47|   184M|}
_Z16le32toh_internalj:
   49|  7.25M|{
   50|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_32(little_endian_32bits);
   51|  7.25M|        else return little_endian_32bits;
   52|  7.25M|}
_Z16htobe64_internalm:
   54|   482k|{
   55|   482k|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_64(host_64bits);
   56|       |        else return host_64bits;
   57|   482k|}
_Z16htole64_internalm:
   59|   673k|{
   60|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_64(host_64bits);
   61|   673k|        else return host_64bits;
   62|   673k|}
_Z16le64toh_internalm:
   69|  23.9k|{
   70|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_64(little_endian_64bits);
   71|  23.9k|        else return little_endian_64bits;
   72|  23.9k|}

_Z20GetSpecialScriptSizej:
   87|  6.82k|{
   88|  6.82k|    if (nSize == 0 || nSize == 1)
  ------------------
  |  Branch (88:9): [True: 2.07k, False: 4.74k]
  |  Branch (88:23): [True: 1.04k, False: 3.70k]
  ------------------
   89|  3.12k|        return 20;
   90|  3.70k|    if (nSize == 2 || nSize == 3 || nSize == 4 || nSize == 5)
  ------------------
  |  Branch (90:9): [True: 851, False: 2.85k]
  |  Branch (90:23): [True: 529, False: 2.32k]
  |  Branch (90:37): [True: 551, False: 1.77k]
  |  Branch (90:51): [True: 1.77k, False: 0]
  ------------------
   91|  3.70k|        return 32;
   92|      0|    return 0;
   93|  3.70k|}
_Z16DecompressScriptR7CScriptjRK9prevectorILj33EhjiE:
   96|  6.72k|{
   97|  6.72k|    switch(nSize) {
  ------------------
  |  Branch (97:12): [True: 0, False: 6.72k]
  ------------------
   98|  2.05k|    case 0x00:
  ------------------
  |  Branch (98:5): [True: 2.05k, False: 4.66k]
  ------------------
   99|  2.05k|        script.resize(25);
  100|  2.05k|        script[0] = OP_DUP;
  101|  2.05k|        script[1] = OP_HASH160;
  102|  2.05k|        script[2] = 20;
  103|  2.05k|        memcpy(&script[3], in.data(), 20);
  104|  2.05k|        script[23] = OP_EQUALVERIFY;
  105|  2.05k|        script[24] = OP_CHECKSIG;
  106|  2.05k|        return true;
  107|  1.03k|    case 0x01:
  ------------------
  |  Branch (107:5): [True: 1.03k, False: 5.69k]
  ------------------
  108|  1.03k|        script.resize(23);
  109|  1.03k|        script[0] = OP_HASH160;
  110|  1.03k|        script[1] = 20;
  111|  1.03k|        memcpy(&script[2], in.data(), 20);
  112|  1.03k|        script[22] = OP_EQUAL;
  113|  1.03k|        return true;
  114|    848|    case 0x02:
  ------------------
  |  Branch (114:5): [True: 848, False: 5.87k]
  ------------------
  115|  1.32k|    case 0x03:
  ------------------
  |  Branch (115:5): [True: 478, False: 6.24k]
  ------------------
  116|  1.32k|        script.resize(35);
  117|  1.32k|        script[0] = 33;
  118|  1.32k|        script[1] = nSize;
  119|  1.32k|        memcpy(&script[2], in.data(), 32);
  120|  1.32k|        script[34] = OP_CHECKSIG;
  121|  1.32k|        return true;
  122|    543|    case 0x04:
  ------------------
  |  Branch (122:5): [True: 543, False: 6.17k]
  ------------------
  123|  2.30k|    case 0x05:
  ------------------
  |  Branch (123:5): [True: 1.76k, False: 4.95k]
  ------------------
  124|  2.30k|        unsigned char vch[33] = {};
  125|  2.30k|        vch[0] = nSize - 2;
  126|  2.30k|        memcpy(&vch[1], in.data(), 32);
  127|  2.30k|        CPubKey pubkey{vch};
  128|  2.30k|        if (!pubkey.Decompress())
  ------------------
  |  Branch (128:13): [True: 1.42k, False: 881]
  ------------------
  129|  1.42k|            return false;
  130|    881|        assert(pubkey.size() == 65);
  131|    881|        script.resize(67);
  132|    881|        script[0] = 65;
  133|    881|        memcpy(&script[1], pubkey.begin(), 65);
  134|    881|        script[66] = OP_CHECKSIG;
  135|    881|        return true;
  136|  6.72k|    }
  137|      0|    return false;
  138|  6.72k|}
_Z16DecompressAmountm:
  169|  10.6k|{
  170|       |    // x = 0  OR  x = 1+10*(9*n + d - 1) + e  OR  x = 1+10*(n - 1) + 9
  171|  10.6k|    if (x == 0)
  ------------------
  |  Branch (171:9): [True: 2.71k, False: 7.95k]
  ------------------
  172|  2.71k|        return 0;
  173|  7.95k|    x--;
  174|       |    // x = 10*(9*n + d - 1) + e
  175|  7.95k|    int e = x % 10;
  176|  7.95k|    x /= 10;
  177|  7.95k|    uint64_t n = 0;
  178|  7.95k|    if (e < 9) {
  ------------------
  |  Branch (178:9): [True: 7.60k, False: 353]
  ------------------
  179|       |        // x = 9*n + d - 1
  180|  7.60k|        int d = (x % 9) + 1;
  181|  7.60k|        x /= 9;
  182|       |        // x = n
  183|  7.60k|        n = x*10 + d;
  184|  7.60k|    } else {
  185|    353|        n = x+1;
  186|    353|    }
  187|  42.8k|    while (e) {
  ------------------
  |  Branch (187:12): [True: 34.8k, False: 7.95k]
  ------------------
  188|  34.8k|        n *= 10;
  189|  34.8k|        e--;
  190|  34.8k|    }
  191|  7.95k|    return n;
  192|  10.6k|}

_ZN16TxOutCompression16SerializationOpsI10DataStream6CTxOut17ActionUnserializeEEvRT0_RT_T1_:
  115|  10.7k|    FORMATTER_METHODS(CTxOut, obj) { READWRITE(Using<AmountCompression>(obj.nValue), Using<ScriptCompression>(obj.scriptPubKey)); }
  ------------------
  |  |  156|  10.7k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN17AmountCompression5UnserI10DataStreamlEEvRT_RT0_:
  105|  10.7k|    {
  106|  10.7k|        uint64_t v;
  107|  10.7k|        s >> VARINT(v);
  ------------------
  |  |  500|  10.7k|#define VARINT(obj) Using<VarIntFormatter<VarIntMode::DEFAULT>>(obj)
  ------------------
  108|  10.7k|        val = DecompressAmount(v);
  109|  10.7k|    }
_ZN17ScriptCompression5UnserI10DataStreamEEvRT_R7CScript:
   77|  10.6k|    void Unser(Stream &s, CScript& script) {
   78|  10.6k|        unsigned int nSize = 0;
   79|  10.6k|        s >> VARINT(nSize);
  ------------------
  |  |  500|  10.6k|#define VARINT(obj) Using<VarIntFormatter<VarIntMode::DEFAULT>>(obj)
  ------------------
   80|  10.6k|        if (nSize < nSpecialScripts) {
  ------------------
  |  Branch (80:13): [True: 6.82k, False: 3.84k]
  ------------------
   81|  6.82k|            CompressedScript vch(GetSpecialScriptSize(nSize), 0x00);
   82|  6.82k|            s >> Span{vch};
   83|  6.82k|            DecompressScript(script, nSize, vch);
   84|  6.82k|            return;
   85|  6.82k|        }
   86|  3.84k|        nSize -= nSpecialScripts;
   87|  3.84k|        if (nSize > MAX_SCRIPT_SIZE) {
  ------------------
  |  Branch (87:13): [True: 127, False: 3.71k]
  ------------------
   88|       |            // Overly long script, replace with a short invalid one
   89|    127|            script << OP_RETURN;
   90|    127|            s.ignore(nSize);
   91|  3.71k|        } else {
   92|  3.71k|            script.resize(nSize);
   93|  3.71k|            s >> Span{script};
   94|  3.71k|        }
   95|  3.84k|    }

_Z10MoneyRangeRKl:
   27|  8.86k|inline bool MoneyRange(const CAmount& nValue) { return (nValue >= 0 && nValue <= MAX_MONEY); }
  ------------------
  |  Branch (27:57): [True: 8.57k, False: 285]
  |  Branch (27:72): [True: 8.34k, False: 231]
  ------------------

_Z9WriteLE16ITk8ByteTypehEvPT_t:
   44|    197|{
   45|    197|    uint16_t v = htole16_internal(x);
   46|    197|    memcpy(ptr, &v, 2);
   47|    197|}
_Z9WriteLE32ITk8ByteTypehEvPT_j:
   51|  2.02M|{
   52|  2.02M|    uint32_t v = htole32_internal(x);
   53|  2.02M|    memcpy(ptr, &v, 4);
   54|  2.02M|}
_Z8ReadLE16ITk8ByteTypehEtPKT_:
   20|  26.7k|{
   21|  26.7k|    uint16_t x;
   22|  26.7k|    memcpy(&x, ptr, 2);
   23|  26.7k|    return le16toh_internal(x);
   24|  26.7k|}
_Z8ReadLE32ITk8ByteTypehEjPKT_:
   28|  6.42M|{
   29|  6.42M|    uint32_t x;
   30|  6.42M|    memcpy(&x, ptr, 4);
   31|  6.42M|    return le32toh_internal(x);
   32|  6.42M|}
_Z9WriteLE64ITk8ByteTypehEvPT_m:
   58|   391k|{
   59|   391k|    uint64_t v = htole64_internal(x);
   60|   391k|    memcpy(ptr, &v, 8);
   61|   391k|}
_Z9WriteBE32ITk8ByteTypehEvPT_j:
   96|  3.81M|{
   97|  3.81M|    uint32_t v = htobe32_internal(x);
   98|  3.81M|    memcpy(ptr, &v, 4);
   99|  3.81M|}
_Z8ReadBE32ITk8ByteTypehEjPKT_:
   73|   184M|{
   74|   184M|    uint32_t x;
   75|   184M|    memcpy(&x, ptr, 4);
   76|   184M|    return be32toh_internal(x);
   77|   184M|}
_Z9WriteBE64ITk8ByteTypehEvPT_m:
  103|   482k|{
  104|   482k|    uint64_t v = htobe64_internal(x);
  105|   482k|    memcpy(ptr, &v, 8);
  106|   482k|}

_ZN10CRIPEMD160C2Ev:
  243|   391k|{
  244|   391k|    ripemd160::Initialize(s);
  245|   391k|}
_ZN10CRIPEMD1605WriteEPKhm:
  248|  1.17M|{
  249|  1.17M|    const unsigned char* end = data + len;
  250|  1.17M|    size_t bufsize = bytes % 64;
  251|  1.17M|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (251:9): [True: 774k, False: 399k]
  |  Branch (251:20): [True: 391k, False: 383k]
  ------------------
  252|       |        // Fill the buffer, and process it.
  253|   391k|        memcpy(buf + bufsize, data, 64 - bufsize);
  254|   391k|        bytes += 64 - bufsize;
  255|   391k|        data += 64 - bufsize;
  256|   391k|        ripemd160::Transform(s, buf);
  257|   391k|        bufsize = 0;
  258|   391k|    }
  259|  1.17M|    while (end - data >= 64) {
  ------------------
  |  Branch (259:12): [True: 5.29k, False: 1.17M]
  ------------------
  260|       |        // Process full chunks directly from the source.
  261|  5.29k|        ripemd160::Transform(s, data);
  262|  5.29k|        bytes += 64;
  263|  5.29k|        data += 64;
  264|  5.29k|    }
  265|  1.17M|    if (end > data) {
  ------------------
  |  Branch (265:9): [True: 774k, False: 399k]
  ------------------
  266|       |        // Fill the buffer with what remains.
  267|   774k|        memcpy(buf + bufsize, data, end - data);
  268|   774k|        bytes += end - data;
  269|   774k|    }
  270|  1.17M|    return *this;
  271|  1.17M|}
_ZN10CRIPEMD1608FinalizeEPh:
  274|   391k|{
  275|   391k|    static const unsigned char pad[64] = {0x80};
  276|   391k|    unsigned char sizedesc[8];
  277|   391k|    WriteLE64(sizedesc, bytes << 3);
  278|   391k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  279|   391k|    Write(sizedesc, 8);
  280|   391k|    WriteLE32(hash, s[0]);
  281|   391k|    WriteLE32(hash + 4, s[1]);
  282|   391k|    WriteLE32(hash + 8, s[2]);
  283|   391k|    WriteLE32(hash + 12, s[3]);
  284|   391k|    WriteLE32(hash + 16, s[4]);
  285|   391k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd16010InitializeEPj:
   25|   391k|{
   26|   391k|    s[0] = 0x67452301ul;
   27|   391k|    s[1] = 0xEFCDAB89ul;
   28|   391k|    s[2] = 0x98BADCFEul;
   29|   391k|    s[3] = 0x10325476ul;
   30|   391k|    s[4] = 0xC3D2E1F0ul;
   31|   391k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1609TransformEPjPKh:
   55|   396k|{
   56|   396k|    uint32_t a1 = s[0], b1 = s[1], c1 = s[2], d1 = s[3], e1 = s[4];
   57|   396k|    uint32_t a2 = a1, b2 = b1, c2 = c1, d2 = d1, e2 = e1;
   58|   396k|    uint32_t w0 = ReadLE32(chunk + 0), w1 = ReadLE32(chunk + 4), w2 = ReadLE32(chunk + 8), w3 = ReadLE32(chunk + 12);
   59|   396k|    uint32_t w4 = ReadLE32(chunk + 16), w5 = ReadLE32(chunk + 20), w6 = ReadLE32(chunk + 24), w7 = ReadLE32(chunk + 28);
   60|   396k|    uint32_t w8 = ReadLE32(chunk + 32), w9 = ReadLE32(chunk + 36), w10 = ReadLE32(chunk + 40), w11 = ReadLE32(chunk + 44);
   61|   396k|    uint32_t w12 = ReadLE32(chunk + 48), w13 = ReadLE32(chunk + 52), w14 = ReadLE32(chunk + 56), w15 = ReadLE32(chunk + 60);
   62|       |
   63|   396k|    R11(a1, b1, c1, d1, e1, w0, 11);
   64|   396k|    R12(a2, b2, c2, d2, e2, w5, 8);
   65|   396k|    R11(e1, a1, b1, c1, d1, w1, 14);
   66|   396k|    R12(e2, a2, b2, c2, d2, w14, 9);
   67|   396k|    R11(d1, e1, a1, b1, c1, w2, 15);
   68|   396k|    R12(d2, e2, a2, b2, c2, w7, 9);
   69|   396k|    R11(c1, d1, e1, a1, b1, w3, 12);
   70|   396k|    R12(c2, d2, e2, a2, b2, w0, 11);
   71|   396k|    R11(b1, c1, d1, e1, a1, w4, 5);
   72|   396k|    R12(b2, c2, d2, e2, a2, w9, 13);
   73|   396k|    R11(a1, b1, c1, d1, e1, w5, 8);
   74|   396k|    R12(a2, b2, c2, d2, e2, w2, 15);
   75|   396k|    R11(e1, a1, b1, c1, d1, w6, 7);
   76|   396k|    R12(e2, a2, b2, c2, d2, w11, 15);
   77|   396k|    R11(d1, e1, a1, b1, c1, w7, 9);
   78|   396k|    R12(d2, e2, a2, b2, c2, w4, 5);
   79|   396k|    R11(c1, d1, e1, a1, b1, w8, 11);
   80|   396k|    R12(c2, d2, e2, a2, b2, w13, 7);
   81|   396k|    R11(b1, c1, d1, e1, a1, w9, 13);
   82|   396k|    R12(b2, c2, d2, e2, a2, w6, 7);
   83|   396k|    R11(a1, b1, c1, d1, e1, w10, 14);
   84|   396k|    R12(a2, b2, c2, d2, e2, w15, 8);
   85|   396k|    R11(e1, a1, b1, c1, d1, w11, 15);
   86|   396k|    R12(e2, a2, b2, c2, d2, w8, 11);
   87|   396k|    R11(d1, e1, a1, b1, c1, w12, 6);
   88|   396k|    R12(d2, e2, a2, b2, c2, w1, 14);
   89|   396k|    R11(c1, d1, e1, a1, b1, w13, 7);
   90|   396k|    R12(c2, d2, e2, a2, b2, w10, 14);
   91|   396k|    R11(b1, c1, d1, e1, a1, w14, 9);
   92|   396k|    R12(b2, c2, d2, e2, a2, w3, 12);
   93|   396k|    R11(a1, b1, c1, d1, e1, w15, 8);
   94|   396k|    R12(a2, b2, c2, d2, e2, w12, 6);
   95|       |
   96|   396k|    R21(e1, a1, b1, c1, d1, w7, 7);
   97|   396k|    R22(e2, a2, b2, c2, d2, w6, 9);
   98|   396k|    R21(d1, e1, a1, b1, c1, w4, 6);
   99|   396k|    R22(d2, e2, a2, b2, c2, w11, 13);
  100|   396k|    R21(c1, d1, e1, a1, b1, w13, 8);
  101|   396k|    R22(c2, d2, e2, a2, b2, w3, 15);
  102|   396k|    R21(b1, c1, d1, e1, a1, w1, 13);
  103|   396k|    R22(b2, c2, d2, e2, a2, w7, 7);
  104|   396k|    R21(a1, b1, c1, d1, e1, w10, 11);
  105|   396k|    R22(a2, b2, c2, d2, e2, w0, 12);
  106|   396k|    R21(e1, a1, b1, c1, d1, w6, 9);
  107|   396k|    R22(e2, a2, b2, c2, d2, w13, 8);
  108|   396k|    R21(d1, e1, a1, b1, c1, w15, 7);
  109|   396k|    R22(d2, e2, a2, b2, c2, w5, 9);
  110|   396k|    R21(c1, d1, e1, a1, b1, w3, 15);
  111|   396k|    R22(c2, d2, e2, a2, b2, w10, 11);
  112|   396k|    R21(b1, c1, d1, e1, a1, w12, 7);
  113|   396k|    R22(b2, c2, d2, e2, a2, w14, 7);
  114|   396k|    R21(a1, b1, c1, d1, e1, w0, 12);
  115|   396k|    R22(a2, b2, c2, d2, e2, w15, 7);
  116|   396k|    R21(e1, a1, b1, c1, d1, w9, 15);
  117|   396k|    R22(e2, a2, b2, c2, d2, w8, 12);
  118|   396k|    R21(d1, e1, a1, b1, c1, w5, 9);
  119|   396k|    R22(d2, e2, a2, b2, c2, w12, 7);
  120|   396k|    R21(c1, d1, e1, a1, b1, w2, 11);
  121|   396k|    R22(c2, d2, e2, a2, b2, w4, 6);
  122|   396k|    R21(b1, c1, d1, e1, a1, w14, 7);
  123|   396k|    R22(b2, c2, d2, e2, a2, w9, 15);
  124|   396k|    R21(a1, b1, c1, d1, e1, w11, 13);
  125|   396k|    R22(a2, b2, c2, d2, e2, w1, 13);
  126|   396k|    R21(e1, a1, b1, c1, d1, w8, 12);
  127|   396k|    R22(e2, a2, b2, c2, d2, w2, 11);
  128|       |
  129|   396k|    R31(d1, e1, a1, b1, c1, w3, 11);
  130|   396k|    R32(d2, e2, a2, b2, c2, w15, 9);
  131|   396k|    R31(c1, d1, e1, a1, b1, w10, 13);
  132|   396k|    R32(c2, d2, e2, a2, b2, w5, 7);
  133|   396k|    R31(b1, c1, d1, e1, a1, w14, 6);
  134|   396k|    R32(b2, c2, d2, e2, a2, w1, 15);
  135|   396k|    R31(a1, b1, c1, d1, e1, w4, 7);
  136|   396k|    R32(a2, b2, c2, d2, e2, w3, 11);
  137|   396k|    R31(e1, a1, b1, c1, d1, w9, 14);
  138|   396k|    R32(e2, a2, b2, c2, d2, w7, 8);
  139|   396k|    R31(d1, e1, a1, b1, c1, w15, 9);
  140|   396k|    R32(d2, e2, a2, b2, c2, w14, 6);
  141|   396k|    R31(c1, d1, e1, a1, b1, w8, 13);
  142|   396k|    R32(c2, d2, e2, a2, b2, w6, 6);
  143|   396k|    R31(b1, c1, d1, e1, a1, w1, 15);
  144|   396k|    R32(b2, c2, d2, e2, a2, w9, 14);
  145|   396k|    R31(a1, b1, c1, d1, e1, w2, 14);
  146|   396k|    R32(a2, b2, c2, d2, e2, w11, 12);
  147|   396k|    R31(e1, a1, b1, c1, d1, w7, 8);
  148|   396k|    R32(e2, a2, b2, c2, d2, w8, 13);
  149|   396k|    R31(d1, e1, a1, b1, c1, w0, 13);
  150|   396k|    R32(d2, e2, a2, b2, c2, w12, 5);
  151|   396k|    R31(c1, d1, e1, a1, b1, w6, 6);
  152|   396k|    R32(c2, d2, e2, a2, b2, w2, 14);
  153|   396k|    R31(b1, c1, d1, e1, a1, w13, 5);
  154|   396k|    R32(b2, c2, d2, e2, a2, w10, 13);
  155|   396k|    R31(a1, b1, c1, d1, e1, w11, 12);
  156|   396k|    R32(a2, b2, c2, d2, e2, w0, 13);
  157|   396k|    R31(e1, a1, b1, c1, d1, w5, 7);
  158|   396k|    R32(e2, a2, b2, c2, d2, w4, 7);
  159|   396k|    R31(d1, e1, a1, b1, c1, w12, 5);
  160|   396k|    R32(d2, e2, a2, b2, c2, w13, 5);
  161|       |
  162|   396k|    R41(c1, d1, e1, a1, b1, w1, 11);
  163|   396k|    R42(c2, d2, e2, a2, b2, w8, 15);
  164|   396k|    R41(b1, c1, d1, e1, a1, w9, 12);
  165|   396k|    R42(b2, c2, d2, e2, a2, w6, 5);
  166|   396k|    R41(a1, b1, c1, d1, e1, w11, 14);
  167|   396k|    R42(a2, b2, c2, d2, e2, w4, 8);
  168|   396k|    R41(e1, a1, b1, c1, d1, w10, 15);
  169|   396k|    R42(e2, a2, b2, c2, d2, w1, 11);
  170|   396k|    R41(d1, e1, a1, b1, c1, w0, 14);
  171|   396k|    R42(d2, e2, a2, b2, c2, w3, 14);
  172|   396k|    R41(c1, d1, e1, a1, b1, w8, 15);
  173|   396k|    R42(c2, d2, e2, a2, b2, w11, 14);
  174|   396k|    R41(b1, c1, d1, e1, a1, w12, 9);
  175|   396k|    R42(b2, c2, d2, e2, a2, w15, 6);
  176|   396k|    R41(a1, b1, c1, d1, e1, w4, 8);
  177|   396k|    R42(a2, b2, c2, d2, e2, w0, 14);
  178|   396k|    R41(e1, a1, b1, c1, d1, w13, 9);
  179|   396k|    R42(e2, a2, b2, c2, d2, w5, 6);
  180|   396k|    R41(d1, e1, a1, b1, c1, w3, 14);
  181|   396k|    R42(d2, e2, a2, b2, c2, w12, 9);
  182|   396k|    R41(c1, d1, e1, a1, b1, w7, 5);
  183|   396k|    R42(c2, d2, e2, a2, b2, w2, 12);
  184|   396k|    R41(b1, c1, d1, e1, a1, w15, 6);
  185|   396k|    R42(b2, c2, d2, e2, a2, w13, 9);
  186|   396k|    R41(a1, b1, c1, d1, e1, w14, 8);
  187|   396k|    R42(a2, b2, c2, d2, e2, w9, 12);
  188|   396k|    R41(e1, a1, b1, c1, d1, w5, 6);
  189|   396k|    R42(e2, a2, b2, c2, d2, w7, 5);
  190|   396k|    R41(d1, e1, a1, b1, c1, w6, 5);
  191|   396k|    R42(d2, e2, a2, b2, c2, w10, 15);
  192|   396k|    R41(c1, d1, e1, a1, b1, w2, 12);
  193|   396k|    R42(c2, d2, e2, a2, b2, w14, 8);
  194|       |
  195|   396k|    R51(b1, c1, d1, e1, a1, w4, 9);
  196|   396k|    R52(b2, c2, d2, e2, a2, w12, 8);
  197|   396k|    R51(a1, b1, c1, d1, e1, w0, 15);
  198|   396k|    R52(a2, b2, c2, d2, e2, w15, 5);
  199|   396k|    R51(e1, a1, b1, c1, d1, w5, 5);
  200|   396k|    R52(e2, a2, b2, c2, d2, w10, 12);
  201|   396k|    R51(d1, e1, a1, b1, c1, w9, 11);
  202|   396k|    R52(d2, e2, a2, b2, c2, w4, 9);
  203|   396k|    R51(c1, d1, e1, a1, b1, w7, 6);
  204|   396k|    R52(c2, d2, e2, a2, b2, w1, 12);
  205|   396k|    R51(b1, c1, d1, e1, a1, w12, 8);
  206|   396k|    R52(b2, c2, d2, e2, a2, w5, 5);
  207|   396k|    R51(a1, b1, c1, d1, e1, w2, 13);
  208|   396k|    R52(a2, b2, c2, d2, e2, w8, 14);
  209|   396k|    R51(e1, a1, b1, c1, d1, w10, 12);
  210|   396k|    R52(e2, a2, b2, c2, d2, w7, 6);
  211|   396k|    R51(d1, e1, a1, b1, c1, w14, 5);
  212|   396k|    R52(d2, e2, a2, b2, c2, w6, 8);
  213|   396k|    R51(c1, d1, e1, a1, b1, w1, 12);
  214|   396k|    R52(c2, d2, e2, a2, b2, w2, 13);
  215|   396k|    R51(b1, c1, d1, e1, a1, w3, 13);
  216|   396k|    R52(b2, c2, d2, e2, a2, w13, 6);
  217|   396k|    R51(a1, b1, c1, d1, e1, w8, 14);
  218|   396k|    R52(a2, b2, c2, d2, e2, w14, 5);
  219|   396k|    R51(e1, a1, b1, c1, d1, w11, 11);
  220|   396k|    R52(e2, a2, b2, c2, d2, w0, 15);
  221|   396k|    R51(d1, e1, a1, b1, c1, w6, 8);
  222|   396k|    R52(d2, e2, a2, b2, c2, w3, 13);
  223|   396k|    R51(c1, d1, e1, a1, b1, w15, 5);
  224|   396k|    R52(c2, d2, e2, a2, b2, w9, 11);
  225|   396k|    R51(b1, c1, d1, e1, a1, w13, 6);
  226|   396k|    R52(b2, c2, d2, e2, a2, w11, 11);
  227|       |
  228|   396k|    uint32_t t = s[0];
  229|   396k|    s[0] = s[1] + c1 + d2;
  230|   396k|    s[1] = s[2] + d1 + e2;
  231|   396k|    s[2] = s[3] + e1 + a2;
  232|   396k|    s[3] = s[4] + a1 + b2;
  233|   396k|    s[4] = t + b1 + c2;
  234|   396k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R11ERjjS1_jjji:
   41|  6.34M|void inline R11(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f1(b, c, d), x, 0, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1605RoundERjjS1_jjjjji:
   36|  63.4M|{
   37|  63.4M|    a = rol(a + f + x + k, r) + e;
   38|  63.4M|    c = rol(c, 10);
   39|  63.4M|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603rolEji:
   33|   126M|uint32_t inline rol(uint32_t x, int i) { return (x << i) | (x >> (32 - i)); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f1Ejjj:
   17|  12.6M|uint32_t inline f1(uint32_t x, uint32_t y, uint32_t z) { return x ^ y ^ z; }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R12ERjjS1_jjji:
   47|  6.34M|void inline R12(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f5(b, c, d), x, 0x50A28BE6ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f5Ejjj:
   21|  12.6M|uint32_t inline f5(uint32_t x, uint32_t y, uint32_t z) { return x ^ (y | ~z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R21ERjjS1_jjji:
   42|  6.34M|void inline R21(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f2(b, c, d), x, 0x5A827999ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f2Ejjj:
   18|  12.6M|uint32_t inline f2(uint32_t x, uint32_t y, uint32_t z) { return (x & y) | (~x & z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R22ERjjS1_jjji:
   48|  6.34M|void inline R22(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f4(b, c, d), x, 0x5C4DD124ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f4Ejjj:
   20|  12.6M|uint32_t inline f4(uint32_t x, uint32_t y, uint32_t z) { return (x & z) | (y & ~z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R31ERjjS1_jjji:
   43|  6.34M|void inline R31(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f3(b, c, d), x, 0x6ED9EBA1ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f3Ejjj:
   19|  12.6M|uint32_t inline f3(uint32_t x, uint32_t y, uint32_t z) { return (x | ~y) ^ z; }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R32ERjjS1_jjji:
   49|  6.34M|void inline R32(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f3(b, c, d), x, 0x6D703EF3ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R41ERjjS1_jjji:
   44|  6.34M|void inline R41(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f4(b, c, d), x, 0x8F1BBCDCul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R42ERjjS1_jjji:
   50|  6.34M|void inline R42(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f2(b, c, d), x, 0x7A6D76E9ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R51ERjjS1_jjji:
   45|  6.34M|void inline R51(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f5(b, c, d), x, 0xA953FD4Eul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R52ERjjS1_jjji:
   51|  6.34M|void inline R52(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f1(b, c, d), x, 0, r); }

_ZN5CSHA1C2Ev:
  150|  14.4k|{
  151|  14.4k|    sha1::Initialize(s);
  152|  14.4k|}
_ZN5CSHA15WriteEPKhm:
  155|  43.2k|{
  156|  43.2k|    const unsigned char* end = data + len;
  157|  43.2k|    size_t bufsize = bytes % 64;
  158|  43.2k|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (158:9): [True: 28.5k, False: 14.6k]
  |  Branch (158:20): [True: 14.6k, False: 13.9k]
  ------------------
  159|       |        // Fill the buffer, and process it.
  160|  14.6k|        memcpy(buf + bufsize, data, 64 - bufsize);
  161|  14.6k|        bytes += 64 - bufsize;
  162|  14.6k|        data += 64 - bufsize;
  163|  14.6k|        sha1::Transform(s, buf);
  164|  14.6k|        bufsize = 0;
  165|  14.6k|    }
  166|  43.9k|    while (end - data >= 64) {
  ------------------
  |  Branch (166:12): [True: 728, False: 43.2k]
  ------------------
  167|       |        // Process full chunks directly from the source.
  168|    728|        sha1::Transform(s, data);
  169|    728|        bytes += 64;
  170|    728|        data += 64;
  171|    728|    }
  172|  43.2k|    if (end > data) {
  ------------------
  |  Branch (172:9): [True: 28.5k, False: 14.6k]
  ------------------
  173|       |        // Fill the buffer with what remains.
  174|  28.5k|        memcpy(buf + bufsize, data, end - data);
  175|  28.5k|        bytes += end - data;
  176|  28.5k|    }
  177|  43.2k|    return *this;
  178|  43.2k|}
_ZN5CSHA18FinalizeEPh:
  181|  14.4k|{
  182|  14.4k|    static const unsigned char pad[64] = {0x80};
  183|  14.4k|    unsigned char sizedesc[8];
  184|  14.4k|    WriteBE64(sizedesc, bytes << 3);
  185|  14.4k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  186|  14.4k|    Write(sizedesc, 8);
  187|  14.4k|    WriteBE32(hash, s[0]);
  188|  14.4k|    WriteBE32(hash + 4, s[1]);
  189|  14.4k|    WriteBE32(hash + 8, s[2]);
  190|  14.4k|    WriteBE32(hash + 12, s[3]);
  191|  14.4k|    WriteBE32(hash + 16, s[4]);
  192|  14.4k|}
sha1.cpp:_ZN12_GLOBAL__N_14sha110InitializeEPj:
   32|  14.4k|{
   33|  14.4k|    s[0] = 0x67452301ul;
   34|  14.4k|    s[1] = 0xEFCDAB89ul;
   35|  14.4k|    s[2] = 0x98BADCFEul;
   36|  14.4k|    s[3] = 0x10325476ul;
   37|  14.4k|    s[4] = 0xC3D2E1F0ul;
   38|  14.4k|}
sha1.cpp:_ZN12_GLOBAL__N_14sha19TransformEPjPKh:
   47|  15.3k|{
   48|  15.3k|    uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4];
   49|  15.3k|    uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
   50|       |
   51|  15.3k|    Round(a, b, c, d, e, f1(b, c, d), k1, w0 = ReadBE32(chunk + 0));
   52|  15.3k|    Round(e, a, b, c, d, f1(a, b, c), k1, w1 = ReadBE32(chunk + 4));
   53|  15.3k|    Round(d, e, a, b, c, f1(e, a, b), k1, w2 = ReadBE32(chunk + 8));
   54|  15.3k|    Round(c, d, e, a, b, f1(d, e, a), k1, w3 = ReadBE32(chunk + 12));
   55|  15.3k|    Round(b, c, d, e, a, f1(c, d, e), k1, w4 = ReadBE32(chunk + 16));
   56|  15.3k|    Round(a, b, c, d, e, f1(b, c, d), k1, w5 = ReadBE32(chunk + 20));
   57|  15.3k|    Round(e, a, b, c, d, f1(a, b, c), k1, w6 = ReadBE32(chunk + 24));
   58|  15.3k|    Round(d, e, a, b, c, f1(e, a, b), k1, w7 = ReadBE32(chunk + 28));
   59|  15.3k|    Round(c, d, e, a, b, f1(d, e, a), k1, w8 = ReadBE32(chunk + 32));
   60|  15.3k|    Round(b, c, d, e, a, f1(c, d, e), k1, w9 = ReadBE32(chunk + 36));
   61|  15.3k|    Round(a, b, c, d, e, f1(b, c, d), k1, w10 = ReadBE32(chunk + 40));
   62|  15.3k|    Round(e, a, b, c, d, f1(a, b, c), k1, w11 = ReadBE32(chunk + 44));
   63|  15.3k|    Round(d, e, a, b, c, f1(e, a, b), k1, w12 = ReadBE32(chunk + 48));
   64|  15.3k|    Round(c, d, e, a, b, f1(d, e, a), k1, w13 = ReadBE32(chunk + 52));
   65|  15.3k|    Round(b, c, d, e, a, f1(c, d, e), k1, w14 = ReadBE32(chunk + 56));
   66|  15.3k|    Round(a, b, c, d, e, f1(b, c, d), k1, w15 = ReadBE32(chunk + 60));
   67|       |
   68|  15.3k|    Round(e, a, b, c, d, f1(a, b, c), k1, w0 = left(w0 ^ w13 ^ w8 ^ w2));
   69|  15.3k|    Round(d, e, a, b, c, f1(e, a, b), k1, w1 = left(w1 ^ w14 ^ w9 ^ w3));
   70|  15.3k|    Round(c, d, e, a, b, f1(d, e, a), k1, w2 = left(w2 ^ w15 ^ w10 ^ w4));
   71|  15.3k|    Round(b, c, d, e, a, f1(c, d, e), k1, w3 = left(w3 ^ w0 ^ w11 ^ w5));
   72|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k2, w4 = left(w4 ^ w1 ^ w12 ^ w6));
   73|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k2, w5 = left(w5 ^ w2 ^ w13 ^ w7));
   74|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k2, w6 = left(w6 ^ w3 ^ w14 ^ w8));
   75|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k2, w7 = left(w7 ^ w4 ^ w15 ^ w9));
   76|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k2, w8 = left(w8 ^ w5 ^ w0 ^ w10));
   77|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k2, w9 = left(w9 ^ w6 ^ w1 ^ w11));
   78|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k2, w10 = left(w10 ^ w7 ^ w2 ^ w12));
   79|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k2, w11 = left(w11 ^ w8 ^ w3 ^ w13));
   80|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k2, w12 = left(w12 ^ w9 ^ w4 ^ w14));
   81|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k2, w13 = left(w13 ^ w10 ^ w5 ^ w15));
   82|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k2, w14 = left(w14 ^ w11 ^ w6 ^ w0));
   83|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k2, w15 = left(w15 ^ w12 ^ w7 ^ w1));
   84|       |
   85|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k2, w0 = left(w0 ^ w13 ^ w8 ^ w2));
   86|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k2, w1 = left(w1 ^ w14 ^ w9 ^ w3));
   87|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k2, w2 = left(w2 ^ w15 ^ w10 ^ w4));
   88|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k2, w3 = left(w3 ^ w0 ^ w11 ^ w5));
   89|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k2, w4 = left(w4 ^ w1 ^ w12 ^ w6));
   90|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k2, w5 = left(w5 ^ w2 ^ w13 ^ w7));
   91|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k2, w6 = left(w6 ^ w3 ^ w14 ^ w8));
   92|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k2, w7 = left(w7 ^ w4 ^ w15 ^ w9));
   93|  15.3k|    Round(a, b, c, d, e, f3(b, c, d), k3, w8 = left(w8 ^ w5 ^ w0 ^ w10));
   94|  15.3k|    Round(e, a, b, c, d, f3(a, b, c), k3, w9 = left(w9 ^ w6 ^ w1 ^ w11));
   95|  15.3k|    Round(d, e, a, b, c, f3(e, a, b), k3, w10 = left(w10 ^ w7 ^ w2 ^ w12));
   96|  15.3k|    Round(c, d, e, a, b, f3(d, e, a), k3, w11 = left(w11 ^ w8 ^ w3 ^ w13));
   97|  15.3k|    Round(b, c, d, e, a, f3(c, d, e), k3, w12 = left(w12 ^ w9 ^ w4 ^ w14));
   98|  15.3k|    Round(a, b, c, d, e, f3(b, c, d), k3, w13 = left(w13 ^ w10 ^ w5 ^ w15));
   99|  15.3k|    Round(e, a, b, c, d, f3(a, b, c), k3, w14 = left(w14 ^ w11 ^ w6 ^ w0));
  100|  15.3k|    Round(d, e, a, b, c, f3(e, a, b), k3, w15 = left(w15 ^ w12 ^ w7 ^ w1));
  101|       |
  102|  15.3k|    Round(c, d, e, a, b, f3(d, e, a), k3, w0 = left(w0 ^ w13 ^ w8 ^ w2));
  103|  15.3k|    Round(b, c, d, e, a, f3(c, d, e), k3, w1 = left(w1 ^ w14 ^ w9 ^ w3));
  104|  15.3k|    Round(a, b, c, d, e, f3(b, c, d), k3, w2 = left(w2 ^ w15 ^ w10 ^ w4));
  105|  15.3k|    Round(e, a, b, c, d, f3(a, b, c), k3, w3 = left(w3 ^ w0 ^ w11 ^ w5));
  106|  15.3k|    Round(d, e, a, b, c, f3(e, a, b), k3, w4 = left(w4 ^ w1 ^ w12 ^ w6));
  107|  15.3k|    Round(c, d, e, a, b, f3(d, e, a), k3, w5 = left(w5 ^ w2 ^ w13 ^ w7));
  108|  15.3k|    Round(b, c, d, e, a, f3(c, d, e), k3, w6 = left(w6 ^ w3 ^ w14 ^ w8));
  109|  15.3k|    Round(a, b, c, d, e, f3(b, c, d), k3, w7 = left(w7 ^ w4 ^ w15 ^ w9));
  110|  15.3k|    Round(e, a, b, c, d, f3(a, b, c), k3, w8 = left(w8 ^ w5 ^ w0 ^ w10));
  111|  15.3k|    Round(d, e, a, b, c, f3(e, a, b), k3, w9 = left(w9 ^ w6 ^ w1 ^ w11));
  112|  15.3k|    Round(c, d, e, a, b, f3(d, e, a), k3, w10 = left(w10 ^ w7 ^ w2 ^ w12));
  113|  15.3k|    Round(b, c, d, e, a, f3(c, d, e), k3, w11 = left(w11 ^ w8 ^ w3 ^ w13));
  114|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k4, w12 = left(w12 ^ w9 ^ w4 ^ w14));
  115|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k4, w13 = left(w13 ^ w10 ^ w5 ^ w15));
  116|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k4, w14 = left(w14 ^ w11 ^ w6 ^ w0));
  117|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k4, w15 = left(w15 ^ w12 ^ w7 ^ w1));
  118|       |
  119|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k4, w0 = left(w0 ^ w13 ^ w8 ^ w2));
  120|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k4, w1 = left(w1 ^ w14 ^ w9 ^ w3));
  121|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k4, w2 = left(w2 ^ w15 ^ w10 ^ w4));
  122|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k4, w3 = left(w3 ^ w0 ^ w11 ^ w5));
  123|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k4, w4 = left(w4 ^ w1 ^ w12 ^ w6));
  124|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k4, w5 = left(w5 ^ w2 ^ w13 ^ w7));
  125|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k4, w6 = left(w6 ^ w3 ^ w14 ^ w8));
  126|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k4, w7 = left(w7 ^ w4 ^ w15 ^ w9));
  127|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k4, w8 = left(w8 ^ w5 ^ w0 ^ w10));
  128|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k4, w9 = left(w9 ^ w6 ^ w1 ^ w11));
  129|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k4, w10 = left(w10 ^ w7 ^ w2 ^ w12));
  130|  15.3k|    Round(a, b, c, d, e, f2(b, c, d), k4, w11 = left(w11 ^ w8 ^ w3 ^ w13));
  131|  15.3k|    Round(e, a, b, c, d, f2(a, b, c), k4, w12 = left(w12 ^ w9 ^ w4 ^ w14));
  132|  15.3k|    Round(d, e, a, b, c, f2(e, a, b), k4, left(w13 ^ w10 ^ w5 ^ w15));
  133|  15.3k|    Round(c, d, e, a, b, f2(d, e, a), k4, left(w14 ^ w11 ^ w6 ^ w0));
  134|  15.3k|    Round(b, c, d, e, a, f2(c, d, e), k4, left(w15 ^ w12 ^ w7 ^ w1));
  135|       |
  136|  15.3k|    s[0] += a;
  137|  15.3k|    s[1] += b;
  138|  15.3k|    s[2] += c;
  139|  15.3k|    s[3] += d;
  140|  15.3k|    s[4] += e;
  141|  15.3k|}
sha1.cpp:_ZN12_GLOBAL__N_14sha15RoundEjRjjjS1_jjj:
   19|  1.22M|{
   20|  1.22M|    e += ((a << 5) | (a >> 27)) + f + k + w;
   21|  1.22M|    b = (b << 30) | (b >> 2);
   22|  1.22M|}
sha1.cpp:_ZN12_GLOBAL__N_14sha12f1Ejjj:
   24|   306k|uint32_t inline f1(uint32_t b, uint32_t c, uint32_t d) { return d ^ (b & (c ^ d)); }
sha1.cpp:_ZN12_GLOBAL__N_14sha14leftEj:
   28|   981k|uint32_t inline left(uint32_t x) { return (x << 1) | (x >> 31); }
sha1.cpp:_ZN12_GLOBAL__N_14sha12f2Ejjj:
   25|   613k|uint32_t inline f2(uint32_t b, uint32_t c, uint32_t d) { return b ^ c ^ d; }
sha1.cpp:_ZN12_GLOBAL__N_14sha12f3Ejjj:
   26|   306k|uint32_t inline f3(uint32_t b, uint32_t c, uint32_t d) { return (b & c) | (d & (b | c)); }

_ZN7CSHA256C2Ev:
  697|   361k|{
  698|   361k|    sha256::Initialize(s);
  699|   361k|}
_ZN7CSHA2565WriteEPKhm:
  702|  26.9M|{
  703|  26.9M|    const unsigned char* end = data + len;
  704|  26.9M|    size_t bufsize = bytes % 64;
  705|  26.9M|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (705:9): [True: 26.0M, False: 885k]
  |  Branch (705:20): [True: 4.58M, False: 21.4M]
  ------------------
  706|       |        // Fill the buffer, and process it.
  707|  4.58M|        memcpy(buf + bufsize, data, 64 - bufsize);
  708|  4.58M|        bytes += 64 - bufsize;
  709|  4.58M|        data += 64 - bufsize;
  710|  4.58M|        Transform(s, buf, 1);
  711|  4.58M|        bufsize = 0;
  712|  4.58M|    }
  713|  26.9M|    if (end - data >= 64) {
  ------------------
  |  Branch (713:9): [True: 103k, False: 26.8M]
  ------------------
  714|   103k|        size_t blocks = (end - data) / 64;
  715|   103k|        Transform(s, data, blocks);
  716|   103k|        data += 64 * blocks;
  717|   103k|        bytes += 64 * blocks;
  718|   103k|    }
  719|  26.9M|    if (end > data) {
  ------------------
  |  Branch (719:9): [True: 26.0M, False: 886k]
  ------------------
  720|       |        // Fill the buffer with what remains.
  721|  26.0M|        memcpy(buf + bufsize, data, end - data);
  722|  26.0M|        bytes += end - data;
  723|  26.0M|    }
  724|  26.9M|    return *this;
  725|  26.9M|}
_ZN7CSHA2568FinalizeEPh:
  728|   468k|{
  729|   468k|    static const unsigned char pad[64] = {0x80};
  730|   468k|    unsigned char sizedesc[8];
  731|   468k|    WriteBE64(sizedesc, bytes << 3);
  732|   468k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  733|   468k|    Write(sizedesc, 8);
  734|   468k|    WriteBE32(hash, s[0]);
  735|   468k|    WriteBE32(hash + 4, s[1]);
  736|   468k|    WriteBE32(hash + 8, s[2]);
  737|   468k|    WriteBE32(hash + 12, s[3]);
  738|   468k|    WriteBE32(hash + 16, s[4]);
  739|   468k|    WriteBE32(hash + 20, s[5]);
  740|   468k|    WriteBE32(hash + 24, s[6]);
  741|   468k|    WriteBE32(hash + 28, s[7]);
  742|   468k|}
_ZN7CSHA2565ResetEv:
  745|   102k|{
  746|   102k|    bytes = 0;
  747|   102k|    sha256::Initialize(s);
  748|   102k|    return *this;
  749|   102k|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2569TransformEPjPKhm:
  102|  4.68M|{
  103|  16.2M|    while (blocks--) {
  ------------------
  |  Branch (103:12): [True: 11.5M, False: 4.68M]
  ------------------
  104|  11.5M|        uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
  105|  11.5M|        uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
  106|       |
  107|  11.5M|        Round(a, b, c, d, e, f, g, h, 0x428a2f98 + (w0 = ReadBE32(chunk + 0)));
  108|  11.5M|        Round(h, a, b, c, d, e, f, g, 0x71374491 + (w1 = ReadBE32(chunk + 4)));
  109|  11.5M|        Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf + (w2 = ReadBE32(chunk + 8)));
  110|  11.5M|        Round(f, g, h, a, b, c, d, e, 0xe9b5dba5 + (w3 = ReadBE32(chunk + 12)));
  111|  11.5M|        Round(e, f, g, h, a, b, c, d, 0x3956c25b + (w4 = ReadBE32(chunk + 16)));
  112|  11.5M|        Round(d, e, f, g, h, a, b, c, 0x59f111f1 + (w5 = ReadBE32(chunk + 20)));
  113|  11.5M|        Round(c, d, e, f, g, h, a, b, 0x923f82a4 + (w6 = ReadBE32(chunk + 24)));
  114|  11.5M|        Round(b, c, d, e, f, g, h, a, 0xab1c5ed5 + (w7 = ReadBE32(chunk + 28)));
  115|  11.5M|        Round(a, b, c, d, e, f, g, h, 0xd807aa98 + (w8 = ReadBE32(chunk + 32)));
  116|  11.5M|        Round(h, a, b, c, d, e, f, g, 0x12835b01 + (w9 = ReadBE32(chunk + 36)));
  117|  11.5M|        Round(g, h, a, b, c, d, e, f, 0x243185be + (w10 = ReadBE32(chunk + 40)));
  118|  11.5M|        Round(f, g, h, a, b, c, d, e, 0x550c7dc3 + (w11 = ReadBE32(chunk + 44)));
  119|  11.5M|        Round(e, f, g, h, a, b, c, d, 0x72be5d74 + (w12 = ReadBE32(chunk + 48)));
  120|  11.5M|        Round(d, e, f, g, h, a, b, c, 0x80deb1fe + (w13 = ReadBE32(chunk + 52)));
  121|  11.5M|        Round(c, d, e, f, g, h, a, b, 0x9bdc06a7 + (w14 = ReadBE32(chunk + 56)));
  122|  11.5M|        Round(b, c, d, e, f, g, h, a, 0xc19bf174 + (w15 = ReadBE32(chunk + 60)));
  123|       |
  124|  11.5M|        Round(a, b, c, d, e, f, g, h, 0xe49b69c1 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  125|  11.5M|        Round(h, a, b, c, d, e, f, g, 0xefbe4786 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  126|  11.5M|        Round(g, h, a, b, c, d, e, f, 0x0fc19dc6 + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  127|  11.5M|        Round(f, g, h, a, b, c, d, e, 0x240ca1cc + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  128|  11.5M|        Round(e, f, g, h, a, b, c, d, 0x2de92c6f + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  129|  11.5M|        Round(d, e, f, g, h, a, b, c, 0x4a7484aa + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  130|  11.5M|        Round(c, d, e, f, g, h, a, b, 0x5cb0a9dc + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  131|  11.5M|        Round(b, c, d, e, f, g, h, a, 0x76f988da + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  132|  11.5M|        Round(a, b, c, d, e, f, g, h, 0x983e5152 + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  133|  11.5M|        Round(h, a, b, c, d, e, f, g, 0xa831c66d + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  134|  11.5M|        Round(g, h, a, b, c, d, e, f, 0xb00327c8 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  135|  11.5M|        Round(f, g, h, a, b, c, d, e, 0xbf597fc7 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  136|  11.5M|        Round(e, f, g, h, a, b, c, d, 0xc6e00bf3 + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  137|  11.5M|        Round(d, e, f, g, h, a, b, c, 0xd5a79147 + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  138|  11.5M|        Round(c, d, e, f, g, h, a, b, 0x06ca6351 + (w14 += sigma1(w12) + w7 + sigma0(w15)));
  139|  11.5M|        Round(b, c, d, e, f, g, h, a, 0x14292967 + (w15 += sigma1(w13) + w8 + sigma0(w0)));
  140|       |
  141|  11.5M|        Round(a, b, c, d, e, f, g, h, 0x27b70a85 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  142|  11.5M|        Round(h, a, b, c, d, e, f, g, 0x2e1b2138 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  143|  11.5M|        Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  144|  11.5M|        Round(f, g, h, a, b, c, d, e, 0x53380d13 + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  145|  11.5M|        Round(e, f, g, h, a, b, c, d, 0x650a7354 + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  146|  11.5M|        Round(d, e, f, g, h, a, b, c, 0x766a0abb + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  147|  11.5M|        Round(c, d, e, f, g, h, a, b, 0x81c2c92e + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  148|  11.5M|        Round(b, c, d, e, f, g, h, a, 0x92722c85 + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  149|  11.5M|        Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1 + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  150|  11.5M|        Round(h, a, b, c, d, e, f, g, 0xa81a664b + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  151|  11.5M|        Round(g, h, a, b, c, d, e, f, 0xc24b8b70 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  152|  11.5M|        Round(f, g, h, a, b, c, d, e, 0xc76c51a3 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  153|  11.5M|        Round(e, f, g, h, a, b, c, d, 0xd192e819 + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  154|  11.5M|        Round(d, e, f, g, h, a, b, c, 0xd6990624 + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  155|  11.5M|        Round(c, d, e, f, g, h, a, b, 0xf40e3585 + (w14 += sigma1(w12) + w7 + sigma0(w15)));
  156|  11.5M|        Round(b, c, d, e, f, g, h, a, 0x106aa070 + (w15 += sigma1(w13) + w8 + sigma0(w0)));
  157|       |
  158|  11.5M|        Round(a, b, c, d, e, f, g, h, 0x19a4c116 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  159|  11.5M|        Round(h, a, b, c, d, e, f, g, 0x1e376c08 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  160|  11.5M|        Round(g, h, a, b, c, d, e, f, 0x2748774c + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  161|  11.5M|        Round(f, g, h, a, b, c, d, e, 0x34b0bcb5 + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  162|  11.5M|        Round(e, f, g, h, a, b, c, d, 0x391c0cb3 + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  163|  11.5M|        Round(d, e, f, g, h, a, b, c, 0x4ed8aa4a + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  164|  11.5M|        Round(c, d, e, f, g, h, a, b, 0x5b9cca4f + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  165|  11.5M|        Round(b, c, d, e, f, g, h, a, 0x682e6ff3 + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  166|  11.5M|        Round(a, b, c, d, e, f, g, h, 0x748f82ee + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  167|  11.5M|        Round(h, a, b, c, d, e, f, g, 0x78a5636f + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  168|  11.5M|        Round(g, h, a, b, c, d, e, f, 0x84c87814 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  169|  11.5M|        Round(f, g, h, a, b, c, d, e, 0x8cc70208 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  170|  11.5M|        Round(e, f, g, h, a, b, c, d, 0x90befffa + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  171|  11.5M|        Round(d, e, f, g, h, a, b, c, 0xa4506ceb + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  172|  11.5M|        Round(c, d, e, f, g, h, a, b, 0xbef9a3f7 + (w14 + sigma1(w12) + w7 + sigma0(w15)));
  173|  11.5M|        Round(b, c, d, e, f, g, h, a, 0xc67178f2 + (w15 + sigma1(w13) + w8 + sigma0(w0)));
  174|       |
  175|  11.5M|        s[0] += a;
  176|  11.5M|        s[1] += b;
  177|  11.5M|        s[2] += c;
  178|  11.5M|        s[3] += d;
  179|  11.5M|        s[4] += e;
  180|  11.5M|        s[5] += f;
  181|  11.5M|        s[6] += g;
  182|  11.5M|        s[7] += h;
  183|  11.5M|        chunk += 64;
  184|  11.5M|    }
  185|  4.68M|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2565RoundEjjjRjjjjS1_j:
   80|   736M|{
   81|   736M|    uint32_t t1 = h + Sigma1(e) + Ch(e, f, g) + k;
   82|   736M|    uint32_t t2 = Sigma0(a) + Maj(a, b, c);
   83|   736M|    d += t1;
   84|   736M|    h = t1 + t2;
   85|   736M|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2566Sigma1Ej:
   74|   736M|uint32_t inline Sigma1(uint32_t x) { return (x >> 6 | x << 26) ^ (x >> 11 | x << 21) ^ (x >> 25 | x << 7); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2562ChEjjj:
   71|   736M|uint32_t inline Ch(uint32_t x, uint32_t y, uint32_t z) { return z ^ (x & (y ^ z)); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566Sigma0Ej:
   73|   736M|uint32_t inline Sigma0(uint32_t x) { return (x >> 2 | x << 30) ^ (x >> 13 | x << 19) ^ (x >> 22 | x << 10); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2563MajEjjj:
   72|   736M|uint32_t inline Maj(uint32_t x, uint32_t y, uint32_t z) { return (x & y) | (z & (x | y)); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566sigma1Ej:
   76|   552M|uint32_t inline sigma1(uint32_t x) { return (x >> 17 | x << 15) ^ (x >> 19 | x << 13) ^ (x >> 10); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566sigma0Ej:
   75|   552M|uint32_t inline sigma0(uint32_t x) { return (x >> 7 | x << 25) ^ (x >> 18 | x << 14) ^ (x >> 3); }
sha256.cpp:_ZN12_GLOBAL__N_16sha25610InitializeEPj:
   89|   464k|{
   90|   464k|    s[0] = 0x6a09e667ul;
   91|   464k|    s[1] = 0xbb67ae85ul;
   92|   464k|    s[2] = 0x3c6ef372ul;
   93|   464k|    s[3] = 0xa54ff53aul;
   94|   464k|    s[4] = 0x510e527ful;
   95|   464k|    s[5] = 0x9b05688cul;
   96|   464k|    s[6] = 0x1f83d9abul;
   97|   464k|    s[7] = 0x5be0cd19ul;
   98|   464k|}

_Z13SHA256Uint256RK7uint256:
   79|  24.7k|{
   80|  24.7k|    uint256 result;
   81|  24.7k|    CSHA256().Write(input.begin(), 32).Finalize(result.begin());
   82|  24.7k|    return result;
   83|  24.7k|}

_ZN8CHash2568FinalizeE4SpanIhE:
   30|  4.12k|    void Finalize(Span<unsigned char> output) {
   31|  4.12k|        assert(output.size() == OUTPUT_SIZE);
   32|  4.12k|        unsigned char buf[CSHA256::OUTPUT_SIZE];
   33|  4.12k|        sha.Finalize(buf);
   34|  4.12k|        sha.Reset().Write(buf, CSHA256::OUTPUT_SIZE).Finalize(output.data());
   35|  4.12k|    }
_ZN8CHash2565WriteE4SpanIKhE:
   37|  4.12k|    CHash256& Write(Span<const unsigned char> input) {
   38|  4.12k|        sha.Write(input.data(), input.size());
   39|  4.12k|        return *this;
   40|  4.12k|    }
_ZN8CHash1608FinalizeE4SpanIhE:
   55|   199k|    void Finalize(Span<unsigned char> output) {
   56|   199k|        assert(output.size() == OUTPUT_SIZE);
   57|   199k|        unsigned char buf[CSHA256::OUTPUT_SIZE];
   58|   199k|        sha.Finalize(buf);
   59|   199k|        CRIPEMD160().Write(buf, CSHA256::OUTPUT_SIZE).Finalize(output.data());
   60|   199k|    }
_ZN8CHash1605WriteE4SpanIKhE:
   62|   199k|    CHash160& Write(Span<const unsigned char> input) {
   63|   199k|        sha.Write(input.data(), input.size());
   64|   199k|        return *this;
   65|   199k|    }
_ZN10HashWriter5writeE4SpanIKSt4byteE:
  107|  25.6M|    {
  108|  25.6M|        ctx.Write(UCharCast(src.data()), src.size());
  109|  25.6M|    }
_ZN10HashWriter7GetHashEv:
  115|  98.6k|    uint256 GetHash() {
  116|  98.6k|        uint256 result;
  117|  98.6k|        ctx.Finalize(result.begin());
  118|  98.6k|        ctx.Reset().Write(result.begin(), CSHA256::OUTPUT_SIZE).Finalize(result.begin());
  119|  98.6k|        return result;
  120|  98.6k|    }
_ZN10HashWriter9GetSHA256Ev:
  126|  30.6k|    uint256 GetSHA256() {
  127|  30.6k|        uint256 result;
  128|  30.6k|        ctx.Finalize(result.begin());
  129|  30.6k|        return result;
  130|  30.6k|    }
_Z9RIPEMD1604SpanIKhE:
  223|  5.83k|{
  224|  5.83k|    uint160 result;
  225|  5.83k|    CRIPEMD160().Write(data.data(), data.size()).Finalize(result.begin());
  226|  5.83k|    return result;
  227|  5.83k|}
_Z7Hash160I4SpanIKhEE7uint160RKT_:
   93|  95.8k|{
   94|  95.8k|    uint160 result;
   95|  95.8k|    CHash160().Write(MakeUCharSpan(in1)).Finalize(result);
   96|  95.8k|    return result;
   97|  95.8k|}
_ZN10HashWriterlsIjEERS_RKT_:
  142|   203k|    {
  143|   203k|        ::Serialize(*this, obj);
  144|   203k|        return *this;
  145|   203k|    }
_Z7Hash160I7CScriptE7uint160RKT_:
   93|  21.0k|{
   94|  21.0k|    uint160 result;
   95|  21.0k|    CHash160().Write(MakeUCharSpan(in1)).Finalize(result);
   96|  21.0k|    return result;
   97|  21.0k|}
_ZN10HashWriterlsINSt3__16vectorIhNS1_9allocatorIhEEEEEERS_RKT_:
  142|    214|    {
  143|    214|        ::Serialize(*this, obj);
  144|    214|        return *this;
  145|    214|    }
_ZN10HashWriterlsI7uint256EERS_RKT_:
  142|  58.1k|    {
  143|  58.1k|        ::Serialize(*this, obj);
  144|  58.1k|        return *this;
  145|  58.1k|    }
_ZN10HashWriterlsI4SpanIKhEEERS_RKT_:
  142|  5.95M|    {
  143|  5.95M|        ::Serialize(*this, obj);
  144|  5.95M|        return *this;
  145|  5.95M|    }
_ZN10HashWriterlsIhEERS_RKT_:
  142|  2.64k|    {
  143|  2.64k|        ::Serialize(*this, obj);
  144|  2.64k|        return *this;
  145|  2.64k|    }
_ZN10HashWriterlsIiEERS_RKT_:
  142|  77.9k|    {
  143|  77.9k|        ::Serialize(*this, obj);
  144|  77.9k|        return *this;
  145|  77.9k|    }
_ZN10HashWriterlsI9COutPointEERS_RKT_:
  142|   165k|    {
  143|   165k|        ::Serialize(*this, obj);
  144|   165k|        return *this;
  145|   165k|    }
_ZN10HashWriterlsI6CTxOutEERS_RKT_:
  142|  21.6k|    {
  143|  21.6k|        ::Serialize(*this, obj);
  144|  21.6k|        return *this;
  145|  21.6k|    }
_ZN10HashWriterlsI13ParamsWrapperI20TransactionSerParamsK12CTransactionEEERS_RKT_:
  142|  17.1k|    {
  143|  17.1k|        ::Serialize(*this, obj);
  144|  17.1k|        return *this;
  145|  17.1k|    }
_ZN10HashWriterlsIlEERS_RKT_:
  142|  23.0k|    {
  143|  23.0k|        ::Serialize(*this, obj);
  144|  23.0k|        return *this;
  145|  23.0k|    }
_ZN10HashWriterlsI7CScriptEERS_RKT_:
  142|  23.0k|    {
  143|  23.0k|        ::Serialize(*this, obj);
  144|  23.0k|        return *this;
  145|  23.0k|    }
interpreter.cpp:_ZN10HashWriterlsIN12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionEEEERS_RKT_:
  142|  17.3k|    {
  143|  17.3k|        ::Serialize(*this, obj);
  144|  17.3k|        return *this;
  145|  17.3k|    }
interpreter.cpp:_ZN10HashWriterlsIN12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionEEEERS_RKT_:
  142|  42.1k|    {
  143|  42.1k|        ::Serialize(*this, obj);
  144|  42.1k|        return *this;
  145|  42.1k|    }
_ZN10HashWriterlsI17CompactSizeWriterEERS_RKT_:
  142|  1.27k|    {
  143|  1.27k|        ::Serialize(*this, obj);
  144|  1.27k|        return *this;
  145|  1.27k|    }

_ZN4CKey5CheckEPKh:
  157|  11.9k|bool CKey::Check(const unsigned char *vch) {
  158|  11.9k|    return secp256k1_ec_seckey_verify(secp256k1_context_sign, vch);
  159|  11.9k|}
_ZNK4CKey9GetPubKeyEv:
  182|  44.4k|CPubKey CKey::GetPubKey() const {
  183|  44.4k|    assert(keydata);
  184|  44.4k|    secp256k1_pubkey pubkey;
  185|  44.4k|    size_t clen = CPubKey::SIZE;
  186|  44.4k|    CPubKey result;
  187|  44.4k|    int ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pubkey, UCharCast(begin()));
  188|  44.4k|    assert(ret);
  189|  44.4k|    secp256k1_ec_pubkey_serialize(secp256k1_context_sign, (unsigned char*)result.begin(), &clen, &pubkey, fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  212|  27.5k|#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  193|  27.5k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  |  |               #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  198|  27.5k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  |  |  ------------------
  ------------------
                  secp256k1_ec_pubkey_serialize(secp256k1_context_sign, (unsigned char*)result.begin(), &clen, &pubkey, fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  213|  61.3k|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  193|  16.8k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  |  Branch (189:107): [True: 27.5k, False: 16.8k]
  ------------------
  190|  44.4k|    assert(result.size() == clen);
  191|  44.4k|    assert(result.IsValid());
  192|  44.4k|    return result;
  193|  44.4k|}
_Z10SigHasLowRPK25secp256k1_ecdsa_signature:
  197|  69.6k|{
  198|  69.6k|    unsigned char compact_sig[64];
  199|  69.6k|    secp256k1_ecdsa_signature_serialize_compact(secp256k1_context_sign, compact_sig, sig);
  200|       |
  201|       |    // In DER serialization, all values are interpreted as big-endian, signed integers. The highest bit in the integer indicates
  202|       |    // its signed-ness; 0 is positive, 1 is negative. When the value is interpreted as a negative integer, it must be converted
  203|       |    // to a positive value by prepending a 0x00 byte so that the highest bit is 0. We can avoid this prepending by ensuring that
  204|       |    // our highest bit is always 0, and thus we must check that the first byte is less than 0x80.
  205|  69.6k|    return compact_sig[0] < 0x80;
  206|  69.6k|}
_ZNK4CKey4SignERK7uint256RNSt3__16vectorIhNS3_9allocatorIhEEEEbj:
  208|  33.5k|bool CKey::Sign(const uint256 &hash, std::vector<unsigned char>& vchSig, bool grind, uint32_t test_case) const {
  209|  33.5k|    if (!keydata)
  ------------------
  |  Branch (209:9): [True: 0, False: 33.5k]
  ------------------
  210|      0|        return false;
  211|  33.5k|    vchSig.resize(CPubKey::SIGNATURE_SIZE);
  212|  33.5k|    size_t nSigLen = CPubKey::SIGNATURE_SIZE;
  213|  33.5k|    unsigned char extra_entropy[32] = {0};
  214|  33.5k|    WriteLE32(extra_entropy, test_case);
  215|  33.5k|    secp256k1_ecdsa_signature sig;
  216|  33.5k|    uint32_t counter = 0;
  217|  33.5k|    int ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, (!grind && test_case) ? extra_entropy : nullptr);
  ------------------
  |  Branch (217:135): [True: 0, False: 33.5k]
  |  Branch (217:145): [True: 0, False: 0]
  ------------------
  218|       |
  219|       |    // Grind for low R
  220|  69.6k|    while (ret && !SigHasLowR(&sig) && grind) {
  ------------------
  |  Branch (220:12): [True: 69.6k, False: 0]
  |  Branch (220:19): [True: 36.0k, False: 33.5k]
  |  Branch (220:40): [True: 36.0k, False: 0]
  ------------------
  221|  36.0k|        WriteLE32(extra_entropy, ++counter);
  222|  36.0k|        ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, extra_entropy);
  223|  36.0k|    }
  224|  33.5k|    assert(ret);
  225|  33.5k|    secp256k1_ecdsa_signature_serialize_der(secp256k1_context_sign, vchSig.data(), &nSigLen, &sig);
  226|  33.5k|    vchSig.resize(nSigLen);
  227|       |    // Additional verification step to prevent using a potentially corrupted signature
  228|  33.5k|    secp256k1_pubkey pk;
  229|  33.5k|    ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pk, UCharCast(begin()));
  230|  33.5k|    assert(ret);
  231|  33.5k|    ret = secp256k1_ecdsa_verify(secp256k1_context_static, &sig, hash.begin(), &pk);
  232|  33.5k|    assert(ret);
  233|  33.5k|    return true;
  234|  33.5k|}
_ZN11ECC_ContextD2Ev:
  482|      2|{
  483|      2|    ECC_Stop();
  484|      2|}
key.cpp:_ZL8ECC_Stopv:
  467|      2|static void ECC_Stop() {
  468|      2|    secp256k1_context *ctx = secp256k1_context_sign;
  469|      2|    secp256k1_context_sign = nullptr;
  470|       |
  471|      2|    if (ctx) {
  ------------------
  |  Branch (471:9): [True: 2, False: 0]
  ------------------
  472|      2|        secp256k1_context_destroy(ctx);
  473|      2|    }
  474|      2|}

_ZN4CKey11MakeKeyDataEv:
   64|  87.5k|    {
   65|  87.5k|        if (!keydata) keydata = make_secure_unique<KeyType>();
  ------------------
  |  Branch (65:13): [True: 87.5k, False: 0]
  ------------------
   66|  87.5k|    }
_ZN4CKey12ClearKeyDataEv:
   69|  1.98k|    {
   70|  1.98k|        keydata.reset();
   71|  1.98k|    }
_ZN4CKeyaSERKS_:
   79|  77.5k|    {
   80|  77.5k|        if (this != &other) {
  ------------------
  |  Branch (80:13): [True: 77.5k, False: 0]
  ------------------
   81|  77.5k|            if (other.keydata) {
  ------------------
  |  Branch (81:17): [True: 77.5k, False: 0]
  ------------------
   82|  77.5k|                MakeKeyData();
   83|  77.5k|                *keydata = *other.keydata;
   84|  77.5k|            } else {
   85|      0|                ClearKeyData();
   86|      0|            }
   87|  77.5k|            fCompressed = other.fCompressed;
   88|  77.5k|        }
   89|  77.5k|        return *this;
   90|  77.5k|    }
_ZNK4CKey4dataEv:
  118|   147k|    const std::byte* data() const { return keydata ? reinterpret_cast<const std::byte*>(keydata->data()) : nullptr; }
  ------------------
  |  Branch (118:44): [True: 147k, False: 0]
  ------------------
_ZNK4CKey5beginEv:
  119|   147k|    const std::byte* begin() const { return data(); }
_ZNK4CKey7IsValidEv:
  123|  13.2k|    bool IsValid() const { return !!keydata; }
_ZNK4CKey12IsCompressedEv:
  126|  9.23k|    bool IsCompressed() const { return fCompressed; }
_ZN4CKeyC2Ev:
   74|   105k|    CKey() noexcept = default;
_ZN4CKey3SetINSt3__111__wrap_iterIPhEEEEvT_S5_b:
  104|  11.9k|    {
  105|  11.9k|        if (size_t(pend - pbegin) != std::tuple_size_v<KeyType>) {
  ------------------
  |  Branch (105:13): [True: 0, False: 11.9k]
  ------------------
  106|      0|            ClearKeyData();
  107|  11.9k|        } else if (Check(UCharCast(&pbegin[0]))) {
  ------------------
  |  Branch (107:20): [True: 9.98k, False: 1.98k]
  ------------------
  108|  9.98k|            MakeKeyData();
  109|  9.98k|            memcpy(keydata->data(), (unsigned char*)&pbegin[0], keydata->size());
  110|  9.98k|            fCompressed = fCompressedIn;
  111|  9.98k|        } else {
  112|  1.98k|            ClearKeyData();
  113|  1.98k|        }
  114|  11.9k|    }

_ZN9prevectorILj28EhjiE3endEv:
  304|  24.8M|    iterator end() { return iterator(item_ptr(size())); }
_ZN9prevectorILj28EhjiE8item_ptrEi:
  206|  75.6M|    T* item_ptr(difference_type pos) { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (206:47): [True: 4.06M, False: 71.5M]
  ------------------
_ZNK9prevectorILj28EhjiE9is_directEv:
  173|   640M|    bool is_direct() const { return _size <= N; }
_ZN9prevectorILj28EhjiE10direct_ptrEi:
  169|  4.41M|    T* direct_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.direct) + pos; }
_ZN9prevectorILj28EhjiE12indirect_ptrEi:
  171|  71.5M|    T* indirect_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.indirect_contents.indirect) + pos; }
_ZN9prevectorILj28EhjiE6insertENS0_8iteratorERKh:
  359|  11.9M|    iterator insert(iterator pos, const T& value) {
  360|  11.9M|        size_type p = pos - begin();
  361|  11.9M|        size_type new_size = size() + 1;
  362|  11.9M|        if (capacity() < new_size) {
  ------------------
  |  Branch (362:13): [True: 2.27k, False: 11.9M]
  ------------------
  363|  2.27k|            change_capacity(new_size + (new_size >> 1));
  364|  2.27k|        }
  365|  11.9M|        T* ptr = item_ptr(p);
  366|  11.9M|        T* dst = ptr + 1;
  367|  11.9M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  368|  11.9M|        _size++;
  369|  11.9M|        new(static_cast<void*>(ptr)) T(value);
  370|  11.9M|        return iterator(ptr);
  371|  11.9M|    }
_ZN9prevectorILj28EhjiE5beginEv:
  302|  24.8M|    iterator begin() { return iterator(item_ptr(0)); }
_ZmiN9prevectorILj28EhjiE8iteratorES1_:
   66|  24.7M|        difference_type friend operator-(iterator a, iterator b) { return (&(*a) - &(*b)); }
_ZNK9prevectorILj28EhjiE8iteratordeEv:
   59|  49.7M|        T& operator*() const { return *ptr; }
_ZNK9prevectorILj28EhjiE8capacityEv:
  312|  24.9M|    size_t capacity() const {
  313|  24.9M|        if (is_direct()) {
  ------------------
  |  Branch (313:13): [True: 1.24M, False: 23.7M]
  ------------------
  314|  1.24M|            return N;
  315|  23.7M|        } else {
  316|  23.7M|            return _union.indirect_contents.capacity;
  317|  23.7M|        }
  318|  24.9M|    }
_ZN9prevectorILj28EhjiE15change_capacityEj:
  175|  1.29M|    void change_capacity(size_type new_capacity) {
  176|  1.29M|        if (new_capacity <= N) {
  ------------------
  |  Branch (176:13): [True: 898k, False: 397k]
  ------------------
  177|   898k|            if (!is_direct()) {
  ------------------
  |  Branch (177:17): [True: 0, False: 898k]
  ------------------
  178|      0|                T* indirect = indirect_ptr(0);
  179|      0|                T* src = indirect;
  180|      0|                T* dst = direct_ptr(0);
  181|      0|                memcpy(dst, src, size() * sizeof(T));
  182|      0|                free(indirect);
  183|      0|                _size -= N + 1;
  184|      0|            }
  185|   898k|        } else {
  186|   397k|            if (!is_direct()) {
  ------------------
  |  Branch (186:17): [True: 45.7k, False: 352k]
  ------------------
  187|       |                /* FIXME: Because malloc/realloc here won't call new_handler if allocation fails, assert
  188|       |                    success. These should instead use an allocator or new/delete so that handlers
  189|       |                    are called as necessary, but performance would be slightly degraded by doing so. */
  190|  45.7k|                _union.indirect_contents.indirect = static_cast<char*>(realloc(_union.indirect_contents.indirect, ((size_t)sizeof(T)) * new_capacity));
  191|  45.7k|                assert(_union.indirect_contents.indirect);
  192|  45.7k|                _union.indirect_contents.capacity = new_capacity;
  193|   352k|            } else {
  194|   352k|                char* new_indirect = static_cast<char*>(malloc(((size_t)sizeof(T)) * new_capacity));
  195|   352k|                assert(new_indirect);
  196|   352k|                T* src = direct_ptr(0);
  197|   352k|                T* dst = reinterpret_cast<T*>(new_indirect);
  198|   352k|                memcpy(dst, src, size() * sizeof(T));
  199|   352k|                _union.indirect_contents.indirect = new_indirect;
  200|   352k|                _union.indirect_contents.capacity = new_capacity;
  201|   352k|                _size += N + 1;
  202|   352k|            }
  203|   397k|        }
  204|  1.29M|    }
_ZN9prevectorILj28EhjiE6insertITkNSt3__114input_iteratorEPKhEEvNS0_8iteratorET_S6_:
  387|    197|    void insert(iterator pos, InputIterator first, InputIterator last) {
  388|    197|        size_type p = pos - begin();
  389|    197|        difference_type count = last - first;
  390|    197|        size_type new_size = size() + count;
  391|    197|        if (capacity() < new_size) {
  ------------------
  |  Branch (391:13): [True: 0, False: 197]
  ------------------
  392|      0|            change_capacity(new_size + (new_size >> 1));
  393|      0|        }
  394|    197|        T* ptr = item_ptr(p);
  395|    197|        T* dst = ptr + count;
  396|    197|        memmove(dst, ptr, (size() - p) * sizeof(T));
  397|    197|        _size += count;
  398|    197|        fill(ptr, first, last);
  399|    197|    }
_ZN9prevectorILj28EhjiE4fillITkNSt3__114input_iteratorEPKhEEvPhT_S6_:
  214|    197|    void fill(T* dst, InputIterator first, InputIterator last) {
  215|    591|        while (first != last) {
  ------------------
  |  Branch (215:16): [True: 394, False: 197]
  ------------------
  216|    394|            new(static_cast<void*>(dst)) T(*first);
  217|    394|            ++dst;
  218|    394|            ++first;
  219|    394|        }
  220|    197|    }
_ZN9prevectorILj28EhjiE6insertITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEEvNS0_8iteratorET_S8_:
  387|  6.07M|    void insert(iterator pos, InputIterator first, InputIterator last) {
  388|  6.07M|        size_type p = pos - begin();
  389|  6.07M|        difference_type count = last - first;
  390|  6.07M|        size_type new_size = size() + count;
  391|  6.07M|        if (capacity() < new_size) {
  ------------------
  |  Branch (391:13): [True: 95.6k, False: 5.98M]
  ------------------
  392|  95.6k|            change_capacity(new_size + (new_size >> 1));
  393|  95.6k|        }
  394|  6.07M|        T* ptr = item_ptr(p);
  395|  6.07M|        T* dst = ptr + count;
  396|  6.07M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  397|  6.07M|        _size += count;
  398|  6.07M|        fill(ptr, first, last);
  399|  6.07M|    }
_ZN9prevectorILj28EhjiE4fillITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEEvPhT_S8_:
  214|  6.09M|    void fill(T* dst, InputIterator first, InputIterator last) {
  215|   724M|        while (first != last) {
  ------------------
  |  Branch (215:16): [True: 718M, False: 6.09M]
  ------------------
  216|   718M|            new(static_cast<void*>(dst)) T(*first);
  217|   718M|            ++dst;
  218|   718M|            ++first;
  219|   718M|        }
  220|  6.09M|    }
_ZN9prevectorILj28EhjiE9push_backERKh:
  444|  10.5k|    void push_back(const T& value) {
  445|  10.5k|        emplace_back(value);
  446|  10.5k|    }
_ZN9prevectorILj28EhjiE12emplace_backIJRKhEEEvDpOT_:
  435|  10.5k|    void emplace_back(Args&&... args) {
  436|  10.5k|        size_type new_size = size() + 1;
  437|  10.5k|        if (capacity() < new_size) {
  ------------------
  |  Branch (437:13): [True: 76, False: 10.5k]
  ------------------
  438|     76|            change_capacity(new_size + (new_size >> 1));
  439|     76|        }
  440|  10.5k|        new(item_ptr(size())) T(std::forward<Args>(args)...);
  441|  10.5k|        _size++;
  442|  10.5k|    }
_ZNK9prevectorILj28EhjiE3endEv:
  305|   217M|    const_iterator end() const { return const_iterator(item_ptr(size())); }
_ZNK9prevectorILj28EhjiE8item_ptrEi:
  207|   221M|    const T* item_ptr(difference_type pos) const { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (207:59): [True: 7.02M, False: 214M]
  ------------------
_ZNK9prevectorILj28EhjiE10direct_ptrEi:
  170|  7.02M|    const T* direct_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.direct) + pos; }
_ZNK9prevectorILj28EhjiE12indirect_ptrEi:
  172|   214M|    const T* indirect_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.indirect_contents.indirect) + pos; }
_ZNK9prevectorILj28EhjiE4sizeEv:
  294|   309M|    size_type size() const {
  295|   309M|        return is_direct() ? _size : _size - N - 1;
  ------------------
  |  Branch (295:16): [True: 22.3M, False: 286M]
  ------------------
  296|   309M|    }
_ZNK9prevectorILj28EhjiE5beginEv:
  303|  3.33M|    const_iterator begin() const { return const_iterator(item_ptr(0)); }
_ZNK9prevectorILj28EhjiE14const_iteratordeEv:
  111|  1.82G|        const T& operator*() const { return *ptr; }
_ZN9prevectorILj28EhjiE5clearEv:
  355|   520k|    void clear() {
  356|   520k|        resize(0);
  357|   520k|    }
_ZN9prevectorILj28EhjiE6resizeEj:
  328|   529k|    void resize(size_type new_size) {
  329|   529k|        size_type cur_size = size();
  330|   529k|        if (cur_size == new_size) {
  ------------------
  |  Branch (330:13): [True: 501k, False: 28.2k]
  ------------------
  331|   501k|            return;
  332|   501k|        }
  333|  28.2k|        if (cur_size > new_size) {
  ------------------
  |  Branch (333:13): [True: 19.3k, False: 8.92k]
  ------------------
  334|  19.3k|            erase(item_ptr(new_size), end());
  335|  19.3k|            return;
  336|  19.3k|        }
  337|  8.92k|        if (new_size > capacity()) {
  ------------------
  |  Branch (337:13): [True: 4.81k, False: 4.10k]
  ------------------
  338|  4.81k|            change_capacity(new_size);
  339|  4.81k|        }
  340|  8.92k|        ptrdiff_t increase = new_size - cur_size;
  341|  8.92k|        fill(item_ptr(cur_size), increase);
  342|  8.92k|        _size += increase;
  343|  8.92k|    }
_ZN9prevectorILj28EhjiE5eraseENS0_8iteratorES1_:
  420|  19.3k|    iterator erase(iterator first, iterator last) {
  421|       |        // Erase is not allowed to the change the object's capacity. That means
  422|       |        // that when starting with an indirectly allocated prevector with
  423|       |        // size and capacity > N, the result may be a still indirectly allocated
  424|       |        // prevector with size <= N and capacity > N. A shrink_to_fit() call is
  425|       |        // necessary to switch to the (more efficient) directly allocated
  426|       |        // representation (with capacity N and size <= N).
  427|  19.3k|        iterator p = first;
  428|  19.3k|        char* endp = (char*)&(*end());
  429|  19.3k|        _size -= last - p;
  430|  19.3k|        memmove(&(*first), &(*last), endp - ((char*)(&(*last))));
  431|  19.3k|        return first;
  432|  19.3k|    }
_ZN9prevectorILj28EhjiE4fillEPhlRKh:
  209|  8.92k|    void fill(T* dst, ptrdiff_t count, const T& value = T{}) {
  210|  8.92k|        std::fill_n(dst, count, value);
  211|  8.92k|    }
_ZN9prevectorILj28EhjiE13shrink_to_fitEv:
  351|   111k|    void shrink_to_fit() {
  352|   111k|        change_capacity(size());
  353|   111k|    }
_ZN9prevectorILj28EhjiE4fillITkNSt3__114input_iteratorENS0_14const_iteratorEEEvPhT_S5_:
  214|  2.19M|    void fill(T* dst, InputIterator first, InputIterator last) {
  215|  1.02G|        while (first != last) {
  ------------------
  |  Branch (215:16): [True: 1.01G, False: 2.19M]
  ------------------
  216|  1.01G|            new(static_cast<void*>(dst)) T(*first);
  217|  1.01G|            ++dst;
  218|  1.01G|            ++first;
  219|  1.01G|        }
  220|  2.19M|    }
_ZNK9prevectorILj28EhjiE14const_iteratorneES1_:
  125|  1.02G|        bool operator!=(const_iterator x) const { return ptr != x.ptr; }
_ZN9prevectorILj28EhjiE14const_iteratorppEv:
  114|  1.23G|        const_iterator& operator++() { ptr++; return *this; }
_ZNK9prevectorILj28EhjiEeqERKS0_:
  481|  15.7k|    bool operator==(const prevector<N, T, Size, Diff>& other) const {
  482|  15.7k|        if (other.size() != size()) {
  ------------------
  |  Branch (482:13): [True: 0, False: 15.7k]
  ------------------
  483|      0|            return false;
  484|      0|        }
  485|  15.7k|        const_iterator b1 = begin();
  486|  15.7k|        const_iterator b2 = other.begin();
  487|  15.7k|        const_iterator e1 = end();
  488|   378k|        while (b1 != e1) {
  ------------------
  |  Branch (488:16): [True: 362k, False: 15.7k]
  ------------------
  489|   362k|            if ((*b1) != (*b2)) {
  ------------------
  |  Branch (489:17): [True: 0, False: 362k]
  ------------------
  490|      0|                return false;
  491|      0|            }
  492|   362k|            ++b1;
  493|   362k|            ++b2;
  494|   362k|        }
  495|  15.7k|        return true;
  496|  15.7k|    }
_ZN9prevectorILj33EhjiE4dataEv:
  533|  6.82k|    value_type* data() {
  534|  6.82k|        return item_ptr(0);
  535|  6.82k|    }
_ZN9prevectorILj33EhjiE8item_ptrEi:
  206|  13.6k|    T* item_ptr(difference_type pos) { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (206:47): [True: 13.6k, False: 0]
  ------------------
_ZNK9prevectorILj33EhjiE9is_directEv:
  173|  40.8k|    bool is_direct() const { return _size <= N; }
_ZN9prevectorILj33EhjiE10direct_ptrEi:
  169|  13.6k|    T* direct_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.direct) + pos; }
_ZNK9prevectorILj33EhjiE4sizeEv:
  294|  6.82k|    size_type size() const {
  295|  6.82k|        return is_direct() ? _size : _size - N - 1;
  ------------------
  |  Branch (295:16): [True: 6.82k, False: 0]
  ------------------
  296|  6.82k|    }
_ZNK9prevectorILj28EhjiE4dataEv:
  537|   212k|    const value_type* data() const {
  538|   212k|        return item_ptr(0);
  539|   212k|    }
_ZN9prevectorILj28EhjiE4dataEv:
  533|  8.76k|    value_type* data() {
  534|  8.76k|        return item_ptr(0);
  535|  8.76k|    }
_ZNK9prevectorILj28EhjiE5emptyEv:
  298|  6.24M|    bool empty() const {
  299|  6.24M|        return size() == 0;
  300|  6.24M|    }
_ZNK9prevectorILj28EhjiEixEj:
  324|  1.16M|    const T& operator[](size_type pos) const {
  325|  1.16M|        return *item_ptr(pos);
  326|  1.16M|    }
_ZN9prevectorILj28EhjiED2Ev:
  474|  7.96M|    ~prevector() {
  475|  7.96M|        if (!is_direct()) {
  ------------------
  |  Branch (475:13): [True: 342k, False: 7.61M]
  ------------------
  476|   342k|            free(_union.indirect_contents.indirect);
  477|   342k|            _union.indirect_contents.indirect = nullptr;
  478|   342k|        }
  479|  7.96M|    }
_ZN9prevectorILj28EhjiEC2EOS0_:
  271|  21.5k|        : _union(std::move(other._union)), _size(other._size)
  272|  21.5k|    {
  273|  21.5k|        other._size = 0;
  274|  21.5k|    }
_ZN9prevectorILj28EhjiEC2Ev:
  243|  6.96M|    prevector() = default;
_ZN9prevectorILj28EhjiE8iteratorC2EPh:
   58|  61.5M|        iterator(T* ptr_) : ptr(ptr_) {}
_ZN9prevectorILj28EhjiE20resize_uninitializedEj:
  401|  45.8k|    inline void resize_uninitialized(size_type new_size) {
  402|       |        // resize_uninitialized changes the size of the prevector but does not initialize it.
  403|       |        // If size < new_size, the added elements must be initialized explicitly.
  404|  45.8k|        if (capacity() < new_size) {
  ------------------
  |  Branch (404:13): [True: 26.5k, False: 19.2k]
  ------------------
  405|  26.5k|            change_capacity(new_size);
  406|  26.5k|            _size += new_size - size();
  407|  26.5k|            return;
  408|  26.5k|        }
  409|  19.2k|        if (new_size < size()) {
  ------------------
  |  Branch (409:13): [True: 0, False: 19.2k]
  ------------------
  410|      0|            erase(item_ptr(new_size), end());
  411|  19.2k|        } else {
  412|  19.2k|            _size += new_size - size();
  413|  19.2k|        }
  414|  19.2k|    }
_ZN9prevectorILj28EhjiEixEj:
  320|  70.2k|    T& operator[](size_type pos) {
  321|  70.2k|        return *item_ptr(pos);
  322|  70.2k|    }
_ZN9prevectorILj28EhjiE14const_iteratorC2EPKh:
  109|   229M|        const_iterator(const T* ptr_) : ptr(ptr_) {}
_ZN9prevectorILj28EhjiEC2ERKS0_:
  263|   829k|    prevector(const prevector<N, T, Size, Diff>& other) {
  264|   829k|        size_type n = other.size();
  265|   829k|        change_capacity(n);
  266|   829k|        _size += n;
  267|   829k|        fill(item_ptr(0), other.begin(),  other.end());
  268|   829k|    }
_ZN9prevectorILj33EhjiEC2EjRKh:
  249|  6.82k|    explicit prevector(size_type n, const T& val) {
  250|  6.82k|        change_capacity(n);
  251|  6.82k|        _size += n;
  252|  6.82k|        fill(item_ptr(0), n, val);
  253|  6.82k|    }
_ZN9prevectorILj33EhjiE15change_capacityEj:
  175|  6.82k|    void change_capacity(size_type new_capacity) {
  176|  6.82k|        if (new_capacity <= N) {
  ------------------
  |  Branch (176:13): [True: 6.82k, False: 0]
  ------------------
  177|  6.82k|            if (!is_direct()) {
  ------------------
  |  Branch (177:17): [True: 0, False: 6.82k]
  ------------------
  178|      0|                T* indirect = indirect_ptr(0);
  179|      0|                T* src = indirect;
  180|      0|                T* dst = direct_ptr(0);
  181|      0|                memcpy(dst, src, size() * sizeof(T));
  182|      0|                free(indirect);
  183|      0|                _size -= N + 1;
  184|      0|            }
  185|  6.82k|        } else {
  186|      0|            if (!is_direct()) {
  ------------------
  |  Branch (186:17): [True: 0, False: 0]
  ------------------
  187|       |                /* FIXME: Because malloc/realloc here won't call new_handler if allocation fails, assert
  188|       |                    success. These should instead use an allocator or new/delete so that handlers
  189|       |                    are called as necessary, but performance would be slightly degraded by doing so. */
  190|      0|                _union.indirect_contents.indirect = static_cast<char*>(realloc(_union.indirect_contents.indirect, ((size_t)sizeof(T)) * new_capacity));
  191|      0|                assert(_union.indirect_contents.indirect);
  192|      0|                _union.indirect_contents.capacity = new_capacity;
  193|      0|            } else {
  194|      0|                char* new_indirect = static_cast<char*>(malloc(((size_t)sizeof(T)) * new_capacity));
  195|      0|                assert(new_indirect);
  196|      0|                T* src = direct_ptr(0);
  197|      0|                T* dst = reinterpret_cast<T*>(new_indirect);
  198|      0|                memcpy(dst, src, size() * sizeof(T));
  199|      0|                _union.indirect_contents.indirect = new_indirect;
  200|      0|                _union.indirect_contents.capacity = new_capacity;
  201|      0|                _size += N + 1;
  202|      0|            }
  203|      0|        }
  204|  6.82k|    }
_ZN9prevectorILj33EhjiE4fillEPhlRKh:
  209|  6.82k|    void fill(T* dst, ptrdiff_t count, const T& value = T{}) {
  210|  6.82k|        std::fill_n(dst, count, value);
  211|  6.82k|    }
_ZN9prevectorILj33EhjiED2Ev:
  474|  6.82k|    ~prevector() {
  475|  6.82k|        if (!is_direct()) {
  ------------------
  |  Branch (475:13): [True: 0, False: 6.82k]
  ------------------
  476|      0|            free(_union.indirect_contents.indirect);
  477|      0|            _union.indirect_contents.indirect = nullptr;
  478|      0|        }
  479|  6.82k|    }
_ZN9prevectorILj28EhjiEaSERKS0_:
  276|   233k|    prevector& operator=(const prevector<N, T, Size, Diff>& other) {
  277|   233k|        if (&other == this) {
  ------------------
  |  Branch (277:13): [True: 0, False: 233k]
  ------------------
  278|      0|            return *this;
  279|      0|        }
  280|   233k|        assign(other.begin(), other.end());
  281|   233k|        return *this;
  282|   233k|    }
_ZN9prevectorILj28EhjiE6assignITkNSt3__114input_iteratorENS0_14const_iteratorEEEvT_S4_:
  233|   233k|    void assign(InputIterator first, InputIterator last) {
  234|   233k|        size_type n = last - first;
  235|   233k|        clear();
  236|   233k|        if (capacity() < n) {
  ------------------
  |  Branch (236:13): [True: 40.5k, False: 193k]
  ------------------
  237|  40.5k|            change_capacity(n);
  238|  40.5k|        }
  239|   233k|        _size += n;
  240|   233k|        fill(item_ptr(0), first, last);
  241|   233k|    }
_ZmiN9prevectorILj28EhjiE14const_iteratorES1_:
  118|   297M|        difference_type friend operator-(const_iterator a, const_iterator b) { return (&(*a) - &(*b)); }
_ZNK9prevectorILj28EhjiE8iteratorptEv:
   60|  71.0k|        T* operator->() const { return ptr; }
_ZN9prevectorILj28EhjiEaSEOS0_:
  284|   139k|    prevector& operator=(prevector<N, T, Size, Diff>&& other) noexcept {
  285|   139k|        if (!is_direct()) {
  ------------------
  |  Branch (285:13): [True: 9.33k, False: 130k]
  ------------------
  286|  9.33k|            free(_union.indirect_contents.indirect);
  287|  9.33k|        }
  288|   139k|        _union = std::move(other._union);
  289|   139k|        _size = other._size;
  290|   139k|        other._size = 0;
  291|   139k|        return *this;
  292|   139k|    }
_ZN9prevectorILj28EhjiEC2ITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEET_S7_:
  256|  22.9k|    prevector(InputIterator first, InputIterator last) {
  257|  22.9k|        size_type n = last - first;
  258|  22.9k|        change_capacity(n);
  259|  22.9k|        _size += n;
  260|  22.9k|        fill(item_ptr(0), first, last);
  261|  22.9k|    }
_ZNK9prevectorILj28EhjiE14const_iteratorptEv:
  112|  15.7M|        const T* operator->() const { return ptr; }
_ZN9prevectorILj28EhjiEC2ITkNSt3__114input_iteratorENS2_11__wrap_iterIPhEEEET_S6_:
  256|  16.2k|    prevector(InputIterator first, InputIterator last) {
  257|  16.2k|        size_type n = last - first;
  258|  16.2k|        change_capacity(n);
  259|  16.2k|        _size += n;
  260|  16.2k|        fill(item_ptr(0), first, last);
  261|  16.2k|    }
_ZN9prevectorILj28EhjiE4fillITkNSt3__114input_iteratorENS2_11__wrap_iterIPhEEEEvS4_T_S6_:
  214|  5.66M|    void fill(T* dst, InputIterator first, InputIterator last) {
  215|   643M|        while (first != last) {
  ------------------
  |  Branch (215:16): [True: 637M, False: 5.66M]
  ------------------
  216|   637M|            new(static_cast<void*>(dst)) T(*first);
  217|   637M|            ++dst;
  218|   637M|            ++first;
  219|   637M|        }
  220|  5.66M|    }
_ZN9prevectorILj28EhjiE6insertITkNSt3__114input_iteratorENS2_11__wrap_iterIPhEEEEvNS0_8iteratorET_S7_:
  387|  5.64M|    void insert(iterator pos, InputIterator first, InputIterator last) {
  388|  5.64M|        size_type p = pos - begin();
  389|  5.64M|        difference_type count = last - first;
  390|  5.64M|        size_type new_size = size() + count;
  391|  5.64M|        if (capacity() < new_size) {
  ------------------
  |  Branch (391:13): [True: 5.54k, False: 5.64M]
  ------------------
  392|  5.54k|            change_capacity(new_size + (new_size >> 1));
  393|  5.54k|        }
  394|  5.64M|        T* ptr = item_ptr(p);
  395|  5.64M|        T* dst = ptr + count;
  396|  5.64M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  397|  5.64M|        _size += count;
  398|  5.64M|        fill(ptr, first, last);
  399|  5.64M|    }
_ZNK9prevectorILj28EhjiE14const_iteratorltES1_:
  129|  9.58M|        bool operator<(const_iterator x) const { return ptr < x.ptr; }
_ZNK9prevectorILj33EhjiE4dataEv:
  537|  6.72k|    const value_type* data() const {
  538|  6.72k|        return item_ptr(0);
  539|  6.72k|    }
_ZNK9prevectorILj33EhjiE8item_ptrEi:
  207|  6.72k|    const T* item_ptr(difference_type pos) const { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (207:59): [True: 6.72k, False: 0]
  ------------------
_ZNK9prevectorILj33EhjiE10direct_ptrEi:
  170|  6.72k|    const T* direct_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.direct) + pos; }
_ZNK9prevectorILj28EhjiE4backEv:
  464|  82.1k|    const T& back() const {
  465|  82.1k|        return *item_ptr(size() - 1);
  466|  82.1k|    }
_ZNK9prevectorILj28EhjiE14const_iteratorplEj:
  119|  8.90M|        const_iterator operator+(size_type n) const { return const_iterator(ptr + n); }
_ZNK9prevectorILj28EhjiE14const_iteratoreqES1_:
  124|    250|        bool operator==(const_iterator x) const { return ptr == x.ptr; }
_ZN9prevectorILj28EhjiE14const_iteratorpLEj:
  121|  37.9M|        const_iterator& operator+=(size_type n) { ptr += n; return *this; }
_ZN9prevectorILj28EhjiE14const_iteratorC2ENS0_8iteratorE:
  110|   192k|        const_iterator(iterator x) : ptr(&(*x)) {}
_ZNK9prevectorILj28EhjiEneERKS0_:
  498|  15.7k|    bool operator!=(const prevector<N, T, Size, Diff>& other) const {
  499|  15.7k|        return !(*this == other);
  500|  15.7k|    }
_ZN9prevectorILj28EhjiE6insertITkNSt3__114input_iteratorENS0_14const_iteratorEEEvNS0_8iteratorET_S5_:
  387|  1.02M|    void insert(iterator pos, InputIterator first, InputIterator last) {
  388|  1.02M|        size_type p = pos - begin();
  389|  1.02M|        difference_type count = last - first;
  390|  1.02M|        size_type new_size = size() + count;
  391|  1.02M|        if (capacity() < new_size) {
  ------------------
  |  Branch (391:13): [True: 36.1k, False: 991k]
  ------------------
  392|  36.1k|            change_capacity(new_size + (new_size >> 1));
  393|  36.1k|        }
  394|  1.02M|        T* ptr = item_ptr(p);
  395|  1.02M|        T* dst = ptr + count;
  396|  1.02M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  397|  1.02M|        _size += count;
  398|  1.02M|        fill(ptr, first, last);
  399|  1.02M|    }
_ZN9prevectorILj28EhjiEC2ITkNSt3__114input_iteratorENS0_14const_iteratorEEET_S4_:
  256|   104k|    prevector(InputIterator first, InputIterator last) {
  257|   104k|        size_type n = last - first;
  258|   104k|        change_capacity(n);
  259|   104k|        _size += n;
  260|   104k|        fill(item_ptr(0), first, last);
  261|   104k|    }
_ZNK9prevectorILj28EhjiE14const_iteratorixEj:
  113|   161k|        const T& operator[](size_type pos) const { return ptr[pos]; }
_ZNK9prevectorILj28EhjiE14const_iteratorgeES1_:
  126|   212M|        bool operator>=(const_iterator x) const { return ptr >= x.ptr; }
_ZN9prevectorILj28EhjiE14const_iteratorppEi:
  116|   214M|        const_iterator operator++(int) { const_iterator copy(*this); ++(*this); return copy; }

_ZN6CTxOutC2ERKl7CScript:
   56|  8.51k|{
   57|  8.51k|    nValue = nValueIn;
   58|  8.51k|    scriptPubKey = scriptPubKeyIn;
   59|  8.51k|}
_ZN19CMutableTransactionC2Ev:
   66|  28.1k|CMutableTransaction::CMutableTransaction() : version{CTransaction::CURRENT_VERSION}, nLockTime{0} {}
_ZNK12CTransaction17ComputeHasWitnessEv:
   75|  16.1k|{
   76|  16.1k|    return std::any_of(vin.begin(), vin.end(), [](const auto& input) {
   77|  16.1k|        return !input.scriptWitness.IsNull();
   78|  16.1k|    });
   79|  16.1k|}
_ZNK12CTransaction11ComputeHashEv:
   82|  16.1k|{
   83|  16.1k|    return Txid::FromUint256((HashWriter{} << TX_NO_WITNESS(*this)).GetHash());
   84|  16.1k|}
_ZNK12CTransaction18ComputeWitnessHashEv:
   87|  16.1k|{
   88|  16.1k|    if (!HasWitness()) {
  ------------------
  |  Branch (88:9): [True: 15.1k, False: 1.02k]
  ------------------
   89|  15.1k|        return Wtxid::FromUint256(hash.ToUint256());
   90|  15.1k|    }
   91|       |
   92|  1.02k|    return Wtxid::FromUint256((HashWriter{} << TX_WITH_WITNESS(*this)).GetHash());
   93|  16.1k|}
_ZN12CTransactionC2ERK19CMutableTransaction:
   95|  16.1k|CTransaction::CTransaction(const CMutableTransaction& tx) : vin(tx.vin), vout(tx.vout), version{tx.version}, nLockTime{tx.nLockTime}, m_has_witness{ComputeHasWitness()}, hash{ComputeHash()}, m_witness_hash{ComputeWitnessHash()} {}
transaction.cpp:_ZZNK12CTransaction17ComputeHasWitnessEvENK3$_0clI5CTxInEEDaRKT_:
   76|   128k|    return std::any_of(vin.begin(), vin.end(), [](const auto& input) {
   77|   128k|        return !input.scriptWitness.IsNull();
   78|   128k|    });

_ZN9COutPointC2Ev:
   36|   165k|    COutPoint(): n(NULL_INDEX) { }
_ZltRK9COutPointS1_:
   45|   290k|    {
   46|   290k|        return std::tie(a.hash, a.n) < std::tie(b.hash, b.n);
   47|   290k|    }
_ZN5CTxInC2Ev:
  122|   154k|    {
  123|   154k|        nSequence = SEQUENCE_FINAL;
  124|   154k|    }
_ZN6CTxOutC2Ev:
  156|   111k|    {
  157|   111k|        SetNull();
  158|   111k|    }
_ZN6CTxOut7SetNullEv:
  165|   111k|    {
  166|   111k|        nValue = -1;
  167|   111k|        scriptPubKey.clear();
  168|   111k|    }
_ZNK6CTxOut6IsNullEv:
  171|  99.0k|    {
  172|  99.0k|        return (nValue == -1);
  173|  99.0k|    }
_ZNK12CTransaction10HasWitnessEv:
  373|  17.1k|    bool HasWitness() const { return m_has_witness; }
_ZNK19CMutableTransaction10HasWitnessEv:
  413|  1.04k|    {
  414|  3.76k|        for (size_t i = 0; i < vin.size(); i++) {
  ------------------
  |  Branch (414:28): [True: 3.74k, False: 17]
  ------------------
  415|  3.74k|            if (!vin[i].scriptWitness.IsNull()) {
  ------------------
  |  Branch (415:17): [True: 1.03k, False: 2.71k]
  ------------------
  416|  1.03k|                return true;
  417|  1.03k|            }
  418|  3.74k|        }
  419|     17|        return false;
  420|  1.04k|    }
_ZN19CMutableTransaction11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  393|  20.0k|    inline void Unserialize(Stream& s) {
  394|  20.0k|        UnserializeTransaction(*this, s, s.template GetParams<TransactionSerParams>());
  395|  20.0k|    }
_Z22UnserializeTransactionI12ParamsStreamIR10DataStream20TransactionSerParamsE19CMutableTransactionEvRT0_RT_RKS3_:
  217|  20.0k|{
  218|  20.0k|    const bool fAllowWitness = params.allow_witness;
  219|       |
  220|  20.0k|    s >> tx.version;
  221|  20.0k|    unsigned char flags = 0;
  222|  20.0k|    tx.vin.clear();
  223|  20.0k|    tx.vout.clear();
  224|       |    /* Try to read the vin. In case the dummy is there, this will be read as an empty vector. */
  225|  20.0k|    s >> tx.vin;
  226|  20.0k|    if (tx.vin.size() == 0 && fAllowWitness) {
  ------------------
  |  Branch (226:9): [True: 7.27k, False: 12.7k]
  |  Branch (226:31): [True: 7.27k, False: 0]
  ------------------
  227|       |        /* We read a dummy or an empty vin. */
  228|  7.27k|        s >> flags;
  229|  7.27k|        if (flags != 0) {
  ------------------
  |  Branch (229:13): [True: 1.23k, False: 6.04k]
  ------------------
  230|  1.23k|            s >> tx.vin;
  231|  1.23k|            s >> tx.vout;
  232|  1.23k|        }
  233|  12.7k|    } else {
  234|       |        /* We read a non-empty vin. Assume a normal vout follows. */
  235|  12.7k|        s >> tx.vout;
  236|  12.7k|    }
  237|  20.0k|    if ((flags & 1) && fAllowWitness) {
  ------------------
  |  Branch (237:9): [True: 1.12k, False: 18.9k]
  |  Branch (237:24): [True: 1.12k, False: 0]
  ------------------
  238|       |        /* The witness flag is present, and we support witnesses. */
  239|  1.12k|        flags ^= 1;
  240|  26.2k|        for (size_t i = 0; i < tx.vin.size(); i++) {
  ------------------
  |  Branch (240:28): [True: 25.1k, False: 1.12k]
  ------------------
  241|  25.1k|            s >> tx.vin[i].scriptWitness.stack;
  242|  25.1k|        }
  243|  1.12k|        if (!tx.HasWitness()) {
  ------------------
  |  Branch (243:13): [True: 17, False: 1.10k]
  ------------------
  244|       |            /* It's illegal to encode witnesses when all witness stacks are empty. */
  245|     17|            throw std::ios_base::failure("Superfluous witness record");
  246|     17|        }
  247|  1.12k|    }
  248|  20.0k|    if (flags) {
  ------------------
  |  Branch (248:9): [True: 14, False: 20.0k]
  ------------------
  249|       |        /* Unknown flag in the serialization */
  250|     14|        throw std::ios_base::failure("Unknown transaction optional data");
  251|     14|    }
  252|  20.0k|    s >> tx.nLockTime;
  253|  20.0k|}
_ZN5CTxIn16SerializationOpsI12ParamsStreamIR10DataStream20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
  129|   152k|    SERIALIZE_METHODS(CTxIn, obj) { READWRITE(obj.prevout, obj.scriptSig, obj.nSequence); }
  ------------------
  |  |  156|   152k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN9COutPoint16SerializationOpsI12ParamsStreamIR10DataStream20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
   39|   152k|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  156|   152k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI12ParamsStreamIR10DataStream20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
  162|  19.9k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  156|  19.9k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN9COutPoint16SerializationOpsI10DataStreamS_17ActionUnserializeEEvRT0_RT_T1_:
   39|  11.6k|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  156|  11.6k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI10DataStreamS_17ActionUnserializeEEvRT0_RT_T1_:
  162|  11.9k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  156|  11.9k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN9COutPoint16SerializationOpsI10HashWriterKS_15ActionSerializeEEvRT0_RT_T1_:
   39|  5.89M|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  156|  5.89M|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI10HashWriterKS_15ActionSerializeEEvRT0_RT_T1_:
  162|   233k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  156|   233k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN5CTxIn16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
  129|   174k|    SERIALIZE_METHODS(CTxIn, obj) { READWRITE(obj.prevout, obj.scriptSig, obj.nSequence); }
  ------------------
  |  |  156|   174k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN9COutPoint16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
   39|   174k|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  156|   174k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
  162|  24.8k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  156|  24.8k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZNK12CTransaction9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  328|  17.1k|    inline void Serialize(Stream& s) const {
  329|  17.1k|        SerializeTransaction(*this, s, s.template GetParams<TransactionSerParams>());
  330|  17.1k|    }
_Z20SerializeTransactionI12ParamsStreamIR10HashWriter20TransactionSerParamsE12CTransactionEvRKT0_RT_RKS3_:
  257|  17.1k|{
  258|  17.1k|    const bool fAllowWitness = params.allow_witness;
  259|       |
  260|  17.1k|    s << tx.version;
  261|  17.1k|    unsigned char flags = 0;
  262|       |    // Consistency check
  263|  17.1k|    if (fAllowWitness) {
  ------------------
  |  Branch (263:9): [True: 1.02k, False: 16.1k]
  ------------------
  264|       |        /* Check whether witnesses need to be serialized. */
  265|  1.02k|        if (tx.HasWitness()) {
  ------------------
  |  Branch (265:13): [True: 1.02k, False: 0]
  ------------------
  266|  1.02k|            flags |= 1;
  267|  1.02k|        }
  268|  1.02k|    }
  269|  17.1k|    if (flags) {
  ------------------
  |  Branch (269:9): [True: 1.02k, False: 16.1k]
  ------------------
  270|       |        /* Use extended format in case witnesses are to be serialized. */
  271|  1.02k|        std::vector<CTxIn> vinDummy;
  272|  1.02k|        s << vinDummy;
  273|  1.02k|        s << flags;
  274|  1.02k|    }
  275|  17.1k|    s << tx.vin;
  276|  17.1k|    s << tx.vout;
  277|  17.1k|    if (flags & 1) {
  ------------------
  |  Branch (277:9): [True: 1.02k, False: 16.1k]
  ------------------
  278|  25.5k|        for (size_t i = 0; i < tx.vin.size(); i++) {
  ------------------
  |  Branch (278:28): [True: 24.5k, False: 1.02k]
  ------------------
  279|  24.5k|            s << tx.vin[i].scriptWitness.stack;
  280|  24.5k|        }
  281|  1.02k|    }
  282|  17.1k|    s << tx.nLockTime;
  283|  17.1k|}

_Z20DeserializeHDKeypathI10DataStreamEvRT_R13KeyOriginInfo:
  137|    625|{
  138|    625|    hd_keypath = DeserializeKeyOrigin(s, ReadCompactSize(s));
  139|    625|}
_Z20DeserializeKeyOriginI10DataStreamE13KeyOriginInfoRT_m:
  118|    276|{
  119|       |    // Read in key path
  120|    276|    if (length % 4 || length == 0) {
  ------------------
  |  Branch (120:9): [True: 94, False: 182]
  |  Branch (120:23): [True: 15, False: 167]
  ------------------
  121|    109|        throw std::ios_base::failure("Invalid length for HD key path");
  122|    109|    }
  123|       |
  124|    167|    KeyOriginInfo hd_keypath;
  125|    167|    s >> hd_keypath.fingerprint;
  126|   164k|    for (unsigned int i = 4; i < length; i += sizeof(uint32_t)) {
  ------------------
  |  Branch (126:30): [True: 163k, False: 167]
  ------------------
  127|   163k|        uint32_t index;
  128|   163k|        s >> index;
  129|   163k|        hd_keypath.path.push_back(index);
  130|   163k|    }
  131|    167|    return hd_keypath;
  132|    276|}
_Z21DeserializeHDKeypathsI10DataStreamEvRT_RKNSt3__16vectorIhNS3_9allocatorIhEEEERNS3_3mapI7CPubKey13KeyOriginInfoNS3_4lessISB_EENS5_INS3_4pairIKSB_SC_EEEEEE:
  144|  23.9k|{
  145|       |    // Make sure that the key is the size of pubkey + 1
  146|  23.9k|    if (key.size() != CPubKey::SIZE + 1 && key.size() != CPubKey::COMPRESSED_SIZE + 1) {
  ------------------
  |  Branch (146:9): [True: 23.5k, False: 388]
  |  Branch (146:44): [True: 22.7k, False: 822]
  ------------------
  147|  22.7k|        throw std::ios_base::failure("Size of key was not the expected size for the type BIP32 keypath");
  148|  22.7k|    }
  149|       |    // Read in the pubkey from key
  150|  1.21k|    CPubKey pubkey(key.begin() + 1, key.end());
  151|  1.21k|    if (!pubkey.IsFullyValid()) {
  ------------------
  |  Branch (151:9): [True: 582, False: 628]
  ------------------
  152|    582|       throw std::ios_base::failure("Invalid pubkey");
  153|    582|    }
  154|    628|    if (hd_keypaths.count(pubkey) > 0) {
  ------------------
  |  Branch (154:9): [True: 3, False: 625]
  ------------------
  155|      3|        throw std::ios_base::failure("Duplicate Key, pubkey derivation path already provided");
  156|      3|    }
  157|       |
  158|    625|    KeyOriginInfo keypath;
  159|    625|    DeserializeHDKeypath(s, keypath);
  160|       |
  161|       |    // Add to map
  162|    625|    hd_keypaths.emplace(pubkey, std::move(keypath));
  163|    625|}
_Z18SerializeHDKeypathI10DataStreamEvRT_13KeyOriginInfo:
  178|  9.24k|{
  179|  9.24k|    WriteCompactSize(s, (hd_keypath.path.size() + 1) * sizeof(uint32_t));
  180|  9.24k|    SerializeKeyOrigin(s, hd_keypath);
  181|  9.24k|}
_Z18SerializeKeyOriginI10DataStreamEvRT_13KeyOriginInfo:
  168|  9.24k|{
  169|  9.24k|    s << hd_keypath.fingerprint;
  170|   234k|    for (const auto& path : hd_keypath.path) {
  ------------------
  |  Branch (170:27): [True: 234k, False: 9.24k]
  ------------------
  171|   234k|        s << path;
  172|   234k|    }
  173|  9.24k|}
_Z17SerializeToVectorI10DataStreamJ17CompactSizeWriter4SpanIKhEEEvRT_DpRKT0_:
   95|  9.24k|{
   96|  9.24k|    SizeComputer sizecomp;
   97|  9.24k|    SerializeMany(sizecomp, args...);
   98|  9.24k|    WriteCompactSize(s, sizecomp.size());
   99|  9.24k|    SerializeMany(s, args...);
  100|  9.24k|}
_Z19SerializeHDKeypathsI10DataStreamEvRT_RKNSt3__13mapI7CPubKey13KeyOriginInfoNS3_4lessIS5_EENS3_9allocatorINS3_4pairIKS5_S6_EEEEEE17CompactSizeWriter:
  186|  23.9k|{
  187|  23.9k|    for (const auto& keypath_pair : hd_keypaths) {
  ------------------
  |  Branch (187:35): [True: 9.59k, False: 23.5k]
  ------------------
  188|  9.59k|        if (!keypath_pair.first.IsValid()) {
  ------------------
  |  Branch (188:13): [True: 354, False: 9.24k]
  ------------------
  189|    354|            throw std::ios_base::failure("Invalid CPubKey being serialized");
  190|    354|        }
  191|  9.24k|        SerializeToVector(s, type, Span{keypath_pair.first});
  192|  9.24k|        SerializeHDKeypath(s, keypath_pair.second);
  193|  9.24k|    }
  194|  23.9k|}

_Z29ecdsa_signature_parse_der_laxP25secp256k1_ecdsa_signaturePKhm:
   45|   109k|int ecdsa_signature_parse_der_lax(secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
   46|   109k|    size_t rpos, rlen, spos, slen;
   47|   109k|    size_t pos = 0;
   48|   109k|    size_t lenbyte;
   49|   109k|    unsigned char tmpsig[64] = {0};
   50|   109k|    int overflow = 0;
   51|       |
   52|       |    /* Hack to initialize sig with a correctly-parsed but invalid signature. */
   53|   109k|    secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
   54|       |
   55|       |    /* Sequence tag byte */
   56|   109k|    if (pos == inputlen || input[pos] != 0x30) {
  ------------------
  |  Branch (56:9): [True: 0, False: 109k]
  |  Branch (56:28): [True: 0, False: 109k]
  ------------------
   57|      0|        return 0;
   58|      0|    }
   59|   109k|    pos++;
   60|       |
   61|       |    /* Sequence length bytes */
   62|   109k|    if (pos == inputlen) {
  ------------------
  |  Branch (62:9): [True: 0, False: 109k]
  ------------------
   63|      0|        return 0;
   64|      0|    }
   65|   109k|    lenbyte = input[pos++];
   66|   109k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (66:9): [True: 0, False: 109k]
  ------------------
   67|      0|        lenbyte -= 0x80;
   68|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (68:13): [True: 0, False: 0]
  ------------------
   69|      0|            return 0;
   70|      0|        }
   71|      0|        pos += lenbyte;
   72|      0|    }
   73|       |
   74|       |    /* Integer tag byte for R */
   75|   109k|    if (pos == inputlen || input[pos] != 0x02) {
  ------------------
  |  Branch (75:9): [True: 0, False: 109k]
  |  Branch (75:28): [True: 0, False: 109k]
  ------------------
   76|      0|        return 0;
   77|      0|    }
   78|   109k|    pos++;
   79|       |
   80|       |    /* Integer length for R */
   81|   109k|    if (pos == inputlen) {
  ------------------
  |  Branch (81:9): [True: 0, False: 109k]
  ------------------
   82|      0|        return 0;
   83|      0|    }
   84|   109k|    lenbyte = input[pos++];
   85|   109k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (85:9): [True: 0, False: 109k]
  ------------------
   86|      0|        lenbyte -= 0x80;
   87|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (87:13): [True: 0, False: 0]
  ------------------
   88|      0|            return 0;
   89|      0|        }
   90|      0|        while (lenbyte > 0 && input[pos] == 0) {
  ------------------
  |  Branch (90:16): [True: 0, False: 0]
  |  Branch (90:31): [True: 0, False: 0]
  ------------------
   91|      0|            pos++;
   92|      0|            lenbyte--;
   93|      0|        }
   94|      0|        static_assert(sizeof(size_t) >= 4, "size_t too small");
   95|      0|        if (lenbyte >= 4) {
  ------------------
  |  Branch (95:13): [True: 0, False: 0]
  ------------------
   96|      0|            return 0;
   97|      0|        }
   98|      0|        rlen = 0;
   99|      0|        while (lenbyte > 0) {
  ------------------
  |  Branch (99:16): [True: 0, False: 0]
  ------------------
  100|      0|            rlen = (rlen << 8) + input[pos];
  101|      0|            pos++;
  102|      0|            lenbyte--;
  103|      0|        }
  104|   109k|    } else {
  105|   109k|        rlen = lenbyte;
  106|   109k|    }
  107|   109k|    if (rlen > inputlen - pos) {
  ------------------
  |  Branch (107:9): [True: 0, False: 109k]
  ------------------
  108|      0|        return 0;
  109|      0|    }
  110|   109k|    rpos = pos;
  111|   109k|    pos += rlen;
  112|       |
  113|       |    /* Integer tag byte for S */
  114|   109k|    if (pos == inputlen || input[pos] != 0x02) {
  ------------------
  |  Branch (114:9): [True: 0, False: 109k]
  |  Branch (114:28): [True: 0, False: 109k]
  ------------------
  115|      0|        return 0;
  116|      0|    }
  117|   109k|    pos++;
  118|       |
  119|       |    /* Integer length for S */
  120|   109k|    if (pos == inputlen) {
  ------------------
  |  Branch (120:9): [True: 0, False: 109k]
  ------------------
  121|      0|        return 0;
  122|      0|    }
  123|   109k|    lenbyte = input[pos++];
  124|   109k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (124:9): [True: 0, False: 109k]
  ------------------
  125|      0|        lenbyte -= 0x80;
  126|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (126:13): [True: 0, False: 0]
  ------------------
  127|      0|            return 0;
  128|      0|        }
  129|      0|        while (lenbyte > 0 && input[pos] == 0) {
  ------------------
  |  Branch (129:16): [True: 0, False: 0]
  |  Branch (129:31): [True: 0, False: 0]
  ------------------
  130|      0|            pos++;
  131|      0|            lenbyte--;
  132|      0|        }
  133|      0|        static_assert(sizeof(size_t) >= 4, "size_t too small");
  134|      0|        if (lenbyte >= 4) {
  ------------------
  |  Branch (134:13): [True: 0, False: 0]
  ------------------
  135|      0|            return 0;
  136|      0|        }
  137|      0|        slen = 0;
  138|      0|        while (lenbyte > 0) {
  ------------------
  |  Branch (138:16): [True: 0, False: 0]
  ------------------
  139|      0|            slen = (slen << 8) + input[pos];
  140|      0|            pos++;
  141|      0|            lenbyte--;
  142|      0|        }
  143|   109k|    } else {
  144|   109k|        slen = lenbyte;
  145|   109k|    }
  146|   109k|    if (slen > inputlen - pos) {
  ------------------
  |  Branch (146:9): [True: 0, False: 109k]
  ------------------
  147|      0|        return 0;
  148|      0|    }
  149|   109k|    spos = pos;
  150|       |
  151|       |    /* Ignore leading zeroes in R */
  152|   110k|    while (rlen > 0 && input[rpos] == 0) {
  ------------------
  |  Branch (152:12): [True: 110k, False: 0]
  |  Branch (152:24): [True: 914, False: 109k]
  ------------------
  153|    914|        rlen--;
  154|    914|        rpos++;
  155|    914|    }
  156|       |    /* Copy R value */
  157|   109k|    if (rlen > 32) {
  ------------------
  |  Branch (157:9): [True: 330, False: 109k]
  ------------------
  158|    330|        overflow = 1;
  159|   109k|    } else {
  160|   109k|        memcpy(tmpsig + 32 - rlen, input + rpos, rlen);
  161|   109k|    }
  162|       |
  163|       |    /* Ignore leading zeroes in S */
  164|   110k|    while (slen > 0 && input[spos] == 0) {
  ------------------
  |  Branch (164:12): [True: 110k, False: 0]
  |  Branch (164:24): [True: 654, False: 109k]
  ------------------
  165|    654|        slen--;
  166|    654|        spos++;
  167|    654|    }
  168|       |    /* Copy S value */
  169|   109k|    if (slen > 32) {
  ------------------
  |  Branch (169:9): [True: 0, False: 109k]
  ------------------
  170|      0|        overflow = 1;
  171|   109k|    } else {
  172|   109k|        memcpy(tmpsig + 64 - slen, input + spos, slen);
  173|   109k|    }
  174|       |
  175|   109k|    if (!overflow) {
  ------------------
  |  Branch (175:9): [True: 109k, False: 330]
  ------------------
  176|   109k|        overflow = !secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
  177|   109k|    }
  178|   109k|    if (overflow) {
  ------------------
  |  Branch (178:9): [True: 330, False: 109k]
  ------------------
  179|       |        /* Overwrite the result again with a correctly-parsed but invalid
  180|       |           signature if parsing failed. */
  181|    330|        memset(tmpsig, 0, 64);
  182|    330|        secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
  183|    330|    }
  184|   109k|    return 1;
  185|   109k|}
_ZNK11XOnlyPubKey9GetKeyIDsEv:
  201|  18.0k|{
  202|  18.0k|    std::vector<CKeyID> out;
  203|       |    // For now, use the old full pubkey-based key derivation logic. As it is indexed by
  204|       |    // Hash160(full pubkey), we need to return both a version prefixed with 0x02, and one
  205|       |    // with 0x03.
  206|  18.0k|    unsigned char b[33] = {0x02};
  207|  18.0k|    std::copy(m_keydata.begin(), m_keydata.end(), b + 1);
  208|  18.0k|    CPubKey fullpubkey;
  209|  18.0k|    fullpubkey.Set(b, b + 33);
  210|  18.0k|    out.push_back(fullpubkey.GetID());
  211|  18.0k|    b[0] = 0x03;
  212|  18.0k|    fullpubkey.Set(b, b + 33);
  213|  18.0k|    out.push_back(fullpubkey.GetID());
  214|  18.0k|    return out;
  215|  18.0k|}
_ZNK11XOnlyPubKey13VerifySchnorrERK7uint2564SpanIKhE:
  231|    447|{
  232|    447|    assert(sigbytes.size() == 64);
  233|    447|    secp256k1_xonly_pubkey pubkey;
  234|    447|    if (!secp256k1_xonly_pubkey_parse(secp256k1_context_static, &pubkey, m_keydata.data())) return false;
  ------------------
  |  Branch (234:9): [True: 39, False: 408]
  ------------------
  235|    408|    return secp256k1_schnorrsig_verify(secp256k1_context_static, sigbytes.data(), msg.begin(), 32, &pubkey);
  236|    447|}
_ZNK11XOnlyPubKey19ComputeTapTweakHashEPK7uint256:
  241|    386|{
  242|    386|    if (merkle_root == nullptr) {
  ------------------
  |  Branch (242:9): [True: 0, False: 386]
  ------------------
  243|       |        // We have no scripts. The actual tweak does not matter, but follow BIP341 here to
  244|       |        // allow for reproducible tweaking.
  245|      0|        return (HashWriter{HASHER_TAPTWEAK} << m_keydata).GetSHA256();
  246|    386|    } else {
  247|    386|        return (HashWriter{HASHER_TAPTWEAK} << m_keydata << *merkle_root).GetSHA256();
  248|    386|    }
  249|    386|}
_ZNK11XOnlyPubKey13CheckTapTweakERKS_RK7uint256b:
  252|  1.27k|{
  253|  1.27k|    secp256k1_xonly_pubkey internal_key;
  254|  1.27k|    if (!secp256k1_xonly_pubkey_parse(secp256k1_context_static, &internal_key, internal.data())) return false;
  ------------------
  |  Branch (254:9): [True: 893, False: 386]
  ------------------
  255|    386|    uint256 tweak = internal.ComputeTapTweakHash(&merkle_root);
  256|    386|    return secp256k1_xonly_pubkey_tweak_add_check(secp256k1_context_static, m_keydata.begin(), parity, &internal_key, tweak.begin());
  257|  1.27k|}
_ZNK7CPubKey6VerifyERK7uint256RKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  277|  45.3k|bool CPubKey::Verify(const uint256 &hash, const std::vector<unsigned char>& vchSig) const {
  278|  45.3k|    if (!IsValid())
  ------------------
  |  Branch (278:9): [True: 0, False: 45.3k]
  ------------------
  279|      0|        return false;
  280|  45.3k|    secp256k1_pubkey pubkey;
  281|  45.3k|    secp256k1_ecdsa_signature sig;
  282|  45.3k|    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size())) {
  ------------------
  |  Branch (282:9): [True: 0, False: 45.3k]
  ------------------
  283|      0|        return false;
  284|      0|    }
  285|  45.3k|    if (!ecdsa_signature_parse_der_lax(&sig, vchSig.data(), vchSig.size())) {
  ------------------
  |  Branch (285:9): [True: 0, False: 45.3k]
  ------------------
  286|      0|        return false;
  287|      0|    }
  288|       |    /* libsecp256k1's ECDSA verification requires lower-S signatures, which have
  289|       |     * not historically been enforced in Bitcoin, so normalize them first. */
  290|  45.3k|    secp256k1_ecdsa_signature_normalize(secp256k1_context_static, &sig, &sig);
  291|  45.3k|    return secp256k1_ecdsa_verify(secp256k1_context_static, &sig, hash.begin(), &pubkey);
  292|  45.3k|}
_ZNK7CPubKey12IsFullyValidEv:
  314|  1.21k|bool CPubKey::IsFullyValid() const {
  315|  1.21k|    if (!IsValid())
  ------------------
  |  Branch (315:9): [True: 40, False: 1.17k]
  ------------------
  316|     40|        return false;
  317|  1.17k|    secp256k1_pubkey pubkey;
  318|  1.17k|    return secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size());
  319|  1.21k|}
_ZN7CPubKey10DecompressEv:
  321|  2.30k|bool CPubKey::Decompress() {
  322|  2.30k|    if (!IsValid())
  ------------------
  |  Branch (322:9): [True: 0, False: 2.30k]
  ------------------
  323|      0|        return false;
  324|  2.30k|    secp256k1_pubkey pubkey;
  325|  2.30k|    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size())) {
  ------------------
  |  Branch (325:9): [True: 1.42k, False: 881]
  ------------------
  326|  1.42k|        return false;
  327|  1.42k|    }
  328|    881|    unsigned char pub[SIZE];
  329|    881|    size_t publen = SIZE;
  330|    881|    secp256k1_ec_pubkey_serialize(secp256k1_context_static, pub, &publen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  213|    881|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  193|    881|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  331|    881|    Set(pub, pub + publen);
  332|    881|    return true;
  333|  2.30k|}
_ZN7CPubKey9CheckLowSERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
  415|  64.3k|/* static */ bool CPubKey::CheckLowS(const std::vector<unsigned char>& vchSig) {
  416|  64.3k|    secp256k1_ecdsa_signature sig;
  417|  64.3k|    if (!ecdsa_signature_parse_der_lax(&sig, vchSig.data(), vchSig.size())) {
  ------------------
  |  Branch (417:9): [True: 0, False: 64.3k]
  ------------------
  418|      0|        return false;
  419|      0|    }
  420|  64.3k|    return (!secp256k1_ecdsa_signature_normalize(secp256k1_context_static, nullptr, &sig));
  421|  64.3k|}

_ZN6CKeyIDC2Ev:
   26|  1.47k|    CKeyID() : uint160() {}
_ZN6CKeyIDC2ERK7uint160:
   27|   130k|    explicit CKeyID(const uint160& in) : uint160(in) {}
_ZN7CPubKey6GetLenEh:
   61|   588k|    {
   62|   588k|        if (chHeader == 2 || chHeader == 3)
  ------------------
  |  Branch (62:13): [True: 212k, False: 376k]
  |  Branch (62:30): [True: 201k, False: 174k]
  ------------------
   63|   414k|            return COMPRESSED_SIZE;
   64|   174k|        if (chHeader == 4 || chHeader == 6 || chHeader == 7)
  ------------------
  |  Branch (64:13): [True: 119k, False: 54.5k]
  |  Branch (64:30): [True: 24.3k, False: 30.2k]
  |  Branch (64:47): [True: 15.4k, False: 14.7k]
  ------------------
   65|   159k|            return SIZE;
   66|  14.7k|        return 0;
   67|   174k|    }
_ZN7CPubKey10InvalidateEv:
   71|   119k|    {
   72|   119k|        vch[0] = 0xFF;
   73|   119k|    }
_ZN7CPubKey9ValidSizeERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
   77|  13.9k|    bool static ValidSize(const std::vector<unsigned char> &vch) {
   78|  13.9k|      return vch.size() > 0 && GetLen(vch[0]) == vch.size();
  ------------------
  |  Branch (78:14): [True: 11.5k, False: 2.42k]
  |  Branch (78:32): [True: 8.06k, False: 3.48k]
  ------------------
   79|  13.9k|    }
_ZN7CPubKeyC2Ev:
   83|   116k|    {
   84|   116k|        Invalidate();
   85|   116k|    }
_ZN7CPubKeyC2E4SpanIKhE:
  107|  54.4k|    {
  108|  54.4k|        Set(_vch.begin(), _vch.end());
  109|  54.4k|    }
_ZNK7CPubKey4sizeEv:
  112|   484k|    unsigned int size() const { return GetLen(vch[0]); }
_ZNK7CPubKey4dataEv:
  113|  9.24k|    const unsigned char* data() const { return vch; }
_ZNK7CPubKey5beginEv:
  114|  77.6k|    const unsigned char* begin() const { return vch; }
_ZNK7CPubKey3endEv:
  115|  32.3k|    const unsigned char* end() const { return vch + size(); }
_ZltRK7CPubKeyS1_:
  129|   110k|    {
  130|   110k|        return a.vch[0] < b.vch[0] ||
  ------------------
  |  Branch (130:16): [True: 20.0k, False: 90.2k]
  ------------------
  131|   110k|               (a.vch[0] == b.vch[0] && memcmp(a.vch, b.vch, a.size()) < 0);
  ------------------
  |  Branch (131:17): [True: 76.6k, False: 13.6k]
  |  Branch (131:41): [True: 43.0k, False: 33.6k]
  ------------------
  132|   110k|    }
_ZNK7CPubKey5GetIDEv:
  165|  95.8k|    {
  166|  95.8k|        return CKeyID(Hash160(Span{vch}.first(size())));
  167|  95.8k|    }
_ZNK7CPubKey7IsValidEv:
  190|   149k|    {
  191|   149k|        return size() > 0;
  192|   149k|    }
_ZNK7CPubKey12IsCompressedEv:
  205|  9.98k|    {
  206|  9.98k|        return size() == COMPRESSED_SIZE;
  207|  9.98k|    }
_ZN11XOnlyPubKeyC2ENSt3__14spanIKhLm18446744073709551615EEE:
  257|  9.57k|    constexpr explicit XOnlyPubKey(std::span<const unsigned char> bytes) : m_keydata{bytes} {}
_ZNK11XOnlyPubKey4dataEv:
  294|  1.27k|    const unsigned char* data() const { return m_keydata.begin(); }
_ZN7CPubKey3SetIPKhEEvT_S3_:
   90|  54.4k|    {
   91|  54.4k|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (91:19): [True: 0, False: 54.4k]
  ------------------
   92|  54.4k|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (92:13): [True: 54.4k, False: 0]
  |  Branch (92:20): [True: 54.4k, False: 0]
  ------------------
   93|  54.4k|            memcpy(vch, (unsigned char*)&pbegin[0], len);
   94|      0|        else
   95|      0|            Invalidate();
   96|  54.4k|    }
_ZN11XOnlyPubKeyC2Ev:
  242|   161k|    XOnlyPubKey() = default;
_ZN7CPubKey11UnserializeI10DataStreamEEvRT_:
  149|  19.8k|    {
  150|  19.8k|        const unsigned int len(::ReadCompactSize(s));
  151|  19.8k|        if (len <= SIZE) {
  ------------------
  |  Branch (151:13): [True: 17.1k, False: 2.70k]
  ------------------
  152|  17.1k|            s >> Span{vch, len};
  153|  17.1k|            if (len != size()) {
  ------------------
  |  Branch (153:17): [True: 2.16k, False: 14.9k]
  ------------------
  154|  2.16k|                Invalidate();
  155|  2.16k|            }
  156|  17.1k|        } else {
  157|       |            // invalid pubkey, skip available data
  158|  2.70k|            s.ignore(len);
  159|  2.70k|            Invalidate();
  160|  2.70k|        }
  161|  19.8k|    }
_ZN7CPubKeyC2INSt3__111__wrap_iterIPhEEEET_S5_:
  101|      2|    {
  102|      2|        Set(pbegin, pend);
  103|      2|    }
_ZN7CPubKey3SetINSt3__111__wrap_iterIPhEEEEvT_S5_:
   90|      2|    {
   91|      2|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (91:19): [True: 0, False: 2]
  ------------------
   92|      2|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (92:13): [True: 0, False: 2]
  |  Branch (92:20): [True: 0, False: 0]
  ------------------
   93|      0|            memcpy(vch, (unsigned char*)&pbegin[0], len);
   94|      2|        else
   95|      2|            Invalidate();
   96|      2|    }
_ZN7CPubKeyC2INSt3__111__wrap_iterIPKhEEEET_S6_:
  101|  1.21k|    {
  102|  1.21k|        Set(pbegin, pend);
  103|  1.21k|    }
_ZN7CPubKey3SetINSt3__111__wrap_iterIPKhEEEEvT_S6_:
   90|  1.21k|    {
   91|  1.21k|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (91:19): [True: 0, False: 1.21k]
  ------------------
   92|  1.21k|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (92:13): [True: 1.17k, False: 34]
  |  Branch (92:20): [True: 1.17k, False: 6]
  ------------------
   93|  1.17k|            memcpy(vch, (unsigned char*)&pbegin[0], len);
   94|     40|        else
   95|     40|            Invalidate();
   96|  1.21k|    }
_ZN7CPubKey3SetIPhEEvT_S2_:
   90|  37.0k|    {
   91|  37.0k|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (91:19): [True: 0, False: 37.0k]
  ------------------
   92|  37.0k|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (92:13): [True: 37.0k, False: 0]
  |  Branch (92:20): [True: 37.0k, False: 0]
  ------------------
   93|  37.0k|            memcpy(vch, (unsigned char*)&pbegin[0], len);
   94|      0|        else
   95|      0|            Invalidate();
   96|  37.0k|    }

_Z10CastToBoolRKNSt3__16vectorIhNS_9allocatorIhEEEE:
   36|   103k|{
   37|   283k|    for (unsigned int i = 0; i < vch.size(); i++)
  ------------------
  |  Branch (37:30): [True: 258k, False: 24.3k]
  ------------------
   38|   258k|    {
   39|   258k|        if (vch[i] != 0)
  ------------------
  |  Branch (39:13): [True: 79.1k, False: 179k]
  ------------------
   40|  79.1k|        {
   41|       |            // Can be negative zero
   42|  79.1k|            if (i == vch.size()-1 && vch[i] == 0x80)
  ------------------
  |  Branch (42:17): [True: 27.4k, False: 51.7k]
  |  Branch (42:38): [True: 959, False: 26.4k]
  ------------------
   43|    959|                return false;
   44|  78.2k|            return true;
   45|  79.1k|        }
   46|   258k|    }
   47|  24.3k|    return false;
   48|   103k|}
_Z22CheckSignatureEncodingRKNSt3__16vectorIhNS_9allocatorIhEEEEjP13ScriptError_t:
  200|  70.6k|bool CheckSignatureEncoding(const std::vector<unsigned char> &vchSig, unsigned int flags, ScriptError* serror) {
  201|       |    // Empty signature. Not strictly DER encoded, but allowed to provide a
  202|       |    // compact way to provide an invalid signature for use with CHECK(MULTI)SIG
  203|  70.6k|    if (vchSig.size() == 0) {
  ------------------
  |  Branch (203:9): [True: 4.21k, False: 66.4k]
  ------------------
  204|  4.21k|        return true;
  205|  4.21k|    }
  206|  66.4k|    if ((flags & (SCRIPT_VERIFY_DERSIG | SCRIPT_VERIFY_LOW_S | SCRIPT_VERIFY_STRICTENC)) != 0 && !IsValidSignatureEncoding(vchSig)) {
  ------------------
  |  Branch (206:9): [True: 66.4k, False: 0]
  |  Branch (206:98): [True: 2.14k, False: 64.3k]
  ------------------
  207|  2.14k|        return set_error(serror, SCRIPT_ERR_SIG_DER);
  208|  64.3k|    } else if ((flags & SCRIPT_VERIFY_LOW_S) != 0 && !IsLowDERSignature(vchSig, serror)) {
  ------------------
  |  Branch (208:16): [True: 64.3k, False: 3]
  |  Branch (208:54): [True: 0, False: 64.3k]
  ------------------
  209|       |        // serror is set
  210|      0|        return false;
  211|  64.3k|    } else if ((flags & SCRIPT_VERIFY_STRICTENC) != 0 && !IsDefinedHashtypeSignature(vchSig)) {
  ------------------
  |  Branch (211:16): [True: 64.3k, False: 0]
  |  Branch (211:58): [True: 17.8k, False: 46.4k]
  ------------------
  212|  17.8k|        return set_error(serror, SCRIPT_ERR_SIG_HASHTYPE);
  213|  17.8k|    }
  214|  46.4k|    return true;
  215|  66.4k|}
_Z13FindAndDeleteR7CScriptRKS_:
  229|  64.1k|{
  230|  64.1k|    int nFound = 0;
  231|  64.1k|    if (b.empty())
  ------------------
  |  Branch (231:9): [True: 0, False: 64.1k]
  ------------------
  232|      0|        return nFound;
  233|  64.1k|    CScript result;
  234|  64.1k|    CScript::const_iterator pc = script.begin(), pc2 = script.begin(), end = script.end();
  235|  64.1k|    opcodetype opcode;
  236|  64.1k|    do
  237|  1.02M|    {
  238|  1.02M|        result.insert(result.end(), pc2, pc);
  239|  1.04M|        while (static_cast<size_t>(end - pc) >= b.size() && std::equal(b.begin(), b.end(), pc))
  ------------------
  |  Branch (239:16): [True: 703k, False: 342k]
  |  Branch (239:61): [True: 20.8k, False: 683k]
  ------------------
  240|  20.8k|        {
  241|  20.8k|            pc = pc + b.size();
  242|  20.8k|            ++nFound;
  243|  20.8k|        }
  244|  1.02M|        pc2 = pc;
  245|  1.02M|    }
  246|  1.02M|    while (script.GetOp(pc, opcode));
  ------------------
  |  Branch (246:12): [True: 961k, False: 64.1k]
  ------------------
  247|       |
  248|  64.1k|    if (nFound > 0) {
  ------------------
  |  Branch (248:9): [True: 2.10k, False: 62.0k]
  ------------------
  249|  2.10k|        result.insert(result.end(), pc2, end);
  250|  2.10k|        script = std::move(result);
  251|  2.10k|    }
  252|       |
  253|  64.1k|    return nFound;
  254|  64.1k|}
_Z10EvalScriptRNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEERK7CScriptjRK20BaseSignatureChecker10SigVersionR19ScriptExecutionDataP13ScriptError_t:
  407|   544k|{
  408|   544k|    static const CScriptNum bnZero(0);
  409|   544k|    static const CScriptNum bnOne(1);
  410|       |    // static const CScriptNum bnFalse(0);
  411|       |    // static const CScriptNum bnTrue(1);
  412|   544k|    static const valtype vchFalse(0);
  413|       |    // static const valtype vchZero(0);
  414|   544k|    static const valtype vchTrue(1, 1);
  415|       |
  416|       |    // sigversion cannot be TAPROOT here, as it admits no script execution.
  417|   544k|    assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0 || sigversion == SigVersion::TAPSCRIPT);
  418|       |
  419|   544k|    CScript::const_iterator pc = script.begin();
  420|   544k|    CScript::const_iterator pend = script.end();
  421|   544k|    CScript::const_iterator pbegincodehash = script.begin();
  422|   544k|    opcodetype opcode;
  423|   544k|    valtype vchPushValue;
  424|   544k|    ConditionStack vfExec;
  425|   544k|    std::vector<valtype> altstack;
  426|   544k|    set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
  427|   544k|    if ((sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) && script.size() > MAX_SCRIPT_SIZE) {
  ------------------
  |  Branch (427:10): [True: 525k, False: 18.2k]
  |  Branch (427:44): [True: 18.2k, False: 0]
  |  Branch (427:85): [True: 74, False: 544k]
  ------------------
  428|     74|        return set_error(serror, SCRIPT_ERR_SCRIPT_SIZE);
  429|     74|    }
  430|   544k|    int nOpCount = 0;
  431|   544k|    bool fRequireMinimal = (flags & SCRIPT_VERIFY_MINIMALDATA) != 0;
  432|   544k|    uint32_t opcode_pos = 0;
  433|   544k|    execdata.m_codeseparator_pos = 0xFFFFFFFFUL;
  434|   544k|    execdata.m_codeseparator_pos_init = true;
  435|       |
  436|   544k|    try
  437|   544k|    {
  438|  7.51M|        for (; pc < pend; ++opcode_pos) {
  ------------------
  |  Branch (438:16): [True: 7.16M, False: 356k]
  ------------------
  439|  7.16M|            bool fExec = vfExec.all_true();
  440|       |
  441|       |            //
  442|       |            // Read instruction
  443|       |            //
  444|  7.16M|            if (!script.GetOp(pc, opcode, vchPushValue))
  ------------------
  |  Branch (444:17): [True: 22.1k, False: 7.13M]
  ------------------
  445|  22.1k|                return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
  446|  7.13M|            if (vchPushValue.size() > MAX_SCRIPT_ELEMENT_SIZE)
  ------------------
  |  Branch (446:17): [True: 486, False: 7.13M]
  ------------------
  447|    486|                return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
  448|       |
  449|  7.13M|            if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (449:17): [True: 7.04M, False: 95.3k]
  |  Branch (449:51): [True: 95.3k, False: 0]
  ------------------
  450|       |                // Note how OP_RESERVED does not count towards the opcode limit.
  451|  7.13M|                if (opcode > OP_16 && ++nOpCount > MAX_OPS_PER_SCRIPT) {
  ------------------
  |  Branch (451:21): [True: 2.25M, False: 4.88M]
  |  Branch (451:39): [True: 796, False: 2.25M]
  ------------------
  452|    796|                    return set_error(serror, SCRIPT_ERR_OP_COUNT);
  453|    796|                }
  454|  7.13M|            }
  455|       |
  456|  7.13M|            if (opcode == OP_CAT ||
  ------------------
  |  Branch (456:17): [True: 241, False: 7.13M]
  ------------------
  457|  7.13M|                opcode == OP_SUBSTR ||
  ------------------
  |  Branch (457:17): [True: 391, False: 7.13M]
  ------------------
  458|  7.13M|                opcode == OP_LEFT ||
  ------------------
  |  Branch (458:17): [True: 231, False: 7.13M]
  ------------------
  459|  7.13M|                opcode == OP_RIGHT ||
  ------------------
  |  Branch (459:17): [True: 367, False: 7.13M]
  ------------------
  460|  7.13M|                opcode == OP_INVERT ||
  ------------------
  |  Branch (460:17): [True: 215, False: 7.13M]
  ------------------
  461|  7.13M|                opcode == OP_AND ||
  ------------------
  |  Branch (461:17): [True: 211, False: 7.13M]
  ------------------
  462|  7.13M|                opcode == OP_OR ||
  ------------------
  |  Branch (462:17): [True: 297, False: 7.13M]
  ------------------
  463|  7.13M|                opcode == OP_XOR ||
  ------------------
  |  Branch (463:17): [True: 222, False: 7.13M]
  ------------------
  464|  7.13M|                opcode == OP_2MUL ||
  ------------------
  |  Branch (464:17): [True: 245, False: 7.13M]
  ------------------
  465|  7.13M|                opcode == OP_2DIV ||
  ------------------
  |  Branch (465:17): [True: 210, False: 7.13M]
  ------------------
  466|  7.13M|                opcode == OP_MUL ||
  ------------------
  |  Branch (466:17): [True: 538, False: 7.13M]
  ------------------
  467|  7.13M|                opcode == OP_DIV ||
  ------------------
  |  Branch (467:17): [True: 339, False: 7.13M]
  ------------------
  468|  7.13M|                opcode == OP_MOD ||
  ------------------
  |  Branch (468:17): [True: 334, False: 7.13M]
  ------------------
  469|  7.13M|                opcode == OP_LSHIFT ||
  ------------------
  |  Branch (469:17): [True: 292, False: 7.13M]
  ------------------
  470|  7.13M|                opcode == OP_RSHIFT)
  ------------------
  |  Branch (470:17): [True: 268, False: 7.13M]
  ------------------
  471|  4.40k|                return set_error(serror, SCRIPT_ERR_DISABLED_OPCODE); // Disabled opcodes (CVE-2010-5137).
  472|       |
  473|       |            // With SCRIPT_VERIFY_CONST_SCRIPTCODE, OP_CODESEPARATOR in non-segwit script is rejected even in an unexecuted branch
  474|  7.13M|            if (opcode == OP_CODESEPARATOR && sigversion == SigVersion::BASE && (flags & SCRIPT_VERIFY_CONST_SCRIPTCODE))
  ------------------
  |  Branch (474:17): [True: 1.23k, False: 7.13M]
  |  Branch (474:47): [True: 1.22k, False: 10]
  |  Branch (474:81): [True: 769, False: 455]
  ------------------
  475|    769|                return set_error(serror, SCRIPT_ERR_OP_CODESEPARATOR);
  476|       |
  477|  7.13M|            if (fExec && 0 <= opcode && opcode <= OP_PUSHDATA4) {
  ------------------
  |  Branch (477:17): [True: 5.79M, False: 1.33M]
  |  Branch (477:26): [True: 5.79M, False: 0]
  |  Branch (477:41): [True: 3.50M, False: 2.28M]
  ------------------
  478|  3.50M|                if (fRequireMinimal && !CheckMinimalPush(vchPushValue, opcode)) {
  ------------------
  |  Branch (478:21): [True: 3.47M, False: 32.7k]
  |  Branch (478:40): [True: 1.08k, False: 3.47M]
  ------------------
  479|  1.08k|                    return set_error(serror, SCRIPT_ERR_MINIMALDATA);
  480|  1.08k|                }
  481|  3.50M|                stack.push_back(vchPushValue);
  482|  3.62M|            } else if (fExec || (OP_IF <= opcode && opcode <= OP_ENDIF))
  ------------------
  |  Branch (482:24): [True: 2.28M, False: 1.33M]
  |  Branch (482:34): [True: 404k, False: 934k]
  |  Branch (482:53): [True: 164k, False: 240k]
  ------------------
  483|  2.45M|            switch (opcode)
  484|  2.45M|            {
  485|       |                //
  486|       |                // Push value
  487|       |                //
  488|  9.87k|                case OP_1NEGATE:
  ------------------
  |  Branch (488:17): [True: 9.87k, False: 2.44M]
  ------------------
  489|  30.5k|                case OP_1:
  ------------------
  |  Branch (489:17): [True: 20.6k, False: 2.43M]
  ------------------
  490|  70.4k|                case OP_2:
  ------------------
  |  Branch (490:17): [True: 39.9k, False: 2.41M]
  ------------------
  491|  75.4k|                case OP_3:
  ------------------
  |  Branch (491:17): [True: 5.00k, False: 2.44M]
  ------------------
  492|  91.4k|                case OP_4:
  ------------------
  |  Branch (492:17): [True: 15.9k, False: 2.43M]
  ------------------
  493|   236k|                case OP_5:
  ------------------
  |  Branch (493:17): [True: 145k, False: 2.30M]
  ------------------
  494|   242k|                case OP_6:
  ------------------
  |  Branch (494:17): [True: 5.75k, False: 2.44M]
  ------------------
  495|   289k|                case OP_7:
  ------------------
  |  Branch (495:17): [True: 46.9k, False: 2.40M]
  ------------------
  496|   293k|                case OP_8:
  ------------------
  |  Branch (496:17): [True: 4.11k, False: 2.44M]
  ------------------
  497|   304k|                case OP_9:
  ------------------
  |  Branch (497:17): [True: 11.2k, False: 2.44M]
  ------------------
  498|   306k|                case OP_10:
  ------------------
  |  Branch (498:17): [True: 1.76k, False: 2.44M]
  ------------------
  499|   312k|                case OP_11:
  ------------------
  |  Branch (499:17): [True: 6.01k, False: 2.44M]
  ------------------
  500|   313k|                case OP_12:
  ------------------
  |  Branch (500:17): [True: 429, False: 2.45M]
  ------------------
  501|   336k|                case OP_13:
  ------------------
  |  Branch (501:17): [True: 23.1k, False: 2.42M]
  ------------------
  502|   435k|                case OP_14:
  ------------------
  |  Branch (502:17): [True: 99.5k, False: 2.35M]
  ------------------
  503|   437k|                case OP_15:
  ------------------
  |  Branch (503:17): [True: 1.83k, False: 2.44M]
  ------------------
  504|   441k|                case OP_16:
  ------------------
  |  Branch (504:17): [True: 3.42k, False: 2.44M]
  ------------------
  505|   441k|                {
  506|       |                    // ( -- value)
  507|   441k|                    CScriptNum bn((int)opcode - (int)(OP_1 - 1));
  508|   441k|                    stack.push_back(bn.getvch());
  509|       |                    // The result of these opcodes should always be the minimal way to push the data
  510|       |                    // they push, so no need for a CheckMinimalPush here.
  511|   441k|                }
  512|   441k|                break;
  513|       |
  514|       |
  515|       |                //
  516|       |                // Control
  517|       |                //
  518|   828k|                case OP_NOP:
  ------------------
  |  Branch (518:17): [True: 828k, False: 1.62M]
  ------------------
  519|   828k|                    break;
  520|       |
  521|  7.44k|                case OP_CHECKLOCKTIMEVERIFY:
  ------------------
  |  Branch (521:17): [True: 7.44k, False: 2.44M]
  ------------------
  522|  7.44k|                {
  523|  7.44k|                    if (!(flags & SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY)) {
  ------------------
  |  Branch (523:25): [True: 430, False: 7.01k]
  ------------------
  524|       |                        // not enabled; treat as a NOP2
  525|    430|                        break;
  526|    430|                    }
  527|       |
  528|  7.01k|                    if (stack.size() < 1)
  ------------------
  |  Branch (528:25): [True: 657, False: 6.36k]
  ------------------
  529|    657|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  530|       |
  531|       |                    // Note that elsewhere numeric opcodes are limited to
  532|       |                    // operands in the range -2**31+1 to 2**31-1, however it is
  533|       |                    // legal for opcodes to produce results exceeding that
  534|       |                    // range. This limitation is implemented by CScriptNum's
  535|       |                    // default 4-byte limit.
  536|       |                    //
  537|       |                    // If we kept to that limit we'd have a year 2038 problem,
  538|       |                    // even though the nLockTime field in transactions
  539|       |                    // themselves is uint32 which only becomes meaningless
  540|       |                    // after the year 2106.
  541|       |                    //
  542|       |                    // Thus as a special case we tell CScriptNum to accept up
  543|       |                    // to 5-byte bignums, which are good until 2**39-1, well
  544|       |                    // beyond the 2**32-1 limit of the nLockTime field itself.
  545|  6.36k|                    const CScriptNum nLockTime(stacktop(-1), fRequireMinimal, 5);
  ------------------
  |  |   54|  6.36k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  546|       |
  547|       |                    // In the rare event that the argument may be < 0 due to
  548|       |                    // some arithmetic being done first, you can always use
  549|       |                    // 0 MAX CHECKLOCKTIMEVERIFY.
  550|  6.36k|                    if (nLockTime < 0)
  ------------------
  |  Branch (550:25): [True: 533, False: 5.82k]
  ------------------
  551|    533|                        return set_error(serror, SCRIPT_ERR_NEGATIVE_LOCKTIME);
  552|       |
  553|       |                    // Actually compare the specified lock time with the transaction.
  554|  5.82k|                    if (!checker.CheckLockTime(nLockTime))
  ------------------
  |  Branch (554:25): [True: 2.65k, False: 3.17k]
  ------------------
  555|  2.65k|                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
  556|       |
  557|  3.17k|                    break;
  558|  5.82k|                }
  559|       |
  560|  12.9k|                case OP_CHECKSEQUENCEVERIFY:
  ------------------
  |  Branch (560:17): [True: 12.9k, False: 2.43M]
  ------------------
  561|  12.9k|                {
  562|  12.9k|                    if (!(flags & SCRIPT_VERIFY_CHECKSEQUENCEVERIFY)) {
  ------------------
  |  Branch (562:25): [True: 940, False: 11.9k]
  ------------------
  563|       |                        // not enabled; treat as a NOP3
  564|    940|                        break;
  565|    940|                    }
  566|       |
  567|  11.9k|                    if (stack.size() < 1)
  ------------------
  |  Branch (567:25): [True: 532, False: 11.4k]
  ------------------
  568|    532|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  569|       |
  570|       |                    // nSequence, like nLockTime, is a 32-bit unsigned integer
  571|       |                    // field. See the comment in CHECKLOCKTIMEVERIFY regarding
  572|       |                    // 5-byte numeric operands.
  573|  11.4k|                    const CScriptNum nSequence(stacktop(-1), fRequireMinimal, 5);
  ------------------
  |  |   54|  11.4k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  574|       |
  575|       |                    // In the rare event that the argument may be < 0 due to
  576|       |                    // some arithmetic being done first, you can always use
  577|       |                    // 0 MAX CHECKSEQUENCEVERIFY.
  578|  11.4k|                    if (nSequence < 0)
  ------------------
  |  Branch (578:25): [True: 573, False: 10.8k]
  ------------------
  579|    573|                        return set_error(serror, SCRIPT_ERR_NEGATIVE_LOCKTIME);
  580|       |
  581|       |                    // To provide for future soft-fork extensibility, if the
  582|       |                    // operand has the disabled lock-time flag set,
  583|       |                    // CHECKSEQUENCEVERIFY behaves as a NOP.
  584|  10.8k|                    if ((nSequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG) != 0)
  ------------------
  |  Branch (584:25): [True: 312, False: 10.5k]
  ------------------
  585|    312|                        break;
  586|       |
  587|       |                    // Compare the specified sequence number with the input.
  588|  10.5k|                    if (!checker.CheckSequence(nSequence))
  ------------------
  |  Branch (588:25): [True: 2.87k, False: 7.71k]
  ------------------
  589|  2.87k|                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
  590|       |
  591|  7.71k|                    break;
  592|  10.5k|                }
  593|       |
  594|  7.71k|                case OP_NOP1: case OP_NOP4: case OP_NOP5:
  ------------------
  |  Branch (594:17): [True: 440, False: 2.45M]
  |  Branch (594:31): [True: 358, False: 2.45M]
  |  Branch (594:45): [True: 338, False: 2.45M]
  ------------------
  595|  3.62k|                case OP_NOP6: case OP_NOP7: case OP_NOP8: case OP_NOP9: case OP_NOP10:
  ------------------
  |  Branch (595:17): [True: 403, False: 2.45M]
  |  Branch (595:31): [True: 544, False: 2.45M]
  |  Branch (595:45): [True: 642, False: 2.45M]
  |  Branch (595:59): [True: 547, False: 2.45M]
  |  Branch (595:73): [True: 353, False: 2.45M]
  ------------------
  596|  3.62k|                {
  597|  3.62k|                    if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS)
  ------------------
  |  Branch (597:25): [True: 758, False: 2.86k]
  ------------------
  598|    758|                        return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS);
  599|  3.62k|                }
  600|  2.86k|                break;
  601|       |
  602|  9.49k|                case OP_IF:
  ------------------
  |  Branch (602:17): [True: 9.49k, False: 2.44M]
  ------------------
  603|   110k|                case OP_NOTIF:
  ------------------
  |  Branch (603:17): [True: 101k, False: 2.35M]
  ------------------
  604|   110k|                {
  605|       |                    // <expression> if [statements] [else [statements]] endif
  606|   110k|                    bool fValue = false;
  607|   110k|                    if (fExec)
  ------------------
  |  Branch (607:25): [True: 25.9k, False: 84.8k]
  ------------------
  608|  25.9k|                    {
  609|  25.9k|                        if (stack.size() < 1)
  ------------------
  |  Branch (609:29): [True: 583, False: 25.3k]
  ------------------
  610|    583|                            return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
  611|  25.3k|                        valtype& vch = stacktop(-1);
  ------------------
  |  |   54|  25.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  612|       |                        // Tapscript requires minimal IF/NOTIF inputs as a consensus rule.
  613|  25.3k|                        if (sigversion == SigVersion::TAPSCRIPT) {
  ------------------
  |  Branch (613:29): [True: 0, False: 25.3k]
  ------------------
  614|       |                            // The input argument to the OP_IF and OP_NOTIF opcodes must be either
  615|       |                            // exactly 0 (the empty vector) or exactly 1 (the one-byte vector with value 1).
  616|      0|                            if (vch.size() > 1 || (vch.size() == 1 && vch[0] != 1)) {
  ------------------
  |  Branch (616:33): [True: 0, False: 0]
  |  Branch (616:52): [True: 0, False: 0]
  |  Branch (616:71): [True: 0, False: 0]
  ------------------
  617|      0|                                return set_error(serror, SCRIPT_ERR_TAPSCRIPT_MINIMALIF);
  618|      0|                            }
  619|      0|                        }
  620|       |                        // Under witness v0 rules it is only a policy rule, enabled through SCRIPT_VERIFY_MINIMALIF.
  621|  25.3k|                        if (sigversion == SigVersion::WITNESS_V0 && (flags & SCRIPT_VERIFY_MINIMALIF)) {
  ------------------
  |  Branch (621:29): [True: 1, False: 25.3k]
  |  Branch (621:69): [True: 1, False: 0]
  ------------------
  622|      1|                            if (vch.size() > 1)
  ------------------
  |  Branch (622:33): [True: 1, False: 0]
  ------------------
  623|      1|                                return set_error(serror, SCRIPT_ERR_MINIMALIF);
  624|      0|                            if (vch.size() == 1 && vch[0] != 1)
  ------------------
  |  Branch (624:33): [True: 0, False: 0]
  |  Branch (624:52): [True: 0, False: 0]
  ------------------
  625|      0|                                return set_error(serror, SCRIPT_ERR_MINIMALIF);
  626|      0|                        }
  627|  25.3k|                        fValue = CastToBool(vch);
  628|  25.3k|                        if (opcode == OP_NOTIF)
  ------------------
  |  Branch (628:29): [True: 22.2k, False: 3.11k]
  ------------------
  629|  22.2k|                            fValue = !fValue;
  630|  25.3k|                        popstack(stack);
  631|  25.3k|                    }
  632|   110k|                    vfExec.push_back(fValue);
  633|   110k|                }
  634|      0|                break;
  635|       |
  636|  2.07k|                case OP_ELSE:
  ------------------
  |  Branch (636:17): [True: 2.07k, False: 2.44M]
  ------------------
  637|  2.07k|                {
  638|  2.07k|                    if (vfExec.empty())
  ------------------
  |  Branch (638:25): [True: 495, False: 1.58k]
  ------------------
  639|    495|                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
  640|  1.58k|                    vfExec.toggle_top();
  641|  1.58k|                }
  642|      0|                break;
  643|       |
  644|  79.8k|                case OP_ENDIF:
  ------------------
  |  Branch (644:17): [True: 79.8k, False: 2.37M]
  ------------------
  645|  79.8k|                {
  646|  79.8k|                    if (vfExec.empty())
  ------------------
  |  Branch (646:25): [True: 586, False: 79.2k]
  ------------------
  647|    586|                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
  648|  79.2k|                    vfExec.pop_back();
  649|  79.2k|                }
  650|      0|                break;
  651|       |
  652|  2.88k|                case OP_VERIFY:
  ------------------
  |  Branch (652:17): [True: 2.88k, False: 2.44M]
  ------------------
  653|  2.88k|                {
  654|       |                    // (true -- ) or
  655|       |                    // (false -- false) and return
  656|  2.88k|                    if (stack.size() < 1)
  ------------------
  |  Branch (656:25): [True: 447, False: 2.44k]
  ------------------
  657|    447|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  658|  2.44k|                    bool fValue = CastToBool(stacktop(-1));
  ------------------
  |  |   54|  2.44k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  659|  2.44k|                    if (fValue)
  ------------------
  |  Branch (659:25): [True: 1.84k, False: 597]
  ------------------
  660|  1.84k|                        popstack(stack);
  661|    597|                    else
  662|    597|                        return set_error(serror, SCRIPT_ERR_VERIFY);
  663|  2.44k|                }
  664|  1.84k|                break;
  665|       |
  666|  1.92k|                case OP_RETURN:
  ------------------
  |  Branch (666:17): [True: 1.92k, False: 2.44M]
  ------------------
  667|  1.92k|                {
  668|  1.92k|                    return set_error(serror, SCRIPT_ERR_OP_RETURN);
  669|  2.44k|                }
  670|      0|                break;
  671|       |
  672|       |
  673|       |                //
  674|       |                // Stack ops
  675|       |                //
  676|  15.4k|                case OP_TOALTSTACK:
  ------------------
  |  Branch (676:17): [True: 15.4k, False: 2.43M]
  ------------------
  677|  15.4k|                {
  678|  15.4k|                    if (stack.size() < 1)
  ------------------
  |  Branch (678:25): [True: 480, False: 14.9k]
  ------------------
  679|    480|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  680|  14.9k|                    altstack.push_back(stacktop(-1));
  ------------------
  |  |   54|  14.9k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  681|  14.9k|                    popstack(stack);
  682|  14.9k|                }
  683|      0|                break;
  684|       |
  685|  2.12k|                case OP_FROMALTSTACK:
  ------------------
  |  Branch (685:17): [True: 2.12k, False: 2.44M]
  ------------------
  686|  2.12k|                {
  687|  2.12k|                    if (altstack.size() < 1)
  ------------------
  |  Branch (687:25): [True: 409, False: 1.71k]
  ------------------
  688|    409|                        return set_error(serror, SCRIPT_ERR_INVALID_ALTSTACK_OPERATION);
  689|  1.71k|                    stack.push_back(altstacktop(-1));
  ------------------
  |  |   55|  1.71k|#define altstacktop(i) (altstack.at(size_t(int64_t(altstack.size()) + int64_t{i})))
  ------------------
  690|  1.71k|                    popstack(altstack);
  691|  1.71k|                }
  692|      0|                break;
  693|       |
  694|  3.31k|                case OP_2DROP:
  ------------------
  |  Branch (694:17): [True: 3.31k, False: 2.44M]
  ------------------
  695|  3.31k|                {
  696|       |                    // (x1 x2 -- )
  697|  3.31k|                    if (stack.size() < 2)
  ------------------
  |  Branch (697:25): [True: 550, False: 2.76k]
  ------------------
  698|    550|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  699|  2.76k|                    popstack(stack);
  700|  2.76k|                    popstack(stack);
  701|  2.76k|                }
  702|      0|                break;
  703|       |
  704|  3.83k|                case OP_2DUP:
  ------------------
  |  Branch (704:17): [True: 3.83k, False: 2.44M]
  ------------------
  705|  3.83k|                {
  706|       |                    // (x1 x2 -- x1 x2 x1 x2)
  707|  3.83k|                    if (stack.size() < 2)
  ------------------
  |  Branch (707:25): [True: 403, False: 3.42k]
  ------------------
  708|    403|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  709|  3.42k|                    valtype vch1 = stacktop(-2);
  ------------------
  |  |   54|  3.42k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  710|  3.42k|                    valtype vch2 = stacktop(-1);
  ------------------
  |  |   54|  3.42k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  711|  3.42k|                    stack.push_back(vch1);
  712|  3.42k|                    stack.push_back(vch2);
  713|  3.42k|                }
  714|      0|                break;
  715|       |
  716|  3.44k|                case OP_3DUP:
  ------------------
  |  Branch (716:17): [True: 3.44k, False: 2.44M]
  ------------------
  717|  3.44k|                {
  718|       |                    // (x1 x2 x3 -- x1 x2 x3 x1 x2 x3)
  719|  3.44k|                    if (stack.size() < 3)
  ------------------
  |  Branch (719:25): [True: 444, False: 2.99k]
  ------------------
  720|    444|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  721|  2.99k|                    valtype vch1 = stacktop(-3);
  ------------------
  |  |   54|  2.99k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  722|  2.99k|                    valtype vch2 = stacktop(-2);
  ------------------
  |  |   54|  2.99k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  723|  2.99k|                    valtype vch3 = stacktop(-1);
  ------------------
  |  |   54|  2.99k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  724|  2.99k|                    stack.push_back(vch1);
  725|  2.99k|                    stack.push_back(vch2);
  726|  2.99k|                    stack.push_back(vch3);
  727|  2.99k|                }
  728|      0|                break;
  729|       |
  730|  9.63k|                case OP_2OVER:
  ------------------
  |  Branch (730:17): [True: 9.63k, False: 2.44M]
  ------------------
  731|  9.63k|                {
  732|       |                    // (x1 x2 x3 x4 -- x1 x2 x3 x4 x1 x2)
  733|  9.63k|                    if (stack.size() < 4)
  ------------------
  |  Branch (733:25): [True: 600, False: 9.03k]
  ------------------
  734|    600|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  735|  9.03k|                    valtype vch1 = stacktop(-4);
  ------------------
  |  |   54|  9.03k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  736|  9.03k|                    valtype vch2 = stacktop(-3);
  ------------------
  |  |   54|  9.03k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  737|  9.03k|                    stack.push_back(vch1);
  738|  9.03k|                    stack.push_back(vch2);
  739|  9.03k|                }
  740|      0|                break;
  741|       |
  742|  90.8k|                case OP_2ROT:
  ------------------
  |  Branch (742:17): [True: 90.8k, False: 2.36M]
  ------------------
  743|  90.8k|                {
  744|       |                    // (x1 x2 x3 x4 x5 x6 -- x3 x4 x5 x6 x1 x2)
  745|  90.8k|                    if (stack.size() < 6)
  ------------------
  |  Branch (745:25): [True: 518, False: 90.3k]
  ------------------
  746|    518|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  747|  90.3k|                    valtype vch1 = stacktop(-6);
  ------------------
  |  |   54|  90.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  748|  90.3k|                    valtype vch2 = stacktop(-5);
  ------------------
  |  |   54|  90.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  749|  90.3k|                    stack.erase(stack.end()-6, stack.end()-4);
  750|  90.3k|                    stack.push_back(vch1);
  751|  90.3k|                    stack.push_back(vch2);
  752|  90.3k|                }
  753|      0|                break;
  754|       |
  755|  5.44k|                case OP_2SWAP:
  ------------------
  |  Branch (755:17): [True: 5.44k, False: 2.44M]
  ------------------
  756|  5.44k|                {
  757|       |                    // (x1 x2 x3 x4 -- x3 x4 x1 x2)
  758|  5.44k|                    if (stack.size() < 4)
  ------------------
  |  Branch (758:25): [True: 4.50k, False: 940]
  ------------------
  759|  4.50k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  760|    940|                    swap(stacktop(-4), stacktop(-2));
  ------------------
  |  |   54|    940|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-4), stacktop(-2));
  ------------------
  |  |   54|    940|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  761|    940|                    swap(stacktop(-3), stacktop(-1));
  ------------------
  |  |   54|    940|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-3), stacktop(-1));
  ------------------
  |  |   54|    940|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  762|    940|                }
  763|      0|                break;
  764|       |
  765|  7.14k|                case OP_IFDUP:
  ------------------
  |  Branch (765:17): [True: 7.14k, False: 2.44M]
  ------------------
  766|  7.14k|                {
  767|       |                    // (x - 0 | x x)
  768|  7.14k|                    if (stack.size() < 1)
  ------------------
  |  Branch (768:25): [True: 583, False: 6.56k]
  ------------------
  769|    583|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  770|  6.56k|                    valtype vch = stacktop(-1);
  ------------------
  |  |   54|  6.56k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  771|  6.56k|                    if (CastToBool(vch))
  ------------------
  |  Branch (771:25): [True: 3.71k, False: 2.85k]
  ------------------
  772|  3.71k|                        stack.push_back(vch);
  773|  6.56k|                }
  774|      0|                break;
  775|       |
  776|  16.2k|                case OP_DEPTH:
  ------------------
  |  Branch (776:17): [True: 16.2k, False: 2.43M]
  ------------------
  777|  16.2k|                {
  778|       |                    // -- stacksize
  779|  16.2k|                    CScriptNum bn(stack.size());
  780|  16.2k|                    stack.push_back(bn.getvch());
  781|  16.2k|                }
  782|  16.2k|                break;
  783|       |
  784|  6.96k|                case OP_DROP:
  ------------------
  |  Branch (784:17): [True: 6.96k, False: 2.44M]
  ------------------
  785|  6.96k|                {
  786|       |                    // (x -- )
  787|  6.96k|                    if (stack.size() < 1)
  ------------------
  |  Branch (787:25): [True: 666, False: 6.29k]
  ------------------
  788|    666|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  789|  6.29k|                    popstack(stack);
  790|  6.29k|                }
  791|      0|                break;
  792|       |
  793|  84.8k|                case OP_DUP:
  ------------------
  |  Branch (793:17): [True: 84.8k, False: 2.36M]
  ------------------
  794|  84.8k|                {
  795|       |                    // (x -- x x)
  796|  84.8k|                    if (stack.size() < 1)
  ------------------
  |  Branch (796:25): [True: 20.6k, False: 64.2k]
  ------------------
  797|  20.6k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  798|  64.2k|                    valtype vch = stacktop(-1);
  ------------------
  |  |   54|  64.2k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  799|  64.2k|                    stack.push_back(vch);
  800|  64.2k|                }
  801|      0|                break;
  802|       |
  803|  40.3k|                case OP_NIP:
  ------------------
  |  Branch (803:17): [True: 40.3k, False: 2.41M]
  ------------------
  804|  40.3k|                {
  805|       |                    // (x1 x2 -- x2)
  806|  40.3k|                    if (stack.size() < 2)
  ------------------
  |  Branch (806:25): [True: 425, False: 39.9k]
  ------------------
  807|    425|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  808|  39.9k|                    stack.erase(stack.end() - 2);
  809|  39.9k|                }
  810|      0|                break;
  811|       |
  812|  3.23k|                case OP_OVER:
  ------------------
  |  Branch (812:17): [True: 3.23k, False: 2.44M]
  ------------------
  813|  3.23k|                {
  814|       |                    // (x1 x2 -- x1 x2 x1)
  815|  3.23k|                    if (stack.size() < 2)
  ------------------
  |  Branch (815:25): [True: 405, False: 2.82k]
  ------------------
  816|    405|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  817|  2.82k|                    valtype vch = stacktop(-2);
  ------------------
  |  |   54|  2.82k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  818|  2.82k|                    stack.push_back(vch);
  819|  2.82k|                }
  820|      0|                break;
  821|       |
  822|    996|                case OP_PICK:
  ------------------
  |  Branch (822:17): [True: 996, False: 2.45M]
  ------------------
  823|  3.57k|                case OP_ROLL:
  ------------------
  |  Branch (823:17): [True: 2.58k, False: 2.44M]
  ------------------
  824|  3.57k|                {
  825|       |                    // (xn ... x2 x1 x0 n - xn ... x2 x1 x0 xn)
  826|       |                    // (xn ... x2 x1 x0 n - ... x2 x1 x0 xn)
  827|  3.57k|                    if (stack.size() < 2)
  ------------------
  |  Branch (827:25): [True: 420, False: 3.15k]
  ------------------
  828|    420|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  829|  3.15k|                    int n = CScriptNum(stacktop(-1), fRequireMinimal).getint();
  ------------------
  |  |   54|  3.15k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  830|  3.15k|                    popstack(stack);
  831|  3.15k|                    if (n < 0 || n >= (int)stack.size())
  ------------------
  |  Branch (831:25): [True: 669, False: 2.48k]
  |  Branch (831:34): [True: 599, False: 1.89k]
  ------------------
  832|  1.05k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  833|  2.10k|                    valtype vch = stacktop(-n-1);
  ------------------
  |  |   54|  2.10k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  834|  2.10k|                    if (opcode == OP_ROLL)
  ------------------
  |  Branch (834:25): [True: 1.31k, False: 787]
  ------------------
  835|  1.31k|                        stack.erase(stack.end()-n-1);
  836|  2.10k|                    stack.push_back(vch);
  837|  2.10k|                }
  838|      0|                break;
  839|       |
  840|  8.19k|                case OP_ROT:
  ------------------
  |  Branch (840:17): [True: 8.19k, False: 2.44M]
  ------------------
  841|  8.19k|                {
  842|       |                    // (x1 x2 x3 -- x2 x3 x1)
  843|       |                    //  x2 x1 x3  after first swap
  844|       |                    //  x2 x3 x1  after second swap
  845|  8.19k|                    if (stack.size() < 3)
  ------------------
  |  Branch (845:25): [True: 611, False: 7.58k]
  ------------------
  846|    611|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  847|  7.58k|                    swap(stacktop(-3), stacktop(-2));
  ------------------
  |  |   54|  7.58k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-3), stacktop(-2));
  ------------------
  |  |   54|  7.58k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  848|  7.58k|                    swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   54|  7.58k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   54|  7.58k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  849|  7.58k|                }
  850|      0|                break;
  851|       |
  852|  1.93k|                case OP_SWAP:
  ------------------
  |  Branch (852:17): [True: 1.93k, False: 2.44M]
  ------------------
  853|  1.93k|                {
  854|       |                    // (x1 x2 -- x2 x1)
  855|  1.93k|                    if (stack.size() < 2)
  ------------------
  |  Branch (855:25): [True: 482, False: 1.45k]
  ------------------
  856|    482|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  857|  1.45k|                    swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   54|  1.45k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   54|  1.45k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  858|  1.45k|                }
  859|      0|                break;
  860|       |
  861|  17.3k|                case OP_TUCK:
  ------------------
  |  Branch (861:17): [True: 17.3k, False: 2.43M]
  ------------------
  862|  17.3k|                {
  863|       |                    // (x1 x2 -- x2 x1 x2)
  864|  17.3k|                    if (stack.size() < 2)
  ------------------
  |  Branch (864:25): [True: 431, False: 16.8k]
  ------------------
  865|    431|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  866|  16.8k|                    valtype vch = stacktop(-1);
  ------------------
  |  |   54|  16.8k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  867|  16.8k|                    stack.insert(stack.end()-2, vch);
  868|  16.8k|                }
  869|      0|                break;
  870|       |
  871|       |
  872|  1.13k|                case OP_SIZE:
  ------------------
  |  Branch (872:17): [True: 1.13k, False: 2.45M]
  ------------------
  873|  1.13k|                {
  874|       |                    // (in -- in size)
  875|  1.13k|                    if (stack.size() < 1)
  ------------------
  |  Branch (875:25): [True: 402, False: 731]
  ------------------
  876|    402|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  877|    731|                    CScriptNum bn(stacktop(-1).size());
  ------------------
  |  |   54|    731|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  878|    731|                    stack.push_back(bn.getvch());
  879|    731|                }
  880|      0|                break;
  881|       |
  882|       |
  883|       |                //
  884|       |                // Bitwise logic
  885|       |                //
  886|  37.5k|                case OP_EQUAL:
  ------------------
  |  Branch (886:17): [True: 37.5k, False: 2.41M]
  ------------------
  887|   101k|                case OP_EQUALVERIFY:
  ------------------
  |  Branch (887:17): [True: 64.3k, False: 2.38M]
  ------------------
  888|       |                //case OP_NOTEQUAL: // use OP_NUMNOTEQUAL
  889|   101k|                {
  890|       |                    // (x1 x2 - bool)
  891|   101k|                    if (stack.size() < 2)
  ------------------
  |  Branch (891:25): [True: 731, False: 101k]
  ------------------
  892|    731|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  893|   101k|                    valtype& vch1 = stacktop(-2);
  ------------------
  |  |   54|   101k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  894|   101k|                    valtype& vch2 = stacktop(-1);
  ------------------
  |  |   54|   101k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  895|   101k|                    bool fEqual = (vch1 == vch2);
  896|       |                    // OP_NOTEQUAL is disabled because it would be too easy to say
  897|       |                    // something like n != 1 and have some wiseguy pass in 1 with extra
  898|       |                    // zero bytes after it (numerically, 0x01 == 0x0001 == 0x000001)
  899|       |                    //if (opcode == OP_NOTEQUAL)
  900|       |                    //    fEqual = !fEqual;
  901|   101k|                    popstack(stack);
  902|   101k|                    popstack(stack);
  903|   101k|                    stack.push_back(fEqual ? vchTrue : vchFalse);
  ------------------
  |  Branch (903:37): [True: 90.5k, False: 10.6k]
  ------------------
  904|   101k|                    if (opcode == OP_EQUALVERIFY)
  ------------------
  |  Branch (904:25): [True: 64.2k, False: 36.9k]
  ------------------
  905|  64.2k|                    {
  906|  64.2k|                        if (fEqual)
  ------------------
  |  Branch (906:29): [True: 63.6k, False: 650]
  ------------------
  907|  63.6k|                            popstack(stack);
  908|    650|                        else
  909|    650|                            return set_error(serror, SCRIPT_ERR_EQUALVERIFY);
  910|  64.2k|                    }
  911|   101k|                }
  912|   100k|                break;
  913|       |
  914|       |
  915|       |                //
  916|       |                // Numeric
  917|       |                //
  918|   100k|                case OP_1ADD:
  ------------------
  |  Branch (918:17): [True: 5.96k, False: 2.44M]
  ------------------
  919|  11.7k|                case OP_1SUB:
  ------------------
  |  Branch (919:17): [True: 5.83k, False: 2.44M]
  ------------------
  920|  14.7k|                case OP_NEGATE:
  ------------------
  |  Branch (920:17): [True: 2.94k, False: 2.44M]
  ------------------
  921|  22.7k|                case OP_ABS:
  ------------------
  |  Branch (921:17): [True: 8.04k, False: 2.44M]
  ------------------
  922|  25.2k|                case OP_NOT:
  ------------------
  |  Branch (922:17): [True: 2.44k, False: 2.44M]
  ------------------
  923|  62.8k|                case OP_0NOTEQUAL:
  ------------------
  |  Branch (923:17): [True: 37.5k, False: 2.41M]
  ------------------
  924|  62.8k|                {
  925|       |                    // (in -- out)
  926|  62.8k|                    if (stack.size() < 1)
  ------------------
  |  Branch (926:25): [True: 447, False: 62.3k]
  ------------------
  927|    447|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  928|  62.3k|                    CScriptNum bn(stacktop(-1), fRequireMinimal);
  ------------------
  |  |   54|  62.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  929|  62.3k|                    switch (opcode)
  930|  62.3k|                    {
  931|  5.94k|                    case OP_1ADD:       bn += bnOne; break;
  ------------------
  |  Branch (931:21): [True: 5.94k, False: 56.4k]
  ------------------
  932|  5.71k|                    case OP_1SUB:       bn -= bnOne; break;
  ------------------
  |  Branch (932:21): [True: 5.71k, False: 56.6k]
  ------------------
  933|  2.63k|                    case OP_NEGATE:     bn = -bn; break;
  ------------------
  |  Branch (933:21): [True: 2.63k, False: 59.7k]
  ------------------
  934|  7.98k|                    case OP_ABS:        if (bn < bnZero) bn = -bn; break;
  ------------------
  |  Branch (934:21): [True: 7.98k, False: 54.3k]
  |  Branch (934:45): [True: 479, False: 7.51k]
  ------------------
  935|  2.39k|                    case OP_NOT:        bn = (bn == bnZero); break;
  ------------------
  |  Branch (935:21): [True: 2.39k, False: 59.9k]
  ------------------
  936|  37.4k|                    case OP_0NOTEQUAL:  bn = (bn != bnZero); break;
  ------------------
  |  Branch (936:21): [True: 37.4k, False: 24.9k]
  ------------------
  937|      0|                    default:            assert(!"invalid opcode"); break;
  ------------------
  |  Branch (937:21): [True: 0, False: 62.3k]
  ------------------
  938|  62.3k|                    }
  939|  62.1k|                    popstack(stack);
  940|  62.1k|                    stack.push_back(bn.getvch());
  941|  62.1k|                }
  942|      0|                break;
  943|       |
  944|    890|                case OP_ADD:
  ------------------
  |  Branch (944:17): [True: 890, False: 2.45M]
  ------------------
  945|  5.34k|                case OP_SUB:
  ------------------
  |  Branch (945:17): [True: 4.45k, False: 2.44M]
  ------------------
  946|  7.03k|                case OP_BOOLAND:
  ------------------
  |  Branch (946:17): [True: 1.69k, False: 2.44M]
  ------------------
  947|  9.20k|                case OP_BOOLOR:
  ------------------
  |  Branch (947:17): [True: 2.17k, False: 2.44M]
  ------------------
  948|  9.70k|                case OP_NUMEQUAL:
  ------------------
  |  Branch (948:17): [True: 501, False: 2.45M]
  ------------------
  949|  11.0k|                case OP_NUMEQUALVERIFY:
  ------------------
  |  Branch (949:17): [True: 1.35k, False: 2.44M]
  ------------------
  950|  15.8k|                case OP_NUMNOTEQUAL:
  ------------------
  |  Branch (950:17): [True: 4.77k, False: 2.44M]
  ------------------
  951|  18.6k|                case OP_LESSTHAN:
  ------------------
  |  Branch (951:17): [True: 2.86k, False: 2.44M]
  ------------------
  952|  19.2k|                case OP_GREATERTHAN:
  ------------------
  |  Branch (952:17): [True: 559, False: 2.45M]
  ------------------
  953|  22.4k|                case OP_LESSTHANOREQUAL:
  ------------------
  |  Branch (953:17): [True: 3.22k, False: 2.44M]
  ------------------
  954|  25.4k|                case OP_GREATERTHANOREQUAL:
  ------------------
  |  Branch (954:17): [True: 2.93k, False: 2.44M]
  ------------------
  955|  29.5k|                case OP_MIN:
  ------------------
  |  Branch (955:17): [True: 4.12k, False: 2.44M]
  ------------------
  956|  31.2k|                case OP_MAX:
  ------------------
  |  Branch (956:17): [True: 1.71k, False: 2.44M]
  ------------------
  957|  31.2k|                {
  958|       |                    // (x1 x2 -- out)
  959|  31.2k|                    if (stack.size() < 2)
  ------------------
  |  Branch (959:25): [True: 883, False: 30.3k]
  ------------------
  960|    883|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  961|  30.3k|                    CScriptNum bn1(stacktop(-2), fRequireMinimal);
  ------------------
  |  |   54|  30.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  962|  30.3k|                    CScriptNum bn2(stacktop(-1), fRequireMinimal);
  ------------------
  |  |   54|  30.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  963|  30.3k|                    CScriptNum bn(0);
  964|  30.3k|                    switch (opcode)
  965|  30.3k|                    {
  966|    871|                    case OP_ADD:
  ------------------
  |  Branch (966:21): [True: 871, False: 29.5k]
  ------------------
  967|    871|                        bn = bn1 + bn2;
  968|    871|                        break;
  969|       |
  970|  3.94k|                    case OP_SUB:
  ------------------
  |  Branch (970:21): [True: 3.94k, False: 26.4k]
  ------------------
  971|  3.94k|                        bn = bn1 - bn2;
  972|  3.94k|                        break;
  973|       |
  974|  1.63k|                    case OP_BOOLAND:             bn = (bn1 != bnZero && bn2 != bnZero); break;
  ------------------
  |  Branch (974:21): [True: 1.63k, False: 28.7k]
  |  Branch (974:56): [True: 909, False: 724]
  |  Branch (974:73): [True: 608, False: 301]
  ------------------
  975|  1.86k|                    case OP_BOOLOR:              bn = (bn1 != bnZero || bn2 != bnZero); break;
  ------------------
  |  Branch (975:21): [True: 1.86k, False: 28.5k]
  |  Branch (975:56): [True: 924, False: 943]
  |  Branch (975:73): [True: 529, False: 414]
  ------------------
  976|    476|                    case OP_NUMEQUAL:            bn = (bn1 == bn2); break;
  ------------------
  |  Branch (976:21): [True: 476, False: 29.8k]
  ------------------
  977|  1.33k|                    case OP_NUMEQUALVERIFY:      bn = (bn1 == bn2); break;
  ------------------
  |  Branch (977:21): [True: 1.33k, False: 29.0k]
  ------------------
  978|  4.70k|                    case OP_NUMNOTEQUAL:         bn = (bn1 != bn2); break;
  ------------------
  |  Branch (978:21): [True: 4.70k, False: 25.6k]
  ------------------
  979|  2.69k|                    case OP_LESSTHAN:            bn = (bn1 < bn2); break;
  ------------------
  |  Branch (979:21): [True: 2.69k, False: 27.6k]
  ------------------
  980|    503|                    case OP_GREATERTHAN:         bn = (bn1 > bn2); break;
  ------------------
  |  Branch (980:21): [True: 503, False: 29.8k]
  ------------------
  981|  3.15k|                    case OP_LESSTHANOREQUAL:     bn = (bn1 <= bn2); break;
  ------------------
  |  Branch (981:21): [True: 3.15k, False: 27.2k]
  ------------------
  982|  2.76k|                    case OP_GREATERTHANOREQUAL:  bn = (bn1 >= bn2); break;
  ------------------
  |  Branch (982:21): [True: 2.76k, False: 27.6k]
  ------------------
  983|  3.79k|                    case OP_MIN:                 bn = (bn1 < bn2 ? bn1 : bn2); break;
  ------------------
  |  Branch (983:21): [True: 3.79k, False: 26.5k]
  |  Branch (983:56): [True: 837, False: 2.96k]
  ------------------
  984|  1.64k|                    case OP_MAX:                 bn = (bn1 > bn2 ? bn1 : bn2); break;
  ------------------
  |  Branch (984:21): [True: 1.64k, False: 28.7k]
  |  Branch (984:56): [True: 437, False: 1.21k]
  ------------------
  985|      0|                    default:                     assert(!"invalid opcode"); break;
  ------------------
  |  Branch (985:21): [True: 0, False: 30.3k]
  ------------------
  986|  30.3k|                    }
  987|  29.3k|                    popstack(stack);
  988|  29.3k|                    popstack(stack);
  989|  29.3k|                    stack.push_back(bn.getvch());
  990|       |
  991|  29.3k|                    if (opcode == OP_NUMEQUALVERIFY)
  ------------------
  |  Branch (991:25): [True: 1.33k, False: 28.0k]
  ------------------
  992|  1.33k|                    {
  993|  1.33k|                        if (CastToBool(stacktop(-1)))
  ------------------
  |  |   54|  1.33k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  |  Branch (993:29): [True: 586, False: 750]
  ------------------
  994|    586|                            popstack(stack);
  995|    750|                        else
  996|    750|                            return set_error(serror, SCRIPT_ERR_NUMEQUALVERIFY);
  997|  1.33k|                    }
  998|  29.3k|                }
  999|  28.6k|                break;
 1000|       |
 1001|  28.6k|                case OP_WITHIN:
  ------------------
  |  Branch (1001:17): [True: 14.7k, False: 2.43M]
  ------------------
 1002|  14.7k|                {
 1003|       |                    // (x min max -- out)
 1004|  14.7k|                    if (stack.size() < 3)
  ------------------
  |  Branch (1004:25): [True: 422, False: 14.3k]
  ------------------
 1005|    422|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1006|  14.3k|                    CScriptNum bn1(stacktop(-3), fRequireMinimal);
  ------------------
  |  |   54|  14.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1007|  14.3k|                    CScriptNum bn2(stacktop(-2), fRequireMinimal);
  ------------------
  |  |   54|  14.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1008|  14.3k|                    CScriptNum bn3(stacktop(-1), fRequireMinimal);
  ------------------
  |  |   54|  14.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1009|  14.3k|                    bool fValue = (bn2 <= bn1 && bn1 < bn3);
  ------------------
  |  Branch (1009:36): [True: 7.28k, False: 7.08k]
  |  Branch (1009:50): [True: 564, False: 6.72k]
  ------------------
 1010|  14.3k|                    popstack(stack);
 1011|  14.3k|                    popstack(stack);
 1012|  14.3k|                    popstack(stack);
 1013|  14.3k|                    stack.push_back(fValue ? vchTrue : vchFalse);
  ------------------
  |  Branch (1013:37): [True: 564, False: 13.8k]
  ------------------
 1014|  14.3k|                }
 1015|      0|                break;
 1016|       |
 1017|       |
 1018|       |                //
 1019|       |                // Crypto
 1020|       |                //
 1021|   186k|                case OP_RIPEMD160:
  ------------------
  |  Branch (1021:17): [True: 186k, False: 2.26M]
  ------------------
 1022|   200k|                case OP_SHA1:
  ------------------
  |  Branch (1022:17): [True: 14.4k, False: 2.43M]
  ------------------
 1023|   203k|                case OP_SHA256:
  ------------------
  |  Branch (1023:17): [True: 2.64k, False: 2.44M]
  ------------------
 1024|   298k|                case OP_HASH160:
  ------------------
  |  Branch (1024:17): [True: 95.1k, False: 2.35M]
  ------------------
 1025|   302k|                case OP_HASH256:
  ------------------
  |  Branch (1025:17): [True: 4.12k, False: 2.44M]
  ------------------
 1026|   302k|                {
 1027|       |                    // (in -- hash)
 1028|   302k|                    if (stack.size() < 1)
  ------------------
  |  Branch (1028:25): [True: 12.5k, False: 289k]
  ------------------
 1029|  12.5k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1030|   289k|                    valtype& vch = stacktop(-1);
  ------------------
  |  |   54|   289k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1031|   289k|                    valtype vchHash((opcode == OP_RIPEMD160 || opcode == OP_SHA1 || opcode == OP_HASH160) ? 20 : 32);
  ------------------
  |  Branch (1031:38): [True: 186k, False: 103k]
  |  Branch (1031:64): [True: 14.4k, False: 89.3k]
  |  Branch (1031:85): [True: 82.5k, False: 6.75k]
  ------------------
 1032|   289k|                    if (opcode == OP_RIPEMD160)
  ------------------
  |  Branch (1032:25): [True: 186k, False: 103k]
  ------------------
 1033|   186k|                        CRIPEMD160().Write(vch.data(), vch.size()).Finalize(vchHash.data());
 1034|   103k|                    else if (opcode == OP_SHA1)
  ------------------
  |  Branch (1034:30): [True: 14.4k, False: 89.3k]
  ------------------
 1035|  14.4k|                        CSHA1().Write(vch.data(), vch.size()).Finalize(vchHash.data());
 1036|  89.3k|                    else if (opcode == OP_SHA256)
  ------------------
  |  Branch (1036:30): [True: 2.63k, False: 86.7k]
  ------------------
 1037|  2.63k|                        CSHA256().Write(vch.data(), vch.size()).Finalize(vchHash.data());
 1038|  86.7k|                    else if (opcode == OP_HASH160)
  ------------------
  |  Branch (1038:30): [True: 82.5k, False: 4.12k]
  ------------------
 1039|  82.5k|                        CHash160().Write(vch).Finalize(vchHash);
 1040|  4.12k|                    else if (opcode == OP_HASH256)
  ------------------
  |  Branch (1040:30): [True: 4.12k, False: 0]
  ------------------
 1041|  4.12k|                        CHash256().Write(vch).Finalize(vchHash);
 1042|   289k|                    popstack(stack);
 1043|   289k|                    stack.push_back(vchHash);
 1044|   289k|                }
 1045|      0|                break;
 1046|       |
 1047|    465|                case OP_CODESEPARATOR:
  ------------------
  |  Branch (1047:17): [True: 465, False: 2.45M]
  ------------------
 1048|    465|                {
 1049|       |                    // If SCRIPT_VERIFY_CONST_SCRIPTCODE flag is set, use of OP_CODESEPARATOR is rejected in pre-segwit
 1050|       |                    // script, even in an unexecuted branch (this is checked above the opcode case statement).
 1051|       |
 1052|       |                    // Hash starts after the code separator
 1053|    465|                    pbegincodehash = pc;
 1054|    465|                    execdata.m_codeseparator_pos = opcode_pos;
 1055|    465|                }
 1056|    465|                break;
 1057|       |
 1058|  70.8k|                case OP_CHECKSIG:
  ------------------
  |  Branch (1058:17): [True: 70.8k, False: 2.38M]
  ------------------
 1059|  74.1k|                case OP_CHECKSIGVERIFY:
  ------------------
  |  Branch (1059:17): [True: 3.26k, False: 2.44M]
  ------------------
 1060|  74.1k|                {
 1061|       |                    // (sig pubkey -- bool)
 1062|  74.1k|                    if (stack.size() < 2)
  ------------------
  |  Branch (1062:25): [True: 6.25k, False: 67.8k]
  ------------------
 1063|  6.25k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1064|       |
 1065|  67.8k|                    valtype& vchSig    = stacktop(-2);
  ------------------
  |  |   54|  67.8k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1066|  67.8k|                    valtype& vchPubKey = stacktop(-1);
  ------------------
  |  |   54|  67.8k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1067|       |
 1068|  67.8k|                    bool fSuccess = true;
 1069|  67.8k|                    if (!EvalChecksig(vchSig, vchPubKey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, fSuccess)) return false;
  ------------------
  |  Branch (1069:25): [True: 65.7k, False: 2.14k]
  ------------------
 1070|  2.14k|                    popstack(stack);
 1071|  2.14k|                    popstack(stack);
 1072|  2.14k|                    stack.push_back(fSuccess ? vchTrue : vchFalse);
  ------------------
  |  Branch (1072:37): [True: 1.44k, False: 705]
  ------------------
 1073|  2.14k|                    if (opcode == OP_CHECKSIGVERIFY)
  ------------------
  |  Branch (1073:25): [True: 658, False: 1.48k]
  ------------------
 1074|    658|                    {
 1075|    658|                        if (fSuccess)
  ------------------
  |  Branch (1075:29): [True: 0, False: 658]
  ------------------
 1076|      0|                            popstack(stack);
 1077|    658|                        else
 1078|    658|                            return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
 1079|    658|                    }
 1080|  2.14k|                }
 1081|  1.48k|                break;
 1082|       |
 1083|  1.48k|                case OP_CHECKSIGADD:
  ------------------
  |  Branch (1083:17): [True: 539, False: 2.45M]
  ------------------
 1084|    539|                {
 1085|       |                    // OP_CHECKSIGADD is only available in Tapscript
 1086|    539|                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
  ------------------
  |  Branch (1086:25): [True: 539, False: 0]
  |  Branch (1086:59): [True: 0, False: 0]
  ------------------
 1087|       |
 1088|       |                    // (sig num pubkey -- num)
 1089|      0|                    if (stack.size() < 3) return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  ------------------
  |  Branch (1089:25): [True: 0, False: 0]
  ------------------
 1090|       |
 1091|      0|                    const valtype& sig = stacktop(-3);
  ------------------
  |  |   54|      0|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1092|      0|                    const CScriptNum num(stacktop(-2), fRequireMinimal);
  ------------------
  |  |   54|      0|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1093|      0|                    const valtype& pubkey = stacktop(-1);
  ------------------
  |  |   54|      0|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1094|       |
 1095|      0|                    bool success = true;
 1096|      0|                    if (!EvalChecksig(sig, pubkey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, success)) return false;
  ------------------
  |  Branch (1096:25): [True: 0, False: 0]
  ------------------
 1097|      0|                    popstack(stack);
 1098|      0|                    popstack(stack);
 1099|      0|                    popstack(stack);
 1100|      0|                    stack.push_back((num + (success ? 1 : 0)).getvch());
  ------------------
  |  Branch (1100:45): [True: 0, False: 0]
  ------------------
 1101|      0|                }
 1102|      0|                break;
 1103|       |
 1104|  38.3k|                case OP_CHECKMULTISIG:
  ------------------
  |  Branch (1104:17): [True: 38.3k, False: 2.41M]
  ------------------
 1105|  41.5k|                case OP_CHECKMULTISIGVERIFY:
  ------------------
  |  Branch (1105:17): [True: 3.25k, False: 2.44M]
  ------------------
 1106|  41.5k|                {
 1107|  41.5k|                    if (sigversion == SigVersion::TAPSCRIPT) return set_error(serror, SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG);
  ------------------
  |  Branch (1107:25): [True: 0, False: 41.5k]
  ------------------
 1108|       |
 1109|       |                    // ([sig ...] num_of_signatures [pubkey ...] num_of_pubkeys -- bool)
 1110|       |
 1111|  41.5k|                    int i = 1;
 1112|  41.5k|                    if ((int)stack.size() < i)
  ------------------
  |  Branch (1112:25): [True: 408, False: 41.1k]
  ------------------
 1113|    408|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1114|       |
 1115|  41.1k|                    int nKeysCount = CScriptNum(stacktop(-i), fRequireMinimal).getint();
  ------------------
  |  |   54|  41.1k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1116|  41.1k|                    if (nKeysCount < 0 || nKeysCount > MAX_PUBKEYS_PER_MULTISIG)
  ------------------
  |  Branch (1116:25): [True: 1.18k, False: 40.0k]
  |  Branch (1116:43): [True: 381, False: 39.6k]
  ------------------
 1117|  1.00k|                        return set_error(serror, SCRIPT_ERR_PUBKEY_COUNT);
 1118|  40.1k|                    nOpCount += nKeysCount;
 1119|  40.1k|                    if (nOpCount > MAX_OPS_PER_SCRIPT)
  ------------------
  |  Branch (1119:25): [True: 463, False: 39.7k]
  ------------------
 1120|    463|                        return set_error(serror, SCRIPT_ERR_OP_COUNT);
 1121|  39.7k|                    int ikey = ++i;
 1122|       |                    // ikey2 is the position of last non-signature item in the stack. Top stack item = 1.
 1123|       |                    // With SCRIPT_VERIFY_NULLFAIL, this is used for cleanup if operation fails.
 1124|  39.7k|                    int ikey2 = nKeysCount + 2;
 1125|  39.7k|                    i += nKeysCount;
 1126|  39.7k|                    if ((int)stack.size() < i)
  ------------------
  |  Branch (1126:25): [True: 415, False: 39.3k]
  ------------------
 1127|    415|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1128|       |
 1129|  39.3k|                    int nSigsCount = CScriptNum(stacktop(-i), fRequireMinimal).getint();
  ------------------
  |  |   54|  39.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1130|  39.3k|                    if (nSigsCount < 0 || nSigsCount > nKeysCount)
  ------------------
  |  Branch (1130:25): [True: 1.21k, False: 38.0k]
  |  Branch (1130:43): [True: 728, False: 37.3k]
  ------------------
 1131|  1.16k|                        return set_error(serror, SCRIPT_ERR_SIG_COUNT);
 1132|  38.1k|                    int isig = ++i;
 1133|  38.1k|                    i += nSigsCount;
 1134|  38.1k|                    if ((int)stack.size() < i)
  ------------------
  |  Branch (1134:25): [True: 425, False: 37.7k]
  ------------------
 1135|    425|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1136|       |
 1137|       |                    // Subset of script starting at the most recent codeseparator
 1138|  37.7k|                    CScript scriptCode(pbegincodehash, pend);
 1139|       |
 1140|       |                    // Drop the signature in pre-segwit scripts but not segwit scripts
 1141|  48.5k|                    for (int k = 0; k < nSigsCount; k++)
  ------------------
  |  Branch (1141:37): [True: 11.5k, False: 36.9k]
  ------------------
 1142|  11.5k|                    {
 1143|  11.5k|                        valtype& vchSig = stacktop(-isig-k);
  ------------------
  |  |   54|  11.5k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1144|  11.5k|                        if (sigversion == SigVersion::BASE) {
  ------------------
  |  Branch (1144:29): [True: 11.5k, False: 0]
  ------------------
 1145|  11.5k|                            int found = FindAndDelete(scriptCode, CScript() << vchSig);
 1146|  11.5k|                            if (found > 0 && (flags & SCRIPT_VERIFY_CONST_SCRIPTCODE))
  ------------------
  |  Branch (1146:33): [True: 820, False: 10.7k]
  |  Branch (1146:46): [True: 712, False: 108]
  ------------------
 1147|    712|                                return set_error(serror, SCRIPT_ERR_SIG_FINDANDDELETE);
 1148|  11.5k|                        }
 1149|  11.5k|                    }
 1150|       |
 1151|  36.9k|                    bool fSuccess = true;
 1152|  38.8k|                    while (fSuccess && nSigsCount > 0)
  ------------------
  |  Branch (1152:28): [True: 37.3k, False: 1.55k]
  |  Branch (1152:40): [True: 4.01k, False: 33.3k]
  ------------------
 1153|  4.01k|                    {
 1154|  4.01k|                        valtype& vchSig    = stacktop(-isig);
  ------------------
  |  |   54|  4.01k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1155|  4.01k|                        valtype& vchPubKey = stacktop(-ikey);
  ------------------
  |  |   54|  4.01k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1156|       |
 1157|       |                        // Note how this makes the exact order of pubkey/signature evaluation
 1158|       |                        // distinguishable by CHECKMULTISIG NOT if the STRICTENC flag is set.
 1159|       |                        // See the script_(in)valid tests for details.
 1160|  4.01k|                        if (!CheckSignatureEncoding(vchSig, flags, serror) || !CheckPubKeyEncoding(vchPubKey, flags, sigversion, serror)) {
  ------------------
  |  Branch (1160:29): [True: 626, False: 3.38k]
  |  Branch (1160:79): [True: 1.50k, False: 1.88k]
  ------------------
 1161|       |                            // serror is set
 1162|  2.12k|                            return false;
 1163|  2.12k|                        }
 1164|       |
 1165|       |                        // Check signature
 1166|  1.88k|                        bool fOk = checker.CheckECDSASignature(vchSig, vchPubKey, scriptCode, sigversion);
 1167|       |
 1168|  1.88k|                        if (fOk) {
  ------------------
  |  Branch (1168:29): [True: 975, False: 911]
  ------------------
 1169|    975|                            isig++;
 1170|    975|                            nSigsCount--;
 1171|    975|                        }
 1172|  1.88k|                        ikey++;
 1173|  1.88k|                        nKeysCount--;
 1174|       |
 1175|       |                        // If there are more signatures left than keys left,
 1176|       |                        // then too many signatures have failed. Exit early,
 1177|       |                        // without checking any further signatures.
 1178|  1.88k|                        if (nSigsCount > nKeysCount)
  ------------------
  |  Branch (1178:29): [True: 783, False: 1.10k]
  ------------------
 1179|    783|                            fSuccess = false;
 1180|  1.88k|                    }
 1181|       |
 1182|       |                    // Clean up stack of actual arguments
 1183|   143k|                    while (i-- > 1) {
  ------------------
  |  Branch (1183:28): [True: 109k, False: 34.1k]
  ------------------
 1184|       |                        // If the operation failed, we require that all signatures must be empty vector
 1185|   109k|                        if (!fSuccess && (flags & SCRIPT_VERIFY_NULLFAIL) && !ikey2 && stacktop(-1).size())
  ------------------
  |  |   54|  1.58k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  |  Branch (1185:29): [True: 7.06k, False: 102k]
  |  Branch (1185:42): [True: 7.02k, False: 36]
  |  Branch (1185:78): [True: 1.58k, False: 5.44k]
  |  Branch (1185:88): [True: 767, False: 816]
  ------------------
 1186|    767|                            return set_error(serror, SCRIPT_ERR_SIG_NULLFAIL);
 1187|   108k|                        if (ikey2 > 0)
  ------------------
  |  Branch (1187:29): [True: 107k, False: 1.48k]
  ------------------
 1188|   107k|                            ikey2--;
 1189|   108k|                        popstack(stack);
 1190|   108k|                    }
 1191|       |
 1192|       |                    // A bug causes CHECKMULTISIG to consume one extra argument
 1193|       |                    // whose contents were not checked in any way.
 1194|       |                    //
 1195|       |                    // Unfortunately this is a potential source of mutability,
 1196|       |                    // so optionally verify it is exactly equal to zero prior
 1197|       |                    // to removing it from the stack.
 1198|  34.1k|                    if (stack.size() < 1)
  ------------------
  |  Branch (1198:25): [True: 0, False: 34.1k]
  ------------------
 1199|      0|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1200|  34.1k|                    if ((flags & SCRIPT_VERIFY_NULLDUMMY) && stacktop(-1).size())
  ------------------
  |  |   54|  33.0k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  |  Branch (1200:25): [True: 33.0k, False: 1.05k]
  |  Branch (1200:62): [True: 455, False: 32.5k]
  ------------------
 1201|    455|                        return set_error(serror, SCRIPT_ERR_SIG_NULLDUMMY);
 1202|  33.6k|                    popstack(stack);
 1203|       |
 1204|  33.6k|                    stack.push_back(fSuccess ? vchTrue : vchFalse);
  ------------------
  |  Branch (1204:37): [True: 32.8k, False: 781]
  ------------------
 1205|       |
 1206|  33.6k|                    if (opcode == OP_CHECKMULTISIGVERIFY)
  ------------------
  |  Branch (1206:25): [True: 1.39k, False: 32.2k]
  ------------------
 1207|  1.39k|                    {
 1208|  1.39k|                        if (fSuccess)
  ------------------
  |  Branch (1208:29): [True: 1.38k, False: 11]
  ------------------
 1209|  1.38k|                            popstack(stack);
 1210|     11|                        else
 1211|     11|                            return set_error(serror, SCRIPT_ERR_CHECKMULTISIGVERIFY);
 1212|  1.39k|                    }
 1213|  33.6k|                }
 1214|  33.6k|                break;
 1215|       |
 1216|  33.6k|                default:
  ------------------
  |  Branch (1216:17): [True: 5.27k, False: 2.44M]
  ------------------
 1217|  5.27k|                    return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
 1218|  2.45M|            }
 1219|       |
 1220|       |            // Size limits
 1221|  6.97M|            if (stack.size() + altstack.size() > MAX_STACK_SIZE)
  ------------------
  |  Branch (1221:17): [True: 646, False: 6.97M]
  ------------------
 1222|    646|                return set_error(serror, SCRIPT_ERR_STACK_SIZE);
 1223|  6.97M|        }
 1224|   544k|    }
 1225|   544k|    catch (...)
 1226|   544k|    {
 1227|  7.46k|        return set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
 1228|  7.46k|    }
 1229|       |
 1230|   356k|    if (!vfExec.empty())
  ------------------
  |  Branch (1230:9): [True: 577, False: 355k]
  ------------------
 1231|    577|        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
 1232|       |
 1233|   355k|    return set_success(serror);
 1234|   356k|}
_Z10EvalScriptRNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEERK7CScriptjRK20BaseSignatureChecker10SigVersionP13ScriptError_t:
 1237|   525k|{
 1238|   525k|    ScriptExecutionData execdata;
 1239|   525k|    return EvalScript(stack, script, flags, checker, sigversion, execdata, serror);
 1240|   525k|}
_ZN26PrecomputedTransactionData4InitI12CTransactionEEvRKT_ONSt3__16vectorI6CTxOutNS5_9allocatorIS7_EEEEb:
 1399|  8.06k|{
 1400|  8.06k|    assert(!m_spent_outputs_ready);
 1401|       |
 1402|  8.06k|    m_spent_outputs = std::move(spent_outputs);
 1403|  8.06k|    if (!m_spent_outputs.empty()) {
  ------------------
  |  Branch (1403:9): [True: 1.00k, False: 7.05k]
  ------------------
 1404|  1.00k|        assert(m_spent_outputs.size() == txTo.vin.size());
 1405|  1.00k|        m_spent_outputs_ready = true;
 1406|  1.00k|    }
 1407|       |
 1408|       |    // Determine which precomputation-impacting features this transaction uses.
 1409|  8.06k|    bool uses_bip143_segwit = force;
 1410|  8.06k|    bool uses_bip341_taproot = force;
 1411|  8.06k|    for (size_t inpos = 0; inpos < txTo.vin.size() && !(uses_bip143_segwit && uses_bip341_taproot); ++inpos) {
  ------------------
  |  Branch (1411:28): [True: 5.36k, False: 2.70k]
  |  Branch (1411:57): [True: 5.36k, False: 0]
  |  Branch (1411:79): [True: 5.36k, False: 0]
  ------------------
 1412|      0|        if (!txTo.vin[inpos].scriptWitness.IsNull()) {
  ------------------
  |  Branch (1412:13): [True: 0, False: 0]
  ------------------
 1413|      0|            if (m_spent_outputs_ready && m_spent_outputs[inpos].scriptPubKey.size() == 2 + WITNESS_V1_TAPROOT_SIZE &&
  ------------------
  |  Branch (1413:17): [True: 0, False: 0]
  |  Branch (1413:42): [True: 0, False: 0]
  ------------------
 1414|      0|                m_spent_outputs[inpos].scriptPubKey[0] == OP_1) {
  ------------------
  |  Branch (1414:17): [True: 0, False: 0]
  ------------------
 1415|       |                // Treat every witness-bearing spend with 34-byte scriptPubKey that starts with OP_1 as a Taproot
 1416|       |                // spend. This only works if spent_outputs was provided as well, but if it wasn't, actual validation
 1417|       |                // will fail anyway. Note that this branch may trigger for scriptPubKeys that aren't actually segwit
 1418|       |                // but in that case validation will fail as SCRIPT_ERR_WITNESS_UNEXPECTED anyway.
 1419|      0|                uses_bip341_taproot = true;
 1420|      0|            } else {
 1421|       |                // Treat every spend that's not known to native witness v1 as a Witness v0 spend. This branch may
 1422|       |                // also be taken for unknown witness versions, but it is harmless, and being precise would require
 1423|       |                // P2SH evaluation to find the redeemScript.
 1424|      0|                uses_bip143_segwit = true;
 1425|      0|            }
 1426|      0|        }
 1427|      0|        if (uses_bip341_taproot && uses_bip143_segwit) break; // No need to scan further if we already need all.
  ------------------
  |  Branch (1427:13): [True: 0, False: 0]
  |  Branch (1427:36): [True: 0, False: 0]
  ------------------
 1428|      0|    }
 1429|       |
 1430|  8.06k|    if (uses_bip143_segwit || uses_bip341_taproot) {
  ------------------
  |  Branch (1430:9): [True: 8.06k, False: 0]
  |  Branch (1430:31): [True: 0, False: 0]
  ------------------
 1431|       |        // Computations shared between both sighash schemes.
 1432|  8.06k|        m_prevouts_single_hash = GetPrevoutsSHA256(txTo);
 1433|  8.06k|        m_sequences_single_hash = GetSequencesSHA256(txTo);
 1434|  8.06k|        m_outputs_single_hash = GetOutputsSHA256(txTo);
 1435|  8.06k|    }
 1436|  8.06k|    if (uses_bip143_segwit) {
  ------------------
  |  Branch (1436:9): [True: 8.06k, False: 0]
  ------------------
 1437|  8.06k|        hashPrevouts = SHA256Uint256(m_prevouts_single_hash);
 1438|  8.06k|        hashSequence = SHA256Uint256(m_sequences_single_hash);
 1439|  8.06k|        hashOutputs = SHA256Uint256(m_outputs_single_hash);
 1440|  8.06k|        m_bip143_segwit_ready = true;
 1441|  8.06k|    }
 1442|  8.06k|    if (uses_bip341_taproot && m_spent_outputs_ready) {
  ------------------
  |  Branch (1442:9): [True: 8.06k, False: 0]
  |  Branch (1442:32): [True: 1.00k, False: 7.05k]
  ------------------
 1443|  1.00k|        m_spent_amounts_single_hash = GetSpentAmountsSHA256(m_spent_outputs);
 1444|  1.00k|        m_spent_scripts_single_hash = GetSpentScriptsSHA256(m_spent_outputs);
 1445|  1.00k|        m_bip341_taproot_ready = true;
 1446|  1.00k|    }
 1447|  8.06k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE20VerifyECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEERK7CPubKeyRK7uint256:
 1637|  21.9k|{
 1638|  21.9k|    return pubkey.Verify(sighash, vchSig);
 1639|  21.9k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE22VerifySchnorrSignatureE4SpanIKhERK11XOnlyPubKeyRK7uint256:
 1643|    447|{
 1644|    447|    return pubkey.VerifySchnorr(sighash, sig);
 1645|    447|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE19CheckECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEES8_RK7CScript10SigVersion:
 1649|  22.7k|{
 1650|  22.7k|    CPubKey pubkey(vchPubKey);
 1651|  22.7k|    if (!pubkey.IsValid())
  ------------------
  |  Branch (1651:9): [True: 0, False: 22.7k]
  ------------------
 1652|      0|        return false;
 1653|       |
 1654|       |    // Hash type is one byte tacked on to the end of the signature
 1655|  22.7k|    std::vector<unsigned char> vchSig(vchSigIn);
 1656|  22.7k|    if (vchSig.empty())
  ------------------
  |  Branch (1656:9): [True: 788, False: 21.9k]
  ------------------
 1657|    788|        return false;
 1658|  21.9k|    int nHashType = vchSig.back();
 1659|  21.9k|    vchSig.pop_back();
 1660|       |
 1661|       |    // Witness sighashes need the amount.
 1662|  21.9k|    if (sigversion == SigVersion::WITNESS_V0 && amount < 0) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1662:9): [True: 4.59k, False: 17.3k]
  |  Branch (1662:49): [True: 0, False: 4.59k]
  ------------------
 1663|       |
 1664|  21.9k|    uint256 sighash = SignatureHash(scriptCode, *txTo, nIn, nHashType, amount, sigversion, this->txdata);
 1665|       |
 1666|  21.9k|    if (!VerifyECDSASignature(vchSig, pubkey, sighash))
  ------------------
  |  Branch (1666:9): [True: 21.9k, False: 0]
  ------------------
 1667|  21.9k|        return false;
 1668|       |
 1669|      0|    return true;
 1670|  21.9k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE21CheckSchnorrSignatureE4SpanIKhES4_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
 1674|  1.54k|{
 1675|  1.54k|    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
 1676|       |    // Schnorr signatures have 32-byte public keys. The caller is responsible for enforcing this.
 1677|  1.54k|    assert(pubkey_in.size() == 32);
 1678|       |    // Note that in Tapscript evaluation, empty signatures are treated specially (invalid signature that does not
 1679|       |    // abort script execution). This is implemented in EvalChecksigTapscript, which won't invoke
 1680|       |    // CheckSchnorrSignature in that case. In other contexts, they are invalid like every other signature with
 1681|       |    // size different from 64 or 65.
 1682|  1.54k|    if (sig.size() != 64 && sig.size() != 65) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_SIZE);
  ------------------
  |  Branch (1682:9): [True: 1.46k, False: 89]
  |  Branch (1682:29): [True: 1.06k, False: 399]
  ------------------
 1683|       |
 1684|    488|    XOnlyPubKey pubkey{pubkey_in};
 1685|       |
 1686|    488|    uint8_t hashtype = SIGHASH_DEFAULT;
 1687|    488|    if (sig.size() == 65) {
  ------------------
  |  Branch (1687:9): [True: 399, False: 89]
  ------------------
 1688|    399|        hashtype = SpanPopBack(sig);
 1689|    399|        if (hashtype == SIGHASH_DEFAULT) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
  ------------------
  |  Branch (1689:13): [True: 9, False: 390]
  ------------------
 1690|    399|    }
 1691|    479|    uint256 sighash;
 1692|    479|    if (!this->txdata) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1692:9): [True: 0, False: 479]
  ------------------
 1693|    479|    if (!SignatureHashSchnorr(sighash, execdata, *txTo, nIn, hashtype, sigversion, *this->txdata, m_mdb)) {
  ------------------
  |  Branch (1693:9): [True: 32, False: 447]
  ------------------
 1694|     32|        return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
 1695|     32|    }
 1696|    447|    if (!VerifySchnorrSignature(sig, pubkey, sighash)) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG);
  ------------------
  |  Branch (1696:9): [True: 447, False: 0]
  ------------------
 1697|      0|    return true;
 1698|    447|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE13CheckLockTimeERK10CScriptNum:
 1702|  2.74k|{
 1703|       |    // There are two kinds of nLockTime: lock-by-blockheight
 1704|       |    // and lock-by-blocktime, distinguished by whether
 1705|       |    // nLockTime < LOCKTIME_THRESHOLD.
 1706|       |    //
 1707|       |    // We want to compare apples to apples, so fail the script
 1708|       |    // unless the type of nLockTime being tested is the same as
 1709|       |    // the nLockTime in the transaction.
 1710|  2.74k|    if (!(
  ------------------
  |  Branch (1710:9): [True: 890, False: 1.85k]
  ------------------
 1711|  2.74k|        (txTo->nLockTime <  LOCKTIME_THRESHOLD && nLockTime <  LOCKTIME_THRESHOLD) ||
  ------------------
  |  Branch (1711:10): [True: 1.77k, False: 972]
  |  Branch (1711:51): [True: 1.20k, False: 572]
  ------------------
 1712|  2.74k|        (txTo->nLockTime >= LOCKTIME_THRESHOLD && nLockTime >= LOCKTIME_THRESHOLD)
  ------------------
  |  Branch (1712:10): [True: 972, False: 572]
  |  Branch (1712:51): [True: 654, False: 318]
  ------------------
 1713|  2.74k|    ))
 1714|    890|        return false;
 1715|       |
 1716|       |    // Now that we know we're comparing apples-to-apples, the
 1717|       |    // comparison is a simple numeric one.
 1718|  1.85k|    if (nLockTime > (int64_t)txTo->nLockTime)
  ------------------
  |  Branch (1718:9): [True: 403, False: 1.45k]
  ------------------
 1719|    403|        return false;
 1720|       |
 1721|       |    // Finally the nLockTime feature can be disabled in IsFinalTx()
 1722|       |    // and thus CHECKLOCKTIMEVERIFY bypassed if every txin has
 1723|       |    // been finalized by setting nSequence to maxint. The
 1724|       |    // transaction would be allowed into the blockchain, making
 1725|       |    // the opcode ineffective.
 1726|       |    //
 1727|       |    // Testing if this vin is not final is sufficient to
 1728|       |    // prevent this condition. Alternatively we could test all
 1729|       |    // inputs, but testing just this input minimizes the data
 1730|       |    // required to prove correct CHECKLOCKTIMEVERIFY execution.
 1731|  1.45k|    if (CTxIn::SEQUENCE_FINAL == txTo->vin[nIn].nSequence)
  ------------------
  |  Branch (1731:9): [True: 10, False: 1.44k]
  ------------------
 1732|     10|        return false;
 1733|       |
 1734|  1.44k|    return true;
 1735|  1.45k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE13CheckSequenceERK10CScriptNum:
 1739|  4.99k|{
 1740|       |    // Relative lock times are supported by comparing the passed
 1741|       |    // in operand to the sequence number of the input.
 1742|  4.99k|    const int64_t txToSequence = (int64_t)txTo->vin[nIn].nSequence;
 1743|       |
 1744|       |    // Fail if the transaction's version number is not set high
 1745|       |    // enough to trigger BIP 68 rules.
 1746|  4.99k|    if (txTo->version < 2)
  ------------------
  |  Branch (1746:9): [True: 298, False: 4.69k]
  ------------------
 1747|    298|        return false;
 1748|       |
 1749|       |    // Sequence numbers with their most significant bit set are not
 1750|       |    // consensus constrained. Testing that the transaction's sequence
 1751|       |    // number do not have this bit set prevents using this property
 1752|       |    // to get around a CHECKSEQUENCEVERIFY check.
 1753|  4.69k|    if (txToSequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG)
  ------------------
  |  Branch (1753:9): [True: 103, False: 4.59k]
  ------------------
 1754|    103|        return false;
 1755|       |
 1756|       |    // Mask off any bits that do not have consensus-enforced meaning
 1757|       |    // before doing the integer comparisons
 1758|  4.59k|    const uint32_t nLockTimeMask = CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG | CTxIn::SEQUENCE_LOCKTIME_MASK;
 1759|  4.59k|    const int64_t txToSequenceMasked = txToSequence & nLockTimeMask;
 1760|  4.59k|    const CScriptNum nSequenceMasked = nSequence & nLockTimeMask;
 1761|       |
 1762|       |    // There are two kinds of nSequence: lock-by-blockheight
 1763|       |    // and lock-by-blocktime, distinguished by whether
 1764|       |    // nSequenceMasked < CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG.
 1765|       |    //
 1766|       |    // We want to compare apples to apples, so fail the script
 1767|       |    // unless the type of nSequenceMasked being tested is the same as
 1768|       |    // the nSequenceMasked in the transaction.
 1769|  4.59k|    if (!(
  ------------------
  |  Branch (1769:9): [True: 838, False: 3.75k]
  ------------------
 1770|  4.59k|        (txToSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG) ||
  ------------------
  |  Branch (1770:10): [True: 3.94k, False: 649]
  |  Branch (1770:70): [True: 3.38k, False: 554]
  ------------------
 1771|  4.59k|        (txToSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG)
  ------------------
  |  Branch (1771:10): [True: 649, False: 554]
  |  Branch (1771:70): [True: 365, False: 284]
  ------------------
 1772|  4.59k|    )) {
 1773|    838|        return false;
 1774|    838|    }
 1775|       |
 1776|       |    // Now that we know we're comparing apples-to-apples, the
 1777|       |    // comparison is a simple numeric one.
 1778|  3.75k|    if (nSequenceMasked > txToSequenceMasked)
  ------------------
  |  Branch (1778:9): [True: 241, False: 3.51k]
  ------------------
 1779|    241|        return false;
 1780|       |
 1781|  3.51k|    return true;
 1782|  3.75k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE20VerifyECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEERK7CPubKeyRK7uint256:
 1637|  23.3k|{
 1638|  23.3k|    return pubkey.Verify(sighash, vchSig);
 1639|  23.3k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE19CheckECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEES8_RK7CScript10SigVersion:
 1649|  24.2k|{
 1650|  24.2k|    CPubKey pubkey(vchPubKey);
 1651|  24.2k|    if (!pubkey.IsValid())
  ------------------
  |  Branch (1651:9): [True: 0, False: 24.2k]
  ------------------
 1652|      0|        return false;
 1653|       |
 1654|       |    // Hash type is one byte tacked on to the end of the signature
 1655|  24.2k|    std::vector<unsigned char> vchSig(vchSigIn);
 1656|  24.2k|    if (vchSig.empty())
  ------------------
  |  Branch (1656:9): [True: 822, False: 23.3k]
  ------------------
 1657|    822|        return false;
 1658|  23.3k|    int nHashType = vchSig.back();
 1659|  23.3k|    vchSig.pop_back();
 1660|       |
 1661|       |    // Witness sighashes need the amount.
 1662|  23.3k|    if (sigversion == SigVersion::WITNESS_V0 && amount < 0) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1662:9): [True: 5.45k, False: 17.9k]
  |  Branch (1662:49): [True: 0, False: 5.45k]
  ------------------
 1663|       |
 1664|  23.3k|    uint256 sighash = SignatureHash(scriptCode, *txTo, nIn, nHashType, amount, sigversion, this->txdata);
 1665|       |
 1666|  23.3k|    if (!VerifyECDSASignature(vchSig, pubkey, sighash))
  ------------------
  |  Branch (1666:9): [True: 21.9k, False: 1.43k]
  ------------------
 1667|  21.9k|        return false;
 1668|       |
 1669|  1.43k|    return true;
 1670|  23.3k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE21CheckSchnorrSignatureE4SpanIKhES4_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
 1674|  1.53k|{
 1675|  1.53k|    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
 1676|       |    // Schnorr signatures have 32-byte public keys. The caller is responsible for enforcing this.
 1677|  1.53k|    assert(pubkey_in.size() == 32);
 1678|       |    // Note that in Tapscript evaluation, empty signatures are treated specially (invalid signature that does not
 1679|       |    // abort script execution). This is implemented in EvalChecksigTapscript, which won't invoke
 1680|       |    // CheckSchnorrSignature in that case. In other contexts, they are invalid like every other signature with
 1681|       |    // size different from 64 or 65.
 1682|  1.53k|    if (sig.size() != 64 && sig.size() != 65) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_SIZE);
  ------------------
  |  Branch (1682:9): [True: 1.44k, False: 89]
  |  Branch (1682:29): [True: 1.05k, False: 398]
  ------------------
 1683|       |
 1684|    487|    XOnlyPubKey pubkey{pubkey_in};
 1685|       |
 1686|    487|    uint8_t hashtype = SIGHASH_DEFAULT;
 1687|    487|    if (sig.size() == 65) {
  ------------------
  |  Branch (1687:9): [True: 398, False: 89]
  ------------------
 1688|    398|        hashtype = SpanPopBack(sig);
 1689|    398|        if (hashtype == SIGHASH_DEFAULT) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
  ------------------
  |  Branch (1689:13): [True: 9, False: 389]
  ------------------
 1690|    398|    }
 1691|    478|    uint256 sighash;
 1692|    478|    if (!this->txdata) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1692:9): [True: 478, False: 0]
  ------------------
 1693|      0|    if (!SignatureHashSchnorr(sighash, execdata, *txTo, nIn, hashtype, sigversion, *this->txdata, m_mdb)) {
  ------------------
  |  Branch (1693:9): [True: 0, False: 0]
  ------------------
 1694|      0|        return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
 1695|      0|    }
 1696|      0|    if (!VerifySchnorrSignature(sig, pubkey, sighash)) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG);
  ------------------
  |  Branch (1696:9): [True: 0, False: 0]
  ------------------
 1697|      0|    return true;
 1698|      0|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE13CheckLockTimeERK10CScriptNum:
 1702|  2.88k|{
 1703|       |    // There are two kinds of nLockTime: lock-by-blockheight
 1704|       |    // and lock-by-blocktime, distinguished by whether
 1705|       |    // nLockTime < LOCKTIME_THRESHOLD.
 1706|       |    //
 1707|       |    // We want to compare apples to apples, so fail the script
 1708|       |    // unless the type of nLockTime being tested is the same as
 1709|       |    // the nLockTime in the transaction.
 1710|  2.88k|    if (!(
  ------------------
  |  Branch (1710:9): [True: 914, False: 1.96k]
  ------------------
 1711|  2.88k|        (txTo->nLockTime <  LOCKTIME_THRESHOLD && nLockTime <  LOCKTIME_THRESHOLD) ||
  ------------------
  |  Branch (1711:10): [True: 1.82k, False: 1.06k]
  |  Branch (1711:51): [True: 1.23k, False: 582]
  ------------------
 1712|  2.88k|        (txTo->nLockTime >= LOCKTIME_THRESHOLD && nLockTime >= LOCKTIME_THRESHOLD)
  ------------------
  |  Branch (1712:10): [True: 1.06k, False: 582]
  |  Branch (1712:51): [True: 729, False: 332]
  ------------------
 1713|  2.88k|    ))
 1714|    914|        return false;
 1715|       |
 1716|       |    // Now that we know we're comparing apples-to-apples, the
 1717|       |    // comparison is a simple numeric one.
 1718|  1.96k|    if (nLockTime > (int64_t)txTo->nLockTime)
  ------------------
  |  Branch (1718:9): [True: 426, False: 1.54k]
  ------------------
 1719|    426|        return false;
 1720|       |
 1721|       |    // Finally the nLockTime feature can be disabled in IsFinalTx()
 1722|       |    // and thus CHECKLOCKTIMEVERIFY bypassed if every txin has
 1723|       |    // been finalized by setting nSequence to maxint. The
 1724|       |    // transaction would be allowed into the blockchain, making
 1725|       |    // the opcode ineffective.
 1726|       |    //
 1727|       |    // Testing if this vin is not final is sufficient to
 1728|       |    // prevent this condition. Alternatively we could test all
 1729|       |    // inputs, but testing just this input minimizes the data
 1730|       |    // required to prove correct CHECKLOCKTIMEVERIFY execution.
 1731|  1.54k|    if (CTxIn::SEQUENCE_FINAL == txTo->vin[nIn].nSequence)
  ------------------
  |  Branch (1731:9): [True: 11, False: 1.53k]
  ------------------
 1732|     11|        return false;
 1733|       |
 1734|  1.53k|    return true;
 1735|  1.54k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE13CheckSequenceERK10CScriptNum:
 1739|  5.32k|{
 1740|       |    // Relative lock times are supported by comparing the passed
 1741|       |    // in operand to the sequence number of the input.
 1742|  5.32k|    const int64_t txToSequence = (int64_t)txTo->vin[nIn].nSequence;
 1743|       |
 1744|       |    // Fail if the transaction's version number is not set high
 1745|       |    // enough to trigger BIP 68 rules.
 1746|  5.32k|    if (txTo->version < 2)
  ------------------
  |  Branch (1746:9): [True: 299, False: 5.03k]
  ------------------
 1747|    299|        return false;
 1748|       |
 1749|       |    // Sequence numbers with their most significant bit set are not
 1750|       |    // consensus constrained. Testing that the transaction's sequence
 1751|       |    // number do not have this bit set prevents using this property
 1752|       |    // to get around a CHECKSEQUENCEVERIFY check.
 1753|  5.03k|    if (txToSequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG)
  ------------------
  |  Branch (1753:9): [True: 51, False: 4.97k]
  ------------------
 1754|     51|        return false;
 1755|       |
 1756|       |    // Mask off any bits that do not have consensus-enforced meaning
 1757|       |    // before doing the integer comparisons
 1758|  4.97k|    const uint32_t nLockTimeMask = CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG | CTxIn::SEQUENCE_LOCKTIME_MASK;
 1759|  4.97k|    const int64_t txToSequenceMasked = txToSequence & nLockTimeMask;
 1760|  4.97k|    const CScriptNum nSequenceMasked = nSequence & nLockTimeMask;
 1761|       |
 1762|       |    // There are two kinds of nSequence: lock-by-blockheight
 1763|       |    // and lock-by-blocktime, distinguished by whether
 1764|       |    // nSequenceMasked < CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG.
 1765|       |    //
 1766|       |    // We want to compare apples to apples, so fail the script
 1767|       |    // unless the type of nSequenceMasked being tested is the same as
 1768|       |    // the nSequenceMasked in the transaction.
 1769|  4.97k|    if (!(
  ------------------
  |  Branch (1769:9): [True: 781, False: 4.19k]
  ------------------
 1770|  4.97k|        (txToSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG) ||
  ------------------
  |  Branch (1770:10): [True: 4.40k, False: 577]
  |  Branch (1770:70): [True: 3.85k, False: 551]
  ------------------
 1771|  4.97k|        (txToSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG)
  ------------------
  |  Branch (1771:10): [True: 577, False: 551]
  |  Branch (1771:70): [True: 347, False: 230]
  ------------------
 1772|  4.97k|    )) {
 1773|    781|        return false;
 1774|    781|    }
 1775|       |
 1776|       |    // Now that we know we're comparing apples-to-apples, the
 1777|       |    // comparison is a simple numeric one.
 1778|  4.19k|    if (nSequenceMasked > txToSequenceMasked)
  ------------------
  |  Branch (1778:9): [True: 259, False: 3.93k]
  ------------------
 1779|    259|        return false;
 1780|       |
 1781|  3.93k|    return true;
 1782|  4.19k|}
_Z18ComputeTapleafHashh4SpanIKhE:
 1829|  1.27k|{
 1830|  1.27k|    return (HashWriter{HASHER_TAPLEAF} << leaf_version << CompactSizeWriter(script.size()) << script).GetSHA256();
 1831|  1.27k|}
_Z20ComputeTapbranchHash4SpanIKhES1_:
 1834|  1.54k|{
 1835|  1.54k|    HashWriter ss_branch{HASHER_TAPBRANCH};
 1836|  1.54k|    if (std::lexicographical_compare(a.begin(), a.end(), b.begin(), b.end())) {
  ------------------
  |  Branch (1836:9): [True: 849, False: 692]
  ------------------
 1837|    849|        ss_branch << a << b;
 1838|    849|    } else {
 1839|    692|        ss_branch << b << a;
 1840|    692|    }
 1841|  1.54k|    return ss_branch.GetSHA256();
 1842|  1.54k|}
_Z24ComputeTaprootMerkleRoot4SpanIKhERK7uint256:
 1845|  1.27k|{
 1846|  1.27k|    assert(control.size() >= TAPROOT_CONTROL_BASE_SIZE);
 1847|  1.27k|    assert(control.size() <= TAPROOT_CONTROL_MAX_SIZE);
 1848|  1.27k|    assert((control.size() - TAPROOT_CONTROL_BASE_SIZE) % TAPROOT_CONTROL_NODE_SIZE == 0);
 1849|       |
 1850|  1.27k|    const int path_len = (control.size() - TAPROOT_CONTROL_BASE_SIZE) / TAPROOT_CONTROL_NODE_SIZE;
 1851|  1.27k|    uint256 k = tapleaf_hash;
 1852|  2.82k|    for (int i = 0; i < path_len; ++i) {
  ------------------
  |  Branch (1852:21): [True: 1.54k, False: 1.27k]
  ------------------
 1853|  1.54k|        Span node{Span{control}.subspan(TAPROOT_CONTROL_BASE_SIZE + TAPROOT_CONTROL_NODE_SIZE * i, TAPROOT_CONTROL_NODE_SIZE)};
 1854|  1.54k|        k = ComputeTapbranchHash(k, node);
 1855|  1.54k|    }
 1856|  1.27k|    return k;
 1857|  1.27k|}
_Z12VerifyScriptRK7CScriptS1_PK14CScriptWitnessjRK20BaseSignatureCheckerP13ScriptError_t:
 1959|   213k|{
 1960|   213k|    static const CScriptWitness emptyWitness;
 1961|   213k|    if (witness == nullptr) {
  ------------------
  |  Branch (1961:9): [True: 0, False: 213k]
  ------------------
 1962|      0|        witness = &emptyWitness;
 1963|      0|    }
 1964|   213k|    bool hadWitness = false;
 1965|       |
 1966|   213k|    set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
 1967|       |
 1968|   213k|    if ((flags & SCRIPT_VERIFY_SIGPUSHONLY) != 0 && !scriptSig.IsPushOnly()) {
  ------------------
  |  Branch (1968:9): [True: 0, False: 213k]
  |  Branch (1968:53): [True: 0, False: 0]
  ------------------
 1969|      0|        return set_error(serror, SCRIPT_ERR_SIG_PUSHONLY);
 1970|      0|    }
 1971|       |
 1972|       |    // scriptSig and scriptPubKey must be evaluated sequentially on the same stack
 1973|       |    // rather than being simply concatenated (see CVE-2010-5141)
 1974|   213k|    std::vector<std::vector<unsigned char> > stack, stackCopy;
 1975|   213k|    if (!EvalScript(stack, scriptSig, flags, checker, SigVersion::BASE, serror))
  ------------------
  |  Branch (1975:9): [True: 11.5k, False: 202k]
  ------------------
 1976|       |        // serror is set
 1977|  11.5k|        return false;
 1978|   202k|    if (flags & SCRIPT_VERIFY_P2SH)
  ------------------
  |  Branch (1978:9): [True: 202k, False: 0]
  ------------------
 1979|   202k|        stackCopy = stack;
 1980|   202k|    if (!EvalScript(stack, scriptPubKey, flags, checker, SigVersion::BASE, serror))
  ------------------
  |  Branch (1980:9): [True: 149k, False: 52.5k]
  ------------------
 1981|       |        // serror is set
 1982|   149k|        return false;
 1983|  52.5k|    if (stack.empty())
  ------------------
  |  Branch (1983:9): [True: 1.54k, False: 51.0k]
  ------------------
 1984|  1.54k|        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 1985|  51.0k|    if (CastToBool(stack.back()) == false)
  ------------------
  |  Branch (1985:9): [True: 2.18k, False: 48.8k]
  ------------------
 1986|  2.18k|        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 1987|       |
 1988|       |    // Bare witness programs
 1989|  48.8k|    int witnessversion;
 1990|  48.8k|    std::vector<unsigned char> witnessprogram;
 1991|  48.8k|    if (flags & SCRIPT_VERIFY_WITNESS) {
  ------------------
  |  Branch (1991:9): [True: 48.8k, False: 0]
  ------------------
 1992|  48.8k|        if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
  ------------------
  |  Branch (1992:13): [True: 27.8k, False: 21.0k]
  ------------------
 1993|  27.8k|            hadWitness = true;
 1994|  27.8k|            if (scriptSig.size() != 0) {
  ------------------
  |  Branch (1994:17): [True: 647, False: 27.1k]
  ------------------
 1995|       |                // The scriptSig must be _exactly_ CScript(), otherwise we reintroduce malleability.
 1996|    647|                return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED);
 1997|    647|            }
 1998|  27.1k|            if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/false)) {
  ------------------
  |  Branch (1998:17): [True: 26.6k, False: 555]
  ------------------
 1999|  26.6k|                return false;
 2000|  26.6k|            }
 2001|       |            // Bypass the cleanstack check at the end. The actual stack is obviously not clean
 2002|       |            // for witness programs.
 2003|    555|            stack.resize(1);
 2004|    555|        }
 2005|  48.8k|    }
 2006|       |
 2007|       |    // Additional validation for spend-to-script-hash transactions:
 2008|  21.5k|    if ((flags & SCRIPT_VERIFY_P2SH) && scriptPubKey.IsPayToScriptHash())
  ------------------
  |  Branch (2008:9): [True: 21.5k, False: 0]
  |  Branch (2008:41): [True: 18.0k, False: 3.53k]
  ------------------
 2009|  18.0k|    {
 2010|       |        // scriptSig must be literals-only or validation fails
 2011|  18.0k|        if (!scriptSig.IsPushOnly())
  ------------------
  |  Branch (2011:13): [True: 222, False: 17.8k]
  ------------------
 2012|    222|            return set_error(serror, SCRIPT_ERR_SIG_PUSHONLY);
 2013|       |
 2014|       |        // Restore stack.
 2015|  17.8k|        swap(stack, stackCopy);
 2016|       |
 2017|       |        // stack cannot be empty here, because if it was the
 2018|       |        // P2SH  HASH <> EQUAL  scriptPubKey would be evaluated with
 2019|       |        // an empty stack and the EvalScript above would return false.
 2020|  17.8k|        assert(!stack.empty());
 2021|       |
 2022|  17.8k|        const valtype& pubKeySerialized = stack.back();
 2023|  17.8k|        CScript pubKey2(pubKeySerialized.begin(), pubKeySerialized.end());
 2024|  17.8k|        popstack(stack);
 2025|       |
 2026|  17.8k|        if (!EvalScript(stack, pubKey2, flags, checker, SigVersion::BASE, serror))
  ------------------
  |  Branch (2026:13): [True: 593, False: 17.2k]
  ------------------
 2027|       |            // serror is set
 2028|    593|            return false;
 2029|  17.2k|        if (stack.empty())
  ------------------
  |  Branch (2029:13): [True: 1.37k, False: 15.8k]
  ------------------
 2030|  1.37k|            return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 2031|  15.8k|        if (!CastToBool(stack.back()))
  ------------------
  |  Branch (2031:13): [True: 70, False: 15.7k]
  ------------------
 2032|     70|            return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 2033|       |
 2034|       |        // P2SH witness program
 2035|  15.7k|        if (flags & SCRIPT_VERIFY_WITNESS) {
  ------------------
  |  Branch (2035:13): [True: 15.7k, False: 0]
  ------------------
 2036|  15.7k|            if (pubKey2.IsWitnessProgram(witnessversion, witnessprogram)) {
  ------------------
  |  Branch (2036:17): [True: 15.7k, False: 28]
  ------------------
 2037|  15.7k|                hadWitness = true;
 2038|  15.7k|                if (scriptSig != CScript() << std::vector<unsigned char>(pubKey2.begin(), pubKey2.end())) {
  ------------------
  |  Branch (2038:21): [True: 0, False: 15.7k]
  ------------------
 2039|       |                    // The scriptSig must be _exactly_ a single push of the redeemScript. Otherwise we
 2040|       |                    // reintroduce malleability.
 2041|      0|                    return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED_P2SH);
 2042|      0|                }
 2043|  15.7k|                if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/true)) {
  ------------------
  |  Branch (2043:21): [True: 14.8k, False: 865]
  ------------------
 2044|  14.8k|                    return false;
 2045|  14.8k|                }
 2046|       |                // Bypass the cleanstack check at the end. The actual stack is obviously not clean
 2047|       |                // for witness programs.
 2048|    865|                stack.resize(1);
 2049|    865|            }
 2050|  15.7k|        }
 2051|  15.7k|    }
 2052|       |
 2053|       |    // The CLEANSTACK check is only performed after potential P2SH evaluation,
 2054|       |    // as the non-P2SH evaluation of a P2SH script will obviously not result in
 2055|       |    // a clean stack (the P2SH inputs remain). The same holds for witness evaluation.
 2056|  4.43k|    if ((flags & SCRIPT_VERIFY_CLEANSTACK) != 0) {
  ------------------
  |  Branch (2056:9): [True: 4.43k, False: 0]
  ------------------
 2057|       |        // Disallow CLEANSTACK without P2SH, as otherwise a switch CLEANSTACK->P2SH+CLEANSTACK
 2058|       |        // would be possible, which is not a softfork (and P2SH should be one).
 2059|  4.43k|        assert((flags & SCRIPT_VERIFY_P2SH) != 0);
 2060|  4.43k|        assert((flags & SCRIPT_VERIFY_WITNESS) != 0);
 2061|  4.43k|        if (stack.size() != 1) {
  ------------------
  |  Branch (2061:13): [True: 1.40k, False: 3.02k]
  ------------------
 2062|  1.40k|            return set_error(serror, SCRIPT_ERR_CLEANSTACK);
 2063|  1.40k|        }
 2064|  4.43k|    }
 2065|       |
 2066|  3.02k|    if (flags & SCRIPT_VERIFY_WITNESS) {
  ------------------
  |  Branch (2066:9): [True: 3.02k, False: 0]
  ------------------
 2067|       |        // We can't check for correct unexpected witness data if P2SH was off, so require
 2068|       |        // that WITNESS implies P2SH. Otherwise, going from WITNESS->P2SH+WITNESS would be
 2069|       |        // possible, which is not a softfork.
 2070|  3.02k|        assert((flags & SCRIPT_VERIFY_P2SH) != 0);
 2071|  3.02k|        if (!hadWitness && !witness->IsNull()) {
  ------------------
  |  Branch (2071:13): [True: 1.60k, False: 1.42k]
  |  Branch (2071:28): [True: 220, False: 1.38k]
  ------------------
 2072|    220|            return set_error(serror, SCRIPT_ERR_WITNESS_UNEXPECTED);
 2073|    220|        }
 2074|  3.02k|    }
 2075|       |
 2076|  2.80k|    return set_success(serror);
 2077|  3.02k|}
interpreter.cpp:_ZL24IsValidSignatureEncodingRKNSt3__16vectorIhNS_9allocatorIhEEEE:
  107|   130k|bool static IsValidSignatureEncoding(const std::vector<unsigned char> &sig) {
  108|       |    // Format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S] [sighash]
  109|       |    // * total-length: 1-byte length descriptor of everything that follows,
  110|       |    //   excluding the sighash byte.
  111|       |    // * R-length: 1-byte length descriptor of the R value that follows.
  112|       |    // * R: arbitrary-length big-endian encoded R value. It must use the shortest
  113|       |    //   possible encoding for a positive integer (which means no null bytes at
  114|       |    //   the start, except a single one when the next byte has its highest bit set).
  115|       |    // * S-length: 1-byte length descriptor of the S value that follows.
  116|       |    // * S: arbitrary-length big-endian encoded S value. The same rules apply.
  117|       |    // * sighash: 1-byte value indicating what data is hashed (not part of the DER
  118|       |    //   signature)
  119|       |
  120|       |    // Minimum and maximum size constraints.
  121|   130k|    if (sig.size() < 9) return false;
  ------------------
  |  Branch (121:9): [True: 899, False: 129k]
  ------------------
  122|   129k|    if (sig.size() > 73) return false;
  ------------------
  |  Branch (122:9): [True: 21, False: 129k]
  ------------------
  123|       |
  124|       |    // A signature is of type 0x30 (compound).
  125|   129k|    if (sig[0] != 0x30) return false;
  ------------------
  |  Branch (125:9): [True: 619, False: 129k]
  ------------------
  126|       |
  127|       |    // Make sure the length covers the entire signature.
  128|   129k|    if (sig[1] != sig.size() - 3) return false;
  ------------------
  |  Branch (128:9): [True: 550, False: 128k]
  ------------------
  129|       |
  130|       |    // Extract the length of the R element.
  131|   128k|    unsigned int lenR = sig[3];
  132|       |
  133|       |    // Make sure the length of the S element is still inside the signature.
  134|   128k|    if (5 + lenR >= sig.size()) return false;
  ------------------
  |  Branch (134:9): [True: 18, False: 128k]
  ------------------
  135|       |
  136|       |    // Extract the length of the S element.
  137|   128k|    unsigned int lenS = sig[5 + lenR];
  138|       |
  139|       |    // Verify that the length of the signature matches the sum of the length
  140|       |    // of the elements.
  141|   128k|    if ((size_t)(lenR + lenS + 7) != sig.size()) return false;
  ------------------
  |  Branch (141:9): [True: 24, False: 128k]
  ------------------
  142|       |
  143|       |    // Check whether the R element is an integer.
  144|   128k|    if (sig[2] != 0x02) return false;
  ------------------
  |  Branch (144:9): [True: 1, False: 128k]
  ------------------
  145|       |
  146|       |    // Zero-length integers are not allowed for R.
  147|   128k|    if (lenR == 0) return false;
  ------------------
  |  Branch (147:9): [True: 0, False: 128k]
  ------------------
  148|       |
  149|       |    // Negative numbers are not allowed for R.
  150|   128k|    if (sig[4] & 0x80) return false;
  ------------------
  |  Branch (150:9): [True: 1, False: 128k]
  ------------------
  151|       |
  152|       |    // Null bytes at the start of R are not allowed, unless R would
  153|       |    // otherwise be interpreted as a negative number.
  154|   128k|    if (lenR > 1 && (sig[4] == 0x00) && !(sig[5] & 0x80)) return false;
  ------------------
  |  Branch (154:9): [True: 128k, False: 1]
  |  Branch (154:21): [True: 1.07k, False: 127k]
  |  Branch (154:41): [True: 1, False: 1.07k]
  ------------------
  155|       |
  156|       |    // Check whether the S element is an integer.
  157|   128k|    if (sig[lenR + 4] != 0x02) return false;
  ------------------
  |  Branch (157:9): [True: 3, False: 128k]
  ------------------
  158|       |
  159|       |    // Zero-length integers are not allowed for S.
  160|   128k|    if (lenS == 0) return false;
  ------------------
  |  Branch (160:9): [True: 0, False: 128k]
  ------------------
  161|       |
  162|       |    // Negative numbers are not allowed for S.
  163|   128k|    if (sig[lenR + 6] & 0x80) return false;
  ------------------
  |  Branch (163:9): [True: 1, False: 128k]
  ------------------
  164|       |
  165|       |    // Null bytes at the start of S are not allowed, unless S would otherwise be
  166|       |    // interpreted as a negative number.
  167|   128k|    if (lenS > 1 && (sig[lenR + 6] == 0x00) && !(sig[lenR + 7] & 0x80)) return false;
  ------------------
  |  Branch (167:9): [True: 128k, False: 0]
  |  Branch (167:21): [True: 726, False: 127k]
  |  Branch (167:48): [True: 2, False: 724]
  ------------------
  168|       |
  169|   128k|    return true;
  170|   128k|}
interpreter.cpp:_ZN12_GLOBAL__N_19set_errorEP13ScriptError_tS0_:
   27|   979k|{
   28|   979k|    if (ret)
  ------------------
  |  Branch (28:9): [True: 370k, False: 608k]
  ------------------
   29|   370k|        *ret = serror;
   30|   979k|    return false;
   31|   979k|}
interpreter.cpp:_ZL17IsLowDERSignatureRKNSt3__16vectorIhNS_9allocatorIhEEEEP13ScriptError_t:
  172|  64.3k|bool static IsLowDERSignature(const valtype &vchSig, ScriptError* serror) {
  173|  64.3k|    if (!IsValidSignatureEncoding(vchSig)) {
  ------------------
  |  Branch (173:9): [True: 0, False: 64.3k]
  ------------------
  174|      0|        return set_error(serror, SCRIPT_ERR_SIG_DER);
  175|      0|    }
  176|       |    // https://bitcoin.stackexchange.com/a/12556:
  177|       |    //     Also note that inside transaction signatures, an extra hashtype byte
  178|       |    //     follows the actual signature data.
  179|  64.3k|    std::vector<unsigned char> vchSigCopy(vchSig.begin(), vchSig.begin() + vchSig.size() - 1);
  180|       |    // If the S value is above the order of the curve divided by two, its
  181|       |    // complement modulo the order could have been used instead, which is
  182|       |    // one byte shorter when encoded correctly.
  183|  64.3k|    if (!CPubKey::CheckLowS(vchSigCopy)) {
  ------------------
  |  Branch (183:9): [True: 0, False: 64.3k]
  ------------------
  184|      0|        return set_error(serror, SCRIPT_ERR_SIG_HIGH_S);
  185|      0|    }
  186|  64.3k|    return true;
  187|  64.3k|}
interpreter.cpp:_ZL26IsDefinedHashtypeSignatureRKNSt3__16vectorIhNS_9allocatorIhEEEE:
  189|  64.3k|bool static IsDefinedHashtypeSignature(const valtype &vchSig) {
  190|  64.3k|    if (vchSig.size() == 0) {
  ------------------
  |  Branch (190:9): [True: 0, False: 64.3k]
  ------------------
  191|      0|        return false;
  192|      0|    }
  193|  64.3k|    unsigned char nHashType = vchSig[vchSig.size() - 1] & (~(SIGHASH_ANYONECANPAY));
  194|  64.3k|    if (nHashType < SIGHASH_ALL || nHashType > SIGHASH_SINGLE)
  ------------------
  |  Branch (194:9): [True: 15.5k, False: 48.8k]
  |  Branch (194:36): [True: 2.37k, False: 46.4k]
  ------------------
  195|  17.8k|        return false;
  196|       |
  197|  46.4k|    return true;
  198|  64.3k|}
interpreter.cpp:_ZNK12_GLOBAL__N_114ConditionStack8all_trueEv:
  284|  7.16M|    bool all_true() const { return m_first_false_pos == NO_FALSE; }
interpreter.cpp:_ZL8popstackRNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEE:
   57|   929k|{
   58|   929k|    if (stack.empty())
  ------------------
  |  Branch (58:9): [True: 0, False: 929k]
  ------------------
   59|      0|        throw std::runtime_error("popstack(): stack empty");
   60|   929k|    stack.pop_back();
   61|   929k|}
interpreter.cpp:_ZN12_GLOBAL__N_114ConditionStack9push_backEb:
  286|   110k|    {
  287|   110k|        if (m_first_false_pos == NO_FALSE && !f) {
  ------------------
  |  Branch (287:13): [True: 25.3k, False: 84.8k]
  |  Branch (287:46): [True: 5.28k, False: 20.0k]
  ------------------
  288|       |            // The stack consists of all true values, and a false is added.
  289|       |            // The first false value will appear at the current size.
  290|  5.28k|            m_first_false_pos = m_stack_size;
  291|  5.28k|        }
  292|   110k|        ++m_stack_size;
  293|   110k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_114ConditionStack5emptyEv:
  283|   438k|    bool empty() const { return m_stack_size == 0; }
interpreter.cpp:_ZN12_GLOBAL__N_114ConditionStack10toggle_topEv:
  304|  1.58k|    {
  305|  1.58k|        assert(m_stack_size > 0);
  306|  1.58k|        if (m_first_false_pos == NO_FALSE) {
  ------------------
  |  Branch (306:13): [True: 569, False: 1.01k]
  ------------------
  307|       |            // The current stack is all true values; the first false will be the top.
  308|    569|            m_first_false_pos = m_stack_size - 1;
  309|  1.01k|        } else if (m_first_false_pos == m_stack_size - 1) {
  ------------------
  |  Branch (309:20): [True: 738, False: 275]
  ------------------
  310|       |            // The top is the first false value; toggling it will make everything true.
  311|    738|            m_first_false_pos = NO_FALSE;
  312|    738|        } else {
  313|       |            // There is a false value, but not on top. No action is needed as toggling
  314|       |            // anything but the first false value is unobservable.
  315|    275|        }
  316|  1.58k|    }
interpreter.cpp:_ZN12_GLOBAL__N_114ConditionStack8pop_backEv:
  295|  79.2k|    {
  296|  79.2k|        assert(m_stack_size > 0);
  297|  79.2k|        --m_stack_size;
  298|  79.2k|        if (m_first_false_pos == m_stack_size) {
  ------------------
  |  Branch (298:13): [True: 4.29k, False: 74.9k]
  ------------------
  299|       |            // When popping off the first false value, everything becomes true.
  300|  4.29k|            m_first_false_pos = NO_FALSE;
  301|  4.29k|        }
  302|  79.2k|    }
interpreter.cpp:_ZL12EvalChecksigRKNSt3__16vectorIhNS_9allocatorIhEEEES5_N9prevectorILj28EhjiE14const_iteratorES8_R19ScriptExecutionDatajRK20BaseSignatureChecker10SigVersionP13ScriptError_tRb:
  392|  67.8k|{
  393|  67.8k|    switch (sigversion) {
  ------------------
  |  Branch (393:13): [True: 0, False: 67.8k]
  ------------------
  394|  52.6k|    case SigVersion::BASE:
  ------------------
  |  Branch (394:5): [True: 52.6k, False: 15.2k]
  ------------------
  395|  67.8k|    case SigVersion::WITNESS_V0:
  ------------------
  |  Branch (395:5): [True: 15.2k, False: 52.6k]
  ------------------
  396|  67.8k|        return EvalChecksigPreTapscript(sig, pubkey, pbegincodehash, pend, flags, checker, sigversion, serror, success);
  397|      0|    case SigVersion::TAPSCRIPT:
  ------------------
  |  Branch (397:5): [True: 0, False: 67.8k]
  ------------------
  398|      0|        return EvalChecksigTapscript(sig, pubkey, execdata, flags, checker, sigversion, serror, success);
  399|      0|    case SigVersion::TAPROOT:
  ------------------
  |  Branch (399:5): [True: 0, False: 67.8k]
  ------------------
  400|       |        // Key path spending in Taproot has no script, so this is unreachable.
  401|      0|        break;
  402|  67.8k|    }
  403|      0|    assert(false);
  404|      0|}
interpreter.cpp:_ZL24EvalChecksigPreTapscriptRKNSt3__16vectorIhNS_9allocatorIhEEEES5_N9prevectorILj28EhjiE14const_iteratorES8_jRK20BaseSignatureChecker10SigVersionP13ScriptError_tRb:
  321|  67.8k|{
  322|  67.8k|    assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
  323|       |
  324|       |    // Subset of script starting at the most recent codeseparator
  325|  67.8k|    CScript scriptCode(pbegincodehash, pend);
  326|       |
  327|       |    // Drop the signature in pre-segwit scripts but not segwit scripts
  328|  67.8k|    if (sigversion == SigVersion::BASE) {
  ------------------
  |  Branch (328:9): [True: 52.6k, False: 15.2k]
  ------------------
  329|  52.6k|        int found = FindAndDelete(scriptCode, CScript() << vchSig);
  330|  52.6k|        if (found > 0 && (flags & SCRIPT_VERIFY_CONST_SCRIPTCODE))
  ------------------
  |  Branch (330:13): [True: 1.28k, False: 51.3k]
  |  Branch (330:26): [True: 1.17k, False: 109]
  ------------------
  331|  1.17k|            return set_error(serror, SCRIPT_ERR_SIG_FINDANDDELETE);
  332|  52.6k|    }
  333|       |
  334|  66.6k|    if (!CheckSignatureEncoding(vchSig, flags, serror) || !CheckPubKeyEncoding(vchPubKey, flags, sigversion, serror)) {
  ------------------
  |  Branch (334:9): [True: 19.3k, False: 47.2k]
  |  Branch (334:59): [True: 1.21k, False: 46.0k]
  ------------------
  335|       |        //serror is set
  336|  20.6k|        return false;
  337|  20.6k|    }
  338|  46.0k|    fSuccess = checker.CheckECDSASignature(vchSig, vchPubKey, scriptCode, sigversion);
  339|       |
  340|  46.0k|    if (!fSuccess && (flags & SCRIPT_VERIFY_NULLFAIL) && vchSig.size())
  ------------------
  |  Branch (340:9): [True: 44.6k, False: 1.44k]
  |  Branch (340:22): [True: 44.6k, False: 3]
  |  Branch (340:58): [True: 43.9k, False: 702]
  ------------------
  341|  43.9k|        return set_error(serror, SCRIPT_ERR_SIG_NULLFAIL);
  342|       |
  343|  2.14k|    return true;
  344|  46.0k|}
interpreter.cpp:_ZL19CheckPubKeyEncodingRKNSt3__16vectorIhNS_9allocatorIhEEEEjRK10SigVersionP13ScriptError_t:
  217|  50.6k|bool static CheckPubKeyEncoding(const valtype &vchPubKey, unsigned int flags, const SigVersion &sigversion, ScriptError* serror) {
  218|  50.6k|    if ((flags & SCRIPT_VERIFY_STRICTENC) != 0 && !IsCompressedOrUncompressedPubKey(vchPubKey)) {
  ------------------
  |  Branch (218:9): [True: 50.6k, False: 0]
  |  Branch (218:51): [True: 2.71k, False: 47.9k]
  ------------------
  219|  2.71k|        return set_error(serror, SCRIPT_ERR_PUBKEYTYPE);
  220|  2.71k|    }
  221|       |    // Only compressed keys are accepted in segwit
  222|  47.9k|    if ((flags & SCRIPT_VERIFY_WITNESS_PUBKEYTYPE) != 0 && sigversion == SigVersion::WITNESS_V0 && !IsCompressedPubKey(vchPubKey)) {
  ------------------
  |  Branch (222:9): [True: 47.9k, False: 6]
  |  Branch (222:60): [True: 10.0k, False: 37.9k]
  |  Branch (222:100): [True: 1, False: 10.0k]
  ------------------
  223|      1|        return set_error(serror, SCRIPT_ERR_WITNESS_PUBKEYTYPE);
  224|      1|    }
  225|  47.9k|    return true;
  226|  47.9k|}
interpreter.cpp:_ZL32IsCompressedOrUncompressedPubKeyRKNSt3__16vectorIhNS_9allocatorIhEEEE:
   63|  50.6k|bool static IsCompressedOrUncompressedPubKey(const valtype &vchPubKey) {
   64|  50.6k|    if (vchPubKey.size() < CPubKey::COMPRESSED_SIZE) {
  ------------------
  |  Branch (64:9): [True: 951, False: 49.7k]
  ------------------
   65|       |        //  Non-canonical public key: too short
   66|    951|        return false;
   67|    951|    }
   68|  49.7k|    if (vchPubKey[0] == 0x04) {
  ------------------
  |  Branch (68:9): [True: 10.2k, False: 39.4k]
  ------------------
   69|  10.2k|        if (vchPubKey.size() != CPubKey::SIZE) {
  ------------------
  |  Branch (69:13): [True: 680, False: 9.56k]
  ------------------
   70|       |            //  Non-canonical public key: invalid length for uncompressed key
   71|    680|            return false;
   72|    680|        }
   73|  39.4k|    } else if (vchPubKey[0] == 0x02 || vchPubKey[0] == 0x03) {
  ------------------
  |  Branch (73:16): [True: 24.5k, False: 14.9k]
  |  Branch (73:40): [True: 14.2k, False: 640]
  ------------------
   74|  38.8k|        if (vchPubKey.size() != CPubKey::COMPRESSED_SIZE) {
  ------------------
  |  Branch (74:13): [True: 448, False: 38.3k]
  ------------------
   75|       |            //  Non-canonical public key: invalid length for compressed key
   76|    448|            return false;
   77|    448|        }
   78|  38.8k|    } else {
   79|       |        //  Non-canonical public key: neither compressed nor uncompressed
   80|    640|        return false;
   81|    640|    }
   82|  47.9k|    return true;
   83|  49.7k|}
interpreter.cpp:_ZL18IsCompressedPubKeyRKNSt3__16vectorIhNS_9allocatorIhEEEE:
   85|  10.0k|bool static IsCompressedPubKey(const valtype &vchPubKey) {
   86|  10.0k|    if (vchPubKey.size() != CPubKey::COMPRESSED_SIZE) {
  ------------------
  |  Branch (86:9): [True: 1, False: 10.0k]
  ------------------
   87|       |        //  Non-canonical public key: invalid length for compressed key
   88|      1|        return false;
   89|      1|    }
   90|  10.0k|    if (vchPubKey[0] != 0x02 && vchPubKey[0] != 0x03) {
  ------------------
  |  Branch (90:9): [True: 8.52k, False: 1.52k]
  |  Branch (90:33): [True: 0, False: 8.52k]
  ------------------
   91|       |        //  Non-canonical public key: invalid prefix for compressed key
   92|      0|        return false;
   93|      0|    }
   94|  10.0k|    return true;
   95|  10.0k|}
interpreter.cpp:_ZN12_GLOBAL__N_111set_successEP13ScriptError_t:
   20|   358k|{
   21|   358k|    if (ret)
  ------------------
  |  Branch (21:9): [True: 124k, False: 233k]
  ------------------
   22|   124k|        *ret = SCRIPT_ERR_OK;
   23|   358k|    return true;
   24|   358k|}
interpreter.cpp:_ZN12_GLOBAL__N_121GetSpentAmountsSHA256ERKNSt3__16vectorI6CTxOutNS0_9allocatorIS2_EEEE:
 1376|  1.00k|{
 1377|  1.00k|    HashWriter ss{};
 1378|  4.63k|    for (const auto& txout : outputs_spent) {
  ------------------
  |  Branch (1378:28): [True: 4.63k, False: 1.00k]
  ------------------
 1379|  4.63k|        ss << txout.nValue;
 1380|  4.63k|    }
 1381|  1.00k|    return ss.GetSHA256();
 1382|  1.00k|}
interpreter.cpp:_ZN12_GLOBAL__N_121GetSpentScriptsSHA256ERKNSt3__16vectorI6CTxOutNS0_9allocatorIS2_EEEE:
 1386|  1.00k|{
 1387|  1.00k|    HashWriter ss{};
 1388|  4.63k|    for (const auto& txout : outputs_spent) {
  ------------------
  |  Branch (1388:28): [True: 4.63k, False: 1.00k]
  ------------------
 1389|  4.63k|        ss << txout.scriptPubKey;
 1390|  4.63k|    }
 1391|  1.00k|    return ss.GetSHA256();
 1392|  1.00k|}
interpreter.cpp:_ZL17HandleMissingData19MissingDataBehavior:
 1466|    492|{
 1467|    492|    switch (mdb) {
  ------------------
  |  Branch (1467:13): [True: 0, False: 492]
  ------------------
 1468|      0|    case MissingDataBehavior::ASSERT_FAIL:
  ------------------
  |  Branch (1468:5): [True: 0, False: 492]
  ------------------
 1469|      0|        assert(!"Missing data");
 1470|      0|        break;
 1471|    492|    case MissingDataBehavior::FAIL:
  ------------------
  |  Branch (1471:5): [True: 492, False: 0]
  ------------------
 1472|    492|        return false;
 1473|    492|    }
 1474|      0|    assert(!"Unknown MissingDataBehavior value");
 1475|      0|}
interpreter.cpp:_ZL20VerifyWitnessProgramRK14CScriptWitnessiRKNSt3__16vectorIhNS2_9allocatorIhEEEEjRK20BaseSignatureCheckerP13ScriptError_tb:
 1874|  42.9k|{
 1875|  42.9k|    CScript exec_script; //!< Actually executed script (last stack item in P2WSH; implied P2PKH script in P2WPKH; leaf script in P2TR)
 1876|  42.9k|    Span stack{witness.stack};
 1877|  42.9k|    ScriptExecutionData execdata;
 1878|       |
 1879|  42.9k|    if (witversion == 0) {
  ------------------
  |  Branch (1879:9): [True: 29.4k, False: 13.4k]
  ------------------
 1880|  29.4k|        if (program.size() == WITNESS_V0_SCRIPTHASH_SIZE) {
  ------------------
  |  Branch (1880:13): [True: 12.1k, False: 17.3k]
  ------------------
 1881|       |            // BIP141 P2WSH: 32-byte witness v0 program (which encodes SHA256(script))
 1882|  12.1k|            if (stack.size() == 0) {
  ------------------
  |  Branch (1882:17): [True: 7.00k, False: 5.10k]
  ------------------
 1883|  7.00k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY);
 1884|  7.00k|            }
 1885|  5.10k|            const valtype& script_bytes = SpanPopBack(stack);
 1886|  5.10k|            exec_script = CScript(script_bytes.begin(), script_bytes.end());
 1887|  5.10k|            uint256 hash_exec_script;
 1888|  5.10k|            CSHA256().Write(exec_script.data(), exec_script.size()).Finalize(hash_exec_script.begin());
 1889|  5.10k|            if (memcmp(hash_exec_script.begin(), program.data(), 32)) {
  ------------------
  |  Branch (1889:17): [True: 2.04k, False: 3.06k]
  ------------------
 1890|  2.04k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
 1891|  2.04k|            }
 1892|  3.06k|            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
 1893|  17.3k|        } else if (program.size() == WITNESS_V0_KEYHASH_SIZE) {
  ------------------
  |  Branch (1893:20): [True: 16.6k, False: 687]
  ------------------
 1894|       |            // BIP141 P2WPKH: 20-byte witness v0 program (which encodes Hash160(pubkey))
 1895|  16.6k|            if (stack.size() != 2) {
  ------------------
  |  Branch (1895:17): [True: 1.43k, False: 15.2k]
  ------------------
 1896|  1.43k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); // 2 items in witness
 1897|  1.43k|            }
 1898|  15.2k|            exec_script << OP_DUP << OP_HASH160 << program << OP_EQUALVERIFY << OP_CHECKSIG;
 1899|  15.2k|            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
 1900|  16.6k|        } else {
 1901|    687|            return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH);
 1902|    687|        }
 1903|  29.4k|    } else if (witversion == 1 && program.size() == WITNESS_V1_TAPROOT_SIZE && !is_p2sh) {
  ------------------
  |  Branch (1903:16): [True: 13.0k, False: 433]
  |  Branch (1903:35): [True: 11.7k, False: 1.28k]
  |  Branch (1903:80): [True: 11.7k, False: 0]
  ------------------
 1904|       |        // BIP341 Taproot: 32-byte non-P2SH witness v1 program (which encodes a P2C-tweaked pubkey)
 1905|  11.7k|        if (!(flags & SCRIPT_VERIFY_TAPROOT)) return set_success(serror);
  ------------------
  |  Branch (1905:13): [True: 0, False: 11.7k]
  ------------------
 1906|  11.7k|        if (stack.size() == 0) return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY);
  ------------------
  |  Branch (1906:13): [True: 6.28k, False: 5.45k]
  ------------------
 1907|  5.45k|        if (stack.size() >= 2 && !stack.back().empty() && stack.back()[0] == ANNEX_TAG) {
  ------------------
  |  Branch (1907:13): [True: 2.36k, False: 3.09k]
  |  Branch (1907:34): [True: 2.06k, False: 292]
  |  Branch (1907:59): [True: 214, False: 1.85k]
  ------------------
 1908|       |            // Drop annex (this is non-standard; see IsWitnessStandard)
 1909|    214|            const valtype& annex = SpanPopBack(stack);
 1910|    214|            execdata.m_annex_hash = (HashWriter{} << annex).GetSHA256();
 1911|    214|            execdata.m_annex_present = true;
 1912|  5.23k|        } else {
 1913|  5.23k|            execdata.m_annex_present = false;
 1914|  5.23k|        }
 1915|  5.45k|        execdata.m_annex_init = true;
 1916|  5.45k|        if (stack.size() == 1) {
  ------------------
  |  Branch (1916:13): [True: 3.09k, False: 2.35k]
  ------------------
 1917|       |            // Key path spending (stack size is 1 after removing optional annex)
 1918|  3.09k|            if (!checker.CheckSchnorrSignature(stack.front(), program, SigVersion::TAPROOT, execdata, serror)) {
  ------------------
  |  Branch (1918:17): [True: 3.08k, False: 12]
  ------------------
 1919|  3.08k|                return false; // serror is set
 1920|  3.08k|            }
 1921|     12|            return set_success(serror);
 1922|  3.09k|        } else {
 1923|       |            // Script path spending (stack size is >1 after removing optional annex)
 1924|  2.35k|            const valtype& control = SpanPopBack(stack);
 1925|  2.35k|            const valtype& script = SpanPopBack(stack);
 1926|  2.35k|            if (control.size() < TAPROOT_CONTROL_BASE_SIZE || control.size() > TAPROOT_CONTROL_MAX_SIZE || ((control.size() - TAPROOT_CONTROL_BASE_SIZE) % TAPROOT_CONTROL_NODE_SIZE) != 0) {
  ------------------
  |  Branch (1926:17): [True: 687, False: 1.66k]
  |  Branch (1926:63): [True: 38, False: 1.62k]
  |  Branch (1926:108): [True: 350, False: 1.27k]
  ------------------
 1927|  1.07k|                return set_error(serror, SCRIPT_ERR_TAPROOT_WRONG_CONTROL_SIZE);
 1928|  1.07k|            }
 1929|  1.27k|            execdata.m_tapleaf_hash = ComputeTapleafHash(control[0] & TAPROOT_LEAF_MASK, script);
 1930|  1.27k|            if (!VerifyTaprootCommitment(control, program, execdata.m_tapleaf_hash)) {
  ------------------
  |  Branch (1930:17): [True: 1.27k, False: 0]
  ------------------
 1931|  1.27k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
 1932|  1.27k|            }
 1933|      0|            execdata.m_tapleaf_hash_init = true;
 1934|      0|            if ((control[0] & TAPROOT_LEAF_MASK) == TAPROOT_LEAF_TAPSCRIPT) {
  ------------------
  |  Branch (1934:17): [True: 0, False: 0]
  ------------------
 1935|       |                // Tapscript (leaf version 0xc0)
 1936|      0|                exec_script = CScript(script.begin(), script.end());
 1937|      0|                execdata.m_validation_weight_left = ::GetSerializeSize(witness.stack) + VALIDATION_WEIGHT_OFFSET;
 1938|      0|                execdata.m_validation_weight_left_init = true;
 1939|      0|                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT, checker, execdata, serror);
 1940|      0|            }
 1941|      0|            if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION) {
  ------------------
  |  Branch (1941:17): [True: 0, False: 0]
  ------------------
 1942|      0|                return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION);
 1943|      0|            }
 1944|      0|            return set_success(serror);
 1945|      0|        }
 1946|  5.45k|    } else if (!is_p2sh && CScript::IsPayToAnchor(witversion, program)) {
  ------------------
  |  Branch (1946:16): [True: 1.71k, False: 0]
  |  Branch (1946:28): [True: 522, False: 1.19k]
  ------------------
 1947|    522|        return true;
 1948|  1.19k|    } else {
 1949|  1.19k|        if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM) {
  ------------------
  |  Branch (1949:13): [True: 1.19k, False: 0]
  ------------------
 1950|  1.19k|            return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM);
 1951|  1.19k|        }
 1952|       |        // Other version/size/p2sh combinations return true for future softfork compatibility
 1953|      0|        return true;
 1954|  1.19k|    }
 1955|       |    // There is intentionally no return statement here, to be able to use "control reaches end of non-void function" warnings to detect gaps in the logic above.
 1956|  42.9k|}
interpreter.cpp:_ZL20ExecuteWitnessScriptRK4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEERK7CScriptj10SigVersionRK20BaseSignatureCheckerR19ScriptExecutionDataP13ScriptError_t:
 1789|  18.2k|{
 1790|  18.2k|    std::vector<valtype> stack{stack_span.begin(), stack_span.end()};
 1791|       |
 1792|  18.2k|    if (sigversion == SigVersion::TAPSCRIPT) {
  ------------------
  |  Branch (1792:9): [True: 0, False: 18.2k]
  ------------------
 1793|       |        // OP_SUCCESSx processing overrides everything, including stack element size limits
 1794|      0|        CScript::const_iterator pc = exec_script.begin();
 1795|      0|        while (pc < exec_script.end()) {
  ------------------
  |  Branch (1795:16): [True: 0, False: 0]
  ------------------
 1796|      0|            opcodetype opcode;
 1797|      0|            if (!exec_script.GetOp(pc, opcode)) {
  ------------------
  |  Branch (1797:17): [True: 0, False: 0]
  ------------------
 1798|       |                // Note how this condition would not be reached if an unknown OP_SUCCESSx was found
 1799|      0|                return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
 1800|      0|            }
 1801|       |            // New opcodes will be listed here. May use a different sigversion to modify existing opcodes.
 1802|      0|            if (IsOpSuccess(opcode)) {
  ------------------
  |  Branch (1802:17): [True: 0, False: 0]
  ------------------
 1803|      0|                if (flags & SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS) {
  ------------------
  |  Branch (1803:21): [True: 0, False: 0]
  ------------------
 1804|      0|                    return set_error(serror, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
 1805|      0|                }
 1806|      0|                return set_success(serror);
 1807|      0|            }
 1808|      0|        }
 1809|       |
 1810|       |        // Tapscript enforces initial stack size limits (altstack is empty here)
 1811|      0|        if (stack.size() > MAX_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
  ------------------
  |  Branch (1811:13): [True: 0, False: 0]
  ------------------
 1812|      0|    }
 1813|       |
 1814|       |    // Disallow stack item size > MAX_SCRIPT_ELEMENT_SIZE in witness stack
 1815|  56.3k|    for (const valtype& elem : stack) {
  ------------------
  |  Branch (1815:30): [True: 56.3k, False: 18.2k]
  ------------------
 1816|  56.3k|        if (elem.size() > MAX_SCRIPT_ELEMENT_SIZE) return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
  ------------------
  |  Branch (1816:13): [True: 70, False: 56.2k]
  ------------------
 1817|  56.3k|    }
 1818|       |
 1819|       |    // Run the script interpreter.
 1820|  18.2k|    if (!EvalScript(stack, exec_script, flags, checker, sigversion, execdata, serror)) return false;
  ------------------
  |  Branch (1820:9): [True: 15.5k, False: 2.64k]
  ------------------
 1821|       |
 1822|       |    // Scripts inside witness implicitly require cleanstack behaviour
 1823|  2.64k|    if (stack.size() != 1) return set_error(serror, SCRIPT_ERR_CLEANSTACK);
  ------------------
  |  Branch (1823:9): [True: 1.60k, False: 1.04k]
  ------------------
 1824|  1.04k|    if (!CastToBool(stack.back())) return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
  ------------------
  |  Branch (1824:9): [True: 163, False: 886]
  ------------------
 1825|    886|    return true;
 1826|  1.04k|}
interpreter.cpp:_ZL23VerifyTaprootCommitmentRKNSt3__16vectorIhNS_9allocatorIhEEEES5_RK7uint256:
 1860|  1.27k|{
 1861|  1.27k|    assert(control.size() >= TAPROOT_CONTROL_BASE_SIZE);
 1862|  1.27k|    assert(program.size() >= uint256::size());
 1863|       |    //! The internal pubkey (x-only, so no Y coordinate parity).
 1864|  1.27k|    const XOnlyPubKey p{Span{control}.subspan(1, TAPROOT_CONTROL_BASE_SIZE - 1)};
 1865|       |    //! The output pubkey (taken from the scriptPubKey).
 1866|  1.27k|    const XOnlyPubKey q{program};
 1867|       |    // Compute the Merkle root from the leaf and the provided path.
 1868|  1.27k|    const uint256 merkle_root = ComputeTaprootMerkleRoot(control, tapleaf_hash);
 1869|       |    // Verify that the output pubkey matches the tweaked internal pubkey, after correcting for parity.
 1870|  1.27k|    return q.CheckTapTweak(p, merkle_root, control[0] & 1);
 1871|  1.27k|}
interpreter.cpp:_ZN12_GLOBAL__N_117GetPrevoutsSHA256I12CTransactionEE7uint256RKT_:
 1344|  8.06k|{
 1345|  8.06k|    HashWriter ss{};
 1346|   146k|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1346:27): [True: 146k, False: 8.06k]
  ------------------
 1347|   146k|        ss << txin.prevout;
 1348|   146k|    }
 1349|  8.06k|    return ss.GetSHA256();
 1350|  8.06k|}
interpreter.cpp:_ZN12_GLOBAL__N_118GetSequencesSHA256I12CTransactionEE7uint256RKT_:
 1355|  8.06k|{
 1356|  8.06k|    HashWriter ss{};
 1357|   146k|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1357:27): [True: 146k, False: 8.06k]
  ------------------
 1358|   146k|        ss << txin.nSequence;
 1359|   146k|    }
 1360|  8.06k|    return ss.GetSHA256();
 1361|  8.06k|}
interpreter.cpp:_ZN12_GLOBAL__N_116GetOutputsSHA256I12CTransactionEE7uint256RKT_:
 1366|  8.06k|{
 1367|  8.06k|    HashWriter ss{};
 1368|  16.9k|    for (const auto& txout : txTo.vout) {
  ------------------
  |  Branch (1368:28): [True: 16.9k, False: 8.06k]
  ------------------
 1369|  16.9k|        ss << txout;
 1370|  16.9k|    }
 1371|  8.06k|    return ss.GetSHA256();
 1372|  8.06k|}
interpreter.cpp:_ZN12_GLOBAL__N_117GetPrevoutsSHA256I19CMutableTransactionEE7uint256RKT_:
 1344|    171|{
 1345|    171|    HashWriter ss{};
 1346|    788|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1346:27): [True: 788, False: 171]
  ------------------
 1347|    788|        ss << txin.prevout;
 1348|    788|    }
 1349|    171|    return ss.GetSHA256();
 1350|    171|}
interpreter.cpp:_ZN12_GLOBAL__N_118GetSequencesSHA256I19CMutableTransactionEE7uint256RKT_:
 1355|    152|{
 1356|    152|    HashWriter ss{};
 1357|    761|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1357:27): [True: 761, False: 152]
  ------------------
 1358|    761|        ss << txin.nSequence;
 1359|    761|    }
 1360|    152|    return ss.GetSHA256();
 1361|    152|}
interpreter.cpp:_ZN12_GLOBAL__N_116GetOutputsSHA256I19CMutableTransactionEE7uint256RKT_:
 1366|    271|{
 1367|    271|    HashWriter ss{};
 1368|  1.23k|    for (const auto& txout : txTo.vout) {
  ------------------
  |  Branch (1368:28): [True: 1.23k, False: 271]
  ------------------
 1369|  1.23k|        ss << txout;
 1370|  1.23k|    }
 1371|    271|    return ss.GetSHA256();
 1372|    271|}
_Z13SignatureHashI12CTransactionE7uint256RK7CScriptRKT_jiRKl10SigVersionPK26PrecomputedTransactionData:
 1569|  21.9k|{
 1570|  21.9k|    assert(nIn < txTo.vin.size());
 1571|       |
 1572|  21.9k|    if (sigversion == SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (1572:9): [True: 4.59k, False: 17.3k]
  ------------------
 1573|  4.59k|        uint256 hashPrevouts;
 1574|  4.59k|        uint256 hashSequence;
 1575|  4.59k|        uint256 hashOutputs;
 1576|  4.59k|        const bool cacheready = cache && cache->m_bip143_segwit_ready;
  ------------------
  |  Branch (1576:33): [True: 4.59k, False: 0]
  |  Branch (1576:42): [True: 4.59k, False: 0]
  ------------------
 1577|       |
 1578|  4.59k|        if (!(nHashType & SIGHASH_ANYONECANPAY)) {
  ------------------
  |  Branch (1578:13): [True: 4.21k, False: 376]
  ------------------
 1579|  4.21k|            hashPrevouts = cacheready ? cache->hashPrevouts : SHA256Uint256(GetPrevoutsSHA256(txTo));
  ------------------
  |  Branch (1579:28): [True: 4.21k, False: 0]
  ------------------
 1580|  4.21k|        }
 1581|       |
 1582|  4.59k|        if (!(nHashType & SIGHASH_ANYONECANPAY) && (nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1582:13): [True: 4.21k, False: 376]
  |  Branch (1582:52): [True: 1.00k, False: 3.21k]
  |  Branch (1582:92): [True: 692, False: 309]
  ------------------
 1583|    692|            hashSequence = cacheready ? cache->hashSequence : SHA256Uint256(GetSequencesSHA256(txTo));
  ------------------
  |  Branch (1583:28): [True: 692, False: 0]
  ------------------
 1584|    692|        }
 1585|       |
 1586|       |
 1587|  4.59k|        if ((nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1587:13): [True: 1.17k, False: 3.41k]
  |  Branch (1587:53): [True: 763, False: 410]
  ------------------
 1588|    763|            hashOutputs = cacheready ? cache->hashOutputs : SHA256Uint256(GetOutputsSHA256(txTo));
  ------------------
  |  Branch (1588:27): [True: 763, False: 0]
  ------------------
 1589|  3.82k|        } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nIn < txTo.vout.size()) {
  ------------------
  |  Branch (1589:20): [True: 3.41k, False: 410]
  |  Branch (1589:60): [True: 1.16k, False: 2.24k]
  ------------------
 1590|  1.16k|            HashWriter ss{};
 1591|  1.16k|            ss << txTo.vout[nIn];
 1592|  1.16k|            hashOutputs = ss.GetHash();
 1593|  1.16k|        }
 1594|       |
 1595|  4.59k|        HashWriter ss{};
 1596|       |        // Version
 1597|  4.59k|        ss << txTo.version;
 1598|       |        // Input prevouts/nSequence (none/all, depending on flags)
 1599|  4.59k|        ss << hashPrevouts;
 1600|  4.59k|        ss << hashSequence;
 1601|       |        // The input being signed (replacing the scriptSig with scriptCode + amount)
 1602|       |        // The prevout may already be contained in hashPrevout, and the nSequence
 1603|       |        // may already be contain in hashSequence.
 1604|  4.59k|        ss << txTo.vin[nIn].prevout;
 1605|  4.59k|        ss << scriptCode;
 1606|  4.59k|        ss << amount;
 1607|  4.59k|        ss << txTo.vin[nIn].nSequence;
 1608|       |        // Outputs (none/one/all, depending on flags)
 1609|  4.59k|        ss << hashOutputs;
 1610|       |        // Locktime
 1611|  4.59k|        ss << txTo.nLockTime;
 1612|       |        // Sighash type
 1613|  4.59k|        ss << nHashType;
 1614|       |
 1615|  4.59k|        return ss.GetHash();
 1616|  4.59k|    }
 1617|       |
 1618|       |    // Check for invalid use of SIGHASH_SINGLE
 1619|  17.3k|    if ((nHashType & 0x1f) == SIGHASH_SINGLE) {
  ------------------
  |  Branch (1619:9): [True: 459, False: 16.9k]
  ------------------
 1620|    459|        if (nIn >= txTo.vout.size()) {
  ------------------
  |  Branch (1620:13): [True: 0, False: 459]
  ------------------
 1621|       |            //  nOut out of range
 1622|      0|            return uint256::ONE;
 1623|      0|        }
 1624|    459|    }
 1625|       |
 1626|       |    // Wrapper to serialize only the necessary parts of the transaction being signed
 1627|  17.3k|    CTransactionSignatureSerializer<T> txTmp(txTo, scriptCode, nIn, nHashType);
 1628|       |
 1629|       |    // Serialize and hash
 1630|  17.3k|    HashWriter ss{};
 1631|  17.3k|    ss << txTmp << nHashType;
 1632|  17.3k|    return ss.GetHash();
 1633|  17.3k|}
interpreter.cpp:_ZN12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionEC2ERKS1_RK7CScriptji:
 1261|  17.3k|        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
 1262|  17.3k|        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
 1263|  17.3k|        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
 1264|  17.3k|        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE9SerializeI10HashWriterEEvRT_:
 1323|  17.3k|    void Serialize(S &s) const {
 1324|       |        // Serialize version
 1325|  17.3k|        ::Serialize(s, txTo.version);
 1326|       |        // Serialize vin
 1327|  17.3k|        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
  ------------------
  |  Branch (1327:32): [True: 552, False: 16.8k]
  ------------------
 1328|  17.3k|        ::WriteCompactSize(s, nInputs);
 1329|  1.74M|        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
  ------------------
  |  Branch (1329:39): [True: 1.72M, False: 17.3k]
  ------------------
 1330|  1.72M|             SerializeInput(s, nInput);
 1331|       |        // Serialize vout
 1332|  17.3k|        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
  ------------------
  |  Branch (1332:33): [True: 2.67k, False: 14.6k]
  |  Branch (1332:50): [True: 459, False: 14.2k]
  ------------------
 1333|  17.3k|        ::WriteCompactSize(s, nOutputs);
 1334|  81.7k|        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
  ------------------
  |  Branch (1334:40): [True: 64.4k, False: 17.3k]
  ------------------
 1335|  64.4k|             SerializeOutput(s, nOutput);
 1336|       |        // Serialize nLockTime
 1337|  17.3k|        ::Serialize(s, txTo.nLockTime);
 1338|  17.3k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE14SerializeInputI10HashWriterEEvRT_j:
 1291|  1.72M|    void SerializeInput(S &s, unsigned int nInput) const {
 1292|       |        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
 1293|  1.72M|        if (fAnyoneCanPay)
  ------------------
  |  Branch (1293:13): [True: 552, False: 1.72M]
  ------------------
 1294|    552|            nInput = nIn;
 1295|       |        // Serialize the prevout
 1296|  1.72M|        ::Serialize(s, txTo.vin[nInput].prevout);
 1297|       |        // Serialize the script
 1298|  1.72M|        if (nInput != nIn)
  ------------------
  |  Branch (1298:13): [True: 1.71M, False: 17.3k]
  ------------------
 1299|       |            // Blank out other inputs' signatures
 1300|  1.71M|            ::Serialize(s, CScript());
 1301|  17.3k|        else
 1302|  17.3k|            SerializeScriptCode(s);
 1303|       |        // Serialize the nSequence
 1304|  1.72M|        if (nInput != nIn && (fHashSingle || fHashNone))
  ------------------
  |  Branch (1304:13): [True: 1.71M, False: 17.3k]
  |  Branch (1304:31): [True: 43.1k, False: 1.66M]
  |  Branch (1304:46): [True: 251k, False: 1.41M]
  ------------------
 1305|       |            // let the others update at will
 1306|   294k|            ::Serialize(s, int32_t{0});
 1307|  1.43M|        else
 1308|  1.43M|            ::Serialize(s, txTo.vin[nInput].nSequence);
 1309|  1.72M|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE19SerializeScriptCodeI10HashWriterEEvRT_:
 1268|  17.3k|    void SerializeScriptCode(S &s) const {
 1269|  17.3k|        CScript::const_iterator it = scriptCode.begin();
 1270|  17.3k|        CScript::const_iterator itBegin = it;
 1271|  17.3k|        opcodetype opcode;
 1272|  17.3k|        unsigned int nCodeSeparators = 0;
 1273|   104k|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1273:16): [True: 86.8k, False: 17.3k]
  ------------------
 1274|  86.8k|            if (opcode == OP_CODESEPARATOR)
  ------------------
  |  Branch (1274:17): [True: 0, False: 86.8k]
  ------------------
 1275|      0|                nCodeSeparators++;
 1276|  86.8k|        }
 1277|  17.3k|        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
 1278|  17.3k|        it = itBegin;
 1279|   104k|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1279:16): [True: 86.8k, False: 17.3k]
  ------------------
 1280|  86.8k|            if (opcode == OP_CODESEPARATOR) {
  ------------------
  |  Branch (1280:17): [True: 0, False: 86.8k]
  ------------------
 1281|      0|                s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin - 1)}));
 1282|      0|                itBegin = it;
 1283|      0|            }
 1284|  86.8k|        }
 1285|  17.3k|        if (itBegin != scriptCode.end())
  ------------------
  |  Branch (1285:13): [True: 17.3k, False: 0]
  ------------------
 1286|  17.3k|            s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin)}));
 1287|  17.3k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE15SerializeOutputI10HashWriterEEvRT_j:
 1313|  64.4k|    void SerializeOutput(S &s, unsigned int nOutput) const {
 1314|  64.4k|        if (fHashSingle && nOutput != nIn)
  ------------------
  |  Branch (1314:13): [True: 21.1k, False: 43.2k]
  |  Branch (1314:28): [True: 20.6k, False: 459]
  ------------------
 1315|       |            // Do not lock-in the txout payee at other indices as txin
 1316|  20.6k|            ::Serialize(s, CTxOut());
 1317|  43.7k|        else
 1318|  43.7k|            ::Serialize(s, txTo.vout[nOutput]);
 1319|  64.4k|    }
_Z20SignatureHashSchnorrI12CTransactionEbR7uint256R19ScriptExecutionDataRKT_jh10SigVersionRK26PrecomputedTransactionData19MissingDataBehavior:
 1479|    479|{
 1480|    479|    uint8_t ext_flag, key_version;
 1481|    479|    switch (sigversion) {
 1482|    479|    case SigVersion::TAPROOT:
  ------------------
  |  Branch (1482:5): [True: 479, False: 0]
  ------------------
 1483|    479|        ext_flag = 0;
 1484|       |        // key_version is not used and left uninitialized.
 1485|    479|        break;
 1486|      0|    case SigVersion::TAPSCRIPT:
  ------------------
  |  Branch (1486:5): [True: 0, False: 479]
  ------------------
 1487|      0|        ext_flag = 1;
 1488|       |        // key_version must be 0 for now, representing the current version of
 1489|       |        // 32-byte public keys in the tapscript signature opcode execution.
 1490|       |        // An upgradable public key version (with a size not 32-byte) may
 1491|       |        // request a different key_version with a new sigversion.
 1492|      0|        key_version = 0;
 1493|      0|        break;
 1494|      0|    default:
  ------------------
  |  Branch (1494:5): [True: 0, False: 479]
  ------------------
 1495|      0|        assert(false);
 1496|    479|    }
 1497|    479|    assert(in_pos < tx_to.vin.size());
 1498|    479|    if (!(cache.m_bip341_taproot_ready && cache.m_spent_outputs_ready)) {
  ------------------
  |  Branch (1498:11): [True: 465, False: 14]
  |  Branch (1498:43): [True: 465, False: 0]
  ------------------
 1499|     14|        return HandleMissingData(mdb);
 1500|     14|    }
 1501|       |
 1502|    465|    HashWriter ss{HASHER_TAPSIGHASH};
 1503|       |
 1504|       |    // Epoch
 1505|    465|    static constexpr uint8_t EPOCH = 0;
 1506|    465|    ss << EPOCH;
 1507|       |
 1508|       |    // Hash type
 1509|    465|    const uint8_t output_type = (hash_type == SIGHASH_DEFAULT) ? SIGHASH_ALL : (hash_type & SIGHASH_OUTPUT_MASK); // Default (no sighash byte) is equivalent to SIGHASH_ALL
  ------------------
  |  Branch (1509:33): [True: 83, False: 382]
  ------------------
 1510|    465|    const uint8_t input_type = hash_type & SIGHASH_INPUT_MASK;
 1511|    465|    if (!(hash_type <= 0x03 || (hash_type >= 0x81 && hash_type <= 0x83))) return false;
  ------------------
  |  Branch (1511:11): [True: 444, False: 21]
  |  Branch (1511:33): [True: 16, False: 5]
  |  Branch (1511:54): [True: 8, False: 8]
  ------------------
 1512|    452|    ss << hash_type;
 1513|       |
 1514|       |    // Transaction level data
 1515|    452|    ss << tx_to.version;
 1516|    452|    ss << tx_to.nLockTime;
 1517|    452|    if (input_type != SIGHASH_ANYONECANPAY) {
  ------------------
  |  Branch (1517:9): [True: 444, False: 8]
  ------------------
 1518|    444|        ss << cache.m_prevouts_single_hash;
 1519|    444|        ss << cache.m_spent_amounts_single_hash;
 1520|    444|        ss << cache.m_spent_scripts_single_hash;
 1521|    444|        ss << cache.m_sequences_single_hash;
 1522|    444|    }
 1523|    452|    if (output_type == SIGHASH_ALL) {
  ------------------
  |  Branch (1523:9): [True: 395, False: 57]
  ------------------
 1524|    395|        ss << cache.m_outputs_single_hash;
 1525|    395|    }
 1526|       |
 1527|       |    // Data about the input/prevout being spent
 1528|    452|    assert(execdata.m_annex_init);
 1529|    452|    const bool have_annex = execdata.m_annex_present;
 1530|    452|    const uint8_t spend_type = (ext_flag << 1) + (have_annex ? 1 : 0); // The low bit indicates whether an annex is present.
  ------------------
  |  Branch (1530:51): [True: 2, False: 450]
  ------------------
 1531|    452|    ss << spend_type;
 1532|    452|    if (input_type == SIGHASH_ANYONECANPAY) {
  ------------------
  |  Branch (1532:9): [True: 8, False: 444]
  ------------------
 1533|      8|        ss << tx_to.vin[in_pos].prevout;
 1534|      8|        ss << cache.m_spent_outputs[in_pos];
 1535|      8|        ss << tx_to.vin[in_pos].nSequence;
 1536|    444|    } else {
 1537|    444|        ss << in_pos;
 1538|    444|    }
 1539|    452|    if (have_annex) {
  ------------------
  |  Branch (1539:9): [True: 2, False: 450]
  ------------------
 1540|      2|        ss << execdata.m_annex_hash;
 1541|      2|    }
 1542|       |
 1543|       |    // Data about the output (if only one).
 1544|    452|    if (output_type == SIGHASH_SINGLE) {
  ------------------
  |  Branch (1544:9): [True: 18, False: 434]
  ------------------
 1545|     18|        if (in_pos >= tx_to.vout.size()) return false;
  ------------------
  |  Branch (1545:13): [True: 5, False: 13]
  ------------------
 1546|     13|        if (!execdata.m_output_hash) {
  ------------------
  |  Branch (1546:13): [True: 13, False: 0]
  ------------------
 1547|     13|            HashWriter sha_single_output{};
 1548|     13|            sha_single_output << tx_to.vout[in_pos];
 1549|     13|            execdata.m_output_hash = sha_single_output.GetSHA256();
 1550|     13|        }
 1551|     13|        ss << execdata.m_output_hash.value();
 1552|     13|    }
 1553|       |
 1554|       |    // Additional data for BIP 342 signatures
 1555|    447|    if (sigversion == SigVersion::TAPSCRIPT) {
  ------------------
  |  Branch (1555:9): [True: 0, False: 447]
  ------------------
 1556|      0|        assert(execdata.m_tapleaf_hash_init);
 1557|      0|        ss << execdata.m_tapleaf_hash;
 1558|      0|        ss << key_version;
 1559|      0|        assert(execdata.m_codeseparator_pos_init);
 1560|      0|        ss << execdata.m_codeseparator_pos;
 1561|      0|    }
 1562|       |
 1563|    447|    hash_out = ss.GetSHA256();
 1564|    447|    return true;
 1565|    447|}
_Z13SignatureHashI19CMutableTransactionE7uint256RK7CScriptRKT_jiRKl10SigVersionPK26PrecomputedTransactionData:
 1569|  56.9k|{
 1570|  56.9k|    assert(nIn < txTo.vin.size());
 1571|       |
 1572|  56.9k|    if (sigversion == SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (1572:9): [True: 13.8k, False: 43.1k]
  ------------------
 1573|  13.8k|        uint256 hashPrevouts;
 1574|  13.8k|        uint256 hashSequence;
 1575|  13.8k|        uint256 hashOutputs;
 1576|  13.8k|        const bool cacheready = cache && cache->m_bip143_segwit_ready;
  ------------------
  |  Branch (1576:33): [True: 13.5k, False: 298]
  |  Branch (1576:42): [True: 13.5k, False: 0]
  ------------------
 1577|       |
 1578|  13.8k|        if (!(nHashType & SIGHASH_ANYONECANPAY)) {
  ------------------
  |  Branch (1578:13): [True: 12.3k, False: 1.40k]
  ------------------
 1579|  12.3k|            hashPrevouts = cacheready ? cache->hashPrevouts : SHA256Uint256(GetPrevoutsSHA256(txTo));
  ------------------
  |  Branch (1579:28): [True: 12.2k, False: 171]
  ------------------
 1580|  12.3k|        }
 1581|       |
 1582|  13.8k|        if (!(nHashType & SIGHASH_ANYONECANPAY) && (nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1582:13): [True: 12.3k, False: 1.40k]
  |  Branch (1582:52): [True: 5.95k, False: 6.44k]
  |  Branch (1582:92): [True: 5.32k, False: 623]
  ------------------
 1583|  5.32k|            hashSequence = cacheready ? cache->hashSequence : SHA256Uint256(GetSequencesSHA256(txTo));
  ------------------
  |  Branch (1583:28): [True: 5.17k, False: 152]
  ------------------
 1584|  5.32k|        }
 1585|       |
 1586|       |
 1587|  13.8k|        if ((nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1587:13): [True: 6.93k, False: 6.86k]
  |  Branch (1587:53): [True: 6.11k, False: 826]
  ------------------
 1588|  6.11k|            hashOutputs = cacheready ? cache->hashOutputs : SHA256Uint256(GetOutputsSHA256(txTo));
  ------------------
  |  Branch (1588:27): [True: 5.83k, False: 271]
  ------------------
 1589|  7.69k|        } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nIn < txTo.vout.size()) {
  ------------------
  |  Branch (1589:20): [True: 6.86k, False: 826]
  |  Branch (1589:60): [True: 2.35k, False: 4.51k]
  ------------------
 1590|  2.35k|            HashWriter ss{};
 1591|  2.35k|            ss << txTo.vout[nIn];
 1592|  2.35k|            hashOutputs = ss.GetHash();
 1593|  2.35k|        }
 1594|       |
 1595|  13.8k|        HashWriter ss{};
 1596|       |        // Version
 1597|  13.8k|        ss << txTo.version;
 1598|       |        // Input prevouts/nSequence (none/all, depending on flags)
 1599|  13.8k|        ss << hashPrevouts;
 1600|  13.8k|        ss << hashSequence;
 1601|       |        // The input being signed (replacing the scriptSig with scriptCode + amount)
 1602|       |        // The prevout may already be contained in hashPrevout, and the nSequence
 1603|       |        // may already be contain in hashSequence.
 1604|  13.8k|        ss << txTo.vin[nIn].prevout;
 1605|  13.8k|        ss << scriptCode;
 1606|  13.8k|        ss << amount;
 1607|  13.8k|        ss << txTo.vin[nIn].nSequence;
 1608|       |        // Outputs (none/one/all, depending on flags)
 1609|  13.8k|        ss << hashOutputs;
 1610|       |        // Locktime
 1611|  13.8k|        ss << txTo.nLockTime;
 1612|       |        // Sighash type
 1613|  13.8k|        ss << nHashType;
 1614|       |
 1615|  13.8k|        return ss.GetHash();
 1616|  13.8k|    }
 1617|       |
 1618|       |    // Check for invalid use of SIGHASH_SINGLE
 1619|  43.1k|    if ((nHashType & 0x1f) == SIGHASH_SINGLE) {
  ------------------
  |  Branch (1619:9): [True: 1.92k, False: 41.2k]
  ------------------
 1620|  1.92k|        if (nIn >= txTo.vout.size()) {
  ------------------
  |  Branch (1620:13): [True: 978, False: 944]
  ------------------
 1621|       |            //  nOut out of range
 1622|    978|            return uint256::ONE;
 1623|    978|        }
 1624|  1.92k|    }
 1625|       |
 1626|       |    // Wrapper to serialize only the necessary parts of the transaction being signed
 1627|  42.1k|    CTransactionSignatureSerializer<T> txTmp(txTo, scriptCode, nIn, nHashType);
 1628|       |
 1629|       |    // Serialize and hash
 1630|  42.1k|    HashWriter ss{};
 1631|  42.1k|    ss << txTmp << nHashType;
 1632|  42.1k|    return ss.GetHash();
 1633|  43.1k|}
interpreter.cpp:_ZN12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionEC2ERKS1_RK7CScriptji:
 1261|  42.1k|        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
 1262|  42.1k|        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
 1263|  42.1k|        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
 1264|  42.1k|        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE9SerializeI10HashWriterEEvRT_:
 1323|  42.1k|    void Serialize(S &s) const {
 1324|       |        // Serialize version
 1325|  42.1k|        ::Serialize(s, txTo.version);
 1326|       |        // Serialize vin
 1327|  42.1k|        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
  ------------------
  |  Branch (1327:32): [True: 1.53k, False: 40.6k]
  ------------------
 1328|  42.1k|        ::WriteCompactSize(s, nInputs);
 1329|  4.03M|        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
  ------------------
  |  Branch (1329:39): [True: 3.99M, False: 42.1k]
  ------------------
 1330|  3.99M|             SerializeInput(s, nInput);
 1331|       |        // Serialize vout
 1332|  42.1k|        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
  ------------------
  |  Branch (1332:33): [True: 5.37k, False: 36.8k]
  |  Branch (1332:50): [True: 944, False: 35.8k]
  ------------------
 1333|  42.1k|        ::WriteCompactSize(s, nOutputs);
 1334|   190k|        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
  ------------------
  |  Branch (1334:40): [True: 147k, False: 42.1k]
  ------------------
 1335|   147k|             SerializeOutput(s, nOutput);
 1336|       |        // Serialize nLockTime
 1337|  42.1k|        ::Serialize(s, txTo.nLockTime);
 1338|  42.1k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE14SerializeInputI10HashWriterEEvRT_j:
 1291|  3.99M|    void SerializeInput(S &s, unsigned int nInput) const {
 1292|       |        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
 1293|  3.99M|        if (fAnyoneCanPay)
  ------------------
  |  Branch (1293:13): [True: 1.53k, False: 3.99M]
  ------------------
 1294|  1.53k|            nInput = nIn;
 1295|       |        // Serialize the prevout
 1296|  3.99M|        ::Serialize(s, txTo.vin[nInput].prevout);
 1297|       |        // Serialize the script
 1298|  3.99M|        if (nInput != nIn)
  ------------------
  |  Branch (1298:13): [True: 3.95M, False: 42.1k]
  ------------------
 1299|       |            // Blank out other inputs' signatures
 1300|  3.95M|            ::Serialize(s, CScript());
 1301|  42.1k|        else
 1302|  42.1k|            SerializeScriptCode(s);
 1303|       |        // Serialize the nSequence
 1304|  3.99M|        if (nInput != nIn && (fHashSingle || fHashNone))
  ------------------
  |  Branch (1304:13): [True: 3.95M, False: 42.1k]
  |  Branch (1304:31): [True: 86.3k, False: 3.86M]
  |  Branch (1304:46): [True: 502k, False: 3.36M]
  ------------------
 1305|       |            // let the others update at will
 1306|   589k|            ::Serialize(s, int32_t{0});
 1307|  3.40M|        else
 1308|  3.40M|            ::Serialize(s, txTo.vin[nInput].nSequence);
 1309|  3.99M|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE19SerializeScriptCodeI10HashWriterEEvRT_:
 1268|  42.1k|    void SerializeScriptCode(S &s) const {
 1269|  42.1k|        CScript::const_iterator it = scriptCode.begin();
 1270|  42.1k|        CScript::const_iterator itBegin = it;
 1271|  42.1k|        opcodetype opcode;
 1272|  42.1k|        unsigned int nCodeSeparators = 0;
 1273|   101M|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1273:16): [True: 100M, False: 42.1k]
  ------------------
 1274|   100M|            if (opcode == OP_CODESEPARATOR)
  ------------------
  |  Branch (1274:17): [True: 243, False: 100M]
  ------------------
 1275|    243|                nCodeSeparators++;
 1276|   100M|        }
 1277|  42.1k|        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
 1278|  42.1k|        it = itBegin;
 1279|   101M|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1279:16): [True: 100M, False: 42.1k]
  ------------------
 1280|   100M|            if (opcode == OP_CODESEPARATOR) {
  ------------------
  |  Branch (1280:17): [True: 243, False: 100M]
  ------------------
 1281|    243|                s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin - 1)}));
 1282|    243|                itBegin = it;
 1283|    243|            }
 1284|   100M|        }
 1285|  42.1k|        if (itBegin != scriptCode.end())
  ------------------
  |  Branch (1285:13): [True: 41.6k, False: 544]
  ------------------
 1286|  41.6k|            s.write(AsBytes(Span{&itBegin[0], size_t(it - itBegin)}));
 1287|  42.1k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE15SerializeOutputI10HashWriterEEvRT_j:
 1313|   147k|    void SerializeOutput(S &s, unsigned int nOutput) const {
 1314|   147k|        if (fHashSingle && nOutput != nIn)
  ------------------
  |  Branch (1314:13): [True: 42.3k, False: 105k]
  |  Branch (1314:28): [True: 41.3k, False: 944]
  ------------------
 1315|       |            // Do not lock-in the txout payee at other indices as txin
 1316|  41.3k|            ::Serialize(s, CTxOut());
 1317|   106k|        else
 1318|   106k|            ::Serialize(s, txTo.vout[nOutput]);
 1319|   147k|    }

_ZNK20BaseSignatureChecker19CheckECDSASignatureERKNSt3__16vectorIhNS0_9allocatorIhEEEES6_RK7CScript10SigVersion:
  249|      6|    {
  250|      6|        return false;
  251|      6|    }
_ZN25DeferringSignatureCheckerC2ERK20BaseSignatureChecker:
  315|  92.4k|    DeferringSignatureChecker(const BaseSignatureChecker& checker) : m_checker(checker) {}
_ZNK25DeferringSignatureChecker21CheckSchnorrSignatureE4SpanIKhES2_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
  323|  1.53k|    {
  324|  1.53k|        return m_checker.CheckSchnorrSignature(sig, pubkey, sigversion, execdata, serror);
  325|  1.53k|    }
_ZNK25DeferringSignatureChecker13CheckLockTimeERK10CScriptNum:
  328|  2.88k|    {
  329|  2.88k|        return m_checker.CheckLockTime(nLockTime);
  330|  2.88k|    }
_ZNK25DeferringSignatureChecker13CheckSequenceERK10CScriptNum:
  332|  5.32k|    {
  333|  5.32k|        return m_checker.CheckSequence(nSequence);
  334|  5.32k|    }
_ZN20BaseSignatureCheckerD2Ev:
  268|   269k|    virtual ~BaseSignatureChecker() = default;
_ZN26PrecomputedTransactionDataC2Ev:
  174|  8.06k|    PrecomputedTransactionData() = default;
_ZN34GenericTransactionSignatureCheckerI19CMutableTransactionEC2EPKS0_jRKlRK26PrecomputedTransactionData19MissingDataBehavior:
  299|  89.2k|    GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, const PrecomputedTransactionData& txdataIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(&txdataIn) {}
_ZN34GenericTransactionSignatureCheckerI12CTransactionEC2EPKS0_jRKlRK26PrecomputedTransactionData19MissingDataBehavior:
  299|  88.0k|    GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, const PrecomputedTransactionData& txdataIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(&txdataIn) {}
_ZN34GenericTransactionSignatureCheckerI19CMutableTransactionEC2EPKS0_jRKl19MissingDataBehavior:
  298|  95.4k|    GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(nullptr) {}

_ZN13KeyOriginInfo16SerializationOpsI10DataStreamS_17ActionUnserializeEEvRT0_RT_T1_:
   40|  16.8k|    SERIALIZE_METHODS(KeyOriginInfo, obj) { READWRITE(obj.fingerprint, obj.path); }
  ------------------
  |  |  156|  16.8k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------

_ZN10miniscript8internal12SanitizeTypeENS_4TypeE:
   19|    501|Type SanitizeType(Type e) {
   20|    501|    int num_types = (e << "K"_mst) + (e << "V"_mst) + (e << "B"_mst) + (e << "W"_mst);
   21|    501|    if (num_types == 0) return ""_mst; // No valid type, don't care about the rest
  ------------------
  |  Branch (21:9): [True: 17, False: 484]
  ------------------
   22|    484|    assert(num_types == 1); // K, V, B, W all conflict with each other
   23|    484|    assert(!(e << "z"_mst) || !(e << "o"_mst)); // z conflicts with o
   24|    484|    assert(!(e << "n"_mst) || !(e << "z"_mst)); // n conflicts with z
   25|    484|    assert(!(e << "n"_mst) || !(e << "W"_mst)); // n conflicts with W
   26|    484|    assert(!(e << "V"_mst) || !(e << "d"_mst)); // V conflicts with d
   27|    484|    assert(!(e << "K"_mst) ||  (e << "u"_mst)); // K implies u
   28|    484|    assert(!(e << "V"_mst) || !(e << "u"_mst)); // V conflicts with u
   29|    484|    assert(!(e << "e"_mst) || !(e << "f"_mst)); // e conflicts with f
   30|    484|    assert(!(e << "e"_mst) ||  (e << "d"_mst)); // e implies d
   31|    484|    assert(!(e << "V"_mst) || !(e << "e"_mst)); // V conflicts with e
   32|    484|    assert(!(e << "d"_mst) || !(e << "f"_mst)); // d conflicts with f
   33|    484|    assert(!(e << "V"_mst) ||  (e << "f"_mst)); // V implies f
   34|    484|    assert(!(e << "K"_mst) ||  (e << "s"_mst)); // K implies s
   35|    484|    assert(!(e << "z"_mst) ||  (e << "m"_mst)); // z implies m
   36|    484|    return e;
   37|    484|}
_ZN10miniscript8internal11ComputeTypeENS_8FragmentENS_4TypeES2_S2_RKNSt3__16vectorIS2_NS3_9allocatorIS2_EEEEjmmmNS_17MiniscriptContextE:
   40|    501|                 size_t data_size, size_t n_subs, size_t n_keys, MiniscriptContext ms_ctx) {
   41|       |    // Sanity check on data
   42|    501|    if (fragment == Fragment::SHA256 || fragment == Fragment::HASH256) {
  ------------------
  |  Branch (42:9): [True: 0, False: 501]
  |  Branch (42:41): [True: 0, False: 501]
  ------------------
   43|      0|        assert(data_size == 32);
   44|    501|    } else if (fragment == Fragment::RIPEMD160 || fragment == Fragment::HASH160) {
  ------------------
  |  Branch (44:16): [True: 0, False: 501]
  |  Branch (44:51): [True: 0, False: 501]
  ------------------
   45|      0|        assert(data_size == 20);
   46|    501|    } else {
   47|    501|        assert(data_size == 0);
   48|    501|    }
   49|       |    // Sanity check on k
   50|    501|    if (fragment == Fragment::OLDER || fragment == Fragment::AFTER) {
  ------------------
  |  Branch (50:9): [True: 0, False: 501]
  |  Branch (50:40): [True: 0, False: 501]
  ------------------
   51|      0|        assert(k >= 1 && k < 0x80000000UL);
   52|    501|    } else if (fragment == Fragment::MULTI || fragment == Fragment::MULTI_A) {
  ------------------
  |  Branch (52:16): [True: 0, False: 501]
  |  Branch (52:47): [True: 0, False: 501]
  ------------------
   53|      0|        assert(k >= 1 && k <= n_keys);
   54|    501|    } else if (fragment == Fragment::THRESH) {
  ------------------
  |  Branch (54:16): [True: 0, False: 501]
  ------------------
   55|      0|        assert(k >= 1 && k <= n_subs);
   56|    501|    } else {
   57|    501|        assert(k == 0);
   58|    501|    }
   59|       |    // Sanity check on subs
   60|    501|    if (fragment == Fragment::AND_V || fragment == Fragment::AND_B || fragment == Fragment::OR_B ||
  ------------------
  |  Branch (60:9): [True: 17, False: 484]
  |  Branch (60:40): [True: 0, False: 484]
  |  Branch (60:71): [True: 0, False: 484]
  ------------------
   61|    501|        fragment == Fragment::OR_C || fragment == Fragment::OR_I || fragment == Fragment::OR_D) {
  ------------------
  |  Branch (61:9): [True: 0, False: 484]
  |  Branch (61:39): [True: 0, False: 484]
  |  Branch (61:69): [True: 0, False: 484]
  ------------------
   62|     17|        assert(n_subs == 2);
   63|    484|    } else if (fragment == Fragment::ANDOR) {
  ------------------
  |  Branch (63:16): [True: 0, False: 484]
  ------------------
   64|      0|        assert(n_subs == 3);
   65|    484|    } else if (fragment == Fragment::WRAP_A || fragment == Fragment::WRAP_S || fragment == Fragment::WRAP_C ||
  ------------------
  |  Branch (65:16): [True: 0, False: 484]
  |  Branch (65:48): [True: 0, False: 484]
  |  Branch (65:80): [True: 0, False: 484]
  ------------------
   66|    484|               fragment == Fragment::WRAP_D || fragment == Fragment::WRAP_V || fragment == Fragment::WRAP_J ||
  ------------------
  |  Branch (66:16): [True: 0, False: 484]
  |  Branch (66:48): [True: 0, False: 484]
  |  Branch (66:80): [True: 0, False: 484]
  ------------------
   67|    484|               fragment == Fragment::WRAP_N) {
  ------------------
  |  Branch (67:16): [True: 0, False: 484]
  ------------------
   68|      0|        assert(n_subs == 1);
   69|    484|    } else if (fragment != Fragment::THRESH) {
  ------------------
  |  Branch (69:16): [True: 484, False: 0]
  ------------------
   70|    484|        assert(n_subs == 0);
   71|    484|    }
   72|       |    // Sanity check on keys
   73|    501|    if (fragment == Fragment::PK_K || fragment == Fragment::PK_H) {
  ------------------
  |  Branch (73:9): [True: 0, False: 501]
  |  Branch (73:39): [True: 0, False: 501]
  ------------------
   74|      0|        assert(n_keys == 1);
   75|    501|    } else if (fragment == Fragment::MULTI) {
  ------------------
  |  Branch (75:16): [True: 0, False: 501]
  ------------------
   76|      0|        assert(n_keys >= 1 && n_keys <= MAX_PUBKEYS_PER_MULTISIG);
   77|      0|        assert(!IsTapscript(ms_ctx));
   78|    501|    } else if (fragment == Fragment::MULTI_A) {
  ------------------
  |  Branch (78:16): [True: 0, False: 501]
  ------------------
   79|      0|        assert(n_keys >= 1 && n_keys <= MAX_PUBKEYS_PER_MULTI_A);
   80|      0|        assert(IsTapscript(ms_ctx));
   81|    501|    } else {
   82|    501|        assert(n_keys == 0);
   83|    501|    }
   84|       |
   85|       |    // Below is the per-fragment logic for computing the expression types.
   86|       |    // It heavily relies on Type's << operator (where "X << a_mst" means
   87|       |    // "X has all properties listed in a").
   88|    501|    switch (fragment) {
  ------------------
  |  Branch (88:13): [True: 0, False: 501]
  ------------------
   89|      0|        case Fragment::PK_K: return "Konudemsxk"_mst;
  ------------------
  |  Branch (89:9): [True: 0, False: 501]
  ------------------
   90|      0|        case Fragment::PK_H: return "Knudemsxk"_mst;
  ------------------
  |  Branch (90:9): [True: 0, False: 501]
  ------------------
   91|      0|        case Fragment::OLDER: return
  ------------------
  |  Branch (91:9): [True: 0, False: 501]
  ------------------
   92|      0|            "g"_mst.If(k & CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG) |
   93|      0|            "h"_mst.If(!(k & CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG)) |
   94|      0|            "Bzfmxk"_mst;
   95|      0|        case Fragment::AFTER: return
  ------------------
  |  Branch (95:9): [True: 0, False: 501]
  ------------------
   96|      0|            "i"_mst.If(k >= LOCKTIME_THRESHOLD) |
   97|      0|            "j"_mst.If(k < LOCKTIME_THRESHOLD) |
   98|      0|            "Bzfmxk"_mst;
   99|      0|        case Fragment::SHA256: return "Bonudmk"_mst;
  ------------------
  |  Branch (99:9): [True: 0, False: 501]
  ------------------
  100|      0|        case Fragment::RIPEMD160: return "Bonudmk"_mst;
  ------------------
  |  Branch (100:9): [True: 0, False: 501]
  ------------------
  101|      0|        case Fragment::HASH256: return "Bonudmk"_mst;
  ------------------
  |  Branch (101:9): [True: 0, False: 501]
  ------------------
  102|      0|        case Fragment::HASH160: return "Bonudmk"_mst;
  ------------------
  |  Branch (102:9): [True: 0, False: 501]
  ------------------
  103|      0|        case Fragment::JUST_1: return "Bzufmxk"_mst;
  ------------------
  |  Branch (103:9): [True: 0, False: 501]
  ------------------
  104|    484|        case Fragment::JUST_0: return "Bzudemsxk"_mst;
  ------------------
  |  Branch (104:9): [True: 484, False: 17]
  ------------------
  105|      0|        case Fragment::WRAP_A: return
  ------------------
  |  Branch (105:9): [True: 0, False: 501]
  ------------------
  106|      0|            "W"_mst.If(x << "B"_mst) | // W=B_x
  107|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  108|      0|            (x & "udfems"_mst) | // u=u_x, d=d_x, f=f_x, e=e_x, m=m_x, s=s_x
  109|      0|            "x"_mst; // x
  110|      0|        case Fragment::WRAP_S: return
  ------------------
  |  Branch (110:9): [True: 0, False: 501]
  ------------------
  111|      0|            "W"_mst.If(x << "Bo"_mst) | // W=B_x*o_x
  112|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  113|      0|            (x & "udfemsx"_mst); // u=u_x, d=d_x, f=f_x, e=e_x, m=m_x, s=s_x, x=x_x
  114|      0|        case Fragment::WRAP_C: return
  ------------------
  |  Branch (114:9): [True: 0, False: 501]
  ------------------
  115|      0|            "B"_mst.If(x << "K"_mst) | // B=K_x
  116|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  117|      0|            (x & "ondfem"_mst) | // o=o_x, n=n_x, d=d_x, f=f_x, e=e_x, m=m_x
  118|      0|            "us"_mst; // u, s
  119|      0|        case Fragment::WRAP_D: return
  ------------------
  |  Branch (119:9): [True: 0, False: 501]
  ------------------
  120|      0|            "B"_mst.If(x << "Vz"_mst) | // B=V_x*z_x
  121|      0|            "o"_mst.If(x << "z"_mst) | // o=z_x
  122|      0|            "e"_mst.If(x << "f"_mst) | // e=f_x
  123|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  124|      0|            (x & "ms"_mst) | // m=m_x, s=s_x
  125|       |            // NOTE: 'd:' is 'u' under Tapscript but not P2WSH as MINIMALIF is only a policy rule there.
  126|      0|            "u"_mst.If(IsTapscript(ms_ctx)) |
  127|      0|            "ndx"_mst; // n, d, x
  128|      0|        case Fragment::WRAP_V: return
  ------------------
  |  Branch (128:9): [True: 0, False: 501]
  ------------------
  129|      0|            "V"_mst.If(x << "B"_mst) | // V=B_x
  130|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  131|      0|            (x & "zonms"_mst) | // z=z_x, o=o_x, n=n_x, m=m_x, s=s_x
  132|      0|            "fx"_mst; // f, x
  133|      0|        case Fragment::WRAP_J: return
  ------------------
  |  Branch (133:9): [True: 0, False: 501]
  ------------------
  134|      0|            "B"_mst.If(x << "Bn"_mst) | // B=B_x*n_x
  135|      0|            "e"_mst.If(x << "f"_mst) | // e=f_x
  136|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  137|      0|            (x & "oums"_mst) | // o=o_x, u=u_x, m=m_x, s=s_x
  138|      0|            "ndx"_mst; // n, d, x
  139|      0|        case Fragment::WRAP_N: return
  ------------------
  |  Branch (139:9): [True: 0, False: 501]
  ------------------
  140|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  141|      0|            (x & "Bzondfems"_mst) | // B=B_x, z=z_x, o=o_x, n=n_x, d=d_x, f=f_x, e=e_x, m=m_x, s=s_x
  142|      0|            "ux"_mst; // u, x
  143|     17|        case Fragment::AND_V: return
  ------------------
  |  Branch (143:9): [True: 17, False: 484]
  ------------------
  144|     17|            (y & "KVB"_mst).If(x << "V"_mst) | // B=V_x*B_y, V=V_x*V_y, K=V_x*K_y
  145|     17|            (x & "n"_mst) | (y & "n"_mst).If(x << "z"_mst) | // n=n_x+z_x*n_y
  146|     17|            ((x | y) & "o"_mst).If((x | y) << "z"_mst) | // o=o_x*z_y+z_x*o_y
  147|     17|            (x & y & "dmz"_mst) | // d=d_x*d_y, m=m_x*m_y, z=z_x*z_y
  148|     17|            ((x | y) & "s"_mst) | // s=s_x+s_y
  149|     17|            "f"_mst.If((y << "f"_mst) || (x << "s"_mst)) | // f=f_y+s_x
  ------------------
  |  Branch (149:24): [True: 0, False: 17]
  |  Branch (149:42): [True: 17, False: 0]
  ------------------
  150|     17|            (y & "ux"_mst) | // u=u_y, x=x_y
  151|     17|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  152|     17|            "k"_mst.If(((x & y) << "k"_mst) &&
  ------------------
  |  Branch (152:24): [True: 17, False: 0]
  ------------------
  153|     17|                !(((x << "g"_mst) && (y << "h"_mst)) ||
  ------------------
  |  Branch (153:20): [True: 0, False: 17]
  |  Branch (153:38): [True: 0, False: 0]
  ------------------
  154|     17|                ((x << "h"_mst) && (y << "g"_mst)) ||
  ------------------
  |  Branch (154:18): [True: 0, False: 17]
  |  Branch (154:36): [True: 0, False: 0]
  ------------------
  155|     17|                ((x << "i"_mst) && (y << "j"_mst)) ||
  ------------------
  |  Branch (155:18): [True: 0, False: 17]
  |  Branch (155:36): [True: 0, False: 0]
  ------------------
  156|     17|                ((x << "j"_mst) && (y << "i"_mst)))); // k=k_x*k_y*!(g_x*h_y + h_x*g_y + i_x*j_y + j_x*i_y)
  ------------------
  |  Branch (156:18): [True: 0, False: 17]
  |  Branch (156:36): [True: 0, False: 0]
  ------------------
  157|      0|        case Fragment::AND_B: return
  ------------------
  |  Branch (157:9): [True: 0, False: 501]
  ------------------
  158|      0|            (x & "B"_mst).If(y << "W"_mst) | // B=B_x*W_y
  159|      0|            ((x | y) & "o"_mst).If((x | y) << "z"_mst) | // o=o_x*z_y+z_x*o_y
  160|      0|            (x & "n"_mst) | (y & "n"_mst).If(x << "z"_mst) | // n=n_x+z_x*n_y
  161|      0|            (x & y & "e"_mst).If((x & y) << "s"_mst) | // e=e_x*e_y*s_x*s_y
  162|      0|            (x & y & "dzm"_mst) | // d=d_x*d_y, z=z_x*z_y, m=m_x*m_y
  163|      0|            "f"_mst.If(((x & y) << "f"_mst) || (x << "sf"_mst) || (y << "sf"_mst)) | // f=f_x*f_y + f_x*s_x + f_y*s_y
  ------------------
  |  Branch (163:24): [True: 0, False: 0]
  |  Branch (163:48): [True: 0, False: 0]
  |  Branch (163:67): [True: 0, False: 0]
  ------------------
  164|      0|            ((x | y) & "s"_mst) | // s=s_x+s_y
  165|      0|            "ux"_mst | // u, x
  166|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  167|      0|            "k"_mst.If(((x & y) << "k"_mst) &&
  ------------------
  |  Branch (167:24): [True: 0, False: 0]
  ------------------
  168|      0|                !(((x << "g"_mst) && (y << "h"_mst)) ||
  ------------------
  |  Branch (168:20): [True: 0, False: 0]
  |  Branch (168:38): [True: 0, False: 0]
  ------------------
  169|      0|                ((x << "h"_mst) && (y << "g"_mst)) ||
  ------------------
  |  Branch (169:18): [True: 0, False: 0]
  |  Branch (169:36): [True: 0, False: 0]
  ------------------
  170|      0|                ((x << "i"_mst) && (y << "j"_mst)) ||
  ------------------
  |  Branch (170:18): [True: 0, False: 0]
  |  Branch (170:36): [True: 0, False: 0]
  ------------------
  171|      0|                ((x << "j"_mst) && (y << "i"_mst)))); // k=k_x*k_y*!(g_x*h_y + h_x*g_y + i_x*j_y + j_x*i_y)
  ------------------
  |  Branch (171:18): [True: 0, False: 0]
  |  Branch (171:36): [True: 0, False: 0]
  ------------------
  172|      0|        case Fragment::OR_B: return
  ------------------
  |  Branch (172:9): [True: 0, False: 501]
  ------------------
  173|      0|            "B"_mst.If(x << "Bd"_mst && y << "Wd"_mst) | // B=B_x*d_x*W_x*d_y
  ------------------
  |  Branch (173:24): [True: 0, False: 0]
  |  Branch (173:41): [True: 0, False: 0]
  ------------------
  174|      0|            ((x | y) & "o"_mst).If((x | y) << "z"_mst) | // o=o_x*z_y+z_x*o_y
  175|      0|            (x & y & "m"_mst).If((x | y) << "s"_mst && (x & y) << "e"_mst) | // m=m_x*m_y*e_x*e_y*(s_x+s_y)
  ------------------
  |  Branch (175:34): [True: 0, False: 0]
  |  Branch (175:56): [True: 0, False: 0]
  ------------------
  176|      0|            (x & y & "zse"_mst) | // z=z_x*z_y, s=s_x*s_y, e=e_x*e_y
  177|      0|            "dux"_mst | // d, u, x
  178|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  179|      0|            (x & y & "k"_mst); // k=k_x*k_y
  180|      0|        case Fragment::OR_D: return
  ------------------
  |  Branch (180:9): [True: 0, False: 501]
  ------------------
  181|      0|            (y & "B"_mst).If(x << "Bdu"_mst) | // B=B_y*B_x*d_x*u_x
  182|      0|            (x & "o"_mst).If(y << "z"_mst) | // o=o_x*z_y
  183|      0|            (x & y & "m"_mst).If(x << "e"_mst && (x | y) << "s"_mst) | // m=m_x*m_y*e_x*(s_x+s_y)
  ------------------
  |  Branch (183:34): [True: 0, False: 0]
  |  Branch (183:50): [True: 0, False: 0]
  ------------------
  184|      0|            (x & y & "zs"_mst) | // z=z_x*z_y, s=s_x*s_y
  185|      0|            (y & "ufde"_mst) | // u=u_y, f=f_y, d=d_y, e=e_y
  186|      0|            "x"_mst | // x
  187|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  188|      0|            (x & y & "k"_mst); // k=k_x*k_y
  189|      0|        case Fragment::OR_C: return
  ------------------
  |  Branch (189:9): [True: 0, False: 501]
  ------------------
  190|      0|            (y & "V"_mst).If(x << "Bdu"_mst) | // V=V_y*B_x*u_x*d_x
  191|      0|            (x & "o"_mst).If(y << "z"_mst) | // o=o_x*z_y
  192|      0|            (x & y & "m"_mst).If(x << "e"_mst && (x | y) << "s"_mst) | // m=m_x*m_y*e_x*(s_x+s_y)
  ------------------
  |  Branch (192:34): [True: 0, False: 0]
  |  Branch (192:50): [True: 0, False: 0]
  ------------------
  193|      0|            (x & y & "zs"_mst) | // z=z_x*z_y, s=s_x*s_y
  194|      0|            "fx"_mst | // f, x
  195|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  196|      0|            (x & y & "k"_mst); // k=k_x*k_y
  197|      0|        case Fragment::OR_I: return
  ------------------
  |  Branch (197:9): [True: 0, False: 501]
  ------------------
  198|      0|            (x & y & "VBKufs"_mst) | // V=V_x*V_y, B=B_x*B_y, K=K_x*K_y, u=u_x*u_y, f=f_x*f_y, s=s_x*s_y
  199|      0|            "o"_mst.If((x & y) << "z"_mst) | // o=z_x*z_y
  200|      0|            ((x | y) & "e"_mst).If((x | y) << "f"_mst) | // e=e_x*f_y+f_x*e_y
  201|      0|            (x & y & "m"_mst).If((x | y) << "s"_mst) | // m=m_x*m_y*(s_x+s_y)
  202|      0|            ((x | y) & "d"_mst) | // d=d_x+d_y
  203|      0|            "x"_mst | // x
  204|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  205|      0|            (x & y & "k"_mst); // k=k_x*k_y
  206|      0|        case Fragment::ANDOR: return
  ------------------
  |  Branch (206:9): [True: 0, False: 501]
  ------------------
  207|      0|            (y & z & "BKV"_mst).If(x << "Bdu"_mst) | // B=B_x*d_x*u_x*B_y*B_z, K=B_x*d_x*u_x*K_y*K_z, V=B_x*d_x*u_x*V_y*V_z
  208|      0|            (x & y & z & "z"_mst) | // z=z_x*z_y*z_z
  209|      0|            ((x | (y & z)) & "o"_mst).If((x | (y & z)) << "z"_mst) | // o=o_x*z_y*z_z+z_x*o_y*o_z
  210|      0|            (y & z & "u"_mst) | // u=u_y*u_z
  211|      0|            (z & "f"_mst).If((x << "s"_mst) || (y << "f"_mst)) | // f=(s_x+f_y)*f_z
  ------------------
  |  Branch (211:30): [True: 0, False: 0]
  |  Branch (211:48): [True: 0, False: 0]
  ------------------
  212|      0|            (z & "d"_mst) | // d=d_z
  213|      0|            (z & "e"_mst).If(x << "s"_mst || y << "f"_mst) | // e=e_z*(s_x+f_y)
  ------------------
  |  Branch (213:30): [True: 0, False: 0]
  |  Branch (213:46): [True: 0, False: 0]
  ------------------
  214|      0|            (x & y & z & "m"_mst).If(x << "e"_mst && (x | y | z) << "s"_mst) | // m=m_x*m_y*m_z*e_x*(s_x+s_y+s_z)
  ------------------
  |  Branch (214:38): [True: 0, False: 0]
  |  Branch (214:54): [True: 0, False: 0]
  ------------------
  215|      0|            (z & (x | y) & "s"_mst) | // s=s_z*(s_x+s_y)
  216|      0|            "x"_mst | // x
  217|      0|            ((x | y | z) & "ghij"_mst) | // g=g_x+g_y+g_z, h=h_x+h_y+h_z, i=i_x+i_y+i_z, j=j_x+j_y_j_z
  218|      0|            "k"_mst.If(((x & y & z) << "k"_mst) &&
  ------------------
  |  Branch (218:24): [True: 0, False: 0]
  ------------------
  219|      0|                !(((x << "g"_mst) && (y << "h"_mst)) ||
  ------------------
  |  Branch (219:20): [True: 0, False: 0]
  |  Branch (219:38): [True: 0, False: 0]
  ------------------
  220|      0|                ((x << "h"_mst) && (y << "g"_mst)) ||
  ------------------
  |  Branch (220:18): [True: 0, False: 0]
  |  Branch (220:36): [True: 0, False: 0]
  ------------------
  221|      0|                ((x << "i"_mst) && (y << "j"_mst)) ||
  ------------------
  |  Branch (221:18): [True: 0, False: 0]
  |  Branch (221:36): [True: 0, False: 0]
  ------------------
  222|      0|                ((x << "j"_mst) && (y << "i"_mst)))); // k=k_x*k_y*k_z* !(g_x*h_y + h_x*g_y + i_x*j_y + j_x*i_y)
  ------------------
  |  Branch (222:18): [True: 0, False: 0]
  |  Branch (222:36): [True: 0, False: 0]
  ------------------
  223|      0|        case Fragment::MULTI: {
  ------------------
  |  Branch (223:9): [True: 0, False: 501]
  ------------------
  224|      0|            return "Bnudemsk"_mst;
  225|      0|        }
  226|      0|        case Fragment::MULTI_A: {
  ------------------
  |  Branch (226:9): [True: 0, False: 501]
  ------------------
  227|      0|            return "Budemsk"_mst;
  228|      0|        }
  229|      0|        case Fragment::THRESH: {
  ------------------
  |  Branch (229:9): [True: 0, False: 501]
  ------------------
  230|      0|            bool all_e = true;
  231|      0|            bool all_m = true;
  232|      0|            uint32_t args = 0;
  233|      0|            uint32_t num_s = 0;
  234|      0|            Type acc_tl = "k"_mst;
  235|      0|            for (size_t i = 0; i < sub_types.size(); ++i) {
  ------------------
  |  Branch (235:32): [True: 0, False: 0]
  ------------------
  236|      0|                Type t = sub_types[i];
  237|      0|                static constexpr auto WDU{"Wdu"_mst}, BDU{"Bdu"_mst};
  238|      0|                if (!(t << (i ? WDU : BDU))) return ""_mst; // Require Bdu, Wdu, Wdu, ...
  ------------------
  |  Branch (238:21): [True: 0, False: 0]
  |  Branch (238:29): [True: 0, False: 0]
  ------------------
  239|      0|                if (!(t << "e"_mst)) all_e = false;
  ------------------
  |  Branch (239:21): [True: 0, False: 0]
  ------------------
  240|      0|                if (!(t << "m"_mst)) all_m = false;
  ------------------
  |  Branch (240:21): [True: 0, False: 0]
  ------------------
  241|      0|                if (t << "s"_mst) num_s += 1;
  ------------------
  |  Branch (241:21): [True: 0, False: 0]
  ------------------
  242|      0|                args += (t << "z"_mst) ? 0 : (t << "o"_mst) ? 1 : 2;
  ------------------
  |  Branch (242:25): [True: 0, False: 0]
  |  Branch (242:46): [True: 0, False: 0]
  ------------------
  243|      0|                acc_tl = ((acc_tl | t) & "ghij"_mst) |
  244|       |                    // Thresh contains a combination of timelocks if it has threshold > 1 and
  245|       |                    // it contains two different children that have different types of timelocks
  246|       |                    // Note how if any of the children don't have "k", the parent also does not have "k"
  247|      0|                    "k"_mst.If(((acc_tl & t) << "k"_mst) && ((k <= 1) ||
  ------------------
  |  Branch (247:32): [True: 0, False: 0]
  |  Branch (247:62): [True: 0, False: 0]
  ------------------
  248|      0|                        ((k > 1) && !(((acc_tl << "g"_mst) && (t << "h"_mst)) ||
  ------------------
  |  Branch (248:26): [True: 0, False: 0]
  |  Branch (248:40): [True: 0, False: 0]
  |  Branch (248:63): [True: 0, False: 0]
  ------------------
  249|      0|                        ((acc_tl << "h"_mst) && (t << "g"_mst)) ||
  ------------------
  |  Branch (249:26): [True: 0, False: 0]
  |  Branch (249:49): [True: 0, False: 0]
  ------------------
  250|      0|                        ((acc_tl << "i"_mst) && (t << "j"_mst)) ||
  ------------------
  |  Branch (250:26): [True: 0, False: 0]
  |  Branch (250:49): [True: 0, False: 0]
  ------------------
  251|      0|                        ((acc_tl << "j"_mst) && (t << "i"_mst))))));
  ------------------
  |  Branch (251:26): [True: 0, False: 0]
  |  Branch (251:49): [True: 0, False: 0]
  ------------------
  252|      0|            }
  253|      0|            return "Bdu"_mst |
  254|      0|                   "z"_mst.If(args == 0) | // z=all z
  255|      0|                   "o"_mst.If(args == 1) | // o=all z except one o
  256|      0|                   "e"_mst.If(all_e && num_s == n_subs) | // e=all e and all s
  ------------------
  |  Branch (256:31): [True: 0, False: 0]
  |  Branch (256:40): [True: 0, False: 0]
  ------------------
  257|      0|                   "m"_mst.If(all_e && all_m && num_s >= n_subs - k) | // m=all e, >=(n-k) s
  ------------------
  |  Branch (257:31): [True: 0, False: 0]
  |  Branch (257:40): [True: 0, False: 0]
  |  Branch (257:49): [True: 0, False: 0]
  ------------------
  258|      0|                   "s"_mst.If(num_s >= n_subs - k + 1) |  // s= >=(n-k+1) s
  259|      0|                   acc_tl; // timelock info
  260|      0|            }
  261|    501|    }
  262|      0|    assert(false);
  263|      0|}
_ZN10miniscript8internal16ComputeScriptLenENS_8FragmentENS_4TypeEmjmmNS_17MiniscriptContextE:
  266|    501|                        size_t n_keys, MiniscriptContext ms_ctx) {
  267|    501|    switch (fragment) {
  ------------------
  |  Branch (267:13): [True: 0, False: 501]
  ------------------
  268|      0|        case Fragment::JUST_1:
  ------------------
  |  Branch (268:9): [True: 0, False: 501]
  ------------------
  269|    484|        case Fragment::JUST_0: return 1;
  ------------------
  |  Branch (269:9): [True: 484, False: 17]
  ------------------
  270|      0|        case Fragment::PK_K: return IsTapscript(ms_ctx) ? 33 : 34;
  ------------------
  |  Branch (270:9): [True: 0, False: 501]
  |  Branch (270:37): [True: 0, False: 0]
  ------------------
  271|      0|        case Fragment::PK_H: return 3 + 21;
  ------------------
  |  Branch (271:9): [True: 0, False: 501]
  ------------------
  272|      0|        case Fragment::OLDER:
  ------------------
  |  Branch (272:9): [True: 0, False: 501]
  ------------------
  273|      0|        case Fragment::AFTER: return 1 + BuildScript(k).size();
  ------------------
  |  Branch (273:9): [True: 0, False: 501]
  ------------------
  274|      0|        case Fragment::HASH256:
  ------------------
  |  Branch (274:9): [True: 0, False: 501]
  ------------------
  275|      0|        case Fragment::SHA256: return 4 + 2 + 33;
  ------------------
  |  Branch (275:9): [True: 0, False: 501]
  ------------------
  276|      0|        case Fragment::HASH160:
  ------------------
  |  Branch (276:9): [True: 0, False: 501]
  ------------------
  277|      0|        case Fragment::RIPEMD160: return 4 + 2 + 21;
  ------------------
  |  Branch (277:9): [True: 0, False: 501]
  ------------------
  278|      0|        case Fragment::MULTI: return 1 + BuildScript(n_keys).size() + BuildScript(k).size() + 34 * n_keys;
  ------------------
  |  Branch (278:9): [True: 0, False: 501]
  ------------------
  279|      0|        case Fragment::MULTI_A: return (1 + 32 + 1) * n_keys + BuildScript(k).size() + 1;
  ------------------
  |  Branch (279:9): [True: 0, False: 501]
  ------------------
  280|     17|        case Fragment::AND_V: return subsize;
  ------------------
  |  Branch (280:9): [True: 17, False: 484]
  ------------------
  281|      0|        case Fragment::WRAP_V: return subsize + (sub0typ << "x"_mst);
  ------------------
  |  Branch (281:9): [True: 0, False: 501]
  ------------------
  282|      0|        case Fragment::WRAP_S:
  ------------------
  |  Branch (282:9): [True: 0, False: 501]
  ------------------
  283|      0|        case Fragment::WRAP_C:
  ------------------
  |  Branch (283:9): [True: 0, False: 501]
  ------------------
  284|      0|        case Fragment::WRAP_N:
  ------------------
  |  Branch (284:9): [True: 0, False: 501]
  ------------------
  285|      0|        case Fragment::AND_B:
  ------------------
  |  Branch (285:9): [True: 0, False: 501]
  ------------------
  286|      0|        case Fragment::OR_B: return subsize + 1;
  ------------------
  |  Branch (286:9): [True: 0, False: 501]
  ------------------
  287|      0|        case Fragment::WRAP_A:
  ------------------
  |  Branch (287:9): [True: 0, False: 501]
  ------------------
  288|      0|        case Fragment::OR_C: return subsize + 2;
  ------------------
  |  Branch (288:9): [True: 0, False: 501]
  ------------------
  289|      0|        case Fragment::WRAP_D:
  ------------------
  |  Branch (289:9): [True: 0, False: 501]
  ------------------
  290|      0|        case Fragment::OR_D:
  ------------------
  |  Branch (290:9): [True: 0, False: 501]
  ------------------
  291|      0|        case Fragment::OR_I:
  ------------------
  |  Branch (291:9): [True: 0, False: 501]
  ------------------
  292|      0|        case Fragment::ANDOR: return subsize + 3;
  ------------------
  |  Branch (292:9): [True: 0, False: 501]
  ------------------
  293|      0|        case Fragment::WRAP_J: return subsize + 4;
  ------------------
  |  Branch (293:9): [True: 0, False: 501]
  ------------------
  294|      0|        case Fragment::THRESH: return subsize + n_subs + BuildScript(k).size();
  ------------------
  |  Branch (294:9): [True: 0, False: 501]
  ------------------
  295|    501|    }
  296|      0|    assert(false);
  297|      0|}
_ZN10miniscript8internal15DecomposeScriptERK7CScript:
  370|  2.06k|{
  371|  2.06k|    std::vector<Opcode> out;
  372|  2.06k|    CScript::const_iterator it = script.begin(), itend = script.end();
  373|  20.3k|    while (it != itend) {
  ------------------
  |  Branch (373:12): [True: 18.7k, False: 1.52k]
  ------------------
  374|  18.7k|        std::vector<unsigned char> push_data;
  375|  18.7k|        opcodetype opcode;
  376|  18.7k|        if (!script.GetOp(it, opcode, push_data)) {
  ------------------
  |  Branch (376:13): [True: 519, False: 18.2k]
  ------------------
  377|    519|            return {};
  378|  18.2k|        } else if (opcode >= OP_1 && opcode <= OP_16) {
  ------------------
  |  Branch (378:20): [True: 11.2k, False: 6.98k]
  |  Branch (378:38): [True: 8.76k, False: 2.50k]
  ------------------
  379|       |            // Deal with OP_n (GetOp does not turn them into pushes).
  380|  8.76k|            push_data.assign(1, CScript::DecodeOP_N(opcode));
  381|  9.49k|        } else if (opcode == OP_CHECKSIGVERIFY) {
  ------------------
  |  Branch (381:20): [True: 0, False: 9.49k]
  ------------------
  382|       |            // Decompose OP_CHECKSIGVERIFY into OP_CHECKSIG OP_VERIFY
  383|      0|            out.emplace_back(OP_CHECKSIG, std::vector<unsigned char>());
  384|      0|            opcode = OP_VERIFY;
  385|  9.49k|        } else if (opcode == OP_CHECKMULTISIGVERIFY) {
  ------------------
  |  Branch (385:20): [True: 2, False: 9.49k]
  ------------------
  386|       |            // Decompose OP_CHECKMULTISIGVERIFY into OP_CHECKMULTISIG OP_VERIFY
  387|      2|            out.emplace_back(OP_CHECKMULTISIG, std::vector<unsigned char>());
  388|      2|            opcode = OP_VERIFY;
  389|  9.49k|        } else if (opcode == OP_EQUALVERIFY) {
  ------------------
  |  Branch (389:20): [True: 15, False: 9.47k]
  ------------------
  390|       |            // Decompose OP_EQUALVERIFY into OP_EQUAL OP_VERIFY
  391|     15|            out.emplace_back(OP_EQUAL, std::vector<unsigned char>());
  392|     15|            opcode = OP_VERIFY;
  393|  9.47k|        } else if (opcode == OP_NUMEQUALVERIFY) {
  ------------------
  |  Branch (393:20): [True: 0, False: 9.47k]
  ------------------
  394|       |            // Decompose OP_NUMEQUALVERIFY into OP_NUMEQUAL OP_VERIFY
  395|      0|            out.emplace_back(OP_NUMEQUAL, std::vector<unsigned char>());
  396|      0|            opcode = OP_VERIFY;
  397|  9.47k|        } else if (IsPushdataOp(opcode)) {
  ------------------
  |  Branch (397:20): [True: 372, False: 9.10k]
  ------------------
  398|    372|            if (!CheckMinimalPush(push_data, opcode)) return {};
  ------------------
  |  Branch (398:17): [True: 23, False: 349]
  ------------------
  399|  9.10k|        } else if (it != itend && (opcode == OP_CHECKSIG || opcode == OP_CHECKMULTISIG || opcode == OP_EQUAL || opcode == OP_NUMEQUAL) && (*it == OP_VERIFY)) {
  ------------------
  |  Branch (399:20): [True: 8.92k, False: 180]
  |  Branch (399:36): [True: 15, False: 8.90k]
  |  Branch (399:61): [True: 0, False: 8.90k]
  |  Branch (399:91): [True: 0, False: 8.90k]
  |  Branch (399:113): [True: 309, False: 8.60k]
  |  Branch (399:139): [True: 0, False: 324]
  ------------------
  400|       |            // Rule out non minimal VERIFY sequences
  401|      0|            return {};
  402|      0|        }
  403|  18.2k|        out.emplace_back(opcode, std::move(push_data));
  404|  18.2k|    }
  405|  1.52k|    std::reverse(out.begin(), out.end());
  406|  1.52k|    return out;
  407|  2.06k|}

_ZNK10miniscript4TypeorES0_:
  138|    221|    constexpr Type operator|(Type x) const { return Type(m_flags | x.m_flags); }
_ZN10miniscript4TypeC2Ej:
  131|    476|    explicit constexpr Type(uint32_t flags) noexcept : m_flags(flags) {}
_ZN10miniscript11IsTapscriptENS_17MiniscriptContextE:
  246|  4.43k|{
  247|  4.43k|    switch (ms_ctx) {
  ------------------
  |  Branch (247:13): [True: 0, False: 4.43k]
  ------------------
  248|  4.43k|        case MiniscriptContext::P2WSH: return false;
  ------------------
  |  Branch (248:9): [True: 4.43k, False: 0]
  ------------------
  249|      0|        case MiniscriptContext::TAPSCRIPT: return true;
  ------------------
  |  Branch (249:9): [True: 0, False: 4.43k]
  ------------------
  250|  4.43k|    }
  251|      0|    assert(false);
  252|      0|}
_ZNK10miniscript4TypelsES0_:
  144|  12.0k|    constexpr bool operator<<(Type x) const { return (x.m_flags & ~m_flags) == 0; }
_ZNK10miniscript4TypeanES0_:
  141|    170|    constexpr Type operator&(Type x) const { return Type(m_flags & x.m_flags); }
_ZNK10miniscript4NodeI7CPubKeyE10ScriptSizeEv:
 1499|  1.39k|    size_t ScriptSize() const { return scriptlen; }
_ZNK10miniscript4NodeI7CPubKeyE7GetTypeEv:
 1557|  2.56k|    Type GetType() const { return typ; }
_ZNK10miniscript4NodeI7CPubKeyE15IsValidTopLevelEv:
 1620|     81|    bool IsValidTopLevel() const { return IsValid() && GetType() << "B"_mst; }
  ------------------
  |  Branch (1620:43): [True: 71, False: 10]
  |  Branch (1620:56): [True: 71, False: 0]
  ------------------
_ZNK10miniscript4NodeI7CPubKeyE7IsValidEv:
 1614|  1.38k|    bool IsValid() const {
 1615|  1.38k|        if (GetType() == ""_mst) return false;
  ------------------
  |  Branch (1615:13): [True: 17, False: 1.36k]
  ------------------
 1616|  1.36k|        return ScriptSize() <= internal::MaxScriptSize(m_script_ctx);
 1617|  1.38k|    }
_ZN10miniscript8internal13MaxScriptSizeENS_17MiniscriptContextE:
  271|  3.43k|{
  272|  3.43k|    if (IsTapscript(ms_ctx)) {
  ------------------
  |  Branch (272:9): [True: 0, False: 3.43k]
  ------------------
  273|       |        // Leaf scripts under Tapscript are not explicitly limited in size. They are only implicitly
  274|       |        // bounded by the maximum standard size of a spending transaction. Let the maximum script
  275|       |        // size conservatively be small enough such that even a maximum sized witness and a reasonably
  276|       |        // sized spending transaction can spend an output paying to this script without running into
  277|       |        // the maximum standard tx size limit.
  278|      0|        constexpr auto max_size{MAX_STANDARD_TX_WEIGHT - TX_BODY_LEEWAY_WEIGHT - MAX_TAPSCRIPT_SAT_SIZE};
  279|      0|        return max_size - GetSizeOfCompactSize(max_size);
  280|      0|    }
  281|  3.43k|    return MAX_STANDARD_P2WSH_SCRIPT_SIZE;
  282|  3.43k|}
_ZN10miniscript11MakeNodeRefI7CPubKeyJNS_8internal10NoDupCheckENS_17MiniscriptContextENS_8FragmentEEEENSt3__110unique_ptrIKNS_4NodeIT_EENS6_14default_deleteISB_EEEEDpOT0_:
  196|    484|NodeRef<Key> MakeNodeRef(Args&&... args) { return std::make_unique<const Node<Key>>(std::forward<Args>(args)...); }
_ZN10miniscript4NodeI7CPubKeyEC2ENS_8internal10NoDupCheckENS_17MiniscriptContextENS_8FragmentEj:
 1670|    484|        : fragment(nt), k(val), m_script_ctx{script_ctx}, ops(CalcOps()), ss(CalcStackSize()), ws(CalcWitnessSize()), typ(CalcType()), scriptlen(CalcScriptLen()) {}
_ZNK10miniscript4NodeI7CPubKeyE7CalcOpsEv:
  944|    501|    internal::Ops CalcOps() const {
  945|    501|        switch (fragment) {
  ------------------
  |  Branch (945:17): [True: 0, False: 501]
  ------------------
  946|      0|            case Fragment::JUST_1: return {0, 0, {}};
  ------------------
  |  Branch (946:13): [True: 0, False: 501]
  ------------------
  947|    484|            case Fragment::JUST_0: return {0, {}, 0};
  ------------------
  |  Branch (947:13): [True: 484, False: 17]
  ------------------
  948|      0|            case Fragment::PK_K: return {0, 0, 0};
  ------------------
  |  Branch (948:13): [True: 0, False: 501]
  ------------------
  949|      0|            case Fragment::PK_H: return {3, 0, 0};
  ------------------
  |  Branch (949:13): [True: 0, False: 501]
  ------------------
  950|      0|            case Fragment::OLDER:
  ------------------
  |  Branch (950:13): [True: 0, False: 501]
  ------------------
  951|      0|            case Fragment::AFTER: return {1, 0, {}};
  ------------------
  |  Branch (951:13): [True: 0, False: 501]
  ------------------
  952|      0|            case Fragment::SHA256:
  ------------------
  |  Branch (952:13): [True: 0, False: 501]
  ------------------
  953|      0|            case Fragment::RIPEMD160:
  ------------------
  |  Branch (953:13): [True: 0, False: 501]
  ------------------
  954|      0|            case Fragment::HASH256:
  ------------------
  |  Branch (954:13): [True: 0, False: 501]
  ------------------
  955|      0|            case Fragment::HASH160: return {4, 0, {}};
  ------------------
  |  Branch (955:13): [True: 0, False: 501]
  ------------------
  956|     17|            case Fragment::AND_V: return {subs[0]->ops.count + subs[1]->ops.count, subs[0]->ops.sat + subs[1]->ops.sat, {}};
  ------------------
  |  Branch (956:13): [True: 17, False: 484]
  ------------------
  957|      0|            case Fragment::AND_B: {
  ------------------
  |  Branch (957:13): [True: 0, False: 501]
  ------------------
  958|      0|                const auto count{1 + subs[0]->ops.count + subs[1]->ops.count};
  959|      0|                const auto sat{subs[0]->ops.sat + subs[1]->ops.sat};
  960|      0|                const auto dsat{subs[0]->ops.dsat + subs[1]->ops.dsat};
  961|      0|                return {count, sat, dsat};
  962|      0|            }
  963|      0|            case Fragment::OR_B: {
  ------------------
  |  Branch (963:13): [True: 0, False: 501]
  ------------------
  964|      0|                const auto count{1 + subs[0]->ops.count + subs[1]->ops.count};
  965|      0|                const auto sat{(subs[0]->ops.sat + subs[1]->ops.dsat) | (subs[1]->ops.sat + subs[0]->ops.dsat)};
  966|      0|                const auto dsat{subs[0]->ops.dsat + subs[1]->ops.dsat};
  967|      0|                return {count, sat, dsat};
  968|      0|            }
  969|      0|            case Fragment::OR_D: {
  ------------------
  |  Branch (969:13): [True: 0, False: 501]
  ------------------
  970|      0|                const auto count{3 + subs[0]->ops.count + subs[1]->ops.count};
  971|      0|                const auto sat{subs[0]->ops.sat | (subs[1]->ops.sat + subs[0]->ops.dsat)};
  972|      0|                const auto dsat{subs[0]->ops.dsat + subs[1]->ops.dsat};
  973|      0|                return {count, sat, dsat};
  974|      0|            }
  975|      0|            case Fragment::OR_C: {
  ------------------
  |  Branch (975:13): [True: 0, False: 501]
  ------------------
  976|      0|                const auto count{2 + subs[0]->ops.count + subs[1]->ops.count};
  977|      0|                const auto sat{subs[0]->ops.sat | (subs[1]->ops.sat + subs[0]->ops.dsat)};
  978|      0|                return {count, sat, {}};
  979|      0|            }
  980|      0|            case Fragment::OR_I: {
  ------------------
  |  Branch (980:13): [True: 0, False: 501]
  ------------------
  981|      0|                const auto count{3 + subs[0]->ops.count + subs[1]->ops.count};
  982|      0|                const auto sat{subs[0]->ops.sat | subs[1]->ops.sat};
  983|      0|                const auto dsat{subs[0]->ops.dsat | subs[1]->ops.dsat};
  984|      0|                return {count, sat, dsat};
  985|      0|            }
  986|      0|            case Fragment::ANDOR: {
  ------------------
  |  Branch (986:13): [True: 0, False: 501]
  ------------------
  987|      0|                const auto count{3 + subs[0]->ops.count + subs[1]->ops.count + subs[2]->ops.count};
  988|      0|                const auto sat{(subs[1]->ops.sat + subs[0]->ops.sat) | (subs[0]->ops.dsat + subs[2]->ops.sat)};
  989|      0|                const auto dsat{subs[0]->ops.dsat + subs[2]->ops.dsat};
  990|      0|                return {count, sat, dsat};
  991|      0|            }
  992|      0|            case Fragment::MULTI: return {1, (uint32_t)keys.size(), (uint32_t)keys.size()};
  ------------------
  |  Branch (992:13): [True: 0, False: 501]
  ------------------
  993|      0|            case Fragment::MULTI_A: return {(uint32_t)keys.size() + 1, 0, 0};
  ------------------
  |  Branch (993:13): [True: 0, False: 501]
  ------------------
  994|      0|            case Fragment::WRAP_S:
  ------------------
  |  Branch (994:13): [True: 0, False: 501]
  ------------------
  995|      0|            case Fragment::WRAP_C:
  ------------------
  |  Branch (995:13): [True: 0, False: 501]
  ------------------
  996|      0|            case Fragment::WRAP_N: return {1 + subs[0]->ops.count, subs[0]->ops.sat, subs[0]->ops.dsat};
  ------------------
  |  Branch (996:13): [True: 0, False: 501]
  ------------------
  997|      0|            case Fragment::WRAP_A: return {2 + subs[0]->ops.count, subs[0]->ops.sat, subs[0]->ops.dsat};
  ------------------
  |  Branch (997:13): [True: 0, False: 501]
  ------------------
  998|      0|            case Fragment::WRAP_D: return {3 + subs[0]->ops.count, subs[0]->ops.sat, 0};
  ------------------
  |  Branch (998:13): [True: 0, False: 501]
  ------------------
  999|      0|            case Fragment::WRAP_J: return {4 + subs[0]->ops.count, subs[0]->ops.sat, 0};
  ------------------
  |  Branch (999:13): [True: 0, False: 501]
  ------------------
 1000|      0|            case Fragment::WRAP_V: return {subs[0]->ops.count + (subs[0]->GetType() << "x"_mst), subs[0]->ops.sat, {}};
  ------------------
  |  Branch (1000:13): [True: 0, False: 501]
  ------------------
 1001|      0|            case Fragment::THRESH: {
  ------------------
  |  Branch (1001:13): [True: 0, False: 501]
  ------------------
 1002|      0|                uint32_t count = 0;
 1003|      0|                auto sats = Vector(internal::MaxInt<uint32_t>(0));
 1004|      0|                for (const auto& sub : subs) {
  ------------------
  |  Branch (1004:38): [True: 0, False: 0]
  ------------------
 1005|      0|                    count += sub->ops.count + 1;
 1006|      0|                    auto next_sats = Vector(sats[0] + sub->ops.dsat);
 1007|      0|                    for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + sub->ops.dsat) | (sats[j - 1] + sub->ops.sat));
  ------------------
  |  Branch (1007:40): [True: 0, False: 0]
  ------------------
 1008|      0|                    next_sats.push_back(sats[sats.size() - 1] + sub->ops.sat);
 1009|      0|                    sats = std::move(next_sats);
 1010|      0|                }
 1011|      0|                assert(k <= sats.size());
 1012|      0|                return {count, sats[k], sats[0]};
 1013|      0|            }
 1014|    501|        }
 1015|      0|        assert(false);
 1016|      0|    }
_ZN10miniscript8internal6MaxIntIjEC2Ej:
  356|    968|    MaxInt(I val) : valid(true), value(val) {}
_ZN10miniscript8internal6MaxIntIjEC2Ev:
  355|  1.03k|    MaxInt() : valid(false), value(0) {}
_ZN10miniscript8internal3OpsC2EjNS0_6MaxIntIjEES3_:
  378|    501|    Ops(uint32_t in_count, MaxInt<uint32_t> in_sat, MaxInt<uint32_t> in_dsat) : count(in_count), sat(in_sat), dsat(in_dsat) {};
_ZN10miniscript8internalplERKNS0_6MaxIntIjEES4_:
  358|     34|    friend MaxInt<I> operator+(const MaxInt<I>& a, const MaxInt<I>& b) {
  359|     34|        if (!a.valid || !b.valid) return {};
  ------------------
  |  Branch (359:13): [True: 34, False: 0]
  |  Branch (359:25): [True: 0, False: 0]
  ------------------
  360|      0|        return a.value + b.value;
  361|     34|    }
_ZNK10miniscript4NodeI7CPubKeyE13CalcStackSizeEv:
 1018|    501|    internal::StackSize CalcStackSize() const {
 1019|    501|        using namespace internal;
 1020|    501|        switch (fragment) {
  ------------------
  |  Branch (1020:17): [True: 0, False: 501]
  ------------------
 1021|    484|            case Fragment::JUST_0: return {{}, SatInfo::Push()};
  ------------------
  |  Branch (1021:13): [True: 484, False: 17]
  ------------------
 1022|      0|            case Fragment::JUST_1: return {SatInfo::Push(), {}};
  ------------------
  |  Branch (1022:13): [True: 0, False: 501]
  ------------------
 1023|      0|            case Fragment::OLDER:
  ------------------
  |  Branch (1023:13): [True: 0, False: 501]
  ------------------
 1024|      0|            case Fragment::AFTER: return {SatInfo::Push() + SatInfo::Nop(), {}};
  ------------------
  |  Branch (1024:13): [True: 0, False: 501]
  ------------------
 1025|      0|            case Fragment::PK_K: return {SatInfo::Push()};
  ------------------
  |  Branch (1025:13): [True: 0, False: 501]
  ------------------
 1026|      0|            case Fragment::PK_H: return {SatInfo::OP_DUP() + SatInfo::Hash() + SatInfo::Push() + SatInfo::OP_EQUALVERIFY()};
  ------------------
  |  Branch (1026:13): [True: 0, False: 501]
  ------------------
 1027|      0|            case Fragment::SHA256:
  ------------------
  |  Branch (1027:13): [True: 0, False: 501]
  ------------------
 1028|      0|            case Fragment::RIPEMD160:
  ------------------
  |  Branch (1028:13): [True: 0, False: 501]
  ------------------
 1029|      0|            case Fragment::HASH256:
  ------------------
  |  Branch (1029:13): [True: 0, False: 501]
  ------------------
 1030|      0|            case Fragment::HASH160: return {
  ------------------
  |  Branch (1030:13): [True: 0, False: 501]
  ------------------
 1031|      0|                SatInfo::OP_SIZE() + SatInfo::Push() + SatInfo::OP_EQUALVERIFY() + SatInfo::Hash() + SatInfo::Push() + SatInfo::OP_EQUAL(),
 1032|      0|                {}
 1033|      0|            };
 1034|      0|            case Fragment::ANDOR: {
  ------------------
  |  Branch (1034:13): [True: 0, False: 501]
  ------------------
 1035|      0|                const auto& x{subs[0]->ss};
 1036|      0|                const auto& y{subs[1]->ss};
 1037|      0|                const auto& z{subs[2]->ss};
 1038|      0|                return {
 1039|      0|                    (x.sat + SatInfo::If() + y.sat) | (x.dsat + SatInfo::If() + z.sat),
 1040|      0|                    x.dsat + SatInfo::If() + z.dsat
 1041|      0|                };
 1042|      0|            }
 1043|     17|            case Fragment::AND_V: {
  ------------------
  |  Branch (1043:13): [True: 17, False: 484]
  ------------------
 1044|     17|                const auto& x{subs[0]->ss};
 1045|     17|                const auto& y{subs[1]->ss};
 1046|     17|                return {x.sat + y.sat, {}};
 1047|      0|            }
 1048|      0|            case Fragment::AND_B: {
  ------------------
  |  Branch (1048:13): [True: 0, False: 501]
  ------------------
 1049|      0|                const auto& x{subs[0]->ss};
 1050|      0|                const auto& y{subs[1]->ss};
 1051|      0|                return {x.sat + y.sat + SatInfo::BinaryOp(), x.dsat + y.dsat + SatInfo::BinaryOp()};
 1052|      0|            }
 1053|      0|            case Fragment::OR_B: {
  ------------------
  |  Branch (1053:13): [True: 0, False: 501]
  ------------------
 1054|      0|                const auto& x{subs[0]->ss};
 1055|      0|                const auto& y{subs[1]->ss};
 1056|      0|                return {
 1057|      0|                    ((x.sat + y.dsat) | (x.dsat + y.sat)) + SatInfo::BinaryOp(),
 1058|      0|                    x.dsat + y.dsat + SatInfo::BinaryOp()
 1059|      0|                };
 1060|      0|            }
 1061|      0|            case Fragment::OR_C: {
  ------------------
  |  Branch (1061:13): [True: 0, False: 501]
  ------------------
 1062|      0|                const auto& x{subs[0]->ss};
 1063|      0|                const auto& y{subs[1]->ss};
 1064|      0|                return {(x.sat + SatInfo::If()) | (x.dsat + SatInfo::If() + y.sat), {}};
 1065|      0|            }
 1066|      0|            case Fragment::OR_D: {
  ------------------
  |  Branch (1066:13): [True: 0, False: 501]
  ------------------
 1067|      0|                const auto& x{subs[0]->ss};
 1068|      0|                const auto& y{subs[1]->ss};
 1069|      0|                return {
 1070|      0|                    (x.sat + SatInfo::OP_IFDUP(true) + SatInfo::If()) | (x.dsat + SatInfo::OP_IFDUP(false) + SatInfo::If() + y.sat),
 1071|      0|                    x.dsat + SatInfo::OP_IFDUP(false) + SatInfo::If() + y.dsat
 1072|      0|                };
 1073|      0|            }
 1074|      0|            case Fragment::OR_I: {
  ------------------
  |  Branch (1074:13): [True: 0, False: 501]
  ------------------
 1075|      0|                const auto& x{subs[0]->ss};
 1076|      0|                const auto& y{subs[1]->ss};
 1077|      0|                return {SatInfo::If() + (x.sat | y.sat), SatInfo::If() + (x.dsat | y.dsat)};
 1078|      0|            }
 1079|       |            // multi(k, key1, key2, ..., key_n) starts off with k+1 stack elements (a 0, plus k
 1080|       |            // signatures), then reaches n+k+3 stack elements after pushing the n keys, plus k and
 1081|       |            // n itself, and ends with 1 stack element (success or failure). Thus, it net removes
 1082|       |            // k elements (from k+1 to 1), while reaching k+n+2 more than it ends with.
 1083|      0|            case Fragment::MULTI: return {SatInfo(k, k + keys.size() + 2)};
  ------------------
  |  Branch (1083:13): [True: 0, False: 501]
  ------------------
 1084|       |            // multi_a(k, key1, key2, ..., key_n) starts off with n stack elements (the
 1085|       |            // signatures), reaches 1 more (after the first key push), and ends with 1. Thus it net
 1086|       |            // removes n-1 elements (from n to 1) while reaching n more than it ends with.
 1087|      0|            case Fragment::MULTI_A: return {SatInfo(keys.size() - 1, keys.size())};
  ------------------
  |  Branch (1087:13): [True: 0, False: 501]
  ------------------
 1088|      0|            case Fragment::WRAP_A:
  ------------------
  |  Branch (1088:13): [True: 0, False: 501]
  ------------------
 1089|      0|            case Fragment::WRAP_N:
  ------------------
  |  Branch (1089:13): [True: 0, False: 501]
  ------------------
 1090|      0|            case Fragment::WRAP_S: return subs[0]->ss;
  ------------------
  |  Branch (1090:13): [True: 0, False: 501]
  ------------------
 1091|      0|            case Fragment::WRAP_C: return {
  ------------------
  |  Branch (1091:13): [True: 0, False: 501]
  ------------------
 1092|      0|                subs[0]->ss.sat + SatInfo::OP_CHECKSIG(),
 1093|      0|                subs[0]->ss.dsat + SatInfo::OP_CHECKSIG()
 1094|      0|            };
 1095|      0|            case Fragment::WRAP_D: return {
  ------------------
  |  Branch (1095:13): [True: 0, False: 501]
  ------------------
 1096|      0|                SatInfo::OP_DUP() + SatInfo::If() + subs[0]->ss.sat,
 1097|      0|                SatInfo::OP_DUP() + SatInfo::If()
 1098|      0|            };
 1099|      0|            case Fragment::WRAP_V: return {subs[0]->ss.sat + SatInfo::OP_VERIFY(), {}};
  ------------------
  |  Branch (1099:13): [True: 0, False: 501]
  ------------------
 1100|      0|            case Fragment::WRAP_J: return {
  ------------------
  |  Branch (1100:13): [True: 0, False: 501]
  ------------------
 1101|      0|                SatInfo::OP_SIZE() + SatInfo::OP_0NOTEQUAL() + SatInfo::If() + subs[0]->ss.sat,
 1102|      0|                SatInfo::OP_SIZE() + SatInfo::OP_0NOTEQUAL() + SatInfo::If()
 1103|      0|            };
 1104|      0|            case Fragment::THRESH: {
  ------------------
  |  Branch (1104:13): [True: 0, False: 501]
  ------------------
 1105|       |                // sats[j] is the SatInfo corresponding to all traces reaching j satisfactions.
 1106|      0|                auto sats = Vector(SatInfo::Empty());
 1107|      0|                for (size_t i = 0; i < subs.size(); ++i) {
  ------------------
  |  Branch (1107:36): [True: 0, False: 0]
  ------------------
 1108|       |                    // Loop over the subexpressions, processing them one by one. After adding
 1109|       |                    // element i we need to add OP_ADD (if i>0).
 1110|      0|                    auto add = i ? SatInfo::BinaryOp() : SatInfo::Empty();
  ------------------
  |  Branch (1110:32): [True: 0, False: 0]
  ------------------
 1111|       |                    // Construct a variable that will become the next sats, starting with index 0.
 1112|      0|                    auto next_sats = Vector(sats[0] + subs[i]->ss.dsat + add);
 1113|       |                    // Then loop to construct next_sats[1..i].
 1114|      0|                    for (size_t j = 1; j < sats.size(); ++j) {
  ------------------
  |  Branch (1114:40): [True: 0, False: 0]
  ------------------
 1115|      0|                        next_sats.push_back(((sats[j] + subs[i]->ss.dsat) | (sats[j - 1] + subs[i]->ss.sat)) + add);
 1116|      0|                    }
 1117|       |                    // Finally construct next_sats[i+1].
 1118|      0|                    next_sats.push_back(sats[sats.size() - 1] + subs[i]->ss.sat + add);
 1119|       |                    // Switch over.
 1120|      0|                    sats = std::move(next_sats);
 1121|      0|                }
 1122|       |                // To satisfy thresh we need k satisfactions; to dissatisfy we need 0. In both
 1123|       |                // cases a push of k and an OP_EQUAL follow.
 1124|      0|                return {
 1125|      0|                    sats[k] + SatInfo::Push() + SatInfo::OP_EQUAL(),
 1126|      0|                    sats[0] + SatInfo::Push() + SatInfo::OP_EQUAL()
 1127|      0|                };
 1128|      0|            }
 1129|    501|        }
 1130|      0|        assert(false);
 1131|      0|    }
_ZN10miniscript8internal7SatInfoC2Ev:
  431|    518|    constexpr SatInfo() noexcept : valid(false), netdiff(0), exec(0) {}
_ZN10miniscript8internal7SatInfo4PushEv:
  461|    484|    static constexpr SatInfo Push() noexcept { return {-1, 0}; }
_ZN10miniscript8internal9StackSizeC2ENS0_7SatInfoES2_:
  485|    501|    constexpr StackSize(SatInfo in_sat, SatInfo in_dsat) noexcept : sat(in_sat), dsat(in_dsat) {};
_ZN10miniscript8internalplERKNS0_7SatInfoES3_:
  449|     17|    {
  450|       |        // Concatenation with an empty set yields an empty set.
  451|     17|        if (!a.valid || !b.valid) return {};
  ------------------
  |  Branch (451:13): [True: 17, False: 0]
  |  Branch (451:25): [True: 0, False: 0]
  ------------------
  452|       |        // Otherwise, the maximum stack size difference for the combined scripts is the sum of the
  453|       |        // netdiffs, and the maximum stack size difference anywhere is either b.exec (if the
  454|       |        // maximum occurred in b) or b.netdiff+a.exec (if the maximum occurred in a).
  455|      0|        return {a.netdiff + b.netdiff, std::max(b.exec, b.netdiff + a.exec)};
  456|     17|    }
_ZN10miniscript8internal7SatInfoC2Eii:
  435|    484|        valid{true}, netdiff{in_netdiff}, exec{in_exec} {}
_ZNK10miniscript4NodeI7CPubKeyE15CalcWitnessSizeEv:
 1133|    501|    internal::WitnessSize CalcWitnessSize() const {
 1134|    501|        const uint32_t sig_size = IsTapscript(m_script_ctx) ? 1 + 65 : 1 + 72;
  ------------------
  |  Branch (1134:35): [True: 0, False: 501]
  ------------------
 1135|    501|        const uint32_t pubkey_size = IsTapscript(m_script_ctx) ? 1 + 32 : 1 + 33;
  ------------------
  |  Branch (1135:38): [True: 0, False: 501]
  ------------------
 1136|    501|        switch (fragment) {
  ------------------
  |  Branch (1136:17): [True: 0, False: 501]
  ------------------
 1137|    484|            case Fragment::JUST_0: return {{}, 0};
  ------------------
  |  Branch (1137:13): [True: 484, False: 17]
  ------------------
 1138|      0|            case Fragment::JUST_1:
  ------------------
  |  Branch (1138:13): [True: 0, False: 501]
  ------------------
 1139|      0|            case Fragment::OLDER:
  ------------------
  |  Branch (1139:13): [True: 0, False: 501]
  ------------------
 1140|      0|            case Fragment::AFTER: return {0, {}};
  ------------------
  |  Branch (1140:13): [True: 0, False: 501]
  ------------------
 1141|      0|            case Fragment::PK_K: return {sig_size, 1};
  ------------------
  |  Branch (1141:13): [True: 0, False: 501]
  ------------------
 1142|      0|            case Fragment::PK_H: return {sig_size + pubkey_size, 1 + pubkey_size};
  ------------------
  |  Branch (1142:13): [True: 0, False: 501]
  ------------------
 1143|      0|            case Fragment::SHA256:
  ------------------
  |  Branch (1143:13): [True: 0, False: 501]
  ------------------
 1144|      0|            case Fragment::RIPEMD160:
  ------------------
  |  Branch (1144:13): [True: 0, False: 501]
  ------------------
 1145|      0|            case Fragment::HASH256:
  ------------------
  |  Branch (1145:13): [True: 0, False: 501]
  ------------------
 1146|      0|            case Fragment::HASH160: return {1 + 32, {}};
  ------------------
  |  Branch (1146:13): [True: 0, False: 501]
  ------------------
 1147|      0|            case Fragment::ANDOR: {
  ------------------
  |  Branch (1147:13): [True: 0, False: 501]
  ------------------
 1148|      0|                const auto sat{(subs[0]->ws.sat + subs[1]->ws.sat) | (subs[0]->ws.dsat + subs[2]->ws.sat)};
 1149|      0|                const auto dsat{subs[0]->ws.dsat + subs[2]->ws.dsat};
 1150|      0|                return {sat, dsat};
 1151|      0|            }
 1152|     17|            case Fragment::AND_V: return {subs[0]->ws.sat + subs[1]->ws.sat, {}};
  ------------------
  |  Branch (1152:13): [True: 17, False: 484]
  ------------------
 1153|      0|            case Fragment::AND_B: return {subs[0]->ws.sat + subs[1]->ws.sat, subs[0]->ws.dsat + subs[1]->ws.dsat};
  ------------------
  |  Branch (1153:13): [True: 0, False: 501]
  ------------------
 1154|      0|            case Fragment::OR_B: {
  ------------------
  |  Branch (1154:13): [True: 0, False: 501]
  ------------------
 1155|      0|                const auto sat{(subs[0]->ws.dsat + subs[1]->ws.sat) | (subs[0]->ws.sat + subs[1]->ws.dsat)};
 1156|      0|                const auto dsat{subs[0]->ws.dsat + subs[1]->ws.dsat};
 1157|      0|                return {sat, dsat};
 1158|      0|            }
 1159|      0|            case Fragment::OR_C: return {subs[0]->ws.sat | (subs[0]->ws.dsat + subs[1]->ws.sat), {}};
  ------------------
  |  Branch (1159:13): [True: 0, False: 501]
  ------------------
 1160|      0|            case Fragment::OR_D: return {subs[0]->ws.sat | (subs[0]->ws.dsat + subs[1]->ws.sat), subs[0]->ws.dsat + subs[1]->ws.dsat};
  ------------------
  |  Branch (1160:13): [True: 0, False: 501]
  ------------------
 1161|      0|            case Fragment::OR_I: return {(subs[0]->ws.sat + 1 + 1) | (subs[1]->ws.sat + 1), (subs[0]->ws.dsat + 1 + 1) | (subs[1]->ws.dsat + 1)};
  ------------------
  |  Branch (1161:13): [True: 0, False: 501]
  ------------------
 1162|      0|            case Fragment::MULTI: return {k * sig_size + 1, k + 1};
  ------------------
  |  Branch (1162:13): [True: 0, False: 501]
  ------------------
 1163|      0|            case Fragment::MULTI_A: return {k * sig_size + static_cast<uint32_t>(keys.size()) - k, static_cast<uint32_t>(keys.size())};
  ------------------
  |  Branch (1163:13): [True: 0, False: 501]
  ------------------
 1164|      0|            case Fragment::WRAP_A:
  ------------------
  |  Branch (1164:13): [True: 0, False: 501]
  ------------------
 1165|      0|            case Fragment::WRAP_N:
  ------------------
  |  Branch (1165:13): [True: 0, False: 501]
  ------------------
 1166|      0|            case Fragment::WRAP_S:
  ------------------
  |  Branch (1166:13): [True: 0, False: 501]
  ------------------
 1167|      0|            case Fragment::WRAP_C: return subs[0]->ws;
  ------------------
  |  Branch (1167:13): [True: 0, False: 501]
  ------------------
 1168|      0|            case Fragment::WRAP_D: return {1 + 1 + subs[0]->ws.sat, 1};
  ------------------
  |  Branch (1168:13): [True: 0, False: 501]
  ------------------
 1169|      0|            case Fragment::WRAP_V: return {subs[0]->ws.sat, {}};
  ------------------
  |  Branch (1169:13): [True: 0, False: 501]
  ------------------
 1170|      0|            case Fragment::WRAP_J: return {subs[0]->ws.sat, 1};
  ------------------
  |  Branch (1170:13): [True: 0, False: 501]
  ------------------
 1171|      0|            case Fragment::THRESH: {
  ------------------
  |  Branch (1171:13): [True: 0, False: 501]
  ------------------
 1172|      0|                auto sats = Vector(internal::MaxInt<uint32_t>(0));
 1173|      0|                for (const auto& sub : subs) {
  ------------------
  |  Branch (1173:38): [True: 0, False: 0]
  ------------------
 1174|      0|                    auto next_sats = Vector(sats[0] + sub->ws.dsat);
 1175|      0|                    for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + sub->ws.dsat) | (sats[j - 1] + sub->ws.sat));
  ------------------
  |  Branch (1175:40): [True: 0, False: 0]
  ------------------
 1176|      0|                    next_sats.push_back(sats[sats.size() - 1] + sub->ws.sat);
 1177|      0|                    sats = std::move(next_sats);
 1178|      0|                }
 1179|      0|                assert(k <= sats.size());
 1180|      0|                return {sats[k], sats[0]};
 1181|      0|            }
 1182|    501|        }
 1183|      0|        assert(false);
 1184|      0|    }
_ZN10miniscript8internal11WitnessSizeC2ENS0_6MaxIntIjEES3_:
  495|    501|    WitnessSize(MaxInt<uint32_t> in_sat, MaxInt<uint32_t> in_dsat) : sat(in_sat), dsat(in_dsat) {};
_ZNK10miniscript4NodeI7CPubKeyE8CalcTypeEv:
  731|    501|    Type CalcType() const {
  732|    501|        using namespace internal;
  733|       |
  734|       |        // THRESH has a variable number of subexpressions
  735|    501|        std::vector<Type> sub_types;
  736|    501|        if (fragment == Fragment::THRESH) {
  ------------------
  |  Branch (736:13): [True: 0, False: 501]
  ------------------
  737|      0|            for (const auto& sub : subs) sub_types.push_back(sub->GetType());
  ------------------
  |  Branch (737:34): [True: 0, False: 0]
  ------------------
  738|      0|        }
  739|       |        // All other nodes than THRESH can be computed just from the types of the 0-3 subexpressions.
  740|    501|        static constexpr auto NONE_MST{""_mst};
  741|    501|        Type x = subs.size() > 0 ? subs[0]->GetType() : NONE_MST;
  ------------------
  |  Branch (741:18): [True: 17, False: 484]
  ------------------
  742|    501|        Type y = subs.size() > 1 ? subs[1]->GetType() : NONE_MST;
  ------------------
  |  Branch (742:18): [True: 17, False: 484]
  ------------------
  743|    501|        Type z = subs.size() > 2 ? subs[2]->GetType() : NONE_MST;
  ------------------
  |  Branch (743:18): [True: 0, False: 501]
  ------------------
  744|       |
  745|    501|        return SanitizeType(ComputeType(fragment, x, y, z, sub_types, k, data.size(), subs.size(), keys.size(), m_script_ctx));
  746|    501|    }
_ZNK10miniscript4NodeI7CPubKeyE13CalcScriptLenEv:
  570|    501|    size_t CalcScriptLen() const {
  571|    501|        size_t subsize = 0;
  572|    501|        for (const auto& sub : subs) {
  ------------------
  |  Branch (572:30): [True: 34, False: 501]
  ------------------
  573|     34|            subsize += sub->ScriptSize();
  574|     34|        }
  575|    501|        static constexpr auto NONE_MST{""_mst};
  576|    501|        Type sub0type = subs.size() > 0 ? subs[0]->GetType() : NONE_MST;
  ------------------
  |  Branch (576:25): [True: 17, False: 484]
  ------------------
  577|    501|        return internal::ComputeScriptLen(fragment, sub0type, subsize, k, subs.size(), keys.size(), m_script_ctx);
  578|    501|    }
_ZN10miniscript4NodeI7CPubKeyEC2ENS_8internal10NoDupCheckENS_17MiniscriptContextENS_8FragmentENSt3__16vectorINS7_10unique_ptrIKS2_NS7_14default_deleteISA_EEEENS7_9allocatorISD_EEEEj:
 1668|     17|        : fragment(nt), k(val), subs(std::move(sub)), m_script_ctx{script_ctx}, ops(CalcOps()), ss(CalcStackSize()), ws(CalcWitnessSize()), typ(CalcType()), scriptlen(CalcScriptLen()) {}
_ZN10miniscript4NodeI7CPubKeyED2Ev:
  520|    501|    ~Node() {
  521|    535|        while (!subs.empty()) {
  ------------------
  |  Branch (521:16): [True: 34, False: 501]
  ------------------
  522|     34|            auto node = std::move(subs.back());
  523|     34|            subs.pop_back();
  524|     34|            while (!node->subs.empty()) {
  ------------------
  |  Branch (524:20): [True: 0, False: 34]
  ------------------
  525|      0|                subs.push_back(std::move(node->subs.back()));
  526|      0|                node->subs.pop_back();
  527|      0|            }
  528|     34|        }
  529|    501|    }
_ZN10miniscript8internal9BuildBackI7CPubKeyEEvNS_17MiniscriptContextENS_8FragmentERNSt3__16vectorINS5_10unique_ptrIKNS_4NodeIT_EENS5_14default_deleteISB_EEEENS5_9allocatorISE_EEEEb:
 1777|     17|{
 1778|     17|    NodeRef<Key> child = std::move(constructed.back());
 1779|     17|    constructed.pop_back();
 1780|     17|    if (reverse) {
  ------------------
  |  Branch (1780:9): [True: 17, False: 0]
  ------------------
 1781|     17|        constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, script_ctx, nt, Vector(std::move(child), std::move(constructed.back())));
 1782|     17|    } else {
 1783|      0|        constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, script_ctx, nt, Vector(std::move(constructed.back()), std::move(child)));
 1784|      0|    }
 1785|     17|}
_ZN10miniscript11MakeNodeRefI7CPubKeyJNS_8internal10NoDupCheckERKNS_17MiniscriptContextERNS_8FragmentENSt3__16vectorINS9_10unique_ptrIKNS_4NodeIS1_EENS9_14default_deleteISE_EEEENS9_9allocatorISH_EEEEEEENSB_IKNSC_IT_EENSF_ISN_EEEEDpOT0_:
  196|     17|NodeRef<Key> MakeNodeRef(Args&&... args) { return std::make_unique<const Node<Key>>(std::forward<Args>(args)...); }
_ZNK10miniscript4TypeeqES0_:
  150|  1.38k|    constexpr bool operator==(Type x) const { return m_flags == x.m_flags; }
_ZN10miniscript8internal11InputResultC2IRKNS0_10InputStackES5_EEOT_OT0_:
  346|     71|    InputResult(A&& in_nsat, B&& in_sat) : nsat(std::forward<A>(in_nsat)), sat(std::forward<B>(in_sat)) {}
_ZNK10miniscript4Type2IfEb:
  153|     85|    constexpr Type If(bool x) const { return Type(x ? m_flags : 0); }
  ------------------
  |  Branch (153:51): [True: 68, False: 17]
  ------------------
_ZN10miniscript10FromScriptI12WshSatisfierEENSt3__110unique_ptrIKNS_4NodeINT_3KeyEEENS2_14default_deleteIS8_EEEERK7CScriptRKS5_:
 2645|  2.07k|inline NodeRef<typename Ctx::Key> FromScript(const CScript& script, const Ctx& ctx) {
 2646|  2.07k|    using namespace internal;
 2647|       |    // A too large Script is necessarily invalid, don't bother parsing it.
 2648|  2.07k|    if (script.size() > MaxScriptSize(ctx.MsContext())) return {};
  ------------------
  |  Branch (2648:9): [True: 3, False: 2.06k]
  ------------------
 2649|  2.06k|    auto decomposed = DecomposeScript(script);
 2650|  2.06k|    if (!decomposed) return {};
  ------------------
  |  Branch (2650:9): [True: 542, False: 1.52k]
  ------------------
 2651|  1.52k|    auto it = decomposed->begin();
 2652|  1.52k|    auto ret = DecodeScript<typename Ctx::Key>(it, decomposed->end(), ctx);
 2653|  1.52k|    if (!ret) return {};
  ------------------
  |  Branch (2653:9): [True: 1.45k, False: 71]
  ------------------
 2654|     71|    if (it != decomposed->end()) return {};
  ------------------
  |  Branch (2654:9): [True: 0, False: 71]
  ------------------
 2655|     71|    return ret;
 2656|     71|}
_ZN10miniscript8internal12DecodeScriptI7CPubKey12WshSatisfierNSt3__111__wrap_iterIPNS4_4pairI10opcodetypeNS4_6vectorIhNS4_9allocatorIhEEEEEEEEEENS4_10unique_ptrIKNS_4NodeIT_EENS4_14default_deleteISJ_EEEERT1_SN_RKT0_:
 2252|  1.52k|{
 2253|       |    // The two integers are used to hold state for thresh()
 2254|  1.52k|    std::vector<std::tuple<DecodeContext, int64_t, int64_t>> to_parse;
 2255|  1.52k|    std::vector<NodeRef<Key>> constructed;
 2256|       |
 2257|       |    // This is the top level, so we assume the type is B
 2258|       |    // (in particular, disallowing top level W expressions)
 2259|  1.52k|    to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2260|       |
 2261|  4.45k|    while (!to_parse.empty()) {
  ------------------
  |  Branch (2261:12): [True: 4.37k, False: 81]
  ------------------
 2262|       |        // Exit early if the Miniscript is not going to be valid.
 2263|  4.37k|        if (!constructed.empty() && !constructed.back()->IsValid()) return {};
  ------------------
  |  Branch (2263:13): [True: 1.30k, False: 3.07k]
  |  Branch (2263:37): [True: 7, False: 1.29k]
  ------------------
 2264|       |
 2265|       |        // Get the current context we are decoding within
 2266|  4.36k|        auto [cur_context, n, k] = to_parse.back();
 2267|  4.36k|        to_parse.pop_back();
 2268|       |
 2269|  4.36k|        switch(cur_context) {
  ------------------
  |  Branch (2269:16): [True: 0, False: 4.36k]
  ------------------
 2270|  1.94k|        case DecodeContext::SINGLE_BKV_EXPR: {
  ------------------
  |  Branch (2270:9): [True: 1.94k, False: 2.42k]
  ------------------
 2271|  1.94k|            if (in >= last) return {};
  ------------------
  |  Branch (2271:17): [True: 1.24k, False: 694]
  ------------------
 2272|       |
 2273|       |            // Constants
 2274|    694|            if (in[0].first == OP_1) {
  ------------------
  |  Branch (2274:17): [True: 0, False: 694]
  ------------------
 2275|      0|                ++in;
 2276|      0|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::JUST_1));
 2277|      0|                break;
 2278|      0|            }
 2279|    694|            if (in[0].first == OP_0) {
  ------------------
  |  Branch (2279:17): [True: 484, False: 210]
  ------------------
 2280|    484|                ++in;
 2281|    484|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::JUST_0));
 2282|    484|                break;
 2283|    484|            }
 2284|       |            // Public keys
 2285|    210|            if (in[0].second.size() == 33 || in[0].second.size() == 32) {
  ------------------
  |  Branch (2285:17): [True: 1, False: 209]
  |  Branch (2285:46): [True: 1, False: 208]
  ------------------
 2286|      2|                auto key = ctx.FromPKBytes(in[0].second.begin(), in[0].second.end());
 2287|      2|                if (!key) return {};
  ------------------
  |  Branch (2287:21): [True: 2, False: 0]
  ------------------
 2288|      0|                ++in;
 2289|      0|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::PK_K, Vector(std::move(*key))));
 2290|      0|                break;
 2291|      2|            }
 2292|    208|            if (last - in >= 5 && in[0].first == OP_VERIFY && in[1].first == OP_EQUAL && in[3].first == OP_HASH160 && in[4].first == OP_DUP && in[2].second.size() == 20) {
  ------------------
  |  Branch (2292:17): [True: 193, False: 15]
  |  Branch (2292:35): [True: 0, False: 193]
  |  Branch (2292:63): [True: 0, False: 0]
  |  Branch (2292:90): [True: 0, False: 0]
  |  Branch (2292:119): [True: 0, False: 0]
  |  Branch (2292:144): [True: 0, False: 0]
  ------------------
 2293|      0|                auto key = ctx.FromPKHBytes(in[2].second.begin(), in[2].second.end());
 2294|      0|                if (!key) return {};
  ------------------
  |  Branch (2294:21): [True: 0, False: 0]
  ------------------
 2295|      0|                in += 5;
 2296|      0|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::PK_H, Vector(std::move(*key))));
 2297|      0|                break;
 2298|      0|            }
 2299|       |            // Time locks
 2300|    208|            std::optional<int64_t> num;
 2301|    208|            if (last - in >= 2 && in[0].first == OP_CHECKSEQUENCEVERIFY && (num = ParseScriptNumber(in[1]))) {
  ------------------
  |  Branch (2301:17): [True: 202, False: 6]
  |  Branch (2301:17): [True: 0, False: 208]
  |  Branch (2301:35): [True: 0, False: 202]
  |  Branch (2301:76): [True: 0, False: 0]
  ------------------
 2302|      0|                in += 2;
 2303|      0|                if (*num < 1 || *num > 0x7FFFFFFFL) return {};
  ------------------
  |  Branch (2303:21): [True: 0, False: 0]
  |  Branch (2303:33): [True: 0, False: 0]
  ------------------
 2304|      0|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::OLDER, *num));
 2305|      0|                break;
 2306|      0|            }
 2307|    208|            if (last - in >= 2 && in[0].first == OP_CHECKLOCKTIMEVERIFY && (num = ParseScriptNumber(in[1]))) {
  ------------------
  |  Branch (2307:17): [True: 202, False: 6]
  |  Branch (2307:17): [True: 0, False: 208]
  |  Branch (2307:35): [True: 0, False: 202]
  |  Branch (2307:76): [True: 0, False: 0]
  ------------------
 2308|      0|                in += 2;
 2309|      0|                if (num < 1 || num > 0x7FFFFFFFL) return {};
  ------------------
  |  Branch (2309:21): [True: 0, False: 0]
  |  Branch (2309:21): [True: 0, False: 0]
  |  Branch (2309:32): [True: 0, False: 0]
  ------------------
 2310|      0|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::AFTER, *num));
 2311|      0|                break;
 2312|      0|            }
 2313|       |            // Hashes
 2314|    208|            if (last - in >= 7 && in[0].first == OP_EQUAL && in[3].first == OP_VERIFY && in[4].first == OP_EQUAL && (num = ParseScriptNumber(in[5])) && num == 32 && in[6].first == OP_SIZE) {
  ------------------
  |  Branch (2314:17): [True: 192, False: 16]
  |  Branch (2314:17): [True: 0, False: 208]
  |  Branch (2314:35): [True: 0, False: 192]
  |  Branch (2314:62): [True: 0, False: 0]
  |  Branch (2314:90): [True: 0, False: 0]
  |  Branch (2314:117): [True: 0, False: 0]
  |  Branch (2314:153): [True: 0, False: 0]
  |  Branch (2314:166): [True: 0, False: 0]
  ------------------
 2315|      0|                if (in[2].first == OP_SHA256 && in[1].second.size() == 32) {
  ------------------
  |  Branch (2315:21): [True: 0, False: 0]
  |  Branch (2315:49): [True: 0, False: 0]
  ------------------
 2316|      0|                    constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::SHA256, in[1].second));
 2317|      0|                    in += 7;
 2318|      0|                    break;
 2319|      0|                } else if (in[2].first == OP_RIPEMD160 && in[1].second.size() == 20) {
  ------------------
  |  Branch (2319:28): [True: 0, False: 0]
  |  Branch (2319:59): [True: 0, False: 0]
  ------------------
 2320|      0|                    constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::RIPEMD160, in[1].second));
 2321|      0|                    in += 7;
 2322|      0|                    break;
 2323|      0|                } else if (in[2].first == OP_HASH256 && in[1].second.size() == 32) {
  ------------------
  |  Branch (2323:28): [True: 0, False: 0]
  |  Branch (2323:57): [True: 0, False: 0]
  ------------------
 2324|      0|                    constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::HASH256, in[1].second));
 2325|      0|                    in += 7;
 2326|      0|                    break;
 2327|      0|                } else if (in[2].first == OP_HASH160 && in[1].second.size() == 20) {
  ------------------
  |  Branch (2327:28): [True: 0, False: 0]
  |  Branch (2327:57): [True: 0, False: 0]
  ------------------
 2328|      0|                    constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::HASH160, in[1].second));
 2329|      0|                    in += 7;
 2330|      0|                    break;
 2331|      0|                }
 2332|      0|            }
 2333|       |            // Multi
 2334|    208|            if (last - in >= 3 && in[0].first == OP_CHECKMULTISIG) {
  ------------------
  |  Branch (2334:17): [True: 193, False: 15]
  |  Branch (2334:35): [True: 0, False: 193]
  ------------------
 2335|      0|                if (IsTapscript(ctx.MsContext())) return {};
  ------------------
  |  Branch (2335:21): [True: 0, False: 0]
  ------------------
 2336|      0|                std::vector<Key> keys;
 2337|      0|                const auto n = ParseScriptNumber(in[1]);
 2338|      0|                if (!n || last - in < 3 + *n) return {};
  ------------------
  |  Branch (2338:21): [True: 0, False: 0]
  |  Branch (2338:27): [True: 0, False: 0]
  ------------------
 2339|      0|                if (*n < 1 || *n > 20) return {};
  ------------------
  |  Branch (2339:21): [True: 0, False: 0]
  |  Branch (2339:31): [True: 0, False: 0]
  ------------------
 2340|      0|                for (int i = 0; i < *n; ++i) {
  ------------------
  |  Branch (2340:33): [True: 0, False: 0]
  ------------------
 2341|      0|                    if (in[2 + i].second.size() != 33) return {};
  ------------------
  |  Branch (2341:25): [True: 0, False: 0]
  ------------------
 2342|      0|                    auto key = ctx.FromPKBytes(in[2 + i].second.begin(), in[2 + i].second.end());
 2343|      0|                    if (!key) return {};
  ------------------
  |  Branch (2343:25): [True: 0, False: 0]
  ------------------
 2344|      0|                    keys.push_back(std::move(*key));
 2345|      0|                }
 2346|      0|                const auto k = ParseScriptNumber(in[2 + *n]);
 2347|      0|                if (!k || *k < 1 || *k > *n) return {};
  ------------------
  |  Branch (2347:21): [True: 0, False: 0]
  |  Branch (2347:27): [True: 0, False: 0]
  |  Branch (2347:37): [True: 0, False: 0]
  ------------------
 2348|      0|                in += 3 + *n;
 2349|      0|                std::reverse(keys.begin(), keys.end());
 2350|      0|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::MULTI, std::move(keys), *k));
 2351|      0|                break;
 2352|      0|            }
 2353|       |            // Tapscript's equivalent of multi
 2354|    208|            if (last - in >= 4 && in[0].first == OP_NUMEQUAL) {
  ------------------
  |  Branch (2354:17): [True: 193, False: 15]
  |  Branch (2354:35): [True: 0, False: 193]
  ------------------
 2355|      0|                if (!IsTapscript(ctx.MsContext())) return {};
  ------------------
  |  Branch (2355:21): [True: 0, False: 0]
  ------------------
 2356|       |                // The necessary threshold of signatures.
 2357|      0|                const auto k = ParseScriptNumber(in[1]);
 2358|      0|                if (!k) return {};
  ------------------
  |  Branch (2358:21): [True: 0, False: 0]
  ------------------
 2359|      0|                if (*k < 1 || *k > MAX_PUBKEYS_PER_MULTI_A) return {};
  ------------------
  |  Branch (2359:21): [True: 0, False: 0]
  |  Branch (2359:31): [True: 0, False: 0]
  ------------------
 2360|      0|                if (last - in < 2 + *k * 2) return {};
  ------------------
  |  Branch (2360:21): [True: 0, False: 0]
  ------------------
 2361|      0|                std::vector<Key> keys;
 2362|      0|                keys.reserve(*k);
 2363|       |                // Walk through the expected (pubkey, CHECKSIG[ADD]) pairs.
 2364|      0|                for (int pos = 2;; pos += 2) {
 2365|      0|                    if (last - in < pos + 2) return {};
  ------------------
  |  Branch (2365:25): [True: 0, False: 0]
  ------------------
 2366|       |                    // Make sure it's indeed an x-only pubkey and a CHECKSIG[ADD], then parse the key.
 2367|      0|                    if (in[pos].first != OP_CHECKSIGADD && in[pos].first != OP_CHECKSIG) return {};
  ------------------
  |  Branch (2367:25): [True: 0, False: 0]
  |  Branch (2367:60): [True: 0, False: 0]
  ------------------
 2368|      0|                    if (in[pos + 1].second.size() != 32) return {};
  ------------------
  |  Branch (2368:25): [True: 0, False: 0]
  ------------------
 2369|      0|                    auto key = ctx.FromPKBytes(in[pos + 1].second.begin(), in[pos + 1].second.end());
 2370|      0|                    if (!key) return {};
  ------------------
  |  Branch (2370:25): [True: 0, False: 0]
  ------------------
 2371|      0|                    keys.push_back(std::move(*key));
 2372|       |                    // Make sure early we don't parse an arbitrary large expression.
 2373|      0|                    if (keys.size() > MAX_PUBKEYS_PER_MULTI_A) return {};
  ------------------
  |  Branch (2373:25): [True: 0, False: 0]
  ------------------
 2374|       |                    // OP_CHECKSIG means it was the last one to parse.
 2375|      0|                    if (in[pos].first == OP_CHECKSIG) break;
  ------------------
  |  Branch (2375:25): [True: 0, False: 0]
  ------------------
 2376|      0|                }
 2377|      0|                if (keys.size() < (size_t)*k) return {};
  ------------------
  |  Branch (2377:21): [True: 0, False: 0]
  ------------------
 2378|      0|                in += 2 + keys.size() * 2;
 2379|      0|                std::reverse(keys.begin(), keys.end());
 2380|      0|                constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::MULTI_A, std::move(keys), *k));
 2381|      0|                break;
 2382|      0|            }
 2383|       |            /** In the following wrappers, we only need to push SINGLE_BKV_EXPR rather
 2384|       |             * than BKV_EXPR, because and_v commutes with these wrappers. For example,
 2385|       |             * c:and_v(X,Y) produces the same script as and_v(X,c:Y). */
 2386|       |            // c: wrapper
 2387|    208|            if (in[0].first == OP_CHECKSIG) {
  ------------------
  |  Branch (2387:17): [True: 17, False: 191]
  ------------------
 2388|     17|                ++in;
 2389|     17|                to_parse.emplace_back(DecodeContext::CHECK, -1, -1);
 2390|     17|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2391|     17|                break;
 2392|     17|            }
 2393|       |            // v: wrapper
 2394|    191|            if (in[0].first == OP_VERIFY) {
  ------------------
  |  Branch (2394:17): [True: 1, False: 190]
  ------------------
 2395|      1|                ++in;
 2396|      1|                to_parse.emplace_back(DecodeContext::VERIFY, -1, -1);
 2397|      1|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2398|      1|                break;
 2399|      1|            }
 2400|       |            // n: wrapper
 2401|    190|            if (in[0].first == OP_0NOTEQUAL) {
  ------------------
  |  Branch (2401:17): [True: 0, False: 190]
  ------------------
 2402|      0|                ++in;
 2403|      0|                to_parse.emplace_back(DecodeContext::ZERO_NOTEQUAL, -1, -1);
 2404|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2405|      0|                break;
 2406|      0|            }
 2407|       |            // Thresh
 2408|    190|            if (last - in >= 3 && in[0].first == OP_EQUAL && (num = ParseScriptNumber(in[1]))) {
  ------------------
  |  Branch (2408:17): [True: 177, False: 13]
  |  Branch (2408:17): [True: 0, False: 190]
  |  Branch (2408:35): [True: 0, False: 177]
  |  Branch (2408:62): [True: 0, False: 0]
  ------------------
 2409|      0|                if (*num < 1) return {};
  ------------------
  |  Branch (2409:21): [True: 0, False: 0]
  ------------------
 2410|      0|                in += 2;
 2411|      0|                to_parse.emplace_back(DecodeContext::THRESH_W, 0, *num);
 2412|      0|                break;
 2413|      0|            }
 2414|       |            // OP_ENDIF can be WRAP_J, WRAP_D, ANDOR, OR_C, OR_D, or OR_I
 2415|    190|            if (in[0].first == OP_ENDIF) {
  ------------------
  |  Branch (2415:17): [True: 0, False: 190]
  ------------------
 2416|      0|                ++in;
 2417|      0|                to_parse.emplace_back(DecodeContext::ENDIF, -1, -1);
 2418|      0|                to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2419|      0|                break;
 2420|      0|            }
 2421|       |            /** In and_b and or_b nodes, we only look for SINGLE_BKV_EXPR, because
 2422|       |             * or_b(and_v(X,Y),Z) has script [X] [Y] [Z] OP_BOOLOR, the same as
 2423|       |             * and_v(X,or_b(Y,Z)). In this example, the former of these is invalid as
 2424|       |             * miniscript, while the latter is valid. So we leave the and_v "outside"
 2425|       |             * while decoding. */
 2426|       |            // and_b
 2427|    190|            if (in[0].first == OP_BOOLAND) {
  ------------------
  |  Branch (2427:17): [True: 0, False: 190]
  ------------------
 2428|      0|                ++in;
 2429|      0|                to_parse.emplace_back(DecodeContext::AND_B, -1, -1);
 2430|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2431|      0|                to_parse.emplace_back(DecodeContext::W_EXPR, -1, -1);
 2432|      0|                break;
 2433|      0|            }
 2434|       |            // or_b
 2435|    190|            if (in[0].first == OP_BOOLOR) {
  ------------------
  |  Branch (2435:17): [True: 0, False: 190]
  ------------------
 2436|      0|                ++in;
 2437|      0|                to_parse.emplace_back(DecodeContext::OR_B, -1, -1);
 2438|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2439|      0|                to_parse.emplace_back(DecodeContext::W_EXPR, -1, -1);
 2440|      0|                break;
 2441|      0|            }
 2442|       |            // Unrecognised expression
 2443|    190|            return {};
 2444|    190|        }
 2445|  1.92k|        case DecodeContext::BKV_EXPR: {
  ------------------
  |  Branch (2445:9): [True: 1.92k, False: 2.44k]
  ------------------
 2446|  1.92k|            to_parse.emplace_back(DecodeContext::MAYBE_AND_V, -1, -1);
 2447|  1.92k|            to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2448|  1.92k|            break;
 2449|    190|        }
 2450|      0|        case DecodeContext::W_EXPR: {
  ------------------
  |  Branch (2450:9): [True: 0, False: 4.36k]
  ------------------
 2451|       |            // a: wrapper
 2452|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2452:17): [True: 0, False: 0]
  ------------------
 2453|      0|            if (in[0].first == OP_FROMALTSTACK) {
  ------------------
  |  Branch (2453:17): [True: 0, False: 0]
  ------------------
 2454|      0|                ++in;
 2455|      0|                to_parse.emplace_back(DecodeContext::ALT, -1, -1);
 2456|      0|            } else {
 2457|      0|                to_parse.emplace_back(DecodeContext::SWAP, -1, -1);
 2458|      0|            }
 2459|      0|            to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2460|      0|            break;
 2461|      0|        }
 2462|    484|        case DecodeContext::MAYBE_AND_V: {
  ------------------
  |  Branch (2462:9): [True: 484, False: 3.87k]
  ------------------
 2463|       |            // If we reach a potential AND_V top-level, check if the next part of the script could be another AND_V child
 2464|       |            // These op-codes cannot end any well-formed miniscript so cannot be used in an and_v node.
 2465|    484|            if (in < last && in[0].first != OP_IF && in[0].first != OP_ELSE && in[0].first != OP_NOTIF && in[0].first != OP_TOALTSTACK && in[0].first != OP_SWAP) {
  ------------------
  |  Branch (2465:17): [True: 396, False: 88]
  |  Branch (2465:30): [True: 396, False: 0]
  |  Branch (2465:54): [True: 396, False: 0]
  |  Branch (2465:80): [True: 396, False: 0]
  |  Branch (2465:107): [True: 396, False: 0]
  |  Branch (2465:139): [True: 396, False: 0]
  ------------------
 2466|    396|                to_parse.emplace_back(DecodeContext::AND_V, -1, -1);
 2467|       |                // BKV_EXPR can contain more AND_V nodes
 2468|    396|                to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2469|    396|            }
 2470|    484|            break;
 2471|      0|        }
 2472|      0|        case DecodeContext::SWAP: {
  ------------------
  |  Branch (2472:9): [True: 0, False: 4.36k]
  ------------------
 2473|      0|            if (in >= last || in[0].first != OP_SWAP || constructed.empty()) return {};
  ------------------
  |  Branch (2473:17): [True: 0, False: 0]
  |  Branch (2473:31): [True: 0, False: 0]
  |  Branch (2473:57): [True: 0, False: 0]
  ------------------
 2474|      0|            ++in;
 2475|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_S, Vector(std::move(constructed.back())));
 2476|      0|            break;
 2477|      0|        }
 2478|      0|        case DecodeContext::ALT: {
  ------------------
  |  Branch (2478:9): [True: 0, False: 4.36k]
  ------------------
 2479|      0|            if (in >= last || in[0].first != OP_TOALTSTACK || constructed.empty()) return {};
  ------------------
  |  Branch (2479:17): [True: 0, False: 0]
  |  Branch (2479:31): [True: 0, False: 0]
  |  Branch (2479:63): [True: 0, False: 0]
  ------------------
 2480|      0|            ++in;
 2481|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_A, Vector(std::move(constructed.back())));
 2482|      0|            break;
 2483|      0|        }
 2484|      0|        case DecodeContext::CHECK: {
  ------------------
  |  Branch (2484:9): [True: 0, False: 4.36k]
  ------------------
 2485|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2485:17): [True: 0, False: 0]
  ------------------
 2486|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_C, Vector(std::move(constructed.back())));
 2487|      0|            break;
 2488|      0|        }
 2489|      0|        case DecodeContext::DUP_IF: {
  ------------------
  |  Branch (2489:9): [True: 0, False: 4.36k]
  ------------------
 2490|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2490:17): [True: 0, False: 0]
  ------------------
 2491|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_D, Vector(std::move(constructed.back())));
 2492|      0|            break;
 2493|      0|        }
 2494|      0|        case DecodeContext::VERIFY: {
  ------------------
  |  Branch (2494:9): [True: 0, False: 4.36k]
  ------------------
 2495|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2495:17): [True: 0, False: 0]
  ------------------
 2496|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_V, Vector(std::move(constructed.back())));
 2497|      0|            break;
 2498|      0|        }
 2499|      0|        case DecodeContext::NON_ZERO: {
  ------------------
  |  Branch (2499:9): [True: 0, False: 4.36k]
  ------------------
 2500|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2500:17): [True: 0, False: 0]
  ------------------
 2501|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_J, Vector(std::move(constructed.back())));
 2502|      0|            break;
 2503|      0|        }
 2504|      0|        case DecodeContext::ZERO_NOTEQUAL: {
  ------------------
  |  Branch (2504:9): [True: 0, False: 4.36k]
  ------------------
 2505|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2505:17): [True: 0, False: 0]
  ------------------
 2506|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_N, Vector(std::move(constructed.back())));
 2507|      0|            break;
 2508|      0|        }
 2509|     17|        case DecodeContext::AND_V: {
  ------------------
  |  Branch (2509:9): [True: 17, False: 4.34k]
  ------------------
 2510|     17|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2510:17): [True: 0, False: 17]
  ------------------
 2511|     17|            BuildBack(ctx.MsContext(), Fragment::AND_V, constructed, /*reverse=*/true);
 2512|     17|            break;
 2513|     17|        }
 2514|      0|        case DecodeContext::AND_B: {
  ------------------
  |  Branch (2514:9): [True: 0, False: 4.36k]
  ------------------
 2515|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2515:17): [True: 0, False: 0]
  ------------------
 2516|      0|            BuildBack(ctx.MsContext(), Fragment::AND_B, constructed, /*reverse=*/true);
 2517|      0|            break;
 2518|      0|        }
 2519|      0|        case DecodeContext::OR_B: {
  ------------------
  |  Branch (2519:9): [True: 0, False: 4.36k]
  ------------------
 2520|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2520:17): [True: 0, False: 0]
  ------------------
 2521|      0|            BuildBack(ctx.MsContext(), Fragment::OR_B, constructed, /*reverse=*/true);
 2522|      0|            break;
 2523|      0|        }
 2524|      0|        case DecodeContext::OR_C: {
  ------------------
  |  Branch (2524:9): [True: 0, False: 4.36k]
  ------------------
 2525|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2525:17): [True: 0, False: 0]
  ------------------
 2526|      0|            BuildBack(ctx.MsContext(), Fragment::OR_C, constructed, /*reverse=*/true);
 2527|      0|            break;
 2528|      0|        }
 2529|      0|        case DecodeContext::OR_D: {
  ------------------
  |  Branch (2529:9): [True: 0, False: 4.36k]
  ------------------
 2530|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2530:17): [True: 0, False: 0]
  ------------------
 2531|      0|            BuildBack(ctx.MsContext(), Fragment::OR_D, constructed, /*reverse=*/true);
 2532|      0|            break;
 2533|      0|        }
 2534|      0|        case DecodeContext::ANDOR: {
  ------------------
  |  Branch (2534:9): [True: 0, False: 4.36k]
  ------------------
 2535|      0|            if (constructed.size() < 3) return {};
  ------------------
  |  Branch (2535:17): [True: 0, False: 0]
  ------------------
 2536|      0|            NodeRef<Key> left = std::move(constructed.back());
 2537|      0|            constructed.pop_back();
 2538|      0|            NodeRef<Key> right = std::move(constructed.back());
 2539|      0|            constructed.pop_back();
 2540|      0|            NodeRef<Key> mid = std::move(constructed.back());
 2541|      0|            constructed.back() = MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::ANDOR, Vector(std::move(left), std::move(mid), std::move(right)));
 2542|      0|            break;
 2543|      0|        }
 2544|      0|        case DecodeContext::THRESH_W: {
  ------------------
  |  Branch (2544:9): [True: 0, False: 4.36k]
  ------------------
 2545|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2545:17): [True: 0, False: 0]
  ------------------
 2546|      0|            if (in[0].first == OP_ADD) {
  ------------------
  |  Branch (2546:17): [True: 0, False: 0]
  ------------------
 2547|      0|                ++in;
 2548|      0|                to_parse.emplace_back(DecodeContext::THRESH_W, n+1, k);
 2549|      0|                to_parse.emplace_back(DecodeContext::W_EXPR, -1, -1);
 2550|      0|            } else {
 2551|      0|                to_parse.emplace_back(DecodeContext::THRESH_E, n+1, k);
 2552|       |                // All children of thresh have type modifier d, so cannot be and_v
 2553|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2554|      0|            }
 2555|      0|            break;
 2556|      0|        }
 2557|      0|        case DecodeContext::THRESH_E: {
  ------------------
  |  Branch (2557:9): [True: 0, False: 4.36k]
  ------------------
 2558|      0|            if (k < 1 || k > n || constructed.size() < static_cast<size_t>(n)) return {};
  ------------------
  |  Branch (2558:17): [True: 0, False: 0]
  |  Branch (2558:26): [True: 0, False: 0]
  |  Branch (2558:35): [True: 0, False: 0]
  ------------------
 2559|      0|            std::vector<NodeRef<Key>> subs;
 2560|      0|            for (int i = 0; i < n; ++i) {
  ------------------
  |  Branch (2560:29): [True: 0, False: 0]
  ------------------
 2561|      0|                NodeRef<Key> sub = std::move(constructed.back());
 2562|      0|                constructed.pop_back();
 2563|      0|                subs.push_back(std::move(sub));
 2564|      0|            }
 2565|      0|            constructed.push_back(MakeNodeRef<Key>(internal::NoDupCheck{}, ctx.MsContext(), Fragment::THRESH, std::move(subs), k));
 2566|      0|            break;
 2567|      0|        }
 2568|      0|        case DecodeContext::ENDIF: {
  ------------------
  |  Branch (2568:9): [True: 0, False: 4.36k]
  ------------------
 2569|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2569:17): [True: 0, False: 0]
  ------------------
 2570|       |
 2571|       |            // could be andor or or_i
 2572|      0|            if (in[0].first == OP_ELSE) {
  ------------------
  |  Branch (2572:17): [True: 0, False: 0]
  ------------------
 2573|      0|                ++in;
 2574|      0|                to_parse.emplace_back(DecodeContext::ENDIF_ELSE, -1, -1);
 2575|      0|                to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2576|      0|            }
 2577|       |            // could be j: or d: wrapper
 2578|      0|            else if (in[0].first == OP_IF) {
  ------------------
  |  Branch (2578:22): [True: 0, False: 0]
  ------------------
 2579|      0|                if (last - in >= 2 && in[1].first == OP_DUP) {
  ------------------
  |  Branch (2579:21): [True: 0, False: 0]
  |  Branch (2579:39): [True: 0, False: 0]
  ------------------
 2580|      0|                    in += 2;
 2581|      0|                    to_parse.emplace_back(DecodeContext::DUP_IF, -1, -1);
 2582|      0|                } else if (last - in >= 3 && in[1].first == OP_0NOTEQUAL && in[2].first == OP_SIZE) {
  ------------------
  |  Branch (2582:28): [True: 0, False: 0]
  |  Branch (2582:46): [True: 0, False: 0]
  |  Branch (2582:77): [True: 0, False: 0]
  ------------------
 2583|      0|                    in += 3;
 2584|      0|                    to_parse.emplace_back(DecodeContext::NON_ZERO, -1, -1);
 2585|      0|                }
 2586|      0|                else {
 2587|      0|                    return {};
 2588|      0|                }
 2589|       |            // could be or_c or or_d
 2590|      0|            } else if (in[0].first == OP_NOTIF) {
  ------------------
  |  Branch (2590:24): [True: 0, False: 0]
  ------------------
 2591|      0|                ++in;
 2592|      0|                to_parse.emplace_back(DecodeContext::ENDIF_NOTIF, -1, -1);
 2593|      0|            }
 2594|      0|            else {
 2595|      0|                return {};
 2596|      0|            }
 2597|      0|            break;
 2598|      0|        }
 2599|      0|        case DecodeContext::ENDIF_NOTIF: {
  ------------------
  |  Branch (2599:9): [True: 0, False: 4.36k]
  ------------------
 2600|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2600:17): [True: 0, False: 0]
  ------------------
 2601|      0|            if (in[0].first == OP_IFDUP) {
  ------------------
  |  Branch (2601:17): [True: 0, False: 0]
  ------------------
 2602|      0|                ++in;
 2603|      0|                to_parse.emplace_back(DecodeContext::OR_D, -1, -1);
 2604|      0|            } else {
 2605|      0|                to_parse.emplace_back(DecodeContext::OR_C, -1, -1);
 2606|      0|            }
 2607|       |            // or_c and or_d both require X to have type modifier d so, can't contain and_v
 2608|      0|            to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2609|      0|            break;
 2610|      0|        }
 2611|      0|        case DecodeContext::ENDIF_ELSE: {
  ------------------
  |  Branch (2611:9): [True: 0, False: 4.36k]
  ------------------
 2612|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2612:17): [True: 0, False: 0]
  ------------------
 2613|      0|            if (in[0].first == OP_IF) {
  ------------------
  |  Branch (2613:17): [True: 0, False: 0]
  ------------------
 2614|      0|                ++in;
 2615|      0|                BuildBack(ctx.MsContext(), Fragment::OR_I, constructed, /*reverse=*/true);
 2616|      0|            } else if (in[0].first == OP_NOTIF) {
  ------------------
  |  Branch (2616:24): [True: 0, False: 0]
  ------------------
 2617|      0|                ++in;
 2618|      0|                to_parse.emplace_back(DecodeContext::ANDOR, -1, -1);
 2619|       |                // andor requires X to have type modifier d, so it can't be and_v
 2620|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2621|      0|            } else {
 2622|      0|                return {};
 2623|      0|            }
 2624|      0|            break;
 2625|      0|        }
 2626|  4.36k|        }
 2627|  4.36k|    }
 2628|     81|    if (constructed.size() != 1) return {};
  ------------------
  |  Branch (2628:9): [True: 0, False: 81]
  ------------------
 2629|     81|    NodeRef<Key> tl_node = std::move(constructed.front());
 2630|     81|    tl_node->DuplicateKeyCheck(ctx);
 2631|       |    // Note that due to how ComputeType works (only assign the type to the node if the
 2632|       |    // subs' types are valid) this would fail if any node of tree is badly typed.
 2633|     81|    if (!tl_node->IsValidTopLevel()) return {};
  ------------------
  |  Branch (2633:9): [True: 10, False: 71]
  ------------------
 2634|     71|    return tl_node;
 2635|     81|}
_ZNK10miniscript4NodeI7CPubKeyE17DuplicateKeyCheckI12WshSatisfierEEvRKT_:
 1441|     81|    {
 1442|       |        // We cannot use a lambda here, as lambdas are non assignable, and the set operations
 1443|       |        // below require moving the comparators around.
 1444|     81|        struct Comp {
 1445|     81|            const Ctx* ctx_ptr;
 1446|     81|            Comp(const Ctx& ctx) : ctx_ptr(&ctx) {}
 1447|     81|            bool operator()(const Key& a, const Key& b) const { return ctx_ptr->KeyCompare(a, b); }
 1448|     81|        };
 1449|       |
 1450|       |        // state in the recursive computation:
 1451|       |        // - std::nullopt means "this node has duplicates"
 1452|       |        // - an std::set means "this node has no duplicate keys, and they are: ...".
 1453|     81|        using keyset = std::set<Key, Comp>;
 1454|     81|        using state = std::optional<keyset>;
 1455|       |
 1456|     81|        auto upfn = [&ctx](const Node& node, Span<state> subs) -> state {
 1457|       |            // If this node is already known to have duplicates, nothing left to do.
 1458|     81|            if (node.has_duplicate_keys.has_value() && *node.has_duplicate_keys) return {};
 1459|       |
 1460|       |            // Check if one of the children is already known to have duplicates.
 1461|     81|            for (auto& sub : subs) {
 1462|     81|                if (!sub.has_value()) {
 1463|     81|                    node.has_duplicate_keys = true;
 1464|     81|                    return {};
 1465|     81|                }
 1466|     81|            }
 1467|       |
 1468|       |            // Start building the set of keys involved in this node and children.
 1469|       |            // Start by keys in this node directly.
 1470|     81|            size_t keys_count = node.keys.size();
 1471|     81|            keyset key_set{node.keys.begin(), node.keys.end(), Comp(ctx)};
 1472|     81|            if (key_set.size() != keys_count) {
 1473|       |                // It already has duplicates; bail out.
 1474|     81|                node.has_duplicate_keys = true;
 1475|     81|                return {};
 1476|     81|            }
 1477|       |
 1478|       |            // Merge the keys from the children into this set.
 1479|     81|            for (auto& sub : subs) {
 1480|     81|                keys_count += sub->size();
 1481|       |                // Small optimization: std::set::merge is linear in the size of the second arg but
 1482|       |                // logarithmic in the size of the first.
 1483|     81|                if (key_set.size() < sub->size()) std::swap(key_set, *sub);
 1484|     81|                key_set.merge(*sub);
 1485|     81|                if (key_set.size() != keys_count) {
 1486|     81|                    node.has_duplicate_keys = true;
 1487|     81|                    return {};
 1488|     81|                }
 1489|     81|            }
 1490|       |
 1491|     81|            node.has_duplicate_keys = false;
 1492|     81|            return key_set;
 1493|     81|        };
 1494|       |
 1495|     81|        TreeEval<state>(upfn);
 1496|     81|    }
_ZNK10miniscript4NodeI7CPubKeyE8TreeEvalINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS7_IS8_EEvSB_EUlRKS2_4SpanISG_EE_EES9_T0_:
  699|     81|    {
  700|     81|        struct DummyState {};
  701|     81|        return std::move(*TreeEvalMaybe<Result>(DummyState{},
  702|     81|            [](DummyState, const Node&, size_t) { return DummyState{}; },
  703|     81|            [&upfn](DummyState, const Node& node, Span<Result> subs) {
  704|     81|                Result res{upfn(node, subs)};
  705|     81|                return std::optional<Result>(std::move(res));
  706|     81|            }
  707|     81|        ));
  708|     81|    }
_ZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS2_8TreeEvalISG_ZNKS7_IS8_EEvSB_EUlRKS2_4SpanISG_EE_EES9_T0_E10DummyStateZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_mE_ZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_SL_E_EENS5_IS9_EESN_T1_T2_:
  605|     81|    {
  606|       |        /** Entries of the explicit stack tracked in this algorithm. */
  607|     81|        struct StackElem
  608|     81|        {
  609|     81|            const Node& node; //!< The node being evaluated.
  610|     81|            size_t expanded; //!< How many children of this node have been expanded.
  611|     81|            State state; //!< The state for that node.
  612|       |
  613|     81|            StackElem(const Node& node_, size_t exp_, State&& state_) :
  614|     81|                node(node_), expanded(exp_), state(std::move(state_)) {}
  615|     81|        };
  616|       |        /* Stack of tree nodes being explored. */
  617|     81|        std::vector<StackElem> stack;
  618|       |        /* Results of subtrees so far. Their order and mapping to tree nodes
  619|       |         * is implicitly defined by stack. */
  620|     81|        std::vector<Result> results;
  621|     81|        stack.emplace_back(*this, 0, std::move(root_state));
  622|       |
  623|       |        /* Here is a demonstration of the algorithm, for an example tree A(B,C(D,E),F).
  624|       |         * State variables are omitted for simplicity.
  625|       |         *
  626|       |         * First: stack=[(A,0)] results=[]
  627|       |         *        stack=[(A,1),(B,0)] results=[]
  628|       |         *        stack=[(A,1)] results=[B]
  629|       |         *        stack=[(A,2),(C,0)] results=[B]
  630|       |         *        stack=[(A,2),(C,1),(D,0)] results=[B]
  631|       |         *        stack=[(A,2),(C,1)] results=[B,D]
  632|       |         *        stack=[(A,2),(C,2),(E,0)] results=[B,D]
  633|       |         *        stack=[(A,2),(C,2)] results=[B,D,E]
  634|       |         *        stack=[(A,2)] results=[B,C]
  635|       |         *        stack=[(A,3),(F,0)] results=[B,C]
  636|       |         *        stack=[(A,3)] results=[B,C,F]
  637|       |         * Final: stack=[] results=[A]
  638|       |         */
  639|    202|        while (stack.size()) {
  ------------------
  |  Branch (639:16): [True: 121, False: 81]
  ------------------
  640|    121|            const Node& node = stack.back().node;
  641|    121|            if (stack.back().expanded < node.subs.size()) {
  ------------------
  |  Branch (641:17): [True: 20, False: 101]
  ------------------
  642|       |                /* We encounter a tree node with at least one unexpanded child.
  643|       |                 * Expand it. By the time we hit this node again, the result of
  644|       |                 * that child (and all earlier children) will be at the end of `results`. */
  645|     20|                size_t child_index = stack.back().expanded++;
  646|     20|                State child_state = downfn(stack.back().state, node, child_index);
  647|     20|                stack.emplace_back(*node.subs[child_index], 0, std::move(child_state));
  648|     20|                continue;
  649|     20|            }
  650|       |            // Invoke upfn with the last node.subs.size() elements of results as input.
  651|    101|            assert(results.size() >= node.subs.size());
  652|    101|            std::optional<Result> result{upfn(std::move(stack.back().state), node,
  653|    101|                Span<Result>{results}.last(node.subs.size()))};
  654|       |            // If evaluation returns std::nullopt, abort immediately.
  655|    101|            if (!result) return {};
  ------------------
  |  Branch (655:17): [True: 0, False: 101]
  ------------------
  656|       |            // Replace the last node.subs.size() elements of results with the new result.
  657|    101|            results.erase(results.end() - node.subs.size(), results.end());
  658|    101|            results.push_back(std::move(*result));
  659|    101|            stack.pop_back();
  660|    101|        }
  661|       |        // The final remaining results element is the root result, return it.
  662|     81|        assert(results.size() == 1);
  663|     81|        return std::move(results[0]);
  664|     81|    }
_ZZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS2_8TreeEvalISG_ZNKS7_IS8_EEvSB_EUlRKS2_4SpanISG_EE_EES9_T0_E10DummyStateZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_mE_ZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_SL_E_EENS5_IS9_EESN_T1_T2_EN9StackElemC2ESJ_mOSO_:
  614|    101|                node(node_), expanded(exp_), state(std::move(state_)) {}
_ZZNK10miniscript4NodeI7CPubKeyE8TreeEvalINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS7_IS8_EEvSB_EUlRKS2_4SpanISG_EE_EES9_T0_ENKUlZNKS3_ISG_SL_EES9_SM_E10DummyStateSI_mE_clESN_SI_m:
  702|     20|            [](DummyState, const Node&, size_t) { return DummyState{}; },
_ZZNK10miniscript4NodeI7CPubKeyE8TreeEvalINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS7_IS8_EEvSB_EUlRKS2_4SpanISG_EE_EES9_T0_ENKUlZNKS3_ISG_SL_EES9_SM_E10DummyStateSI_SK_E_clESN_SI_SK_:
  703|    101|            [&upfn](DummyState, const Node& node, Span<Result> subs) {
  704|    101|                Result res{upfn(node, subs)};
  705|    101|                return std::optional<Result>(std::move(res));
  706|    101|            }
_ZZNK10miniscript4NodeI7CPubKeyE17DuplicateKeyCheckI12WshSatisfierEEvRKT_ENKUlRKS2_4SpanINSt3__18optionalINSB_3setIS1_ZNKS3_IS4_EEvS7_E4CompNSB_9allocatorIS1_EEEEEEEE_clES9_SJ_:
 1456|    101|        auto upfn = [&ctx](const Node& node, Span<state> subs) -> state {
 1457|       |            // If this node is already known to have duplicates, nothing left to do.
 1458|    101|            if (node.has_duplicate_keys.has_value() && *node.has_duplicate_keys) return {};
  ------------------
  |  Branch (1458:17): [True: 0, False: 101]
  |  Branch (1458:56): [True: 0, False: 0]
  ------------------
 1459|       |
 1460|       |            // Check if one of the children is already known to have duplicates.
 1461|    101|            for (auto& sub : subs) {
  ------------------
  |  Branch (1461:28): [True: 20, False: 101]
  ------------------
 1462|     20|                if (!sub.has_value()) {
  ------------------
  |  Branch (1462:21): [True: 0, False: 20]
  ------------------
 1463|      0|                    node.has_duplicate_keys = true;
 1464|      0|                    return {};
 1465|      0|                }
 1466|     20|            }
 1467|       |
 1468|       |            // Start building the set of keys involved in this node and children.
 1469|       |            // Start by keys in this node directly.
 1470|    101|            size_t keys_count = node.keys.size();
 1471|    101|            keyset key_set{node.keys.begin(), node.keys.end(), Comp(ctx)};
 1472|    101|            if (key_set.size() != keys_count) {
  ------------------
  |  Branch (1472:17): [True: 0, False: 101]
  ------------------
 1473|       |                // It already has duplicates; bail out.
 1474|      0|                node.has_duplicate_keys = true;
 1475|      0|                return {};
 1476|      0|            }
 1477|       |
 1478|       |            // Merge the keys from the children into this set.
 1479|    101|            for (auto& sub : subs) {
  ------------------
  |  Branch (1479:28): [True: 20, False: 101]
  ------------------
 1480|     20|                keys_count += sub->size();
 1481|       |                // Small optimization: std::set::merge is linear in the size of the second arg but
 1482|       |                // logarithmic in the size of the first.
 1483|     20|                if (key_set.size() < sub->size()) std::swap(key_set, *sub);
  ------------------
  |  Branch (1483:21): [True: 0, False: 20]
  ------------------
 1484|     20|                key_set.merge(*sub);
 1485|     20|                if (key_set.size() != keys_count) {
  ------------------
  |  Branch (1485:21): [True: 0, False: 20]
  ------------------
 1486|      0|                    node.has_duplicate_keys = true;
 1487|      0|                    return {};
 1488|      0|                }
 1489|     20|            }
 1490|       |
 1491|    101|            node.has_duplicate_keys = false;
 1492|    101|            return key_set;
 1493|    101|        };
_ZZNK10miniscript4NodeI7CPubKeyE17DuplicateKeyCheckI12WshSatisfierEEvRKT_EN4CompC2ERKS4_:
 1446|    101|            Comp(const Ctx& ctx) : ctx_ptr(&ctx) {}
_ZNK10miniscript4NodeI7CPubKeyE7SatisfyI12WshSatisfierEENS_12AvailabilityERKT_RNSt3__16vectorINSA_IhNS9_9allocatorIhEEEENSB_ISD_EEEEb:
 1648|     71|    Availability Satisfy(const Ctx& ctx, std::vector<std::vector<unsigned char>>& stack, bool nonmalleable = true) const {
 1649|     71|        auto ret = ProduceInput(ctx);
 1650|     71|        if (nonmalleable && (ret.sat.malleable || !ret.sat.has_sig)) return Availability::NO;
  ------------------
  |  Branch (1650:13): [True: 71, False: 0]
  |  Branch (1650:30): [True: 0, False: 71]
  |  Branch (1650:51): [True: 71, False: 0]
  ------------------
 1651|      0|        stack = std::move(ret.sat.stack);
 1652|      0|        return ret.sat.available;
 1653|     71|    }
_ZNK10miniscript4NodeI7CPubKeyE12ProduceInputI12WshSatisfierEENS_8internal11InputResultERKT_:
 1187|     71|    internal::InputResult ProduceInput(const Ctx& ctx) const {
 1188|     71|        using namespace internal;
 1189|       |
 1190|       |        // Internal function which is invoked for every tree node, constructing satisfaction/dissatisfactions
 1191|       |        // given those of its subnodes.
 1192|     71|        auto helper = [&ctx](const Node& node, Span<InputResult> subres) -> InputResult {
 1193|     71|            switch (node.fragment) {
 1194|     71|                case Fragment::PK_K: {
 1195|     71|                    std::vector<unsigned char> sig;
 1196|     71|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1197|     71|                    return {ZERO, InputStack(std::move(sig)).SetWithSig().SetAvailable(avail)};
 1198|     71|                }
 1199|     71|                case Fragment::PK_H: {
 1200|     71|                    std::vector<unsigned char> key = ctx.ToPKBytes(node.keys[0]), sig;
 1201|     71|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1202|     71|                    return {ZERO + InputStack(key), (InputStack(std::move(sig)).SetWithSig() + InputStack(key)).SetAvailable(avail)};
 1203|     71|                }
 1204|     71|                case Fragment::MULTI_A: {
 1205|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1206|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1207|     71|                    std::vector<InputStack> sats = Vector(EMPTY);
 1208|     71|                    for (size_t i = 0; i < node.keys.size(); ++i) {
 1209|       |                        // Get the signature for the i'th key in reverse order (the signature for the first key needs to
 1210|       |                        // be at the top of the stack, contrary to CHECKMULTISIG's satisfaction).
 1211|     71|                        std::vector<unsigned char> sig;
 1212|     71|                        Availability avail = ctx.Sign(node.keys[node.keys.size() - 1 - i], sig);
 1213|       |                        // Compute signature stack for just this key.
 1214|     71|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1215|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1216|       |                        // next_sats[j] are equal to either the existing sats[j] + ZERO, or sats[j-1] plus a signature
 1217|       |                        // for the current (i'th) key. The very last element needs all signatures filled.
 1218|     71|                        std::vector<InputStack> next_sats;
 1219|     71|                        next_sats.push_back(sats[0] + ZERO);
 1220|     71|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + ZERO) | (std::move(sats[j - 1]) + sat));
 1221|     71|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1222|       |                        // Switch over.
 1223|     71|                        sats = std::move(next_sats);
 1224|     71|                    }
 1225|       |                    // The dissatisfaction consists of as many empty vectors as there are keys, which is the same as
 1226|       |                    // satisfying 0 keys.
 1227|     71|                    auto& nsat{sats[0]};
 1228|     71|                    assert(node.k != 0);
 1229|     71|                    assert(node.k <= sats.size());
 1230|     71|                    return {std::move(nsat), std::move(sats[node.k])};
 1231|     71|                }
 1232|     71|                case Fragment::MULTI: {
 1233|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1234|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1235|       |                    // sats[0] starts off being {0}, due to the CHECKMULTISIG bug that pops off one element too many.
 1236|     71|                    std::vector<InputStack> sats = Vector(ZERO);
 1237|     71|                    for (size_t i = 0; i < node.keys.size(); ++i) {
 1238|     71|                        std::vector<unsigned char> sig;
 1239|     71|                        Availability avail = ctx.Sign(node.keys[i], sig);
 1240|       |                        // Compute signature stack for just the i'th key.
 1241|     71|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1242|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1243|       |                        // next_sats[j] are equal to either the existing sats[j], or sats[j-1] plus a signature for the
 1244|       |                        // current (i'th) key. The very last element needs all signatures filled.
 1245|     71|                        std::vector<InputStack> next_sats;
 1246|     71|                        next_sats.push_back(sats[0]);
 1247|     71|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back(sats[j] | (std::move(sats[j - 1]) + sat));
 1248|     71|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1249|       |                        // Switch over.
 1250|     71|                        sats = std::move(next_sats);
 1251|     71|                    }
 1252|       |                    // The dissatisfaction consists of k+1 stack elements all equal to 0.
 1253|     71|                    InputStack nsat = ZERO;
 1254|     71|                    for (size_t i = 0; i < node.k; ++i) nsat = std::move(nsat) + ZERO;
 1255|     71|                    assert(node.k <= sats.size());
 1256|     71|                    return {std::move(nsat), std::move(sats[node.k])};
 1257|     71|                }
 1258|     71|                case Fragment::THRESH: {
 1259|       |                    // sats[k] represents the best stack that satisfies k out of the *last* i subexpressions.
 1260|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1261|       |                    // sats[0] starts off empty.
 1262|     71|                    std::vector<InputStack> sats = Vector(EMPTY);
 1263|     71|                    for (size_t i = 0; i < subres.size(); ++i) {
 1264|       |                        // Introduce an alias for the i'th last satisfaction/dissatisfaction.
 1265|     71|                        auto& res = subres[subres.size() - i - 1];
 1266|       |                        // Compute the next sats vector: next_sats[0] is sats[0] plus res.nsat (thus containing all dissatisfactions
 1267|       |                        // so far. next_sats[j] is either sats[j] + res.nsat (reusing j earlier satisfactions) or sats[j-1] + res.sat
 1268|       |                        // (reusing j-1 earlier satisfactions plus a new one). The very last next_sats[j] is all satisfactions.
 1269|     71|                        std::vector<InputStack> next_sats;
 1270|     71|                        next_sats.push_back(sats[0] + res.nsat);
 1271|     71|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + res.nsat) | (std::move(sats[j - 1]) + res.sat));
 1272|     71|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(res.sat));
 1273|       |                        // Switch over.
 1274|     71|                        sats = std::move(next_sats);
 1275|     71|                    }
 1276|       |                    // At this point, sats[k].sat is the best satisfaction for the overall thresh() node. The best dissatisfaction
 1277|       |                    // is computed by gathering all sats[i].nsat for i != k.
 1278|     71|                    InputStack nsat = INVALID;
 1279|     71|                    for (size_t i = 0; i < sats.size(); ++i) {
 1280|       |                        // i==k is the satisfaction; i==0 is the canonical dissatisfaction;
 1281|       |                        // the rest are non-canonical (a no-signature dissatisfaction - the i=0
 1282|       |                        // form - is always available) and malleable (due to overcompleteness).
 1283|       |                        // Marking the solutions malleable here is not strictly necessary, as they
 1284|       |                        // should already never be picked in non-malleable solutions due to the
 1285|       |                        // availability of the i=0 form.
 1286|     71|                        if (i != 0 && i != node.k) sats[i].SetMalleable().SetNonCanon();
 1287|       |                        // Include all dissatisfactions (even these non-canonical ones) in nsat.
 1288|     71|                        if (i != node.k) nsat = std::move(nsat) | std::move(sats[i]);
 1289|     71|                    }
 1290|     71|                    assert(node.k <= sats.size());
 1291|     71|                    return {std::move(nsat), std::move(sats[node.k])};
 1292|     71|                }
 1293|     71|                case Fragment::OLDER: {
 1294|     71|                    return {INVALID, ctx.CheckOlder(node.k) ? EMPTY : INVALID};
 1295|     71|                }
 1296|     71|                case Fragment::AFTER: {
 1297|     71|                    return {INVALID, ctx.CheckAfter(node.k) ? EMPTY : INVALID};
 1298|     71|                }
 1299|     71|                case Fragment::SHA256: {
 1300|     71|                    std::vector<unsigned char> preimage;
 1301|     71|                    Availability avail = ctx.SatSHA256(node.data, preimage);
 1302|     71|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1303|     71|                }
 1304|     71|                case Fragment::RIPEMD160: {
 1305|     71|                    std::vector<unsigned char> preimage;
 1306|     71|                    Availability avail = ctx.SatRIPEMD160(node.data, preimage);
 1307|     71|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1308|     71|                }
 1309|     71|                case Fragment::HASH256: {
 1310|     71|                    std::vector<unsigned char> preimage;
 1311|     71|                    Availability avail = ctx.SatHASH256(node.data, preimage);
 1312|     71|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1313|     71|                }
 1314|     71|                case Fragment::HASH160: {
 1315|     71|                    std::vector<unsigned char> preimage;
 1316|     71|                    Availability avail = ctx.SatHASH160(node.data, preimage);
 1317|     71|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1318|     71|                }
 1319|     71|                case Fragment::AND_V: {
 1320|     71|                    auto& x = subres[0], &y = subres[1];
 1321|       |                    // As the dissatisfaction here only consist of a single option, it doesn't
 1322|       |                    // actually need to be listed (it's not required for reasoning about malleability of
 1323|       |                    // other options), and is never required (no valid miniscript relies on the ability
 1324|       |                    // to satisfy the type V left subexpression). It's still listed here for
 1325|       |                    // completeness, as a hypothetical (not currently implemented) satisfier that doesn't
 1326|       |                    // care about malleability might in some cases prefer it still.
 1327|     71|                    return {(y.nsat + x.sat).SetNonCanon(), y.sat + x.sat};
 1328|     71|                }
 1329|     71|                case Fragment::AND_B: {
 1330|     71|                    auto& x = subres[0], &y = subres[1];
 1331|       |                    // Note that it is not strictly necessary to mark the 2nd and 3rd dissatisfaction here
 1332|       |                    // as malleable. While they are definitely malleable, they are also non-canonical due
 1333|       |                    // to the guaranteed existence of a no-signature other dissatisfaction (the 1st)
 1334|       |                    // option. Because of that, the 2nd and 3rd option will never be chosen, even if they
 1335|       |                    // weren't marked as malleable.
 1336|     71|                    return {(y.nsat + x.nsat) | (y.sat + x.nsat).SetMalleable().SetNonCanon() | (y.nsat + x.sat).SetMalleable().SetNonCanon(), y.sat + x.sat};
 1337|     71|                }
 1338|     71|                case Fragment::OR_B: {
 1339|     71|                    auto& x = subres[0], &z = subres[1];
 1340|       |                    // The (sat(Z) sat(X)) solution is overcomplete (attacker can change either into dsat).
 1341|     71|                    return {z.nsat + x.nsat, (z.nsat + x.sat) | (z.sat + x.nsat) | (z.sat + x.sat).SetMalleable().SetNonCanon()};
 1342|     71|                }
 1343|     71|                case Fragment::OR_C: {
 1344|     71|                    auto& x = subres[0], &z = subres[1];
 1345|     71|                    return {INVALID, std::move(x.sat) | (z.sat + x.nsat)};
 1346|     71|                }
 1347|     71|                case Fragment::OR_D: {
 1348|     71|                    auto& x = subres[0], &z = subres[1];
 1349|     71|                    return {z.nsat + x.nsat, std::move(x.sat) | (z.sat + x.nsat)};
 1350|     71|                }
 1351|     71|                case Fragment::OR_I: {
 1352|     71|                    auto& x = subres[0], &z = subres[1];
 1353|     71|                    return {(x.nsat + ONE) | (z.nsat + ZERO), (x.sat + ONE) | (z.sat + ZERO)};
 1354|     71|                }
 1355|     71|                case Fragment::ANDOR: {
 1356|     71|                    auto& x = subres[0], &y = subres[1], &z = subres[2];
 1357|     71|                    return {(y.nsat + x.sat).SetNonCanon() | (z.nsat + x.nsat), (y.sat + x.sat) | (z.sat + x.nsat)};
 1358|     71|                }
 1359|     71|                case Fragment::WRAP_A:
 1360|     71|                case Fragment::WRAP_S:
 1361|     71|                case Fragment::WRAP_C:
 1362|     71|                case Fragment::WRAP_N:
 1363|     71|                    return std::move(subres[0]);
 1364|     71|                case Fragment::WRAP_D: {
 1365|     71|                    auto &x = subres[0];
 1366|     71|                    return {ZERO, x.sat + ONE};
 1367|     71|                }
 1368|     71|                case Fragment::WRAP_J: {
 1369|     71|                    auto &x = subres[0];
 1370|       |                    // If a dissatisfaction with a nonzero top stack element exists, an alternative dissatisfaction exists.
 1371|       |                    // As the dissatisfaction logic currently doesn't keep track of this nonzeroness property, and thus even
 1372|       |                    // if a dissatisfaction with a top zero element is found, we don't know whether another one with a
 1373|       |                    // nonzero top stack element exists. Make the conservative assumption that whenever the subexpression is weakly
 1374|       |                    // dissatisfiable, this alternative dissatisfaction exists and leads to malleability.
 1375|     71|                    return {InputStack(ZERO).SetMalleable(x.nsat.available != Availability::NO && !x.nsat.has_sig), std::move(x.sat)};
 1376|     71|                }
 1377|     71|                case Fragment::WRAP_V: {
 1378|     71|                    auto &x = subres[0];
 1379|     71|                    return {INVALID, std::move(x.sat)};
 1380|     71|                }
 1381|     71|                case Fragment::JUST_0: return {EMPTY, INVALID};
 1382|     71|                case Fragment::JUST_1: return {INVALID, EMPTY};
 1383|     71|            }
 1384|     71|            assert(false);
 1385|     71|            return {INVALID, INVALID};
 1386|     71|        };
 1387|       |
 1388|     71|        auto tester = [&helper](const Node& node, Span<InputResult> subres) -> InputResult {
 1389|     71|            auto ret = helper(node, subres);
 1390|       |
 1391|       |            // Do a consistency check between the satisfaction code and the type checker
 1392|       |            // (the actual satisfaction code in ProduceInputHelper does not use GetType)
 1393|       |
 1394|       |            // For 'z' nodes, available satisfactions/dissatisfactions must have stack size 0.
 1395|     71|            if (node.GetType() << "z"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.stack.size() == 0);
 1396|     71|            if (node.GetType() << "z"_mst && ret.sat.available != Availability::NO) assert(ret.sat.stack.size() == 0);
 1397|       |
 1398|       |            // For 'o' nodes, available satisfactions/dissatisfactions must have stack size 1.
 1399|     71|            if (node.GetType() << "o"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.stack.size() == 1);
 1400|     71|            if (node.GetType() << "o"_mst && ret.sat.available != Availability::NO) assert(ret.sat.stack.size() == 1);
 1401|       |
 1402|       |            // For 'n' nodes, available satisfactions/dissatisfactions must have stack size 1 or larger. For satisfactions,
 1403|       |            // the top element cannot be 0.
 1404|     71|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) assert(ret.sat.stack.size() >= 1);
 1405|     71|            if (node.GetType() << "n"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.stack.size() >= 1);
 1406|     71|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) assert(!ret.sat.stack.back().empty());
 1407|       |
 1408|       |            // For 'd' nodes, a dissatisfaction must exist, and they must not need a signature. If it is non-malleable,
 1409|       |            // it must be canonical.
 1410|     71|            if (node.GetType() << "d"_mst) assert(ret.nsat.available != Availability::NO);
 1411|     71|            if (node.GetType() << "d"_mst) assert(!ret.nsat.has_sig);
 1412|     71|            if (node.GetType() << "d"_mst && !ret.nsat.malleable) assert(!ret.nsat.non_canon);
 1413|       |
 1414|       |            // For 'f'/'s' nodes, dissatisfactions/satisfactions must have a signature.
 1415|     71|            if (node.GetType() << "f"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.has_sig);
 1416|     71|            if (node.GetType() << "s"_mst && ret.sat.available != Availability::NO) assert(ret.sat.has_sig);
 1417|       |
 1418|       |            // For non-malleable 'e' nodes, a non-malleable dissatisfaction must exist.
 1419|     71|            if (node.GetType() << "me"_mst) assert(ret.nsat.available != Availability::NO);
 1420|     71|            if (node.GetType() << "me"_mst) assert(!ret.nsat.malleable);
 1421|       |
 1422|       |            // For 'm' nodes, if a satisfaction exists, it must be non-malleable.
 1423|     71|            if (node.GetType() << "m"_mst && ret.sat.available != Availability::NO) assert(!ret.sat.malleable);
 1424|       |
 1425|       |            // If a non-malleable satisfaction exists, it must be canonical.
 1426|     71|            if (ret.sat.available != Availability::NO && !ret.sat.malleable) assert(!ret.sat.non_canon);
 1427|       |
 1428|     71|            return ret;
 1429|     71|        };
 1430|       |
 1431|     71|        return TreeEval<InputResult>(tester);
 1432|     71|    }
_ZNK10miniscript4NodeI7CPubKeyE8TreeEvalINS_8internal11InputResultEZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_4SpanIS5_EE0_EES8_T0_:
  699|     71|    {
  700|     71|        struct DummyState {};
  701|     71|        return std::move(*TreeEvalMaybe<Result>(DummyState{},
  702|     71|            [](DummyState, const Node&, size_t) { return DummyState{}; },
  703|     71|            [&upfn](DummyState, const Node& node, Span<Result> subs) {
  704|     71|                Result res{upfn(node, subs)};
  705|     71|                return std::optional<Result>(std::move(res));
  706|     71|            }
  707|     71|        ));
  708|     71|    }
_ZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINS_8internal11InputResultEZNKS2_8TreeEvalIS5_ZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_4SpanIS5_EE0_EES9_T0_E10DummyStateZNKS6_IS5_SG_EES9_SH_EUlSI_SD_mE_ZNKS6_IS5_SG_EES9_SH_EUlSI_SD_SF_E_EENSt3__18optionalIS9_EESH_T1_T2_:
  605|     71|    {
  606|       |        /** Entries of the explicit stack tracked in this algorithm. */
  607|     71|        struct StackElem
  608|     71|        {
  609|     71|            const Node& node; //!< The node being evaluated.
  610|     71|            size_t expanded; //!< How many children of this node have been expanded.
  611|     71|            State state; //!< The state for that node.
  612|       |
  613|     71|            StackElem(const Node& node_, size_t exp_, State&& state_) :
  614|     71|                node(node_), expanded(exp_), state(std::move(state_)) {}
  615|     71|        };
  616|       |        /* Stack of tree nodes being explored. */
  617|     71|        std::vector<StackElem> stack;
  618|       |        /* Results of subtrees so far. Their order and mapping to tree nodes
  619|       |         * is implicitly defined by stack. */
  620|     71|        std::vector<Result> results;
  621|     71|        stack.emplace_back(*this, 0, std::move(root_state));
  622|       |
  623|       |        /* Here is a demonstration of the algorithm, for an example tree A(B,C(D,E),F).
  624|       |         * State variables are omitted for simplicity.
  625|       |         *
  626|       |         * First: stack=[(A,0)] results=[]
  627|       |         *        stack=[(A,1),(B,0)] results=[]
  628|       |         *        stack=[(A,1)] results=[B]
  629|       |         *        stack=[(A,2),(C,0)] results=[B]
  630|       |         *        stack=[(A,2),(C,1),(D,0)] results=[B]
  631|       |         *        stack=[(A,2),(C,1)] results=[B,D]
  632|       |         *        stack=[(A,2),(C,2),(E,0)] results=[B,D]
  633|       |         *        stack=[(A,2),(C,2)] results=[B,D,E]
  634|       |         *        stack=[(A,2)] results=[B,C]
  635|       |         *        stack=[(A,3),(F,0)] results=[B,C]
  636|       |         *        stack=[(A,3)] results=[B,C,F]
  637|       |         * Final: stack=[] results=[A]
  638|       |         */
  639|    142|        while (stack.size()) {
  ------------------
  |  Branch (639:16): [True: 71, False: 71]
  ------------------
  640|     71|            const Node& node = stack.back().node;
  641|     71|            if (stack.back().expanded < node.subs.size()) {
  ------------------
  |  Branch (641:17): [True: 0, False: 71]
  ------------------
  642|       |                /* We encounter a tree node with at least one unexpanded child.
  643|       |                 * Expand it. By the time we hit this node again, the result of
  644|       |                 * that child (and all earlier children) will be at the end of `results`. */
  645|      0|                size_t child_index = stack.back().expanded++;
  646|      0|                State child_state = downfn(stack.back().state, node, child_index);
  647|      0|                stack.emplace_back(*node.subs[child_index], 0, std::move(child_state));
  648|      0|                continue;
  649|      0|            }
  650|       |            // Invoke upfn with the last node.subs.size() elements of results as input.
  651|     71|            assert(results.size() >= node.subs.size());
  652|     71|            std::optional<Result> result{upfn(std::move(stack.back().state), node,
  653|     71|                Span<Result>{results}.last(node.subs.size()))};
  654|       |            // If evaluation returns std::nullopt, abort immediately.
  655|     71|            if (!result) return {};
  ------------------
  |  Branch (655:17): [True: 0, False: 71]
  ------------------
  656|       |            // Replace the last node.subs.size() elements of results with the new result.
  657|     71|            results.erase(results.end() - node.subs.size(), results.end());
  658|     71|            results.push_back(std::move(*result));
  659|     71|            stack.pop_back();
  660|     71|        }
  661|       |        // The final remaining results element is the root result, return it.
  662|     71|        assert(results.size() == 1);
  663|     71|        return std::move(results[0]);
  664|     71|    }
_ZZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINS_8internal11InputResultEZNKS2_8TreeEvalIS5_ZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_4SpanIS5_EE0_EES9_T0_E10DummyStateZNKS6_IS5_SG_EES9_SH_EUlSI_SD_mE_ZNKS6_IS5_SG_EES9_SH_EUlSI_SD_SF_E_EENSt3__18optionalIS9_EESH_T1_T2_EN9StackElemC2ESD_mOSI_:
  614|     71|                node(node_), expanded(exp_), state(std::move(state_)) {}
_ZZNK10miniscript4NodeI7CPubKeyE8TreeEvalINS_8internal11InputResultEZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_4SpanIS5_EE0_EES8_T0_ENKUlZNKS3_IS5_SF_EES8_SG_E10DummyStateSC_SE_E_clESH_SC_SE_:
  703|     71|            [&upfn](DummyState, const Node& node, Span<Result> subs) {
  704|     71|                Result res{upfn(node, subs)};
  705|     71|                return std::optional<Result>(std::move(res));
  706|     71|            }
_ZZNK10miniscript4NodeI7CPubKeyE12ProduceInputI12WshSatisfierEENS_8internal11InputResultERKT_ENKUlRKS2_4SpanIS6_EE0_clESB_SD_:
 1388|     71|        auto tester = [&helper](const Node& node, Span<InputResult> subres) -> InputResult {
 1389|     71|            auto ret = helper(node, subres);
 1390|       |
 1391|       |            // Do a consistency check between the satisfaction code and the type checker
 1392|       |            // (the actual satisfaction code in ProduceInputHelper does not use GetType)
 1393|       |
 1394|       |            // For 'z' nodes, available satisfactions/dissatisfactions must have stack size 0.
 1395|     71|            if (node.GetType() << "z"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.stack.size() == 0);
  ------------------
  |  Branch (1395:17): [True: 71, False: 0]
  |  Branch (1395:17): [True: 71, False: 0]
  |  Branch (1395:46): [True: 71, False: 0]
  ------------------
 1396|     71|            if (node.GetType() << "z"_mst && ret.sat.available != Availability::NO) assert(ret.sat.stack.size() == 0);
  ------------------
  |  Branch (1396:17): [True: 71, False: 0]
  |  Branch (1396:17): [True: 0, False: 71]
  |  Branch (1396:46): [True: 0, False: 71]
  ------------------
 1397|       |
 1398|       |            // For 'o' nodes, available satisfactions/dissatisfactions must have stack size 1.
 1399|     71|            if (node.GetType() << "o"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.stack.size() == 1);
  ------------------
  |  Branch (1399:17): [True: 0, False: 71]
  |  Branch (1399:17): [True: 0, False: 71]
  |  Branch (1399:46): [True: 0, False: 0]
  ------------------
 1400|     71|            if (node.GetType() << "o"_mst && ret.sat.available != Availability::NO) assert(ret.sat.stack.size() == 1);
  ------------------
  |  Branch (1400:17): [True: 0, False: 71]
  |  Branch (1400:17): [True: 0, False: 71]
  |  Branch (1400:46): [True: 0, False: 0]
  ------------------
 1401|       |
 1402|       |            // For 'n' nodes, available satisfactions/dissatisfactions must have stack size 1 or larger. For satisfactions,
 1403|       |            // the top element cannot be 0.
 1404|     71|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) assert(ret.sat.stack.size() >= 1);
  ------------------
  |  Branch (1404:17): [True: 0, False: 71]
  |  Branch (1404:17): [True: 0, False: 71]
  |  Branch (1404:46): [True: 0, False: 0]
  ------------------
 1405|     71|            if (node.GetType() << "n"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.stack.size() >= 1);
  ------------------
  |  Branch (1405:17): [True: 0, False: 71]
  |  Branch (1405:17): [True: 0, False: 71]
  |  Branch (1405:46): [True: 0, False: 0]
  ------------------
 1406|     71|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) assert(!ret.sat.stack.back().empty());
  ------------------
  |  Branch (1406:17): [True: 0, False: 71]
  |  Branch (1406:17): [True: 0, False: 71]
  |  Branch (1406:46): [True: 0, False: 0]
  ------------------
 1407|       |
 1408|       |            // For 'd' nodes, a dissatisfaction must exist, and they must not need a signature. If it is non-malleable,
 1409|       |            // it must be canonical.
 1410|     71|            if (node.GetType() << "d"_mst) assert(ret.nsat.available != Availability::NO);
  ------------------
  |  Branch (1410:17): [True: 71, False: 0]
  ------------------
 1411|     71|            if (node.GetType() << "d"_mst) assert(!ret.nsat.has_sig);
  ------------------
  |  Branch (1411:17): [True: 71, False: 0]
  ------------------
 1412|     71|            if (node.GetType() << "d"_mst && !ret.nsat.malleable) assert(!ret.nsat.non_canon);
  ------------------
  |  Branch (1412:17): [True: 71, False: 0]
  |  Branch (1412:17): [True: 71, False: 0]
  |  Branch (1412:46): [True: 71, False: 0]
  ------------------
 1413|       |
 1414|       |            // For 'f'/'s' nodes, dissatisfactions/satisfactions must have a signature.
 1415|     71|            if (node.GetType() << "f"_mst && ret.nsat.available != Availability::NO) assert(ret.nsat.has_sig);
  ------------------
  |  Branch (1415:17): [True: 0, False: 71]
  |  Branch (1415:17): [True: 0, False: 71]
  |  Branch (1415:46): [True: 0, False: 0]
  ------------------
 1416|     71|            if (node.GetType() << "s"_mst && ret.sat.available != Availability::NO) assert(ret.sat.has_sig);
  ------------------
  |  Branch (1416:17): [True: 71, False: 0]
  |  Branch (1416:17): [True: 0, False: 71]
  |  Branch (1416:46): [True: 0, False: 71]
  ------------------
 1417|       |
 1418|       |            // For non-malleable 'e' nodes, a non-malleable dissatisfaction must exist.
 1419|     71|            if (node.GetType() << "me"_mst) assert(ret.nsat.available != Availability::NO);
  ------------------
  |  Branch (1419:17): [True: 71, False: 0]
  ------------------
 1420|     71|            if (node.GetType() << "me"_mst) assert(!ret.nsat.malleable);
  ------------------
  |  Branch (1420:17): [True: 71, False: 0]
  ------------------
 1421|       |
 1422|       |            // For 'm' nodes, if a satisfaction exists, it must be non-malleable.
 1423|     71|            if (node.GetType() << "m"_mst && ret.sat.available != Availability::NO) assert(!ret.sat.malleable);
  ------------------
  |  Branch (1423:17): [True: 71, False: 0]
  |  Branch (1423:17): [True: 0, False: 71]
  |  Branch (1423:46): [True: 0, False: 71]
  ------------------
 1424|       |
 1425|       |            // If a non-malleable satisfaction exists, it must be canonical.
 1426|     71|            if (ret.sat.available != Availability::NO && !ret.sat.malleable) assert(!ret.sat.non_canon);
  ------------------
  |  Branch (1426:17): [True: 0, False: 71]
  |  Branch (1426:58): [True: 0, False: 0]
  ------------------
 1427|       |
 1428|     71|            return ret;
 1429|     71|        };
_ZZNK10miniscript4NodeI7CPubKeyE12ProduceInputI12WshSatisfierEENS_8internal11InputResultERKT_ENKUlRKS2_4SpanIS6_EE_clESB_SD_:
 1192|     71|        auto helper = [&ctx](const Node& node, Span<InputResult> subres) -> InputResult {
 1193|     71|            switch (node.fragment) {
  ------------------
  |  Branch (1193:21): [True: 0, False: 71]
  ------------------
 1194|      0|                case Fragment::PK_K: {
  ------------------
  |  Branch (1194:17): [True: 0, False: 71]
  ------------------
 1195|      0|                    std::vector<unsigned char> sig;
 1196|      0|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1197|      0|                    return {ZERO, InputStack(std::move(sig)).SetWithSig().SetAvailable(avail)};
 1198|      0|                }
 1199|      0|                case Fragment::PK_H: {
  ------------------
  |  Branch (1199:17): [True: 0, False: 71]
  ------------------
 1200|      0|                    std::vector<unsigned char> key = ctx.ToPKBytes(node.keys[0]), sig;
 1201|      0|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1202|      0|                    return {ZERO + InputStack(key), (InputStack(std::move(sig)).SetWithSig() + InputStack(key)).SetAvailable(avail)};
 1203|      0|                }
 1204|      0|                case Fragment::MULTI_A: {
  ------------------
  |  Branch (1204:17): [True: 0, False: 71]
  ------------------
 1205|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1206|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1207|      0|                    std::vector<InputStack> sats = Vector(EMPTY);
 1208|      0|                    for (size_t i = 0; i < node.keys.size(); ++i) {
  ------------------
  |  Branch (1208:40): [True: 0, False: 0]
  ------------------
 1209|       |                        // Get the signature for the i'th key in reverse order (the signature for the first key needs to
 1210|       |                        // be at the top of the stack, contrary to CHECKMULTISIG's satisfaction).
 1211|      0|                        std::vector<unsigned char> sig;
 1212|      0|                        Availability avail = ctx.Sign(node.keys[node.keys.size() - 1 - i], sig);
 1213|       |                        // Compute signature stack for just this key.
 1214|      0|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1215|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1216|       |                        // next_sats[j] are equal to either the existing sats[j] + ZERO, or sats[j-1] plus a signature
 1217|       |                        // for the current (i'th) key. The very last element needs all signatures filled.
 1218|      0|                        std::vector<InputStack> next_sats;
 1219|      0|                        next_sats.push_back(sats[0] + ZERO);
 1220|      0|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + ZERO) | (std::move(sats[j - 1]) + sat));
  ------------------
  |  Branch (1220:44): [True: 0, False: 0]
  ------------------
 1221|      0|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1222|       |                        // Switch over.
 1223|      0|                        sats = std::move(next_sats);
 1224|      0|                    }
 1225|       |                    // The dissatisfaction consists of as many empty vectors as there are keys, which is the same as
 1226|       |                    // satisfying 0 keys.
 1227|      0|                    auto& nsat{sats[0]};
 1228|      0|                    assert(node.k != 0);
 1229|      0|                    assert(node.k <= sats.size());
 1230|      0|                    return {std::move(nsat), std::move(sats[node.k])};
 1231|      0|                }
 1232|      0|                case Fragment::MULTI: {
  ------------------
  |  Branch (1232:17): [True: 0, False: 71]
  ------------------
 1233|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1234|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1235|       |                    // sats[0] starts off being {0}, due to the CHECKMULTISIG bug that pops off one element too many.
 1236|      0|                    std::vector<InputStack> sats = Vector(ZERO);
 1237|      0|                    for (size_t i = 0; i < node.keys.size(); ++i) {
  ------------------
  |  Branch (1237:40): [True: 0, False: 0]
  ------------------
 1238|      0|                        std::vector<unsigned char> sig;
 1239|      0|                        Availability avail = ctx.Sign(node.keys[i], sig);
 1240|       |                        // Compute signature stack for just the i'th key.
 1241|      0|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1242|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1243|       |                        // next_sats[j] are equal to either the existing sats[j], or sats[j-1] plus a signature for the
 1244|       |                        // current (i'th) key. The very last element needs all signatures filled.
 1245|      0|                        std::vector<InputStack> next_sats;
 1246|      0|                        next_sats.push_back(sats[0]);
 1247|      0|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back(sats[j] | (std::move(sats[j - 1]) + sat));
  ------------------
  |  Branch (1247:44): [True: 0, False: 0]
  ------------------
 1248|      0|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1249|       |                        // Switch over.
 1250|      0|                        sats = std::move(next_sats);
 1251|      0|                    }
 1252|       |                    // The dissatisfaction consists of k+1 stack elements all equal to 0.
 1253|      0|                    InputStack nsat = ZERO;
 1254|      0|                    for (size_t i = 0; i < node.k; ++i) nsat = std::move(nsat) + ZERO;
  ------------------
  |  Branch (1254:40): [True: 0, False: 0]
  ------------------
 1255|      0|                    assert(node.k <= sats.size());
 1256|      0|                    return {std::move(nsat), std::move(sats[node.k])};
 1257|      0|                }
 1258|      0|                case Fragment::THRESH: {
  ------------------
  |  Branch (1258:17): [True: 0, False: 71]
  ------------------
 1259|       |                    // sats[k] represents the best stack that satisfies k out of the *last* i subexpressions.
 1260|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1261|       |                    // sats[0] starts off empty.
 1262|      0|                    std::vector<InputStack> sats = Vector(EMPTY);
 1263|      0|                    for (size_t i = 0; i < subres.size(); ++i) {
  ------------------
  |  Branch (1263:40): [True: 0, False: 0]
  ------------------
 1264|       |                        // Introduce an alias for the i'th last satisfaction/dissatisfaction.
 1265|      0|                        auto& res = subres[subres.size() - i - 1];
 1266|       |                        // Compute the next sats vector: next_sats[0] is sats[0] plus res.nsat (thus containing all dissatisfactions
 1267|       |                        // so far. next_sats[j] is either sats[j] + res.nsat (reusing j earlier satisfactions) or sats[j-1] + res.sat
 1268|       |                        // (reusing j-1 earlier satisfactions plus a new one). The very last next_sats[j] is all satisfactions.
 1269|      0|                        std::vector<InputStack> next_sats;
 1270|      0|                        next_sats.push_back(sats[0] + res.nsat);
 1271|      0|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + res.nsat) | (std::move(sats[j - 1]) + res.sat));
  ------------------
  |  Branch (1271:44): [True: 0, False: 0]
  ------------------
 1272|      0|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(res.sat));
 1273|       |                        // Switch over.
 1274|      0|                        sats = std::move(next_sats);
 1275|      0|                    }
 1276|       |                    // At this point, sats[k].sat is the best satisfaction for the overall thresh() node. The best dissatisfaction
 1277|       |                    // is computed by gathering all sats[i].nsat for i != k.
 1278|      0|                    InputStack nsat = INVALID;
 1279|      0|                    for (size_t i = 0; i < sats.size(); ++i) {
  ------------------
  |  Branch (1279:40): [True: 0, False: 0]
  ------------------
 1280|       |                        // i==k is the satisfaction; i==0 is the canonical dissatisfaction;
 1281|       |                        // the rest are non-canonical (a no-signature dissatisfaction - the i=0
 1282|       |                        // form - is always available) and malleable (due to overcompleteness).
 1283|       |                        // Marking the solutions malleable here is not strictly necessary, as they
 1284|       |                        // should already never be picked in non-malleable solutions due to the
 1285|       |                        // availability of the i=0 form.
 1286|      0|                        if (i != 0 && i != node.k) sats[i].SetMalleable().SetNonCanon();
  ------------------
  |  Branch (1286:29): [True: 0, False: 0]
  |  Branch (1286:39): [True: 0, False: 0]
  ------------------
 1287|       |                        // Include all dissatisfactions (even these non-canonical ones) in nsat.
 1288|      0|                        if (i != node.k) nsat = std::move(nsat) | std::move(sats[i]);
  ------------------
  |  Branch (1288:29): [True: 0, False: 0]
  ------------------
 1289|      0|                    }
 1290|      0|                    assert(node.k <= sats.size());
 1291|      0|                    return {std::move(nsat), std::move(sats[node.k])};
 1292|      0|                }
 1293|      0|                case Fragment::OLDER: {
  ------------------
  |  Branch (1293:17): [True: 0, False: 71]
  ------------------
 1294|      0|                    return {INVALID, ctx.CheckOlder(node.k) ? EMPTY : INVALID};
  ------------------
  |  Branch (1294:38): [True: 0, False: 0]
  ------------------
 1295|      0|                }
 1296|      0|                case Fragment::AFTER: {
  ------------------
  |  Branch (1296:17): [True: 0, False: 71]
  ------------------
 1297|      0|                    return {INVALID, ctx.CheckAfter(node.k) ? EMPTY : INVALID};
  ------------------
  |  Branch (1297:38): [True: 0, False: 0]
  ------------------
 1298|      0|                }
 1299|      0|                case Fragment::SHA256: {
  ------------------
  |  Branch (1299:17): [True: 0, False: 71]
  ------------------
 1300|      0|                    std::vector<unsigned char> preimage;
 1301|      0|                    Availability avail = ctx.SatSHA256(node.data, preimage);
 1302|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1303|      0|                }
 1304|      0|                case Fragment::RIPEMD160: {
  ------------------
  |  Branch (1304:17): [True: 0, False: 71]
  ------------------
 1305|      0|                    std::vector<unsigned char> preimage;
 1306|      0|                    Availability avail = ctx.SatRIPEMD160(node.data, preimage);
 1307|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1308|      0|                }
 1309|      0|                case Fragment::HASH256: {
  ------------------
  |  Branch (1309:17): [True: 0, False: 71]
  ------------------
 1310|      0|                    std::vector<unsigned char> preimage;
 1311|      0|                    Availability avail = ctx.SatHASH256(node.data, preimage);
 1312|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1313|      0|                }
 1314|      0|                case Fragment::HASH160: {
  ------------------
  |  Branch (1314:17): [True: 0, False: 71]
  ------------------
 1315|      0|                    std::vector<unsigned char> preimage;
 1316|      0|                    Availability avail = ctx.SatHASH160(node.data, preimage);
 1317|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1318|      0|                }
 1319|      0|                case Fragment::AND_V: {
  ------------------
  |  Branch (1319:17): [True: 0, False: 71]
  ------------------
 1320|      0|                    auto& x = subres[0], &y = subres[1];
 1321|       |                    // As the dissatisfaction here only consist of a single option, it doesn't
 1322|       |                    // actually need to be listed (it's not required for reasoning about malleability of
 1323|       |                    // other options), and is never required (no valid miniscript relies on the ability
 1324|       |                    // to satisfy the type V left subexpression). It's still listed here for
 1325|       |                    // completeness, as a hypothetical (not currently implemented) satisfier that doesn't
 1326|       |                    // care about malleability might in some cases prefer it still.
 1327|      0|                    return {(y.nsat + x.sat).SetNonCanon(), y.sat + x.sat};
 1328|      0|                }
 1329|      0|                case Fragment::AND_B: {
  ------------------
  |  Branch (1329:17): [True: 0, False: 71]
  ------------------
 1330|      0|                    auto& x = subres[0], &y = subres[1];
 1331|       |                    // Note that it is not strictly necessary to mark the 2nd and 3rd dissatisfaction here
 1332|       |                    // as malleable. While they are definitely malleable, they are also non-canonical due
 1333|       |                    // to the guaranteed existence of a no-signature other dissatisfaction (the 1st)
 1334|       |                    // option. Because of that, the 2nd and 3rd option will never be chosen, even if they
 1335|       |                    // weren't marked as malleable.
 1336|      0|                    return {(y.nsat + x.nsat) | (y.sat + x.nsat).SetMalleable().SetNonCanon() | (y.nsat + x.sat).SetMalleable().SetNonCanon(), y.sat + x.sat};
 1337|      0|                }
 1338|      0|                case Fragment::OR_B: {
  ------------------
  |  Branch (1338:17): [True: 0, False: 71]
  ------------------
 1339|      0|                    auto& x = subres[0], &z = subres[1];
 1340|       |                    // The (sat(Z) sat(X)) solution is overcomplete (attacker can change either into dsat).
 1341|      0|                    return {z.nsat + x.nsat, (z.nsat + x.sat) | (z.sat + x.nsat) | (z.sat + x.sat).SetMalleable().SetNonCanon()};
 1342|      0|                }
 1343|      0|                case Fragment::OR_C: {
  ------------------
  |  Branch (1343:17): [True: 0, False: 71]
  ------------------
 1344|      0|                    auto& x = subres[0], &z = subres[1];
 1345|      0|                    return {INVALID, std::move(x.sat) | (z.sat + x.nsat)};
 1346|      0|                }
 1347|      0|                case Fragment::OR_D: {
  ------------------
  |  Branch (1347:17): [True: 0, False: 71]
  ------------------
 1348|      0|                    auto& x = subres[0], &z = subres[1];
 1349|      0|                    return {z.nsat + x.nsat, std::move(x.sat) | (z.sat + x.nsat)};
 1350|      0|                }
 1351|      0|                case Fragment::OR_I: {
  ------------------
  |  Branch (1351:17): [True: 0, False: 71]
  ------------------
 1352|      0|                    auto& x = subres[0], &z = subres[1];
 1353|      0|                    return {(x.nsat + ONE) | (z.nsat + ZERO), (x.sat + ONE) | (z.sat + ZERO)};
 1354|      0|                }
 1355|      0|                case Fragment::ANDOR: {
  ------------------
  |  Branch (1355:17): [True: 0, False: 71]
  ------------------
 1356|      0|                    auto& x = subres[0], &y = subres[1], &z = subres[2];
 1357|      0|                    return {(y.nsat + x.sat).SetNonCanon() | (z.nsat + x.nsat), (y.sat + x.sat) | (z.sat + x.nsat)};
 1358|      0|                }
 1359|      0|                case Fragment::WRAP_A:
  ------------------
  |  Branch (1359:17): [True: 0, False: 71]
  ------------------
 1360|      0|                case Fragment::WRAP_S:
  ------------------
  |  Branch (1360:17): [True: 0, False: 71]
  ------------------
 1361|      0|                case Fragment::WRAP_C:
  ------------------
  |  Branch (1361:17): [True: 0, False: 71]
  ------------------
 1362|      0|                case Fragment::WRAP_N:
  ------------------
  |  Branch (1362:17): [True: 0, False: 71]
  ------------------
 1363|      0|                    return std::move(subres[0]);
 1364|      0|                case Fragment::WRAP_D: {
  ------------------
  |  Branch (1364:17): [True: 0, False: 71]
  ------------------
 1365|      0|                    auto &x = subres[0];
 1366|      0|                    return {ZERO, x.sat + ONE};
 1367|      0|                }
 1368|      0|                case Fragment::WRAP_J: {
  ------------------
  |  Branch (1368:17): [True: 0, False: 71]
  ------------------
 1369|      0|                    auto &x = subres[0];
 1370|       |                    // If a dissatisfaction with a nonzero top stack element exists, an alternative dissatisfaction exists.
 1371|       |                    // As the dissatisfaction logic currently doesn't keep track of this nonzeroness property, and thus even
 1372|       |                    // if a dissatisfaction with a top zero element is found, we don't know whether another one with a
 1373|       |                    // nonzero top stack element exists. Make the conservative assumption that whenever the subexpression is weakly
 1374|       |                    // dissatisfiable, this alternative dissatisfaction exists and leads to malleability.
 1375|      0|                    return {InputStack(ZERO).SetMalleable(x.nsat.available != Availability::NO && !x.nsat.has_sig), std::move(x.sat)};
  ------------------
  |  Branch (1375:59): [True: 0, False: 0]
  |  Branch (1375:99): [True: 0, False: 0]
  ------------------
 1376|      0|                }
 1377|      0|                case Fragment::WRAP_V: {
  ------------------
  |  Branch (1377:17): [True: 0, False: 71]
  ------------------
 1378|      0|                    auto &x = subres[0];
 1379|      0|                    return {INVALID, std::move(x.sat)};
 1380|      0|                }
 1381|     71|                case Fragment::JUST_0: return {EMPTY, INVALID};
  ------------------
  |  Branch (1381:17): [True: 71, False: 0]
  ------------------
 1382|      0|                case Fragment::JUST_1: return {INVALID, EMPTY};
  ------------------
  |  Branch (1382:17): [True: 0, False: 71]
  ------------------
 1383|     71|            }
 1384|      0|            assert(false);
 1385|      0|            return {INVALID, INVALID};
 1386|      0|        };

_ZN9CScriptIDC2ERK7CScript:
   16|  21.0k|CScriptID::CScriptID(const CScript& in) : BaseHash(Hash160(in)) {}
_ZNK7CScript13IsPayToAnchorEv:
  208|  3.33k|{
  209|  3.33k|    return (this->size() == 4 &&
  ------------------
  |  Branch (209:13): [True: 1.95k, False: 1.37k]
  ------------------
  210|  3.33k|        (*this)[0] == OP_1 &&
  ------------------
  |  Branch (210:9): [True: 1.63k, False: 320]
  ------------------
  211|  3.33k|        (*this)[1] == 0x02 &&
  ------------------
  |  Branch (211:9): [True: 1.63k, False: 0]
  ------------------
  212|  3.33k|        (*this)[2] == 0x4e &&
  ------------------
  |  Branch (212:9): [True: 1.06k, False: 577]
  ------------------
  213|  3.33k|        (*this)[3] == 0x73);
  ------------------
  |  Branch (213:9): [True: 1.04k, False: 11]
  ------------------
  214|  3.33k|}
_ZN7CScript13IsPayToAnchorEiRKNSt3__16vectorIhNS0_9allocatorIhEEEE:
  217|  1.71k|{
  218|  1.71k|    return version == 1 &&
  ------------------
  |  Branch (218:12): [True: 1.28k, False: 433]
  ------------------
  219|  1.71k|        program.size() == 2 &&
  ------------------
  |  Branch (219:9): [True: 815, False: 468]
  ------------------
  220|  1.71k|        program[0] == 0x4e &&
  ------------------
  |  Branch (220:9): [True: 527, False: 288]
  ------------------
  221|  1.71k|        program[1] == 0x73;
  ------------------
  |  Branch (221:9): [True: 522, False: 5]
  ------------------
  222|  1.71k|}
_ZNK7CScript17IsPayToScriptHashEv:
  225|   253k|{
  226|       |    // Extra-fast test for pay-to-script-hash CScripts:
  227|   253k|    return (this->size() == 23 &&
  ------------------
  |  Branch (227:13): [True: 45.7k, False: 207k]
  ------------------
  228|   253k|            (*this)[0] == OP_HASH160 &&
  ------------------
  |  Branch (228:13): [True: 43.7k, False: 2.05k]
  ------------------
  229|   253k|            (*this)[1] == 0x14 &&
  ------------------
  |  Branch (229:13): [True: 43.4k, False: 223]
  ------------------
  230|   253k|            (*this)[22] == OP_EQUAL);
  ------------------
  |  Branch (230:13): [True: 43.4k, False: 2]
  ------------------
  231|   253k|}
_ZNK7CScript16IsWitnessProgramERiRNSt3__16vectorIhNS1_9allocatorIhEEEE:
  244|   270k|{
  245|   270k|    if (this->size() < 4 || this->size() > 42) {
  ------------------
  |  Branch (245:9): [True: 34.0k, False: 236k]
  |  Branch (245:29): [True: 60.8k, False: 175k]
  ------------------
  246|  94.9k|        return false;
  247|  94.9k|    }
  248|   175k|    if ((*this)[0] != OP_0 && ((*this)[0] < OP_1 || (*this)[0] > OP_16)) {
  ------------------
  |  Branch (248:9): [True: 120k, False: 55.0k]
  |  Branch (248:32): [True: 5.67k, False: 114k]
  |  Branch (248:53): [True: 83.5k, False: 31.3k]
  ------------------
  249|  89.2k|        return false;
  250|  89.2k|    }
  251|  86.4k|    if ((size_t)((*this)[1] + 2) == this->size()) {
  ------------------
  |  Branch (251:9): [True: 80.8k, False: 5.56k]
  ------------------
  252|  80.8k|        version = DecodeOP_N((opcodetype)(*this)[0]);
  253|  80.8k|        program = std::vector<unsigned char>(this->begin() + 2, this->end());
  254|  80.8k|        return true;
  255|  80.8k|    }
  256|  5.56k|    return false;
  257|  86.4k|}
_ZNK7CScript10IsPushOnlyEN9prevectorILj28EhjiE14const_iteratorE:
  260|  20.0k|{
  261|  2.06M|    while (pc < end())
  ------------------
  |  Branch (261:12): [True: 2.04M, False: 18.5k]
  ------------------
  262|  2.04M|    {
  263|  2.04M|        opcodetype opcode;
  264|  2.04M|        if (!GetOp(pc, opcode))
  ------------------
  |  Branch (264:13): [True: 991, False: 2.04M]
  ------------------
  265|    991|            return false;
  266|       |        // Note that IsPushOnly() *does* consider OP_RESERVED to be a
  267|       |        // push-type opcode, however execution of OP_RESERVED fails, so
  268|       |        // it's not relevant to P2SH/BIP62 as the scriptSig would fail prior to
  269|       |        // the P2SH special validation code being executed.
  270|  2.04M|        if (opcode > OP_16)
  ------------------
  |  Branch (270:13): [True: 494, False: 2.04M]
  ------------------
  271|    494|            return false;
  272|  2.04M|    }
  273|  18.5k|    return true;
  274|  20.0k|}
_ZNK7CScript10IsPushOnlyEv:
  277|  18.0k|{
  278|  18.0k|    return this->IsPushOnly(begin());
  279|  18.0k|}
_Z11GetScriptOpRN9prevectorILj28EhjiE14const_iteratorES1_R10opcodetypePNSt3__16vectorIhNS5_9allocatorIhEEEE:
  307|   212M|{
  308|   212M|    opcodeRet = OP_INVALIDOPCODE;
  309|   212M|    if (pvchRet)
  ------------------
  |  Branch (309:9): [True: 7.19M, False: 205M]
  ------------------
  310|  7.19M|        pvchRet->clear();
  311|   212M|    if (pc >= end)
  ------------------
  |  Branch (311:9): [True: 175k, False: 212M]
  ------------------
  312|   175k|        return false;
  313|       |
  314|       |    // Read instruction
  315|   212M|    if (end - pc < 1)
  ------------------
  |  Branch (315:9): [True: 0, False: 212M]
  ------------------
  316|      0|        return false;
  317|   212M|    unsigned int opcode = *pc++;
  318|       |
  319|       |    // Immediate operand
  320|   212M|    if (opcode <= OP_PUSHDATA4)
  ------------------
  |  Branch (320:9): [True: 37.7M, False: 174M]
  ------------------
  321|  37.7M|    {
  322|  37.7M|        unsigned int nSize = 0;
  323|  37.7M|        if (opcode < OP_PUSHDATA1)
  ------------------
  |  Branch (323:13): [True: 35.5M, False: 2.24M]
  ------------------
  324|  35.5M|        {
  325|  35.5M|            nSize = opcode;
  326|  35.5M|        }
  327|  2.24M|        else if (opcode == OP_PUSHDATA1)
  ------------------
  |  Branch (327:18): [True: 2.14M, False: 103k]
  ------------------
  328|  2.14M|        {
  329|  2.14M|            if (end - pc < 1)
  ------------------
  |  Branch (329:17): [True: 488, False: 2.14M]
  ------------------
  330|    488|                return false;
  331|  2.14M|            nSize = *pc++;
  332|  2.14M|        }
  333|   103k|        else if (opcode == OP_PUSHDATA2)
  ------------------
  |  Branch (333:18): [True: 27.1k, False: 76.4k]
  ------------------
  334|  27.1k|        {
  335|  27.1k|            if (end - pc < 2)
  ------------------
  |  Branch (335:17): [True: 423, False: 26.7k]
  ------------------
  336|    423|                return false;
  337|  26.7k|            nSize = ReadLE16(&pc[0]);
  338|  26.7k|            pc += 2;
  339|  26.7k|        }
  340|  76.4k|        else if (opcode == OP_PUSHDATA4)
  ------------------
  |  Branch (340:18): [True: 76.4k, False: 0]
  ------------------
  341|  76.4k|        {
  342|  76.4k|            if (end - pc < 4)
  ------------------
  |  Branch (342:17): [True: 687, False: 75.7k]
  ------------------
  343|    687|                return false;
  344|  75.7k|            nSize = ReadLE32(&pc[0]);
  345|  75.7k|            pc += 4;
  346|  75.7k|        }
  347|  37.7M|        if (end - pc < 0 || (unsigned int)(end - pc) < nSize)
  ------------------
  |  Branch (347:13): [True: 0, False: 37.7M]
  |  Branch (347:29): [True: 29.7k, False: 37.7M]
  ------------------
  348|  29.7k|            return false;
  349|  37.7M|        if (pvchRet)
  ------------------
  |  Branch (349:13): [True: 4.44M, False: 33.2M]
  ------------------
  350|  4.44M|            pvchRet->assign(pc, pc + nSize);
  351|  37.7M|        pc += nSize;
  352|  37.7M|    }
  353|       |
  354|   212M|    opcodeRet = static_cast<opcodetype>(opcode);
  355|   212M|    return true;
  356|   212M|}
_Z16CheckMinimalPushRKNSt3__16vectorIhNS_9allocatorIhEEEE10opcodetype:
  366|  3.47M|bool CheckMinimalPush(const std::vector<unsigned char>& data, opcodetype opcode) {
  367|       |    // Excludes OP_1NEGATE, OP_1-16 since they are by definition minimal
  368|  3.47M|    assert(0 <= opcode && opcode <= OP_PUSHDATA4);
  369|  3.47M|    if (data.size() == 0) {
  ------------------
  |  Branch (369:9): [True: 3.10M, False: 369k]
  ------------------
  370|       |        // Should have used OP_0.
  371|  3.10M|        return opcode == OP_0;
  372|  3.10M|    } else if (data.size() == 1 && data[0] >= 1 && data[0] <= 16) {
  ------------------
  |  Branch (372:16): [True: 10.7k, False: 358k]
  |  Branch (372:36): [True: 6.24k, False: 4.51k]
  |  Branch (372:52): [True: 1.04k, False: 5.19k]
  ------------------
  373|       |        // Should have used OP_1 .. OP_16.
  374|  1.04k|        return false;
  375|   368k|    } else if (data.size() == 1 && data[0] == 0x81) {
  ------------------
  |  Branch (375:16): [True: 9.71k, False: 358k]
  |  Branch (375:36): [True: 205, False: 9.50k]
  ------------------
  376|       |        // Should have used OP_1NEGATE.
  377|    205|        return false;
  378|   368k|    } else if (data.size() <= 75) {
  ------------------
  |  Branch (378:16): [True: 365k, False: 2.84k]
  ------------------
  379|       |        // Must have used a direct push (opcode indicating number of bytes pushed + those bytes).
  380|   365k|        return opcode == data.size();
  381|   365k|    } else if (data.size() <= 255) {
  ------------------
  |  Branch (381:16): [True: 637, False: 2.20k]
  ------------------
  382|       |        // Must have used OP_PUSHDATA.
  383|    637|        return opcode == OP_PUSHDATA1;
  384|  2.20k|    } else if (data.size() <= 65535) {
  ------------------
  |  Branch (384:16): [True: 2.20k, False: 0]
  ------------------
  385|       |        // Must have used OP_PUSHDATA2.
  386|  2.20k|        return opcode == OP_PUSHDATA2;
  387|  2.20k|    }
  388|      0|    return true;
  389|  3.47M|}

_ZN15scriptnum_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE:
  223|  8.20k|    explicit scriptnum_error(const std::string& str) : std::runtime_error(str) {}
_ZN10CScriptNumC2ERKl:
  239|   518k|    {
  240|   518k|        m_value = n;
  241|   518k|    }
_ZN10CScriptNumC2ERKNSt3__16vectorIhNS0_9allocatorIhEEEEbm:
  247|   268k|    {
  248|   268k|        if (vch.size() > nMaxNumSize) {
  ------------------
  |  Branch (248:13): [True: 7.51k, False: 260k]
  ------------------
  249|  7.51k|            throw scriptnum_error("script number overflow");
  250|  7.51k|        }
  251|   260k|        if (fRequireMinimal && vch.size() > 0) {
  ------------------
  |  Branch (251:13): [True: 249k, False: 11.0k]
  |  Branch (251:32): [True: 120k, False: 128k]
  ------------------
  252|       |            // Check that the number is encoded with the minimum possible
  253|       |            // number of bytes.
  254|       |            //
  255|       |            // If the most-significant-byte - excluding the sign bit - is zero
  256|       |            // then we're not minimal. Note how this test also rejects the
  257|       |            // negative-zero encoding, 0x80.
  258|   120k|            if ((vch.back() & 0x7f) == 0) {
  ------------------
  |  Branch (258:17): [True: 1.91k, False: 118k]
  ------------------
  259|       |                // One exception: if there's more than one byte and the most
  260|       |                // significant bit of the second-most-significant-byte is set
  261|       |                // it would conflict with the sign bit. An example of this case
  262|       |                // is +-255, which encode to 0xff00 and 0xff80 respectively.
  263|       |                // (big-endian).
  264|  1.91k|                if (vch.size() <= 1 || (vch[vch.size() - 2] & 0x80) == 0) {
  ------------------
  |  Branch (264:21): [True: 312, False: 1.60k]
  |  Branch (264:40): [True: 374, False: 1.22k]
  ------------------
  265|    686|                    throw scriptnum_error("non-minimally encoded script number");
  266|    686|                }
  267|  1.91k|            }
  268|   120k|        }
  269|   259k|        m_value = set_vch(vch);
  270|   259k|    }
_ZNK10CScriptNumeqERKl:
  272|  4.20k|    inline bool operator==(const int64_t& rhs) const    { return m_value == rhs; }
_ZNK10CScriptNumneERKl:
  273|  58.1k|    inline bool operator!=(const int64_t& rhs) const    { return m_value != rhs; }
_ZNK10CScriptNumleERKl:
  274|  12.7k|    inline bool operator<=(const int64_t& rhs) const    { return m_value <= rhs; }
_ZNK10CScriptNumltERKl:
  275|  51.0k|    inline bool operator< (const int64_t& rhs) const    { return m_value <  rhs; }
_ZNK10CScriptNumgeERKl:
  276|  6.02k|    inline bool operator>=(const int64_t& rhs) const    { return m_value >= rhs; }
_ZNK10CScriptNumgtERKl:
  277|  13.9k|    inline bool operator> (const int64_t& rhs) const    { return m_value >  rhs; }
_ZNK10CScriptNumeqERKS_:
  279|  4.20k|    inline bool operator==(const CScriptNum& rhs) const { return operator==(rhs.m_value); }
_ZNK10CScriptNumneERKS_:
  280|  47.5k|    inline bool operator!=(const CScriptNum& rhs) const { return operator!=(rhs.m_value); }
_ZNK10CScriptNumleERKS_:
  281|  12.7k|    inline bool operator<=(const CScriptNum& rhs) const { return operator<=(rhs.m_value); }
_ZNK10CScriptNumltERKS_:
  282|  21.7k|    inline bool operator< (const CScriptNum& rhs) const { return operator< (rhs.m_value); }
_ZNK10CScriptNumgeERKS_:
  283|  2.76k|    inline bool operator>=(const CScriptNum& rhs) const { return operator>=(rhs.m_value); }
_ZNK10CScriptNumgtERKS_:
  284|  2.15k|    inline bool operator> (const CScriptNum& rhs) const { return operator> (rhs.m_value); }
_ZNK10CScriptNumplERKl:
  286|    871|    inline CScriptNum operator+(   const int64_t& rhs)    const { return CScriptNum(m_value + rhs);}
_ZNK10CScriptNummiERKl:
  287|  3.94k|    inline CScriptNum operator-(   const int64_t& rhs)    const { return CScriptNum(m_value - rhs);}
_ZNK10CScriptNumplERKS_:
  288|    871|    inline CScriptNum operator+(   const CScriptNum& rhs) const { return operator+(rhs.m_value);   }
_ZNK10CScriptNummiERKS_:
  289|  3.94k|    inline CScriptNum operator-(   const CScriptNum& rhs) const { return operator-(rhs.m_value);   }
_ZN10CScriptNumpLERKS_:
  291|  5.94k|    inline CScriptNum& operator+=( const CScriptNum& rhs)       { return operator+=(rhs.m_value);  }
_ZN10CScriptNummIERKS_:
  292|  5.71k|    inline CScriptNum& operator-=( const CScriptNum& rhs)       { return operator-=(rhs.m_value);  }
_ZNK10CScriptNumanERKl:
  294|  20.2k|    inline CScriptNum operator&(   const int64_t& rhs)    const { return CScriptNum(m_value & rhs);}
_ZNK10CScriptNumngEv:
  300|  3.11k|    {
  301|  3.11k|        assert(m_value != std::numeric_limits<int64_t>::min());
  302|  3.11k|        return CScriptNum(-m_value);
  303|  3.11k|    }
_ZN10CScriptNumaSERKl:
  306|  58.9k|    {
  307|  58.9k|        m_value = rhs;
  308|  58.9k|        return *this;
  309|  58.9k|    }
_ZN10CScriptNumpLERKl:
  312|  5.94k|    {
  313|  5.94k|        assert(rhs == 0 || (rhs > 0 && m_value <= std::numeric_limits<int64_t>::max() - rhs) ||
  314|  5.94k|                           (rhs < 0 && m_value >= std::numeric_limits<int64_t>::min() - rhs));
  315|  5.94k|        m_value += rhs;
  316|  5.94k|        return *this;
  317|  5.94k|    }
_ZN10CScriptNummIERKl:
  320|  5.71k|    {
  321|  5.71k|        assert(rhs == 0 || (rhs > 0 && m_value >= std::numeric_limits<int64_t>::min() + rhs) ||
  322|  5.71k|                           (rhs < 0 && m_value <= std::numeric_limits<int64_t>::max() + rhs));
  323|  5.71k|        m_value -= rhs;
  324|  5.71k|        return *this;
  325|  5.71k|    }
_ZNK10CScriptNum6getintEv:
  334|  83.7k|    {
  335|  83.7k|        if (m_value > std::numeric_limits<int>::max())
  ------------------
  |  Branch (335:13): [True: 0, False: 83.7k]
  ------------------
  336|      0|            return std::numeric_limits<int>::max();
  337|  83.7k|        else if (m_value < std::numeric_limits<int>::min())
  ------------------
  |  Branch (337:18): [True: 0, False: 83.7k]
  ------------------
  338|      0|            return std::numeric_limits<int>::min();
  339|  83.7k|        return m_value;
  340|  83.7k|    }
_ZNK10CScriptNum6getvchEv:
  345|   552k|    {
  346|   552k|        return serialize(m_value);
  347|   552k|    }
_ZN10CScriptNum9serializeERKl:
  350|   583k|    {
  351|   583k|        if(value == 0)
  ------------------
  |  Branch (351:12): [True: 54.6k, False: 528k]
  ------------------
  352|  54.6k|            return std::vector<unsigned char>();
  353|       |
  354|   528k|        std::vector<unsigned char> result;
  355|   528k|        const bool neg = value < 0;
  356|   528k|        uint64_t absvalue = neg ? ~static_cast<uint64_t>(value) + 1 : static_cast<uint64_t>(value);
  ------------------
  |  Branch (356:29): [True: 20.1k, False: 508k]
  ------------------
  357|       |
  358|  1.32M|        while(absvalue)
  ------------------
  |  Branch (358:15): [True: 798k, False: 528k]
  ------------------
  359|   798k|        {
  360|   798k|            result.push_back(absvalue & 0xff);
  361|   798k|            absvalue >>= 8;
  362|   798k|        }
  363|       |
  364|       |//    - If the most significant byte is >= 0x80 and the value is positive, push a
  365|       |//    new zero-byte to make the significant byte < 0x80 again.
  366|       |
  367|       |//    - If the most significant byte is >= 0x80 and the value is negative, push a
  368|       |//    new 0x80 byte that will be popped off when converting to an integral.
  369|       |
  370|       |//    - If the most significant byte is < 0x80 and the value is negative, add
  371|       |//    0x80 to it, since it will be subtracted and interpreted as a negative when
  372|       |//    converting to an integral.
  373|       |
  374|   528k|        if (result.back() & 0x80)
  ------------------
  |  Branch (374:13): [True: 3.51k, False: 525k]
  ------------------
  375|  3.51k|            result.push_back(neg ? 0x80 : 0);
  ------------------
  |  Branch (375:30): [True: 216, False: 3.29k]
  ------------------
  376|   525k|        else if (neg)
  ------------------
  |  Branch (376:18): [True: 19.9k, False: 505k]
  ------------------
  377|  19.9k|            result.back() |= 0x80;
  378|       |
  379|   528k|        return result;
  380|   583k|    }
_ZN10CScriptNum7set_vchERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
  384|   259k|    {
  385|   259k|      if (vch.empty())
  ------------------
  |  Branch (385:11): [True: 133k, False: 126k]
  ------------------
  386|   133k|          return 0;
  387|       |
  388|   126k|      int64_t result = 0;
  389|   330k|      for (size_t i = 0; i != vch.size(); ++i)
  ------------------
  |  Branch (389:26): [True: 204k, False: 126k]
  ------------------
  390|   204k|          result |= static_cast<int64_t>(vch[i]) << 8*i;
  391|       |
  392|       |      // If the input vector's most significant byte is 0x80, remove it from
  393|       |      // the result's msb and return a negative.
  394|   126k|      if (vch.back() & 0x80)
  ------------------
  |  Branch (394:11): [True: 11.7k, False: 114k]
  ------------------
  395|  11.7k|          return -((int64_t)(result & ~(0x80ULL << (8 * (vch.size() - 1)))));
  396|       |
  397|   114k|      return result;
  398|   126k|    }
_ZN7CScript14AppendDataSizeEj:
  418|  6.07M|    {
  419|  6.07M|        if (size < OP_PUSHDATA1) {
  ------------------
  |  Branch (419:13): [True: 365k, False: 5.71M]
  ------------------
  420|   365k|            insert(end(), static_cast<value_type>(size));
  421|  5.71M|        } else if (size <= 0xff) {
  ------------------
  |  Branch (421:20): [True: 5.71M, False: 197]
  ------------------
  422|  5.71M|            insert(end(), OP_PUSHDATA1);
  423|  5.71M|            insert(end(), static_cast<value_type>(size));
  424|  5.71M|        } else if (size <= 0xffff) {
  ------------------
  |  Branch (424:20): [True: 197, False: 0]
  ------------------
  425|    197|            insert(end(), OP_PUSHDATA2);
  426|    197|            value_type data[2];
  427|    197|            WriteLE16(data, size);
  428|    197|            insert(end(), std::cbegin(data), std::cend(data));
  429|    197|        } else {
  430|      0|            insert(end(), OP_PUSHDATA4);
  431|      0|            value_type data[4];
  432|      0|            WriteLE32(data, size);
  433|      0|            insert(end(), std::cbegin(data), std::cend(data));
  434|      0|        }
  435|  6.07M|    }
_ZN7CScript10AppendDataENSt3__14spanIKhLm18446744073709551615EEE:
  438|  6.07M|    {
  439|  6.07M|        insert(end(), data.begin(), data.end());
  440|  6.07M|    }
_ZN7CScript10push_int64El:
  444|  41.3k|    {
  445|  41.3k|        if (n == -1 || (n >= 1 && n <= 16))
  ------------------
  |  Branch (445:13): [True: 160, False: 41.1k]
  |  Branch (445:25): [True: 37.9k, False: 3.23k]
  |  Branch (445:35): [True: 7.89k, False: 30.0k]
  ------------------
  446|  8.05k|        {
  447|  8.05k|            push_back(n + (OP_1 - 1));
  448|  8.05k|        }
  449|  33.2k|        else if (n == 0)
  ------------------
  |  Branch (449:18): [True: 2.52k, False: 30.7k]
  ------------------
  450|  2.52k|        {
  451|  2.52k|            push_back(OP_0);
  452|  2.52k|        }
  453|  30.7k|        else
  454|  30.7k|        {
  455|  30.7k|            *this << CScriptNum::serialize(n);
  456|  30.7k|        }
  457|  41.3k|        return *this;
  458|  41.3k|    }
_ZN7CScriptlsEl:
  477|  41.3k|    CScript& operator<<(int64_t b) LIFETIMEBOUND { return push_int64(b); }
_ZN7CScriptlsE10opcodetype:
  480|   129k|    {
  481|   129k|        if (opcode < 0 || opcode > 0xff)
  ------------------
  |  Branch (481:13): [True: 0, False: 129k]
  |  Branch (481:27): [True: 0, False: 129k]
  ------------------
  482|      0|            throw std::runtime_error("CScript::operator<<(): invalid opcode");
  483|   129k|        insert(end(), (unsigned char)opcode);
  484|   129k|        return *this;
  485|   129k|    }
_ZN7CScriptlsERK10CScriptNum:
  488|  3.01k|    {
  489|  3.01k|        *this << b.getvch();
  490|  3.01k|        return *this;
  491|  3.01k|    }
_ZN7CScriptlsENSt3__14spanIKSt4byteLm18446744073709551615EEE:
  494|  6.07M|    {
  495|  6.07M|        AppendDataSize(b.size());
  496|  6.07M|        AppendData({reinterpret_cast<const value_type*>(b.data()), b.size()});
  497|  6.07M|        return *this;
  498|  6.07M|    }
_ZN7CScriptlsENSt3__14spanIKhLm18446744073709551615EEE:
  502|  6.07M|    {
  503|  6.07M|        return *this << std::as_bytes(b);
  504|  6.07M|    }
_ZNK7CScript5GetOpERN9prevectorILj28EhjiE14const_iteratorER10opcodetypeRNSt3__16vectorIhNS6_9allocatorIhEEEE:
  507|  7.19M|    {
  508|  7.19M|        return GetScriptOp(pc, end(), opcodeRet, &vchRet);
  509|  7.19M|    }
_ZNK7CScript5GetOpERN9prevectorILj28EhjiE14const_iteratorER10opcodetype:
  512|   205M|    {
  513|   205M|        return GetScriptOp(pc, end(), opcodeRet, nullptr);
  514|   205M|    }
_ZN7CScript10DecodeOP_NE10opcodetype:
  518|  95.6k|    {
  519|  95.6k|        if (opcode == OP_0)
  ------------------
  |  Branch (519:13): [True: 52.6k, False: 42.9k]
  ------------------
  520|  52.6k|            return 0;
  521|  42.9k|        assert(opcode >= OP_1 && opcode <= OP_16);
  522|  42.9k|        return (int)opcode - (int)(OP_1 - 1);
  523|  42.9k|    }
_ZN7CScript10EncodeOP_NEi:
  525|    322|    {
  526|    322|        assert(n >= 0 && n <= 16);
  527|    322|        if (n == 0)
  ------------------
  |  Branch (527:13): [True: 0, False: 322]
  ------------------
  528|      0|            return OP_0;
  529|    322|        return (opcodetype)(OP_1+n-1);
  530|    322|    }
_ZN7CScript5clearEv:
  577|   111k|    {
  578|       |        // The default prevector::clear() does not release memory
  579|   111k|        CScriptBase::clear();
  580|   111k|        shrink_to_fit();
  581|   111k|    }
_ZNK14CScriptWitness6IsNullEv:
  593|   133k|    bool IsNull() const { return stack.empty(); }
_ZN9CScriptIDC2ERK7uint160:
  606|  18.3k|    explicit CScriptID(const uint160& in) : BaseHash(in) {}
_ZN7CScriptC2Ev:
  461|  6.96M|    CScript() = default;
_ZN14CScriptWitnessC2Ev:
  591|   297k|    CScriptWitness() = default;
_ZN7CScript16SerializationOpsI12ParamsStreamIR10DataStream20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
  465|   171k|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  156|   171k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN7CScript16SerializationOpsI10DataStreamS_17ActionUnserializeEEvRT0_RT_T1_:
  465|  3.61k|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  156|  3.61k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN7CScriptC2ITkNSt3__114input_iteratorENS1_11__wrap_iterIPKhEEEET_S6_:
  463|  22.9k|    CScript(InputIterator first, InputIterator last) : CScriptBase{first, last} { }
_ZN7CScriptC2ITkNSt3__114input_iteratorENS1_11__wrap_iterIPhEEEET_S5_:
  463|  16.2k|    CScript(InputIterator first, InputIterator last) : CScriptBase{first, last} { }
_Z12ToByteVectorI7CPubKeyENSt3__16vectorIhNS1_9allocatorIhEEEERKT_:
   68|  32.3k|{
   69|  32.3k|    return std::vector<unsigned char>(in.begin(), in.end());
   70|  32.3k|}
_Z12ToByteVectorI16WitnessV0KeyHashENSt3__16vectorIhNS1_9allocatorIhEEEERKT_:
   68|  4.00k|{
   69|  4.00k|    return std::vector<unsigned char>(in.begin(), in.end());
   70|  4.00k|}
_Z12ToByteVectorINSt3__16vectorIhNS0_9allocatorIhEEEEES4_RKT_:
   68|  9.03k|{
   69|  9.03k|    return std::vector<unsigned char>(in.begin(), in.end());
   70|  9.03k|}
_ZN7CScript16SerializationOpsI10HashWriterKS_15ActionSerializeEEvRT0_RT_T1_:
  465|  5.92M|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  156|  5.92M|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN7CScript16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
  465|   198k|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  156|   198k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN7CScriptC2ITkNSt3__114input_iteratorEN9prevectorILj28EhjiE14const_iteratorEEET_S5_:
  463|   104k|    CScript(InputIterator first, InputIterator last) : CScriptBase{first, last} { }

_Z17ScriptErrorString13ScriptError_t:
   11|  49.4k|{
   12|  49.4k|    switch (serror)
   13|  49.4k|    {
   14|      0|        case SCRIPT_ERR_OK:
  ------------------
  |  Branch (14:9): [True: 0, False: 49.4k]
  ------------------
   15|      0|            return "No error";
   16|  2.92k|        case SCRIPT_ERR_EVAL_FALSE:
  ------------------
  |  Branch (16:9): [True: 2.92k, False: 46.5k]
  ------------------
   17|  2.92k|            return "Script evaluated without error but finished with a false/empty top stack element";
   18|    291|        case SCRIPT_ERR_VERIFY:
  ------------------
  |  Branch (18:9): [True: 291, False: 49.2k]
  ------------------
   19|    291|            return "Script failed an OP_VERIFY operation";
   20|    271|        case SCRIPT_ERR_EQUALVERIFY:
  ------------------
  |  Branch (20:9): [True: 271, False: 49.2k]
  ------------------
   21|    271|            return "Script failed an OP_EQUALVERIFY operation";
   22|      0|        case SCRIPT_ERR_CHECKMULTISIGVERIFY:
  ------------------
  |  Branch (22:9): [True: 0, False: 49.4k]
  ------------------
   23|      0|            return "Script failed an OP_CHECKMULTISIGVERIFY operation";
   24|    329|        case SCRIPT_ERR_CHECKSIGVERIFY:
  ------------------
  |  Branch (24:9): [True: 329, False: 49.1k]
  ------------------
   25|    329|            return "Script failed an OP_CHECKSIGVERIFY operation";
   26|    349|        case SCRIPT_ERR_NUMEQUALVERIFY:
  ------------------
  |  Branch (26:9): [True: 349, False: 49.1k]
  ------------------
   27|    349|            return "Script failed an OP_NUMEQUALVERIFY operation";
   28|     21|        case SCRIPT_ERR_SCRIPT_SIZE:
  ------------------
  |  Branch (28:9): [True: 21, False: 49.4k]
  ------------------
   29|     21|            return "Script is too big";
   30|    252|        case SCRIPT_ERR_PUSH_SIZE:
  ------------------
  |  Branch (30:9): [True: 252, False: 49.2k]
  ------------------
   31|    252|            return "Push value size limit exceeded";
   32|    627|        case SCRIPT_ERR_OP_COUNT:
  ------------------
  |  Branch (32:9): [True: 627, False: 48.8k]
  ------------------
   33|    627|            return "Operation limit exceeded";
   34|    323|        case SCRIPT_ERR_STACK_SIZE:
  ------------------
  |  Branch (34:9): [True: 323, False: 49.1k]
  ------------------
   35|    323|            return "Stack size limit exceeded";
   36|    528|        case SCRIPT_ERR_SIG_COUNT:
  ------------------
  |  Branch (36:9): [True: 528, False: 48.9k]
  ------------------
   37|    528|            return "Signature count negative or greater than pubkey count";
   38|    450|        case SCRIPT_ERR_PUBKEY_COUNT:
  ------------------
  |  Branch (38:9): [True: 450, False: 49.0k]
  ------------------
   39|    450|            return "Pubkey count negative or limit exceeded";
   40|  4.13k|        case SCRIPT_ERR_BAD_OPCODE:
  ------------------
  |  Branch (40:9): [True: 4.13k, False: 45.3k]
  ------------------
   41|  4.13k|            return "Opcode missing or not understood";
   42|  2.00k|        case SCRIPT_ERR_DISABLED_OPCODE:
  ------------------
  |  Branch (42:9): [True: 2.00k, False: 47.4k]
  ------------------
   43|  2.00k|            return "Attempted to use a disabled opcode";
   44|      0|        case SCRIPT_ERR_INVALID_STACK_OPERATION:
  ------------------
  |  Branch (44:9): [True: 0, False: 49.4k]
  ------------------
   45|      0|            return "Operation not valid with the current stack size";
   46|    195|        case SCRIPT_ERR_INVALID_ALTSTACK_OPERATION:
  ------------------
  |  Branch (46:9): [True: 195, False: 49.3k]
  ------------------
   47|    195|            return "Operation not valid with the current altstack size";
   48|    953|        case SCRIPT_ERR_OP_RETURN:
  ------------------
  |  Branch (48:9): [True: 953, False: 48.5k]
  ------------------
   49|    953|            return "OP_RETURN was encountered";
   50|    999|        case SCRIPT_ERR_UNBALANCED_CONDITIONAL:
  ------------------
  |  Branch (50:9): [True: 999, False: 48.4k]
  ------------------
   51|    999|            return "Invalid OP_IF construction";
   52|    530|        case SCRIPT_ERR_NEGATIVE_LOCKTIME:
  ------------------
  |  Branch (52:9): [True: 530, False: 48.9k]
  ------------------
   53|    530|            return "Negative locktime";
   54|  2.78k|        case SCRIPT_ERR_UNSATISFIED_LOCKTIME:
  ------------------
  |  Branch (54:9): [True: 2.78k, False: 46.7k]
  ------------------
   55|  2.78k|            return "Locktime requirement not satisfied";
   56|  8.93k|        case SCRIPT_ERR_SIG_HASHTYPE:
  ------------------
  |  Branch (56:9): [True: 8.93k, False: 40.5k]
  ------------------
   57|  8.93k|            return "Signature hash type missing or not understood";
   58|  1.06k|        case SCRIPT_ERR_SIG_DER:
  ------------------
  |  Branch (58:9): [True: 1.06k, False: 48.4k]
  ------------------
   59|  1.06k|            return "Non-canonical DER signature";
   60|    456|        case SCRIPT_ERR_MINIMALDATA:
  ------------------
  |  Branch (60:9): [True: 456, False: 49.0k]
  ------------------
   61|    456|            return "Data push larger than necessary";
   62|     23|        case SCRIPT_ERR_SIG_PUSHONLY:
  ------------------
  |  Branch (62:9): [True: 23, False: 49.4k]
  ------------------
   63|     23|            return "Only push operators allowed in signatures";
   64|      0|        case SCRIPT_ERR_SIG_HIGH_S:
  ------------------
  |  Branch (64:9): [True: 0, False: 49.4k]
  ------------------
   65|      0|            return "Non-canonical signature: S value is unnecessarily high";
   66|    213|        case SCRIPT_ERR_SIG_NULLDUMMY:
  ------------------
  |  Branch (66:9): [True: 213, False: 49.2k]
  ------------------
   67|    213|            return "Dummy CHECKMULTISIG argument must be zero";
   68|      0|        case SCRIPT_ERR_MINIMALIF:
  ------------------
  |  Branch (68:9): [True: 0, False: 49.4k]
  ------------------
   69|      0|            return "OP_IF/NOTIF argument must be minimal";
   70|      0|        case SCRIPT_ERR_SIG_NULLFAIL:
  ------------------
  |  Branch (70:9): [True: 0, False: 49.4k]
  ------------------
   71|      0|            return "Signature must be zero for failed CHECK(MULTI)SIG operation";
   72|    292|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS:
  ------------------
  |  Branch (72:9): [True: 292, False: 49.2k]
  ------------------
   73|    292|            return "NOPx reserved for soft-fork upgrades";
   74|    742|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM:
  ------------------
  |  Branch (74:9): [True: 742, False: 48.7k]
  ------------------
   75|    742|            return "Witness version reserved for soft-fork upgrades";
   76|      0|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION:
  ------------------
  |  Branch (76:9): [True: 0, False: 49.4k]
  ------------------
   77|      0|            return "Taproot version reserved for soft-fork upgrades";
   78|      0|        case SCRIPT_ERR_DISCOURAGE_OP_SUCCESS:
  ------------------
  |  Branch (78:9): [True: 0, False: 49.4k]
  ------------------
   79|      0|            return "OP_SUCCESSx reserved for soft-fork upgrades";
   80|      0|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_PUBKEYTYPE:
  ------------------
  |  Branch (80:9): [True: 0, False: 49.4k]
  ------------------
   81|      0|            return "Public key version reserved for soft-fork upgrades";
   82|  1.27k|        case SCRIPT_ERR_PUBKEYTYPE:
  ------------------
  |  Branch (82:9): [True: 1.27k, False: 48.2k]
  ------------------
   83|  1.27k|            return "Public key is neither compressed or uncompressed";
   84|  2.06k|        case SCRIPT_ERR_CLEANSTACK:
  ------------------
  |  Branch (84:9): [True: 2.06k, False: 47.4k]
  ------------------
   85|  2.06k|            return "Stack size must be exactly one after execution";
   86|    378|        case SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH:
  ------------------
  |  Branch (86:9): [True: 378, False: 49.1k]
  ------------------
   87|    378|            return "Witness program has incorrect length";
   88|  7.15k|        case SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY:
  ------------------
  |  Branch (88:9): [True: 7.15k, False: 42.3k]
  ------------------
   89|  7.15k|            return "Witness program was passed an empty witness";
   90|  1.84k|        case SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH:
  ------------------
  |  Branch (90:9): [True: 1.84k, False: 47.6k]
  ------------------
   91|  1.84k|            return "Witness program hash mismatch";
   92|     89|        case SCRIPT_ERR_WITNESS_MALLEATED:
  ------------------
  |  Branch (92:9): [True: 89, False: 49.4k]
  ------------------
   93|     89|            return "Witness requires empty scriptSig";
   94|      0|        case SCRIPT_ERR_WITNESS_MALLEATED_P2SH:
  ------------------
  |  Branch (94:9): [True: 0, False: 49.4k]
  ------------------
   95|      0|            return "Witness requires only-redeemscript scriptSig";
   96|     76|        case SCRIPT_ERR_WITNESS_UNEXPECTED:
  ------------------
  |  Branch (96:9): [True: 76, False: 49.4k]
  ------------------
   97|     76|            return "Witness provided for non-witness script";
   98|      0|        case SCRIPT_ERR_WITNESS_PUBKEYTYPE:
  ------------------
  |  Branch (98:9): [True: 0, False: 49.4k]
  ------------------
   99|      0|            return "Using non-compressed keys in segwit";
  100|  1.06k|        case SCRIPT_ERR_SCHNORR_SIG_SIZE:
  ------------------
  |  Branch (100:9): [True: 1.06k, False: 48.4k]
  ------------------
  101|  1.06k|            return "Invalid Schnorr signature size";
  102|     41|        case SCRIPT_ERR_SCHNORR_SIG_HASHTYPE:
  ------------------
  |  Branch (102:9): [True: 41, False: 49.4k]
  ------------------
  103|     41|            return "Invalid Schnorr signature hash type";
  104|    447|        case SCRIPT_ERR_SCHNORR_SIG:
  ------------------
  |  Branch (104:9): [True: 447, False: 49.0k]
  ------------------
  105|    447|            return "Invalid Schnorr signature";
  106|    548|        case SCRIPT_ERR_TAPROOT_WRONG_CONTROL_SIZE:
  ------------------
  |  Branch (106:9): [True: 548, False: 48.9k]
  ------------------
  107|    548|            return "Invalid Taproot control block size";
  108|      0|        case SCRIPT_ERR_TAPSCRIPT_VALIDATION_WEIGHT:
  ------------------
  |  Branch (108:9): [True: 0, False: 49.4k]
  ------------------
  109|      0|            return "Too much signature validation relative to witness weight";
  110|      0|        case SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG:
  ------------------
  |  Branch (110:9): [True: 0, False: 49.4k]
  ------------------
  111|      0|            return "OP_CHECKMULTISIG(VERIFY) is not available in tapscript";
  112|      0|        case SCRIPT_ERR_TAPSCRIPT_MINIMALIF:
  ------------------
  |  Branch (112:9): [True: 0, False: 49.4k]
  ------------------
  113|      0|            return "OP_IF/NOTIF argument must be minimal in tapscript";
  114|    326|        case SCRIPT_ERR_OP_CODESEPARATOR:
  ------------------
  |  Branch (114:9): [True: 326, False: 49.1k]
  ------------------
  115|    326|            return "Using OP_CODESEPARATOR in non-witness script";
  116|    889|        case SCRIPT_ERR_SIG_FINDANDDELETE:
  ------------------
  |  Branch (116:9): [True: 889, False: 48.6k]
  ------------------
  117|    889|            return "Signature is found in scriptCode";
  118|  3.61k|        case SCRIPT_ERR_UNKNOWN_ERROR:
  ------------------
  |  Branch (118:9): [True: 3.61k, False: 45.8k]
  ------------------
  119|  3.61k|        case SCRIPT_ERR_ERROR_COUNT:
  ------------------
  |  Branch (119:9): [True: 0, False: 49.4k]
  ------------------
  120|  3.61k|        default: break;
  ------------------
  |  Branch (120:9): [True: 0, False: 49.4k]
  ------------------
  121|  49.4k|    }
  122|  3.61k|    return "unknown error";
  123|  49.4k|}

_ZN34MutableTransactionSignatureCreatorC2ERK19CMutableTransactionjRKli:
   24|  2.96k|    : m_txto{tx}, nIn{input_idx}, nHashType{hash_type}, amount{amount}, checker{&m_txto, nIn, amount, MissingDataBehavior::FAIL},
   25|  2.96k|      m_txdata(nullptr)
   26|  2.96k|{
   27|  2.96k|}
_ZN34MutableTransactionSignatureCreatorC2ERK19CMutableTransactionjRKlPK26PrecomputedTransactionDatai:
   30|  89.2k|    : m_txto{tx}, nIn{input_idx}, nHashType{hash_type}, amount{amount},
   31|  89.2k|      checker{txdata ? MutableTransactionSignatureChecker{&m_txto, nIn, amount, *txdata, MissingDataBehavior::FAIL} :
  ------------------
  |  Branch (31:15): [True: 89.2k, False: 0]
  ------------------
   32|  89.2k|                       MutableTransactionSignatureChecker{&m_txto, nIn, amount, MissingDataBehavior::FAIL}},
   33|  89.2k|      m_txdata(txdata)
   34|  89.2k|{
   35|  89.2k|}
_ZNK34MutableTransactionSignatureCreator9CreateSigERK15SigningProviderRNSt3__16vectorIhNS3_9allocatorIhEEEERK6CKeyIDRK7CScript10SigVersion:
   38|  37.1k|{
   39|  37.1k|    assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
   40|       |
   41|  37.1k|    CKey key;
   42|  37.1k|    if (!provider.GetKey(address, key))
  ------------------
  |  Branch (42:9): [True: 2.66k, False: 34.4k]
  ------------------
   43|  2.66k|        return false;
   44|       |
   45|       |    // Signing with uncompressed keys is disabled in witness scripts
   46|  34.4k|    if (sigversion == SigVersion::WITNESS_V0 && !key.IsCompressed())
  ------------------
  |  Branch (46:9): [True: 9.23k, False: 25.2k]
  |  Branch (46:49): [True: 372, False: 8.86k]
  ------------------
   47|    372|        return false;
   48|       |
   49|       |    // Signing without known amount does not work in witness scripts.
   50|  34.0k|    if (sigversion == SigVersion::WITNESS_V0 && !MoneyRange(amount)) return false;
  ------------------
  |  Branch (50:9): [True: 8.86k, False: 25.2k]
  |  Branch (50:49): [True: 516, False: 8.34k]
  ------------------
   51|       |
   52|       |    // BASE/WITNESS_V0 signatures don't support explicit SIGHASH_DEFAULT, use SIGHASH_ALL instead.
   53|  33.5k|    const int hashtype = nHashType == SIGHASH_DEFAULT ? SIGHASH_ALL : nHashType;
  ------------------
  |  Branch (53:26): [True: 944, False: 32.6k]
  ------------------
   54|       |
   55|  33.5k|    uint256 hash = SignatureHash(scriptCode, m_txto, nIn, hashtype, amount, sigversion, m_txdata);
   56|  33.5k|    if (!key.Sign(hash, vchSig))
  ------------------
  |  Branch (56:9): [True: 0, False: 33.5k]
  ------------------
   57|      0|        return false;
   58|  33.5k|    vchSig.push_back((unsigned char)hashtype);
   59|  33.5k|    return true;
   60|  33.5k|}
_ZNK34MutableTransactionSignatureCreator16CreateSchnorrSigERK15SigningProviderRNSt3__16vectorIhNS3_9allocatorIhEEEERK11XOnlyPubKeyPK7uint256SE_10SigVersion:
   63|  12.0k|{
   64|  12.0k|    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
   65|       |
   66|  12.0k|    CKey key;
   67|  12.0k|    if (!provider.GetKeyByXOnly(pubkey, key)) return false;
  ------------------
  |  Branch (67:9): [True: 12.0k, False: 0]
  ------------------
   68|       |
   69|       |    // BIP341/BIP342 signing needs lots of precomputed transaction data. While some
   70|       |    // (non-SIGHASH_DEFAULT) sighash modes exist that can work with just some subset
   71|       |    // of data present, for now, only support signing when everything is provided.
   72|      0|    if (!m_txdata || !m_txdata->m_bip341_taproot_ready || !m_txdata->m_spent_outputs_ready) return false;
  ------------------
  |  Branch (72:9): [True: 0, False: 0]
  |  Branch (72:22): [True: 0, False: 0]
  |  Branch (72:59): [True: 0, False: 0]
  ------------------
   73|       |
   74|      0|    ScriptExecutionData execdata;
   75|      0|    execdata.m_annex_init = true;
   76|      0|    execdata.m_annex_present = false; // Only support annex-less signing for now.
   77|      0|    if (sigversion == SigVersion::TAPSCRIPT) {
  ------------------
  |  Branch (77:9): [True: 0, False: 0]
  ------------------
   78|      0|        execdata.m_codeseparator_pos_init = true;
   79|      0|        execdata.m_codeseparator_pos = 0xFFFFFFFF; // Only support non-OP_CODESEPARATOR BIP342 signing for now.
   80|      0|        if (!leaf_hash) return false; // BIP342 signing needs leaf hash.
  ------------------
  |  Branch (80:13): [True: 0, False: 0]
  ------------------
   81|      0|        execdata.m_tapleaf_hash_init = true;
   82|      0|        execdata.m_tapleaf_hash = *leaf_hash;
   83|      0|    }
   84|      0|    uint256 hash;
   85|      0|    if (!SignatureHashSchnorr(hash, execdata, m_txto, nIn, nHashType, sigversion, *m_txdata, MissingDataBehavior::FAIL)) return false;
  ------------------
  |  Branch (85:9): [True: 0, False: 0]
  ------------------
   86|      0|    sig.resize(64);
   87|       |    // Use uint256{} as aux_rnd for now.
   88|      0|    if (!key.SignSchnorr(hash, sig, merkle_root, {})) return false;
  ------------------
  |  Branch (88:9): [True: 0, False: 0]
  ------------------
   89|      0|    if (nHashType) sig.push_back(nHashType);
  ------------------
  |  Branch (89:9): [True: 0, False: 0]
  ------------------
   90|      0|    return true;
   91|      0|}
_Z16ProduceSignatureRK15SigningProviderRK20BaseSignatureCreatorRK7CScriptR13SignatureData:
  503|   114k|{
  504|   114k|    if (sigdata.complete) return true;
  ------------------
  |  Branch (504:9): [True: 434, False: 114k]
  ------------------
  505|       |
  506|   114k|    std::vector<valtype> result;
  507|   114k|    TxoutType whichType;
  508|   114k|    bool solved = SignStep(provider, creator, fromPubKey, result, whichType, SigVersion::BASE, sigdata);
  509|   114k|    bool P2SH = false;
  510|   114k|    CScript subscript;
  511|       |
  512|   114k|    if (solved && whichType == TxoutType::SCRIPTHASH)
  ------------------
  |  Branch (512:9): [True: 37.9k, False: 76.2k]
  |  Branch (512:19): [True: 10.3k, False: 27.6k]
  ------------------
  513|  10.3k|    {
  514|       |        // Solver returns the subscript that needs to be evaluated;
  515|       |        // the final scriptSig is the signatures from that
  516|       |        // and then the serialized subscript:
  517|  10.3k|        subscript = CScript(result[0].begin(), result[0].end());
  518|  10.3k|        sigdata.redeem_script = subscript;
  519|  10.3k|        solved = solved && SignStep(provider, creator, subscript, result, whichType, SigVersion::BASE, sigdata) && whichType != TxoutType::SCRIPTHASH;
  ------------------
  |  Branch (519:18): [True: 10.3k, False: 0]
  |  Branch (519:28): [True: 8.56k, False: 1.75k]
  |  Branch (519:116): [True: 8.56k, False: 0]
  ------------------
  520|  10.3k|        P2SH = true;
  521|  10.3k|    }
  522|       |
  523|   114k|    if (solved && whichType == TxoutType::WITNESS_V0_KEYHASH)
  ------------------
  |  Branch (523:9): [True: 36.2k, False: 78.0k]
  |  Branch (523:19): [True: 9.03k, False: 27.1k]
  ------------------
  524|  9.03k|    {
  525|  9.03k|        CScript witnessscript;
  526|  9.03k|        witnessscript << OP_DUP << OP_HASH160 << ToByteVector(result[0]) << OP_EQUALVERIFY << OP_CHECKSIG;
  527|  9.03k|        TxoutType subType;
  528|  9.03k|        solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata);
  ------------------
  |  Branch (528:18): [True: 9.03k, False: 0]
  |  Branch (528:28): [True: 8.04k, False: 988]
  ------------------
  529|  9.03k|        sigdata.scriptWitness.stack = result;
  530|  9.03k|        sigdata.witness = true;
  531|  9.03k|        result.clear();
  532|  9.03k|    }
  533|   105k|    else if (solved && whichType == TxoutType::WITNESS_V0_SCRIPTHASH)
  ------------------
  |  Branch (533:14): [True: 27.1k, False: 78.0k]
  |  Branch (533:24): [True: 2.10k, False: 25.0k]
  ------------------
  534|  2.10k|    {
  535|  2.10k|        CScript witnessscript(result[0].begin(), result[0].end());
  536|  2.10k|        sigdata.witness_script = witnessscript;
  537|       |
  538|  2.10k|        TxoutType subType{TxoutType::NONSTANDARD};
  539|  2.10k|        solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata) && subType != TxoutType::SCRIPTHASH && subType != TxoutType::WITNESS_V0_SCRIPTHASH && subType != TxoutType::WITNESS_V0_KEYHASH;
  ------------------
  |  Branch (539:18): [True: 2.10k, False: 0]
  |  Branch (539:28): [True: 37, False: 2.07k]
  |  Branch (539:124): [True: 37, False: 0]
  |  Branch (539:160): [True: 37, False: 0]
  |  Branch (539:207): [True: 0, False: 37]
  ------------------
  540|       |
  541|       |        // If we couldn't find a solution with the legacy satisfier, try satisfying the script using Miniscript.
  542|       |        // Note we need to check if the result stack is empty before, because it might be used even if the Script
  543|       |        // isn't fully solved. For instance the CHECKMULTISIG satisfaction in SignStep() pushes partial signatures
  544|       |        // and the extractor relies on this behaviour to combine witnesses.
  545|  2.10k|        if (!solved && result.empty()) {
  ------------------
  |  Branch (545:13): [True: 2.10k, False: 0]
  |  Branch (545:24): [True: 2.07k, False: 37]
  ------------------
  546|  2.07k|            WshSatisfier ms_satisfier{provider, sigdata, creator, witnessscript};
  547|  2.07k|            const auto ms = miniscript::FromScript(witnessscript, ms_satisfier);
  548|  2.07k|            solved = ms && ms->Satisfy(ms_satisfier, result) == miniscript::Availability::YES;
  ------------------
  |  Branch (548:22): [True: 71, False: 2.00k]
  |  Branch (548:28): [True: 0, False: 71]
  ------------------
  549|  2.07k|        }
  550|  2.10k|        result.emplace_back(witnessscript.begin(), witnessscript.end());
  551|       |
  552|  2.10k|        sigdata.scriptWitness.stack = result;
  553|  2.10k|        sigdata.witness = true;
  554|  2.10k|        result.clear();
  555|   103k|    } else if (whichType == TxoutType::WITNESS_V1_TAPROOT && !P2SH) {
  ------------------
  |  Branch (555:16): [True: 6.03k, False: 97.0k]
  |  Branch (555:62): [True: 6.03k, False: 0]
  ------------------
  556|  6.03k|        sigdata.witness = true;
  557|  6.03k|        if (solved) {
  ------------------
  |  Branch (557:13): [True: 12, False: 6.02k]
  ------------------
  558|     12|            sigdata.scriptWitness.stack = std::move(result);
  559|     12|        }
  560|  6.03k|        result.clear();
  561|  97.0k|    } else if (solved && whichType == TxoutType::WITNESS_UNKNOWN) {
  ------------------
  |  Branch (561:16): [True: 25.0k, False: 71.9k]
  |  Branch (561:26): [True: 0, False: 25.0k]
  ------------------
  562|      0|        sigdata.witness = true;
  563|      0|    }
  564|       |
  565|   114k|    if (!sigdata.witness) sigdata.scriptWitness.stack.clear();
  ------------------
  |  Branch (565:9): [True: 97.0k, False: 17.1k]
  ------------------
  566|   114k|    if (P2SH) {
  ------------------
  |  Branch (566:9): [True: 10.3k, False: 103k]
  ------------------
  567|  10.3k|        result.emplace_back(subscript.begin(), subscript.end());
  568|  10.3k|    }
  569|   114k|    sigdata.scriptSig = PushAll(result);
  570|       |
  571|       |    // Test solution
  572|   114k|    sigdata.complete = solved && VerifyScript(sigdata.scriptSig, fromPubKey, &sigdata.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, creator.Checker());
  ------------------
  |  Branch (572:24): [True: 33.1k, False: 81.1k]
  |  Branch (572:34): [True: 2.09k, False: 31.0k]
  ------------------
  573|   114k|    return sigdata.complete;
  574|   114k|}
_Z19DataFromTransactionRK19CMutableTransactionjRK6CTxOut:
  611|  92.4k|{
  612|  92.4k|    SignatureData data;
  613|  92.4k|    assert(tx.vin.size() > nIn);
  614|  92.4k|    data.scriptSig = tx.vin[nIn].scriptSig;
  615|  92.4k|    data.scriptWitness = tx.vin[nIn].scriptWitness;
  616|  92.4k|    Stacks stack(data);
  617|       |
  618|       |    // Get signatures
  619|  92.4k|    MutableTransactionSignatureChecker tx_checker(&tx, nIn, txout.nValue, MissingDataBehavior::FAIL);
  620|  92.4k|    SignatureExtractorChecker extractor_checker(data, tx_checker);
  621|  92.4k|    if (VerifyScript(data.scriptSig, txout.scriptPubKey, &data.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, extractor_checker)) {
  ------------------
  |  Branch (621:9): [True: 492, False: 91.9k]
  ------------------
  622|    492|        data.complete = true;
  623|    492|        return data;
  624|    492|    }
  625|       |
  626|       |    // Get scripts
  627|  91.9k|    std::vector<std::vector<unsigned char>> solutions;
  628|  91.9k|    TxoutType script_type = Solver(txout.scriptPubKey, solutions);
  629|  91.9k|    SigVersion sigversion = SigVersion::BASE;
  630|  91.9k|    CScript next_script = txout.scriptPubKey;
  631|       |
  632|  91.9k|    if (script_type == TxoutType::SCRIPTHASH && !stack.script.empty() && !stack.script.back().empty()) {
  ------------------
  |  Branch (632:9): [True: 12.8k, False: 79.0k]
  |  Branch (632:49): [True: 1.69k, False: 11.1k]
  |  Branch (632:74): [True: 1.26k, False: 424]
  ------------------
  633|       |        // Get the redeemScript
  634|  1.26k|        CScript redeem_script(stack.script.back().begin(), stack.script.back().end());
  635|  1.26k|        data.redeem_script = redeem_script;
  636|  1.26k|        next_script = std::move(redeem_script);
  637|       |
  638|       |        // Get redeemScript type
  639|  1.26k|        script_type = Solver(next_script, solutions);
  640|  1.26k|        stack.script.pop_back();
  641|  1.26k|    }
  642|  91.9k|    if (script_type == TxoutType::WITNESS_V0_SCRIPTHASH && !stack.witness.empty() && !stack.witness.back().empty()) {
  ------------------
  |  Branch (642:9): [True: 6.44k, False: 85.5k]
  |  Branch (642:60): [True: 2.84k, False: 3.59k]
  |  Branch (642:86): [True: 2.55k, False: 288]
  ------------------
  643|       |        // Get the witnessScript
  644|  2.55k|        CScript witness_script(stack.witness.back().begin(), stack.witness.back().end());
  645|  2.55k|        data.witness_script = witness_script;
  646|  2.55k|        next_script = std::move(witness_script);
  647|       |
  648|       |        // Get witnessScript type
  649|  2.55k|        script_type = Solver(next_script, solutions);
  650|  2.55k|        stack.witness.pop_back();
  651|  2.55k|        stack.script = std::move(stack.witness);
  652|  2.55k|        stack.witness.clear();
  653|  2.55k|        sigversion = SigVersion::WITNESS_V0;
  654|  2.55k|    }
  655|  91.9k|    if (script_type == TxoutType::MULTISIG && !stack.script.empty()) {
  ------------------
  |  Branch (655:9): [True: 0, False: 91.9k]
  |  Branch (655:47): [True: 0, False: 0]
  ------------------
  656|       |        // Build a map of pubkey -> signature by matching sigs to pubkeys:
  657|      0|        assert(solutions.size() > 1);
  658|      0|        unsigned int num_pubkeys = solutions.size()-2;
  659|      0|        unsigned int last_success_key = 0;
  660|      0|        for (const valtype& sig : stack.script) {
  ------------------
  |  Branch (660:33): [True: 0, False: 0]
  ------------------
  661|      0|            for (unsigned int i = last_success_key; i < num_pubkeys; ++i) {
  ------------------
  |  Branch (661:53): [True: 0, False: 0]
  ------------------
  662|      0|                const valtype& pubkey = solutions[i+1];
  663|       |                // We either have a signature for this pubkey, or we have found a signature and it is valid
  664|      0|                if (data.signatures.count(CPubKey(pubkey).GetID()) || extractor_checker.CheckECDSASignature(sig, pubkey, next_script, sigversion)) {
  ------------------
  |  Branch (664:21): [True: 0, False: 0]
  |  Branch (664:21): [True: 0, False: 0]
  |  Branch (664:71): [True: 0, False: 0]
  ------------------
  665|      0|                    last_success_key = i + 1;
  666|      0|                    break;
  667|      0|                }
  668|      0|            }
  669|      0|        }
  670|      0|    }
  671|       |
  672|  91.9k|    return data;
  673|  91.9k|}
_Z11UpdateInputR5CTxInRK13SignatureData:
  676|  93.9k|{
  677|  93.9k|    input.scriptSig = data.scriptSig;
  678|  93.9k|    input.scriptWitness = data.scriptWitness;
  679|  93.9k|}
_ZN13SignatureData18MergeSignatureDataES_:
  682|  13.8k|{
  683|  13.8k|    if (complete) return;
  ------------------
  |  Branch (683:9): [True: 16, False: 13.8k]
  ------------------
  684|  13.8k|    if (sigdata.complete) {
  ------------------
  |  Branch (684:9): [True: 0, False: 13.8k]
  ------------------
  685|      0|        *this = std::move(sigdata);
  686|      0|        return;
  687|      0|    }
  688|  13.8k|    if (redeem_script.empty() && !sigdata.redeem_script.empty()) {
  ------------------
  |  Branch (688:9): [True: 13.8k, False: 6]
  |  Branch (688:34): [True: 0, False: 13.8k]
  ------------------
  689|      0|        redeem_script = sigdata.redeem_script;
  690|      0|    }
  691|  13.8k|    if (witness_script.empty() && !sigdata.witness_script.empty()) {
  ------------------
  |  Branch (691:9): [True: 13.8k, False: 25]
  |  Branch (691:35): [True: 0, False: 13.8k]
  ------------------
  692|      0|        witness_script = sigdata.witness_script;
  693|      0|    }
  694|  13.8k|    signatures.insert(std::make_move_iterator(sigdata.signatures.begin()), std::make_move_iterator(sigdata.signatures.end()));
  695|  13.8k|}
_Z15SignTransactionR19CMutableTransactionPK15SigningProviderRKNSt3__13mapI9COutPoint4CoinNS4_4lessIS6_EENS4_9allocatorINS4_4pairIKS6_S7_EEEEEEiRNS5_Ii13bilingual_strNS8_IiEENSA_INSB_IKiSI_EEEEEE:
  767|  8.06k|{
  768|  8.06k|    bool fHashSingle = ((nHashType & ~SIGHASH_ANYONECANPAY) == SIGHASH_SINGLE);
  769|       |
  770|       |    // Use CTransaction for the constant parts of the
  771|       |    // transaction to avoid rehashing.
  772|  8.06k|    const CTransaction txConst(mtx);
  773|       |
  774|  8.06k|    PrecomputedTransactionData txdata;
  775|  8.06k|    std::vector<CTxOut> spent_outputs;
  776|  16.5k|    for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
  ------------------
  |  Branch (776:30): [True: 12.8k, False: 3.71k]
  ------------------
  777|  12.8k|        CTxIn& txin = mtx.vin[i];
  778|  12.8k|        auto coin = coins.find(txin.prevout);
  779|  12.8k|        if (coin == coins.end() || coin->second.IsSpent()) {
  ------------------
  |  Branch (779:13): [True: 4.35k, False: 8.51k]
  |  Branch (779:13): [True: 4.35k, False: 8.51k]
  |  Branch (779:36): [True: 0, False: 8.51k]
  ------------------
  780|  4.35k|            txdata.Init(txConst, /*spent_outputs=*/{}, /*force=*/true);
  781|  4.35k|            break;
  782|  8.51k|        } else {
  783|  8.51k|            spent_outputs.emplace_back(coin->second.out.nValue, coin->second.out.scriptPubKey);
  784|  8.51k|        }
  785|  12.8k|    }
  786|  8.06k|    if (spent_outputs.size() == mtx.vin.size()) {
  ------------------
  |  Branch (786:9): [True: 3.71k, False: 4.35k]
  ------------------
  787|  3.71k|        txdata.Init(txConst, std::move(spent_outputs), true);
  788|  3.71k|    }
  789|       |
  790|       |    // Sign what we can:
  791|   154k|    for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
  ------------------
  |  Branch (791:30): [True: 146k, False: 8.06k]
  ------------------
  792|   146k|        CTxIn& txin = mtx.vin[i];
  793|   146k|        auto coin = coins.find(txin.prevout);
  794|   146k|        if (coin == coins.end() || coin->second.IsSpent()) {
  ------------------
  |  Branch (794:13): [True: 55.6k, False: 90.5k]
  |  Branch (794:13): [True: 55.6k, False: 90.5k]
  |  Branch (794:36): [True: 0, False: 90.5k]
  ------------------
  795|  55.6k|            input_errors[i] = _("Input not found or already spent");
  796|  55.6k|            continue;
  797|  55.6k|        }
  798|  90.5k|        const CScript& prevPubKey = coin->second.out.scriptPubKey;
  799|  90.5k|        const CAmount& amount = coin->second.out.nValue;
  800|       |
  801|  90.5k|        SignatureData sigdata = DataFromTransaction(mtx, i, coin->second.out);
  802|       |        // Only sign SIGHASH_SINGLE if there's a corresponding output:
  803|  90.5k|        if (!fHashSingle || (i < mtx.vout.size())) {
  ------------------
  |  Branch (803:13): [True: 88.8k, False: 1.69k]
  |  Branch (803:29): [True: 389, False: 1.30k]
  ------------------
  804|  89.2k|            ProduceSignature(*keystore, MutableTransactionSignatureCreator(mtx, i, amount, &txdata, nHashType), prevPubKey, sigdata);
  805|  89.2k|        }
  806|       |
  807|  90.5k|        UpdateInput(txin, sigdata);
  808|       |
  809|       |        // amount must be specified for valid segwit signature
  810|  90.5k|        if (amount == MAX_MONEY && !txin.scriptWitness.IsNull()) {
  ------------------
  |  Branch (810:13): [True: 0, False: 90.5k]
  |  Branch (810:36): [True: 0, False: 0]
  ------------------
  811|      0|            input_errors[i] = _("Missing amount");
  812|      0|            continue;
  813|      0|        }
  814|       |
  815|  90.5k|        ScriptError serror = SCRIPT_ERR_OK;
  816|  90.5k|        if (!sigdata.complete && !VerifyScript(txin.scriptSig, prevPubKey, &txin.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, TransactionSignatureChecker(&txConst, i, amount, txdata, MissingDataBehavior::FAIL), &serror)) {
  ------------------
  |  Branch (816:13): [True: 88.0k, False: 2.43k]
  |  Branch (816:13): [True: 87.8k, False: 2.65k]
  |  Branch (816:34): [True: 87.8k, False: 223]
  ------------------
  817|  87.8k|            if (serror == SCRIPT_ERR_INVALID_STACK_OPERATION) {
  ------------------
  |  Branch (817:17): [True: 16.0k, False: 71.8k]
  ------------------
  818|       |                // Unable to sign input and verification failed (possible attempt to partially sign).
  819|  16.0k|                input_errors[i] = Untranslated("Unable to sign input, invalid stack size (possibly missing key)");
  820|  71.8k|            } else if (serror == SCRIPT_ERR_SIG_NULLFAIL) {
  ------------------
  |  Branch (820:24): [True: 22.3k, False: 49.4k]
  ------------------
  821|       |                // Verification failed (possibly due to insufficient signatures).
  822|  22.3k|                input_errors[i] = Untranslated("CHECK(MULTI)SIG failing with non-zero signature (possibly need more signatures)");
  823|  49.4k|            } else {
  824|  49.4k|                input_errors[i] = Untranslated(ScriptErrorString(serror));
  825|  49.4k|            }
  826|  87.8k|        } else {
  827|       |            // If this input succeeds, make sure there is no error set for it
  828|  2.65k|            input_errors.erase(i);
  829|  2.65k|        }
  830|  90.5k|    }
  831|  8.06k|    return input_errors.empty();
  832|  8.06k|}
sign.cpp:_ZL8SignStepRK15SigningProviderRK20BaseSignatureCreatorRK7CScriptRNSt3__16vectorINS9_IhNS8_9allocatorIhEEEENSA_ISC_EEEER9TxoutType10SigVersionR13SignatureData:
  403|   135k|{
  404|   135k|    CScript scriptRet;
  405|   135k|    ret.clear();
  406|   135k|    std::vector<unsigned char> sig;
  407|       |
  408|   135k|    std::vector<valtype> vSolutions;
  409|   135k|    whichTypeRet = Solver(scriptPubKey, vSolutions);
  410|       |
  411|   135k|    switch (whichTypeRet) {
  ------------------
  |  Branch (411:13): [True: 0, False: 135k]
  ------------------
  412|  63.6k|    case TxoutType::NONSTANDARD:
  ------------------
  |  Branch (412:5): [True: 63.6k, False: 72.0k]
  ------------------
  413|  64.0k|    case TxoutType::NULL_DATA:
  ------------------
  |  Branch (413:5): [True: 403, False: 135k]
  ------------------
  414|  64.7k|    case TxoutType::WITNESS_UNKNOWN:
  ------------------
  |  Branch (414:5): [True: 756, False: 134k]
  ------------------
  415|  64.7k|        return false;
  416|  2.33k|    case TxoutType::PUBKEY:
  ------------------
  |  Branch (416:5): [True: 2.33k, False: 133k]
  ------------------
  417|  2.33k|        if (!CreateSig(creator, sigdata, provider, sig, CPubKey(vSolutions[0]), scriptPubKey, sigversion)) return false;
  ------------------
  |  Branch (417:13): [True: 2.32k, False: 11]
  ------------------
  418|     11|        ret.push_back(std::move(sig));
  419|     11|        return true;
  420|  34.2k|    case TxoutType::PUBKEYHASH: {
  ------------------
  |  Branch (420:5): [True: 34.2k, False: 101k]
  ------------------
  421|  34.2k|        CKeyID keyID = CKeyID(uint160(vSolutions[0]));
  422|  34.2k|        CPubKey pubkey;
  423|  34.2k|        if (!GetPubKey(provider, sigdata, keyID, pubkey)) {
  ------------------
  |  Branch (423:13): [True: 1.16k, False: 33.1k]
  ------------------
  424|       |            // Pubkey could not be found, add to missing
  425|  1.16k|            sigdata.missing_pubkeys.push_back(keyID);
  426|  1.16k|            return false;
  427|  1.16k|        }
  428|  33.1k|        if (!CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) return false;
  ------------------
  |  Branch (428:13): [True: 801, False: 32.3k]
  ------------------
  429|  32.3k|        ret.push_back(std::move(sig));
  430|  32.3k|        ret.push_back(ToByteVector(pubkey));
  431|  32.3k|        return true;
  432|  33.1k|    }
  433|  12.5k|    case TxoutType::SCRIPTHASH: {
  ------------------
  |  Branch (433:5): [True: 12.5k, False: 123k]
  ------------------
  434|  12.5k|        uint160 h160{vSolutions[0]};
  435|  12.5k|        if (GetCScript(provider, sigdata, CScriptID{h160}, scriptRet)) {
  ------------------
  |  Branch (435:13): [True: 10.3k, False: 2.24k]
  ------------------
  436|  10.3k|            ret.emplace_back(scriptRet.begin(), scriptRet.end());
  437|  10.3k|            return true;
  438|  10.3k|        }
  439|       |        // Could not find redeemScript, add to missing
  440|  2.24k|        sigdata.missing_redeem_script = h160;
  441|  2.24k|        return false;
  442|  12.5k|    }
  443|    247|    case TxoutType::MULTISIG: {
  ------------------
  |  Branch (443:5): [True: 247, False: 135k]
  ------------------
  444|    247|        size_t required = vSolutions.front()[0];
  445|    247|        ret.emplace_back(); // workaround CHECKMULTISIG bug
  446|  3.14k|        for (size_t i = 1; i < vSolutions.size() - 1; ++i) {
  ------------------
  |  Branch (446:28): [True: 2.89k, False: 247]
  ------------------
  447|  2.89k|            CPubKey pubkey = CPubKey(vSolutions[i]);
  448|       |            // We need to always call CreateSig in order to fill sigdata with all
  449|       |            // possible signatures that we can create. This will allow further PSBT
  450|       |            // processing to work as it needs all possible signature and pubkey pairs
  451|  2.89k|            if (CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) {
  ------------------
  |  Branch (451:17): [True: 2.70k, False: 191]
  ------------------
  452|  2.70k|                if (ret.size() < required + 1) {
  ------------------
  |  Branch (452:21): [True: 1.70k, False: 997]
  ------------------
  453|  1.70k|                    ret.push_back(std::move(sig));
  454|  1.70k|                }
  455|  2.70k|            }
  456|  2.89k|        }
  457|    247|        bool ok = ret.size() == required + 1;
  458|    309|        for (size_t i = 0; i + ret.size() < required + 1; ++i) {
  ------------------
  |  Branch (458:28): [True: 62, False: 247]
  ------------------
  459|     62|            ret.emplace_back();
  460|     62|        }
  461|    247|        return ok;
  462|  12.5k|    }
  463|  9.07k|    case TxoutType::WITNESS_V0_KEYHASH:
  ------------------
  |  Branch (463:5): [True: 9.07k, False: 126k]
  ------------------
  464|  9.07k|        ret.push_back(vSolutions[0]);
  465|  9.07k|        return true;
  466|       |
  467|  5.83k|    case TxoutType::WITNESS_V0_SCRIPTHASH:
  ------------------
  |  Branch (467:5): [True: 5.83k, False: 129k]
  ------------------
  468|  5.83k|        if (GetCScript(provider, sigdata, CScriptID{RIPEMD160(vSolutions[0])}, scriptRet)) {
  ------------------
  |  Branch (468:13): [True: 2.10k, False: 3.72k]
  ------------------
  469|  2.10k|            ret.emplace_back(scriptRet.begin(), scriptRet.end());
  470|  2.10k|            return true;
  471|  2.10k|        }
  472|       |        // Could not find witnessScript, add to missing
  473|  3.72k|        sigdata.missing_witness_script = uint256(vSolutions[0]);
  474|  3.72k|        return false;
  475|       |
  476|  6.03k|    case TxoutType::WITNESS_V1_TAPROOT:
  ------------------
  |  Branch (476:5): [True: 6.03k, False: 129k]
  ------------------
  477|  6.03k|        return SignTaproot(provider, creator, WitnessV1Taproot(XOnlyPubKey{vSolutions[0]}), sigdata, ret);
  478|       |
  479|    522|    case TxoutType::ANCHOR:
  ------------------
  |  Branch (479:5): [True: 522, False: 135k]
  ------------------
  480|    522|        return true;
  481|   135k|    } // no default case, so the compiler can warn about missing cases
  482|      0|    assert(false);
  483|      0|}
sign.cpp:_ZL9CreateSigRK20BaseSignatureCreatorR13SignatureDataRK15SigningProviderRNSt3__16vectorIhNS7_9allocatorIhEEEERK7CPubKeyRK7CScript10SigVersion:
  133|  38.3k|{
  134|  38.3k|    CKeyID keyid = pubkey.GetID();
  135|  38.3k|    const auto it = sigdata.signatures.find(keyid);
  136|  38.3k|    if (it != sigdata.signatures.end()) {
  ------------------
  |  Branch (136:9): [True: 718, False: 37.6k]
  ------------------
  137|    718|        sig_out = it->second.second;
  138|    718|        return true;
  139|    718|    }
  140|  37.6k|    KeyOriginInfo info;
  141|  37.6k|    if (provider.GetKeyOrigin(keyid, info)) {
  ------------------
  |  Branch (141:9): [True: 0, False: 37.6k]
  ------------------
  142|      0|        sigdata.misc_pubkeys.emplace(keyid, std::make_pair(pubkey, std::move(info)));
  143|      0|    }
  144|  37.6k|    if (creator.CreateSig(provider, sig_out, keyid, scriptcode, sigversion)) {
  ------------------
  |  Branch (144:9): [True: 34.3k, False: 3.31k]
  ------------------
  145|  34.3k|        auto i = sigdata.signatures.emplace(keyid, SigPair(pubkey, sig_out));
  146|  34.3k|        assert(i.second);
  147|  34.3k|        return true;
  148|  34.3k|    }
  149|       |    // Could not make signature or signature not found, add keyid to missing
  150|  3.31k|    sigdata.missing_sigs.push_back(keyid);
  151|  3.31k|    return false;
  152|  37.6k|}
sign.cpp:_ZL9GetPubKeyRK15SigningProviderRK13SignatureDataRK6CKeyIDR7CPubKey:
  110|  34.2k|{
  111|       |    // Look for pubkey in all partial sigs
  112|  34.2k|    const auto it = sigdata.signatures.find(address);
  113|  34.2k|    if (it != sigdata.signatures.end()) {
  ------------------
  |  Branch (113:9): [True: 0, False: 34.2k]
  ------------------
  114|      0|        pubkey = it->second.first;
  115|      0|        return true;
  116|      0|    }
  117|       |    // Look for pubkey in pubkey lists
  118|  34.2k|    const auto& pk_it = sigdata.misc_pubkeys.find(address);
  119|  34.2k|    if (pk_it != sigdata.misc_pubkeys.end()) {
  ------------------
  |  Branch (119:9): [True: 0, False: 34.2k]
  ------------------
  120|      0|        pubkey = pk_it->second.first;
  121|      0|        return true;
  122|      0|    }
  123|  34.2k|    const auto& tap_pk_it = sigdata.tap_pubkeys.find(address);
  124|  34.2k|    if (tap_pk_it != sigdata.tap_pubkeys.end()) {
  ------------------
  |  Branch (124:9): [True: 0, False: 34.2k]
  ------------------
  125|      0|        pubkey = tap_pk_it->second.GetEvenCorrespondingCPubKey();
  126|      0|        return true;
  127|      0|    }
  128|       |    // Query the underlying provider
  129|  34.2k|    return provider.GetPubKey(address, pubkey);
  130|  34.2k|}
sign.cpp:_ZL10GetCScriptRK15SigningProviderRK13SignatureDataRK9CScriptIDR7CScript:
   94|  18.3k|{
   95|  18.3k|    if (provider.GetCScript(scriptid, script)) {
  ------------------
  |  Branch (95:9): [True: 8.56k, False: 9.82k]
  ------------------
   96|  8.56k|        return true;
   97|  8.56k|    }
   98|       |    // Look for scripts in SignatureData
   99|  9.82k|    if (CScriptID(sigdata.redeem_script) == scriptid) {
  ------------------
  |  Branch (99:9): [True: 2.61k, False: 7.21k]
  ------------------
  100|  2.61k|        script = sigdata.redeem_script;
  101|  2.61k|        return true;
  102|  7.21k|    } else if (CScriptID(sigdata.witness_script) == scriptid) {
  ------------------
  |  Branch (102:16): [True: 1.24k, False: 5.96k]
  ------------------
  103|  1.24k|        script = sigdata.witness_script;
  104|  1.24k|        return true;
  105|  1.24k|    }
  106|  5.96k|    return false;
  107|  9.82k|}
sign.cpp:_ZL11SignTaprootRK15SigningProviderRK20BaseSignatureCreatorRK16WitnessV1TaprootR13SignatureDataRNSt3__16vectorINSB_IhNSA_9allocatorIhEEEENSC_ISE_EEEE:
  334|  6.03k|{
  335|  6.03k|    TaprootSpendData spenddata;
  336|  6.03k|    TaprootBuilder builder;
  337|       |
  338|       |    // Gather information about this output.
  339|  6.03k|    if (provider.GetTaprootSpendData(output, spenddata)) {
  ------------------
  |  Branch (339:9): [True: 0, False: 6.03k]
  ------------------
  340|      0|        sigdata.tr_spenddata.Merge(spenddata);
  341|      0|    }
  342|  6.03k|    if (provider.GetTaprootBuilder(output, builder)) {
  ------------------
  |  Branch (342:9): [True: 0, False: 6.03k]
  ------------------
  343|      0|        sigdata.tr_builder = builder;
  344|      0|    }
  345|       |
  346|       |    // Try key path spending.
  347|  6.03k|    {
  348|  6.03k|        KeyOriginInfo info;
  349|  6.03k|        if (provider.GetKeyOriginByXOnly(sigdata.tr_spenddata.internal_key, info)) {
  ------------------
  |  Branch (349:13): [True: 0, False: 6.03k]
  ------------------
  350|      0|            auto it = sigdata.taproot_misc_pubkeys.find(sigdata.tr_spenddata.internal_key);
  351|      0|            if (it == sigdata.taproot_misc_pubkeys.end()) {
  ------------------
  |  Branch (351:17): [True: 0, False: 0]
  ------------------
  352|      0|                sigdata.taproot_misc_pubkeys.emplace(sigdata.tr_spenddata.internal_key, std::make_pair(std::set<uint256>(), info));
  353|      0|            }
  354|      0|        }
  355|       |
  356|  6.03k|        std::vector<unsigned char> sig;
  357|  6.03k|        if (sigdata.taproot_key_path_sig.size() == 0) {
  ------------------
  |  Branch (357:13): [True: 6.03k, False: 0]
  ------------------
  358|  6.03k|            if (creator.CreateSchnorrSig(provider, sig, sigdata.tr_spenddata.internal_key, nullptr, &sigdata.tr_spenddata.merkle_root, SigVersion::TAPROOT)) {
  ------------------
  |  Branch (358:17): [True: 12, False: 6.02k]
  ------------------
  359|     12|                sigdata.taproot_key_path_sig = sig;
  360|     12|            }
  361|  6.03k|        }
  362|  6.03k|        if (sigdata.taproot_key_path_sig.size() == 0) {
  ------------------
  |  Branch (362:13): [True: 6.02k, False: 12]
  ------------------
  363|  6.02k|            if (creator.CreateSchnorrSig(provider, sig, output, nullptr, nullptr, SigVersion::TAPROOT)) {
  ------------------
  |  Branch (363:17): [True: 0, False: 6.02k]
  ------------------
  364|      0|                sigdata.taproot_key_path_sig = sig;
  365|      0|            }
  366|  6.02k|        }
  367|  6.03k|        if (sigdata.taproot_key_path_sig.size()) {
  ------------------
  |  Branch (367:13): [True: 12, False: 6.02k]
  ------------------
  368|     12|            result = Vector(sigdata.taproot_key_path_sig);
  369|     12|            return true;
  370|     12|        }
  371|  6.03k|    }
  372|       |
  373|       |    // Try script path spending.
  374|  6.02k|    std::vector<std::vector<unsigned char>> smallest_result_stack;
  375|  6.02k|    for (const auto& [key, control_blocks] : sigdata.tr_spenddata.scripts) {
  ------------------
  |  Branch (375:44): [True: 0, False: 6.02k]
  ------------------
  376|      0|        const auto& [script, leaf_ver] = key;
  377|      0|        std::vector<std::vector<unsigned char>> result_stack;
  378|      0|        if (SignTaprootScript(provider, creator, sigdata, leaf_ver, script, result_stack)) {
  ------------------
  |  Branch (378:13): [True: 0, False: 0]
  ------------------
  379|      0|            result_stack.emplace_back(std::begin(script), std::end(script)); // Push the script
  380|      0|            result_stack.push_back(*control_blocks.begin()); // Push the smallest control block
  381|      0|            if (smallest_result_stack.size() == 0 ||
  ------------------
  |  Branch (381:17): [True: 0, False: 0]
  ------------------
  382|      0|                GetSerializeSize(result_stack) < GetSerializeSize(smallest_result_stack)) {
  ------------------
  |  Branch (382:17): [True: 0, False: 0]
  ------------------
  383|      0|                smallest_result_stack = std::move(result_stack);
  384|      0|            }
  385|      0|        }
  386|      0|    }
  387|  6.02k|    if (smallest_result_stack.size() != 0) {
  ------------------
  |  Branch (387:9): [True: 0, False: 6.02k]
  ------------------
  388|      0|        result = std::move(smallest_result_stack);
  389|      0|        return true;
  390|      0|    }
  391|       |
  392|  6.02k|    return false;
  393|  6.02k|}
_ZN12WshSatisfierC2ERK15SigningProviderR13SignatureDataRK20BaseSignatureCreatorRK7CScript:
  260|  2.07k|                          : Satisfier(provider, sig_data, creator, witscript, miniscript::MiniscriptContext::P2WSH) {}
_ZN9SatisfierI7CPubKeyEC2ERK15SigningProviderR13SignatureDataRK20BaseSignatureCreatorRK7CScriptN10miniscript17MiniscriptContextE:
  208|  2.07k|                       miniscript::MiniscriptContext script_ctx) : m_provider(provider),
  209|  2.07k|                                                                   m_sig_data(sig_data),
  210|  2.07k|                                                                   m_creator(creator),
  211|  2.07k|                                                                   m_witness_script(witscript),
  212|  2.07k|                                                                   m_script_ctx(script_ctx) {}
sign.cpp:_ZL7PushAllRKNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEE:
  486|   114k|{
  487|   114k|    CScript result;
  488|   114k|    for (const valtype& v : values) {
  ------------------
  |  Branch (488:27): [True: 60.9k, False: 114k]
  ------------------
  489|  60.9k|        if (v.size() == 0) {
  ------------------
  |  Branch (489:13): [True: 1.61k, False: 59.2k]
  ------------------
  490|  1.61k|            result << OP_0;
  491|  59.2k|        } else if (v.size() == 1 && v[0] >= 1 && v[0] <= 16) {
  ------------------
  |  Branch (491:20): [True: 364, False: 58.9k]
  |  Branch (491:37): [True: 354, False: 10]
  |  Branch (491:50): [True: 322, False: 32]
  ------------------
  492|    322|            result << CScript::EncodeOP_N(v[0]);
  493|  58.9k|        } else if (v.size() == 1 && v[0] == 0x81) {
  ------------------
  |  Branch (493:20): [True: 42, False: 58.9k]
  |  Branch (493:37): [True: 18, False: 24]
  ------------------
  494|     18|            result << OP_1NEGATE;
  495|  58.9k|        } else {
  496|  58.9k|            result << v;
  497|  58.9k|        }
  498|  60.9k|    }
  499|   114k|    return result;
  500|   114k|}
sign.cpp:_ZN12_GLOBAL__N_16StacksC2ERK13SignatureData:
  603|  92.4k|    explicit Stacks(const SignatureData& data) : witness(data.scriptWitness.stack) {
  604|  92.4k|        EvalScript(script, data.scriptSig, SCRIPT_VERIFY_STRICTENC, BaseSignatureChecker(), SigVersion::BASE);
  605|  92.4k|    }
sign.cpp:_ZN12_GLOBAL__N_125SignatureExtractorCheckerC2ER13SignatureDataR20BaseSignatureChecker:
  583|  92.4k|    SignatureExtractorChecker(SignatureData& sigdata, BaseSignatureChecker& checker) : DeferringSignatureChecker(checker), sigdata(sigdata) {}
sign.cpp:_ZNK12_GLOBAL__N_125SignatureExtractorChecker19CheckECDSASignatureERKNSt3__16vectorIhNS1_9allocatorIhEEEES7_RK7CScript10SigVersion:
  586|    822|    {
  587|    822|        if (m_checker.CheckECDSASignature(scriptSig, vchPubKey, scriptCode, sigversion)) {
  ------------------
  |  Branch (587:13): [True: 0, False: 822]
  ------------------
  588|      0|            CPubKey pubkey(vchPubKey);
  589|      0|            sigdata.signatures.emplace(pubkey.GetID(), SigPair(pubkey, scriptSig));
  590|      0|            return true;
  591|      0|        }
  592|    822|        return false;
  593|    822|    }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureChecker19CheckECDSASignatureERKNSt3__16vectorIhNS1_9allocatorIhEEEES7_RK7CScript10SigVersion:
  703|    982|    bool CheckECDSASignature(const std::vector<unsigned char>& sig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override { return sig.size() != 0; }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureChecker21CheckSchnorrSignatureE4SpanIKhES3_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
  704|     12|    bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror) const override { return sig.size() != 0; }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureCreator7CheckerEv:
  719|    255|    const BaseSignatureChecker& Checker() const override { return DUMMY_CHECKER; }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureCreator9CreateSigERK15SigningProviderRNSt3__16vectorIhNS4_9allocatorIhEEEERK6CKeyIDRK7CScript10SigVersion:
  721|  1.99k|    {
  722|       |        // Create a dummy signature that is a valid DER-encoding
  723|  1.99k|        vchSig.assign(m_r_len + m_s_len + 7, '\000');
  724|  1.99k|        vchSig[0] = 0x30;
  725|  1.99k|        vchSig[1] = m_r_len + m_s_len + 4;
  726|  1.99k|        vchSig[2] = 0x02;
  727|  1.99k|        vchSig[3] = m_r_len;
  728|  1.99k|        vchSig[4] = 0x01;
  729|  1.99k|        vchSig[4 + m_r_len] = 0x02;
  730|  1.99k|        vchSig[5 + m_r_len] = m_s_len;
  731|  1.99k|        vchSig[6 + m_r_len] = 0x01;
  732|  1.99k|        vchSig[6 + m_r_len + m_s_len] = SIGHASH_ALL;
  733|  1.99k|        return true;
  734|  1.99k|    }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureCreator16CreateSchnorrSigERK15SigningProviderRNSt3__16vectorIhNS4_9allocatorIhEEEERK11XOnlyPubKeyPK7uint256SF_10SigVersion:
  736|     12|    {
  737|     12|        sig.assign(64, '\000');
  738|     12|        return true;
  739|     12|    }
_ZNK9SatisfierI7CPubKeyE9MsContextEv:
  251|  2.57k|    miniscript::MiniscriptContext MsContext() const {
  252|  2.57k|        return m_script_ctx;
  253|  2.57k|    }
_ZNK12WshSatisfier11FromPKBytesINSt3__111__wrap_iterIPhEEEENS1_8optionalI7CPubKeyEET_S8_:
  264|      2|    std::optional<CPubKey> FromPKBytes(I first, I last) const {
  265|      2|        CPubKey pubkey{first, last};
  266|      2|        if (pubkey.IsValid()) return pubkey;
  ------------------
  |  Branch (266:13): [True: 0, False: 2]
  ------------------
  267|      2|        return {};
  268|      2|    }

_ZNK34MutableTransactionSignatureCreator7CheckerEv:
   51|  32.8k|    const BaseSignatureChecker& Checker() const override { return checker; }
_ZN13SignatureDataC2ERK7CScript:
   93|  25.8k|    explicit SignatureData(const CScript& script) : scriptSig(script) {}
_ZN13SignatureDataC2Ev:
   92|   117k|    SignatureData() = default;
_ZN20BaseSignatureCreatorD2Ev:
   30|  89.2k|    virtual ~BaseSignatureCreator() = default;

_ZN23FillableSigningProvider32ImplicitlyLearnRelatedKeyScriptsERK7CPubKey:
   96|  9.98k|{
   97|  9.98k|    AssertLockHeld(cs_KeyStore);
  ------------------
  |  |  142|  9.98k|#define AssertLockHeld(cs) AssertLockHeldInternal(#cs, __FILE__, __LINE__, &cs)
  ------------------
   98|  9.98k|    CKeyID key_id = pubkey.GetID();
   99|       |    // This adds the redeemscripts necessary to detect P2WPKH and P2SH-P2WPKH
  100|       |    // outputs. Technically P2WPKH outputs don't have a redeemscript to be
  101|       |    // spent. However, our current IsMine logic requires the corresponding
  102|       |    // P2SH-P2WPKH redeemscript to be present in the wallet in order to accept
  103|       |    // payment even to P2WPKH outputs.
  104|       |    // Also note that having superfluous scripts in the keystore never hurts.
  105|       |    // They're only used to guide recursion in signing and IsMine logic - if
  106|       |    // a script is present but we can't do anything with it, it has no effect.
  107|       |    // "Implicitly" refers to fact that scripts are derived automatically from
  108|       |    // existing keys, and are present in memory, even without being explicitly
  109|       |    // loaded (e.g. from a file).
  110|  9.98k|    if (pubkey.IsCompressed()) {
  ------------------
  |  Branch (110:9): [True: 4.00k, False: 5.98k]
  ------------------
  111|  4.00k|        CScript script = GetScriptForDestination(WitnessV0KeyHash(key_id));
  112|       |        // This does not use AddCScript, as it may be overridden.
  113|  4.00k|        CScriptID id(script);
  114|  4.00k|        mapScripts[id] = std::move(script);
  115|  4.00k|    }
  116|  9.98k|}
_ZNK23FillableSigningProvider9GetPubKeyERK6CKeyIDR7CPubKey:
  119|  34.2k|{
  120|  34.2k|    CKey key;
  121|  34.2k|    if (!GetKey(address, key)) {
  ------------------
  |  Branch (121:9): [True: 1.16k, False: 33.1k]
  ------------------
  122|  1.16k|        return false;
  123|  1.16k|    }
  124|  33.1k|    vchPubKeyOut = key.GetPubKey();
  125|  33.1k|    return true;
  126|  34.2k|}
_ZN23FillableSigningProvider12AddKeyPubKeyERK4CKeyRK7CPubKey:
  129|  9.98k|{
  130|  9.98k|    LOCK(cs_KeyStore);
  ------------------
  |  |  257|  9.98k|#define LOCK(cs) UniqueLock UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  9.98k|#define UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  9.98k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  9.98k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  131|  9.98k|    mapKeys[pubkey.GetID()] = key;
  132|  9.98k|    ImplicitlyLearnRelatedKeyScripts(pubkey);
  133|  9.98k|    return true;
  134|  9.98k|}
_ZNK23FillableSigningProvider6GetKeyERK6CKeyIDR4CKey:
  153|  95.5k|{
  154|  95.5k|    LOCK(cs_KeyStore);
  ------------------
  |  |  257|  95.5k|#define LOCK(cs) UniqueLock UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  95.5k|#define UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  95.5k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  95.5k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  155|  95.5k|    KeyMap::const_iterator mi = mapKeys.find(address);
  156|  95.5k|    if (mi != mapKeys.end()) {
  ------------------
  |  Branch (156:9): [True: 67.5k, False: 27.9k]
  ------------------
  157|  67.5k|        keyOut = mi->second;
  158|  67.5k|        return true;
  159|  67.5k|    }
  160|  27.9k|    return false;
  161|  95.5k|}
_ZNK23FillableSigningProvider10GetCScriptERK9CScriptIDR7CScript:
  192|  18.3k|{
  193|  18.3k|    LOCK(cs_KeyStore);
  ------------------
  |  |  257|  18.3k|#define LOCK(cs) UniqueLock UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  18.3k|#define UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  18.3k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  18.3k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  194|  18.3k|    ScriptMap::const_iterator mi = mapScripts.find(hash);
  195|  18.3k|    if (mi != mapScripts.end())
  ------------------
  |  Branch (195:9): [True: 8.56k, False: 9.82k]
  ------------------
  196|  8.56k|    {
  197|  8.56k|        redeemScriptOut = (*mi).second;
  198|  8.56k|        return true;
  199|  8.56k|    }
  200|  9.82k|    return false;
  201|  18.3k|}

_ZNK15SigningProvider12GetKeyOriginERK6CKeyIDR13KeyOriginInfo:
  161|  49.7k|    virtual bool GetKeyOrigin(const CKeyID& keyid, KeyOriginInfo& info) const { return false; }
_ZNK15SigningProvider19GetTaprootSpendDataERK11XOnlyPubKeyR16TaprootSpendData:
  162|  6.03k|    virtual bool GetTaprootSpendData(const XOnlyPubKey& output_key, TaprootSpendData& spenddata) const { return false; }
_ZNK15SigningProvider17GetTaprootBuilderERK11XOnlyPubKeyR14TaprootBuilder:
  163|  6.03k|    virtual bool GetTaprootBuilder(const XOnlyPubKey& output_key, TaprootBuilder& builder) const { return false; }
_ZNK15SigningProvider13GetKeyByXOnlyERK11XOnlyPubKeyR4CKey:
  166|  12.0k|    {
  167|  24.1k|        for (const auto& id : pubkey.GetKeyIDs()) {
  ------------------
  |  Branch (167:29): [True: 24.1k, False: 12.0k]
  ------------------
  168|  24.1k|            if (GetKey(id, key)) return true;
  ------------------
  |  Branch (168:17): [True: 0, False: 24.1k]
  ------------------
  169|  24.1k|        }
  170|  12.0k|        return false;
  171|  12.0k|    }
_ZNK15SigningProvider19GetKeyOriginByXOnlyERK11XOnlyPubKeyR13KeyOriginInfo:
  182|  6.03k|    {
  183|  12.0k|        for (const auto& id : pubkey.GetKeyIDs()) {
  ------------------
  |  Branch (183:29): [True: 12.0k, False: 6.03k]
  ------------------
  184|  12.0k|            if (GetKeyOrigin(id, info)) return true;
  ------------------
  |  Branch (184:17): [True: 0, False: 12.0k]
  ------------------
  185|  12.0k|        }
  186|  6.03k|        return false;
  187|  6.03k|    }
_ZN23FillableSigningProvider6AddKeyERK4CKey:
  290|  9.98k|    virtual bool AddKey(const CKey &key) { return AddKeyPubKey(key, key.GetPubKey()); }
_ZN15SigningProviderD2Ev:
  155|  11.9k|    virtual ~SigningProvider() = default;

_Z6SolverRK7CScriptRNSt3__16vectorINS3_IhNS2_9allocatorIhEEEENS4_IS6_EEEE:
  142|   231k|{
  143|   231k|    vSolutionsRet.clear();
  144|       |
  145|       |    // Shortcut for pay-to-script-hash, which are more constrained than the other types:
  146|       |    // it is always OP_HASH160 20 [20 byte hash] OP_EQUAL
  147|   231k|    if (scriptPubKey.IsPayToScriptHash())
  ------------------
  |  Branch (147:9): [True: 25.4k, False: 206k]
  ------------------
  148|  25.4k|    {
  149|  25.4k|        std::vector<unsigned char> hashBytes(scriptPubKey.begin()+2, scriptPubKey.begin()+22);
  150|  25.4k|        vSolutionsRet.push_back(hashBytes);
  151|  25.4k|        return TxoutType::SCRIPTHASH;
  152|  25.4k|    }
  153|       |
  154|   206k|    int witnessversion;
  155|   206k|    std::vector<unsigned char> witnessprogram;
  156|   206k|    if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
  ------------------
  |  Branch (156:9): [True: 37.3k, False: 168k]
  ------------------
  157|  37.3k|        if (witnessversion == 0 && witnessprogram.size() == WITNESS_V0_KEYHASH_SIZE) {
  ------------------
  |  Branch (157:13): [True: 22.6k, False: 14.6k]
  |  Branch (157:36): [True: 9.64k, False: 13.0k]
  ------------------
  158|  9.64k|            vSolutionsRet.push_back(std::move(witnessprogram));
  159|  9.64k|            return TxoutType::WITNESS_V0_KEYHASH;
  160|  9.64k|        }
  161|  27.6k|        if (witnessversion == 0 && witnessprogram.size() == WITNESS_V0_SCRIPTHASH_SIZE) {
  ------------------
  |  Branch (161:13): [True: 13.0k, False: 14.6k]
  |  Branch (161:36): [True: 12.2k, False: 771]
  ------------------
  162|  12.2k|            vSolutionsRet.push_back(std::move(witnessprogram));
  163|  12.2k|            return TxoutType::WITNESS_V0_SCRIPTHASH;
  164|  12.2k|        }
  165|  15.4k|        if (witnessversion == 1 && witnessprogram.size() == WITNESS_V1_TAPROOT_SIZE) {
  ------------------
  |  Branch (165:13): [True: 14.1k, False: 1.22k]
  |  Branch (165:36): [True: 12.0k, False: 2.11k]
  ------------------
  166|  12.0k|            vSolutionsRet.push_back(std::move(witnessprogram));
  167|  12.0k|            return TxoutType::WITNESS_V1_TAPROOT;
  168|  12.0k|        }
  169|  3.33k|        if (scriptPubKey.IsPayToAnchor()) {
  ------------------
  |  Branch (169:13): [True: 1.04k, False: 2.28k]
  ------------------
  170|  1.04k|            return TxoutType::ANCHOR;
  171|  1.04k|        }
  172|  2.28k|        if (witnessversion != 0) {
  ------------------
  |  Branch (172:13): [True: 1.51k, False: 771]
  ------------------
  173|  1.51k|            vSolutionsRet.push_back(std::vector<unsigned char>{(unsigned char)witnessversion});
  174|  1.51k|            vSolutionsRet.push_back(std::move(witnessprogram));
  175|  1.51k|            return TxoutType::WITNESS_UNKNOWN;
  176|  1.51k|        }
  177|    771|        return TxoutType::NONSTANDARD;
  178|  2.28k|    }
  179|       |
  180|       |    // Provably prunable, data-carrying output
  181|       |    //
  182|       |    // So long as script passes the IsUnspendable() test and all but the first
  183|       |    // byte passes the IsPushOnly() test we don't care what exactly is in the
  184|       |    // script.
  185|   168k|    if (scriptPubKey.size() >= 1 && scriptPubKey[0] == OP_RETURN && scriptPubKey.IsPushOnly(scriptPubKey.begin()+1)) {
  ------------------
  |  Branch (185:9): [True: 139k, False: 28.8k]
  |  Branch (185:9): [True: 778, False: 167k]
  |  Branch (185:37): [True: 2.04k, False: 137k]
  |  Branch (185:69): [True: 778, False: 1.26k]
  ------------------
  186|    778|        return TxoutType::NULL_DATA;
  187|    778|    }
  188|       |
  189|   167k|    std::vector<unsigned char> data;
  190|   167k|    if (MatchPayToPubkey(scriptPubKey, data)) {
  ------------------
  |  Branch (190:9): [True: 4.71k, False: 163k]
  ------------------
  191|  4.71k|        vSolutionsRet.push_back(std::move(data));
  192|  4.71k|        return TxoutType::PUBKEY;
  193|  4.71k|    }
  194|       |
  195|   163k|    if (MatchPayToPubkeyHash(scriptPubKey, data)) {
  ------------------
  |  Branch (195:9): [True: 59.5k, False: 103k]
  ------------------
  196|  59.5k|        vSolutionsRet.push_back(std::move(data));
  197|  59.5k|        return TxoutType::PUBKEYHASH;
  198|  59.5k|    }
  199|       |
  200|   103k|    int required;
  201|   103k|    std::vector<std::vector<unsigned char>> keys;
  202|   103k|    if (MatchMultisig(scriptPubKey, required, keys)) {
  ------------------
  |  Branch (202:9): [True: 247, False: 103k]
  ------------------
  203|    247|        vSolutionsRet.push_back({static_cast<unsigned char>(required)}); // safe as required is in range 1..20
  204|    247|        vSolutionsRet.insert(vSolutionsRet.end(), keys.begin(), keys.end());
  205|    247|        vSolutionsRet.push_back({static_cast<unsigned char>(keys.size())}); // safe as size is in range 1..20
  206|    247|        return TxoutType::MULTISIG;
  207|    247|    }
  208|       |
  209|   103k|    vSolutionsRet.clear();
  210|   103k|    return TxoutType::NONSTANDARD;
  211|   103k|}
solver.cpp:_ZL15GetScriptNumber10opcodetypeNSt3__16vectorIhNS0_9allocatorIhEEEEii:
   67|  10.4k|{
   68|  10.4k|    int count;
   69|  10.4k|    if (IsSmallInteger(opcode)) {
  ------------------
  |  Branch (69:9): [True: 6.01k, False: 4.44k]
  ------------------
   70|  6.01k|        count = CScript::DecodeOP_N(opcode);
   71|  6.01k|    } else if (IsPushdataOp(opcode)) {
  ------------------
  |  Branch (71:16): [True: 2.68k, False: 1.75k]
  ------------------
   72|  2.68k|        if (!CheckMinimalPush(data, opcode)) return {};
  ------------------
  |  Branch (72:13): [True: 282, False: 2.40k]
  ------------------
   73|  2.40k|        try {
   74|  2.40k|            count = CScriptNum(data, /* fRequireMinimal = */ true).getint();
   75|  2.40k|        } catch (const scriptnum_error&) {
   76|    735|            return {};
   77|    735|        }
   78|  2.40k|    } else {
   79|  1.75k|        return {};
   80|  1.75k|    }
   81|  7.68k|    if (count < min || count > max) return {};
  ------------------
  |  Branch (81:9): [True: 705, False: 6.98k]
  |  Branch (81:24): [True: 858, False: 6.12k]
  ------------------
   82|  6.12k|    return count;
   83|  7.68k|}
solver.cpp:_ZL14IsSmallInteger10opcodetype:
   60|  10.4k|{
   61|  10.4k|    return opcode >= OP_1 && opcode <= OP_16;
  ------------------
  |  Branch (61:12): [True: 7.17k, False: 3.28k]
  |  Branch (61:30): [True: 6.01k, False: 1.15k]
  ------------------
   62|  10.4k|}
solver.cpp:_ZL16MatchPayToPubkeyRK7CScriptRNSt3__16vectorIhNS2_9allocatorIhEEEE:
   37|   167k|{
   38|   167k|    if (script.size() == CPubKey::SIZE + 2 && script[0] == CPubKey::SIZE && script.back() == OP_CHECKSIG) {
  ------------------
  |  Branch (38:9): [True: 4.50k, False: 163k]
  |  Branch (38:47): [True: 4.28k, False: 221]
  |  Branch (38:77): [True: 3.76k, False: 524]
  ------------------
   39|  3.76k|        pubkey = valtype(script.begin() + 1, script.begin() + CPubKey::SIZE + 1);
   40|  3.76k|        return CPubKey::ValidSize(pubkey);
   41|  3.76k|    }
   42|   164k|    if (script.size() == CPubKey::COMPRESSED_SIZE + 2 && script[0] == CPubKey::COMPRESSED_SIZE && script.back() == OP_CHECKSIG) {
  ------------------
  |  Branch (42:9): [True: 3.63k, False: 160k]
  |  Branch (42:58): [True: 3.10k, False: 536]
  |  Branch (42:99): [True: 2.66k, False: 436]
  ------------------
   43|  2.66k|        pubkey = valtype(script.begin() + 1, script.begin() + CPubKey::COMPRESSED_SIZE + 1);
   44|  2.66k|        return CPubKey::ValidSize(pubkey);
   45|  2.66k|    }
   46|   161k|    return false;
   47|   164k|}
solver.cpp:_ZL20MatchPayToPubkeyHashRK7CScriptRNSt3__16vectorIhNS2_9allocatorIhEEEE:
   50|   163k|{
   51|   163k|    if (script.size() == 25 && script[0] == OP_DUP && script[1] == OP_HASH160 && script[2] == 20 && script[23] == OP_EQUALVERIFY && script[24] == OP_CHECKSIG) {
  ------------------
  |  Branch (51:9): [True: 61.2k, False: 101k]
  |  Branch (51:32): [True: 60.5k, False: 730]
  |  Branch (51:55): [True: 60.2k, False: 230]
  |  Branch (51:82): [True: 60.0k, False: 228]
  |  Branch (51:101): [True: 59.7k, False: 263]
  |  Branch (51:133): [True: 59.5k, False: 212]
  ------------------
   52|  59.5k|        pubkeyhash = valtype(script.begin () + 3, script.begin() + 23);
   53|  59.5k|        return true;
   54|  59.5k|    }
   55|   103k|    return false;
   56|   163k|}
solver.cpp:_ZL13MatchMultisigRK7CScriptRiRNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEE:
   86|   103k|{
   87|   103k|    opcodetype opcode;
   88|   103k|    valtype data;
   89|       |
   90|   103k|    CScript::const_iterator it = script.begin();
   91|   103k|    if (script.size() < 1 || script.back() != OP_CHECKMULTISIG) return false;
  ------------------
  |  Branch (91:9): [True: 28.8k, False: 74.7k]
  |  Branch (91:30): [True: 68.4k, False: 6.27k]
  ------------------
   92|       |
   93|  6.27k|    if (!script.GetOp(it, opcode, data)) return false;
  ------------------
  |  Branch (93:9): [True: 201, False: 6.06k]
  ------------------
   94|  6.06k|    auto req_sigs = GetScriptNumber(opcode, data, 1, MAX_PUBKEYS_PER_MULTISIG);
   95|  6.06k|    if (!req_sigs) return false;
  ------------------
  |  Branch (95:9): [True: 1.67k, False: 4.39k]
  ------------------
   96|  4.39k|    required_sigs = *req_sigs;
   97|  7.73k|    while (script.GetOp(it, opcode, data) && CPubKey::ValidSize(data)) {
  ------------------
  |  Branch (97:12): [True: 7.54k, False: 194]
  |  Branch (97:46): [True: 3.34k, False: 4.19k]
  ------------------
   98|  3.34k|        pubkeys.emplace_back(std::move(data));
   99|  3.34k|    }
  100|  4.39k|    auto num_keys = GetScriptNumber(opcode, data, required_sigs, MAX_PUBKEYS_PER_MULTISIG);
  101|  4.39k|    if (!num_keys) return false;
  ------------------
  |  Branch (101:9): [True: 2.65k, False: 1.73k]
  ------------------
  102|  1.73k|    if (pubkeys.size() != static_cast<unsigned long>(*num_keys)) return false;
  ------------------
  |  Branch (102:9): [True: 1.48k, False: 250]
  ------------------
  103|       |
  104|    250|    return (it + 1 == script.end());
  105|  1.73k|}

_Z12IsPushdataOp10opcodetype:
   41|  13.9k|{
   42|  13.9k|    return opcode > OP_FALSE && opcode <= OP_PUSHDATA4;
  ------------------
  |  Branch (42:12): [True: 12.1k, False: 1.77k]
  |  Branch (42:33): [True: 3.05k, False: 9.08k]
  ------------------
   43|  13.9k|}

secp256k1.c:secp256k1_ecdsa_sig_serialize:
  171|  33.5k|static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar* ar, const secp256k1_scalar* as) {
  172|  33.5k|    unsigned char r[33] = {0}, s[33] = {0};
  173|  33.5k|    unsigned char *rp = r, *sp = s;
  174|  33.5k|    size_t lenR = 33, lenS = 33;
  175|  33.5k|    secp256k1_scalar_get_b32(&r[1], ar);
  176|  33.5k|    secp256k1_scalar_get_b32(&s[1], as);
  177|  67.4k|    while (lenR > 1 && rp[0] == 0 && rp[1] < 0x80) { lenR--; rp++; }
  ------------------
  |  Branch (177:12): [True: 67.4k, False: 0]
  |  Branch (177:24): [True: 34.1k, False: 33.2k]
  |  Branch (177:38): [True: 33.8k, False: 274]
  ------------------
  178|  67.3k|    while (lenS > 1 && sp[0] == 0 && sp[1] < 0x80) { lenS--; sp++; }
  ------------------
  |  Branch (178:12): [True: 67.3k, False: 0]
  |  Branch (178:24): [True: 33.9k, False: 33.3k]
  |  Branch (178:38): [True: 33.8k, False: 190]
  ------------------
  179|  33.5k|    if (*size < 6+lenS+lenR) {
  ------------------
  |  Branch (179:9): [True: 0, False: 33.5k]
  ------------------
  180|      0|        *size = 6 + lenS + lenR;
  181|      0|        return 0;
  182|      0|    }
  183|  33.5k|    *size = 6 + lenS + lenR;
  184|  33.5k|    sig[0] = 0x30;
  185|  33.5k|    sig[1] = 4 + lenS + lenR;
  186|  33.5k|    sig[2] = 0x02;
  187|  33.5k|    sig[3] = lenR;
  188|  33.5k|    memcpy(sig+4, rp, lenR);
  189|  33.5k|    sig[4+lenR] = 0x02;
  190|  33.5k|    sig[5+lenR] = lenS;
  191|  33.5k|    memcpy(sig+lenR+6, sp, lenS);
  192|  33.5k|    return 1;
  193|  33.5k|}
secp256k1.c:secp256k1_ecdsa_sig_verify:
  195|  78.9k|static int secp256k1_ecdsa_sig_verify(const secp256k1_scalar *sigr, const secp256k1_scalar *sigs, const secp256k1_ge *pubkey, const secp256k1_scalar *message) {
  196|  78.9k|    unsigned char c[32];
  197|  78.9k|    secp256k1_scalar sn, u1, u2;
  198|  78.9k|#if !defined(EXHAUSTIVE_TEST_ORDER)
  199|  78.9k|    secp256k1_fe xr;
  200|  78.9k|#endif
  201|  78.9k|    secp256k1_gej pubkeyj;
  202|  78.9k|    secp256k1_gej pr;
  203|       |
  204|  78.9k|    if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
  ------------------
  |  Branch (204:9): [True: 0, False: 78.9k]
  |  Branch (204:43): [True: 0, False: 78.9k]
  ------------------
  205|      0|        return 0;
  206|      0|    }
  207|       |
  208|  78.9k|    secp256k1_scalar_inverse_var(&sn, sigs);
  209|  78.9k|    secp256k1_scalar_mul(&u1, &sn, message);
  210|  78.9k|    secp256k1_scalar_mul(&u2, &sn, sigr);
  211|  78.9k|    secp256k1_gej_set_ge(&pubkeyj, pubkey);
  212|  78.9k|    secp256k1_ecmult(&pr, &pubkeyj, &u2, &u1);
  213|  78.9k|    if (secp256k1_gej_is_infinity(&pr)) {
  ------------------
  |  Branch (213:9): [True: 0, False: 78.9k]
  ------------------
  214|      0|        return 0;
  215|      0|    }
  216|       |
  217|       |#if defined(EXHAUSTIVE_TEST_ORDER)
  218|       |{
  219|       |    secp256k1_scalar computed_r;
  220|       |    secp256k1_ge pr_ge;
  221|       |    secp256k1_ge_set_gej(&pr_ge, &pr);
  222|       |    secp256k1_fe_normalize(&pr_ge.x);
  223|       |
  224|       |    secp256k1_fe_get_b32(c, &pr_ge.x);
  225|       |    secp256k1_scalar_set_b32(&computed_r, c, NULL);
  226|       |    return secp256k1_scalar_eq(sigr, &computed_r);
  227|       |}
  228|       |#else
  229|  78.9k|    secp256k1_scalar_get_b32(c, sigr);
  230|       |    /* we can ignore the fe_set_b32_limit return value, because we know the input is in range */
  231|  78.9k|    (void)secp256k1_fe_set_b32_limit(&xr, c);
  ------------------
  |  |   88|  78.9k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  232|       |
  233|       |    /** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n)
  234|       |     *  in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p),
  235|       |     *  compute the remainder modulo n, and compare it to xr. However:
  236|       |     *
  237|       |     *        xr == X(pr) mod n
  238|       |     *    <=> exists h. (xr + h * n < p && xr + h * n == X(pr))
  239|       |     *    [Since 2 * n > p, h can only be 0 or 1]
  240|       |     *    <=> (xr == X(pr)) || (xr + n < p && xr + n == X(pr))
  241|       |     *    [In Jacobian coordinates, X(pr) is pr.x / pr.z^2 mod p]
  242|       |     *    <=> (xr == pr.x / pr.z^2 mod p) || (xr + n < p && xr + n == pr.x / pr.z^2 mod p)
  243|       |     *    [Multiplying both sides of the equations by pr.z^2 mod p]
  244|       |     *    <=> (xr * pr.z^2 mod p == pr.x) || (xr + n < p && (xr + n) * pr.z^2 mod p == pr.x)
  245|       |     *
  246|       |     *  Thus, we can avoid the inversion, but we have to check both cases separately.
  247|       |     *  secp256k1_gej_eq_x implements the (xr * pr.z^2 mod p == pr.x) test.
  248|       |     */
  249|  78.9k|    if (secp256k1_gej_eq_x_var(&xr, &pr)) {
  ------------------
  |  Branch (249:9): [True: 34.9k, False: 43.9k]
  ------------------
  250|       |        /* xr * pr.z^2 mod p == pr.x, so the signature is valid. */
  251|  34.9k|        return 1;
  252|  34.9k|    }
  253|  43.9k|    if (secp256k1_fe_cmp_var(&xr, &secp256k1_ecdsa_const_p_minus_order) >= 0) {
  ------------------
  |  |   86|  43.9k|#  define secp256k1_fe_cmp_var secp256k1_fe_impl_cmp_var
  ------------------
  |  Branch (253:9): [True: 43.9k, False: 0]
  ------------------
  254|       |        /* xr + n >= p, so we can skip testing the second case. */
  255|  43.9k|        return 0;
  256|  43.9k|    }
  257|      0|    secp256k1_fe_add(&xr, &secp256k1_ecdsa_const_order_as_fe);
  ------------------
  |  |   92|      0|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  258|      0|    if (secp256k1_gej_eq_x_var(&xr, &pr)) {
  ------------------
  |  Branch (258:9): [True: 0, False: 0]
  ------------------
  259|       |        /* (xr + n) * pr.z^2 mod p == pr.x, so the signature is valid. */
  260|      0|        return 1;
  261|      0|    }
  262|      0|    return 0;
  263|      0|#endif
  264|      0|}
secp256k1.c:secp256k1_ecdsa_sig_sign:
  266|  69.6k|static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) {
  267|  69.6k|    unsigned char b[32];
  268|  69.6k|    secp256k1_gej rp;
  269|  69.6k|    secp256k1_ge r;
  270|  69.6k|    secp256k1_scalar n;
  271|  69.6k|    int overflow = 0;
  272|  69.6k|    int high;
  273|       |
  274|  69.6k|    secp256k1_ecmult_gen(ctx, &rp, nonce);
  275|  69.6k|    secp256k1_ge_set_gej(&r, &rp);
  276|  69.6k|    secp256k1_fe_normalize(&r.x);
  ------------------
  |  |   78|  69.6k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  277|  69.6k|    secp256k1_fe_normalize(&r.y);
  ------------------
  |  |   78|  69.6k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  278|  69.6k|    secp256k1_fe_get_b32(b, &r.x);
  ------------------
  |  |   89|  69.6k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
  279|  69.6k|    secp256k1_scalar_set_b32(sigr, b, &overflow);
  280|  69.6k|    if (recid) {
  ------------------
  |  Branch (280:9): [True: 0, False: 69.6k]
  ------------------
  281|       |        /* The overflow condition is cryptographically unreachable as hitting it requires finding the discrete log
  282|       |         * of some P where P.x >= order, and only 1 in about 2^127 points meet this criteria.
  283|       |         */
  284|      0|        *recid = (overflow << 1) | secp256k1_fe_is_odd(&r.y);
  ------------------
  |  |   85|      0|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  285|      0|    }
  286|  69.6k|    secp256k1_scalar_mul(&n, sigr, seckey);
  287|  69.6k|    secp256k1_scalar_add(&n, &n, message);
  288|  69.6k|    secp256k1_scalar_inverse(sigs, nonce);
  289|  69.6k|    secp256k1_scalar_mul(sigs, sigs, &n);
  290|  69.6k|    secp256k1_scalar_clear(&n);
  291|  69.6k|    secp256k1_gej_clear(&rp);
  292|  69.6k|    secp256k1_ge_clear(&r);
  293|  69.6k|    high = secp256k1_scalar_is_high(sigs);
  294|  69.6k|    secp256k1_scalar_cond_negate(sigs, high);
  295|  69.6k|    if (recid) {
  ------------------
  |  Branch (295:9): [True: 0, False: 69.6k]
  ------------------
  296|      0|        *recid ^= high;
  297|      0|    }
  298|       |    /* P.x = order is on the curve, so technically sig->r could end up being zero, which would be an invalid signature.
  299|       |     * This is cryptographically unreachable as hitting it requires finding the discrete log of P.x = N.
  300|       |     */
  301|  69.6k|    return (int)(!secp256k1_scalar_is_zero(sigr)) & (int)(!secp256k1_scalar_is_zero(sigs));
  302|  69.6k|}

secp256k1.c:secp256k1_eckey_pubkey_parse:
   17|  48.8k|static int secp256k1_eckey_pubkey_parse(secp256k1_ge *elem, const unsigned char *pub, size_t size) {
   18|  48.8k|    if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
  ------------------
  |  |  216|  78.5k|#define SECP256K1_TAG_PUBKEY_EVEN 0x02
  ------------------
                  if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
  ------------------
  |  |  217|  15.3k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
  |  Branch (18:9): [True: 39.2k, False: 9.54k]
  |  Branch (18:24): [True: 23.9k, False: 15.3k]
  |  Branch (18:63): [True: 15.3k, False: 0]
  ------------------
   19|  39.2k|        secp256k1_fe x;
   20|  39.2k|        return secp256k1_fe_set_b32_limit(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
  ------------------
  |  |   88|  39.2k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
                      return secp256k1_fe_set_b32_limit(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
  ------------------
  |  |  217|  38.7k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
  |  Branch (20:16): [True: 38.7k, False: 520]
  |  Branch (20:57): [True: 37.7k, False: 1.06k]
  ------------------
   21|  39.2k|    } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  218|  19.0k|#define SECP256K1_TAG_PUBKEY_UNCOMPRESSED 0x04
  ------------------
                  } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  219|  9.82k|#define SECP256K1_TAG_PUBKEY_HYBRID_EVEN 0x06
  ------------------
                  } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  220|     26|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (21:16): [True: 9.54k, False: 0]
  |  Branch (21:31): [True: 9.26k, False: 282]
  |  Branch (21:78): [True: 256, False: 26]
  |  Branch (21:124): [True: 26, False: 0]
  ------------------
   22|  9.54k|        secp256k1_fe x, y;
   23|  9.54k|        if (!secp256k1_fe_set_b32_limit(&x, pub+1) || !secp256k1_fe_set_b32_limit(&y, pub+33)) {
  ------------------
  |  |   88|  9.54k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
                      if (!secp256k1_fe_set_b32_limit(&x, pub+1) || !secp256k1_fe_set_b32_limit(&y, pub+33)) {
  ------------------
  |  |   88|  9.54k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  |  Branch (23:13): [True: 2, False: 9.54k]
  |  Branch (23:55): [True: 2, False: 9.53k]
  ------------------
   24|      4|            return 0;
   25|      4|        }
   26|  9.53k|        secp256k1_ge_set_xy(elem, &x, &y);
   27|  9.53k|        if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
  ------------------
  |  |  219|  19.0k|#define SECP256K1_TAG_PUBKEY_HYBRID_EVEN 0x06
  ------------------
                      if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
  ------------------
  |  |  220|  9.28k|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (27:14): [True: 252, False: 9.28k]
  |  Branch (27:60): [True: 26, False: 9.26k]
  ------------------
   28|  9.53k|            secp256k1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |   85|    278|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
                          secp256k1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  220|    278|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (28:13): [True: 82, False: 196]
  ------------------
   29|     82|            return 0;
   30|     82|        }
   31|  9.45k|        return secp256k1_ge_is_valid_var(elem);
   32|  9.53k|    } else {
   33|      0|        return 0;
   34|      0|    }
   35|  48.8k|}
secp256k1.c:secp256k1_eckey_pubkey_serialize:
   37|  45.3k|static int secp256k1_eckey_pubkey_serialize(secp256k1_ge *elem, unsigned char *pub, size_t *size, int compressed) {
   38|  45.3k|    if (secp256k1_ge_is_infinity(elem)) {
  ------------------
  |  Branch (38:9): [True: 0, False: 45.3k]
  ------------------
   39|      0|        return 0;
   40|      0|    }
   41|  45.3k|    secp256k1_fe_normalize_var(&elem->x);
  ------------------
  |  |   80|  45.3k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   42|  45.3k|    secp256k1_fe_normalize_var(&elem->y);
  ------------------
  |  |   80|  45.3k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   43|  45.3k|    secp256k1_fe_get_b32(&pub[1], &elem->x);
  ------------------
  |  |   89|  45.3k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   44|  45.3k|    if (compressed) {
  ------------------
  |  Branch (44:9): [True: 27.5k, False: 17.7k]
  ------------------
   45|  27.5k|        *size = 33;
   46|  27.5k|        pub[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |   85|  27.5k|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
                      pub[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |  217|  13.0k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
                      pub[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |  216|  42.0k|#define SECP256K1_TAG_PUBKEY_EVEN 0x02
  ------------------
  |  Branch (46:18): [True: 13.0k, False: 14.5k]
  ------------------
   47|  27.5k|    } else {
   48|  17.7k|        *size = 65;
   49|  17.7k|        pub[0] = SECP256K1_TAG_PUBKEY_UNCOMPRESSED;
  ------------------
  |  |  218|  17.7k|#define SECP256K1_TAG_PUBKEY_UNCOMPRESSED 0x04
  ------------------
   50|  17.7k|        secp256k1_fe_get_b32(&pub[33], &elem->y);
  ------------------
  |  |   89|  17.7k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   51|  17.7k|    }
   52|  45.3k|    return 1;
   53|  45.3k|}
secp256k1.c:secp256k1_eckey_pubkey_tweak_add:
   60|    386|static int secp256k1_eckey_pubkey_tweak_add(secp256k1_ge *key, const secp256k1_scalar *tweak) {
   61|    386|    secp256k1_gej pt;
   62|    386|    secp256k1_gej_set_ge(&pt, key);
   63|    386|    secp256k1_ecmult(&pt, &pt, &secp256k1_scalar_one, tweak);
   64|       |
   65|    386|    if (secp256k1_gej_is_infinity(&pt)) {
  ------------------
  |  Branch (65:9): [True: 0, False: 386]
  ------------------
   66|      0|        return 0;
   67|      0|    }
   68|    386|    secp256k1_ge_set_gej(key, &pt);
   69|    386|    return 1;
   70|    386|}

secp256k1.c:secp256k1_ecmult_gen_context_clear:
   26|      2|static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context *ctx) {
   27|      2|    ctx->built = 0;
   28|      2|    secp256k1_scalar_clear(&ctx->scalar_offset);
   29|      2|    secp256k1_ge_clear(&ctx->ge_offset);
   30|      2|    secp256k1_fe_clear(&ctx->proj_blind);
   31|      2|}
secp256k1.c:secp256k1_ecmult_gen_context_is_built:
   22|   147k|static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx) {
   23|   147k|    return ctx->built;
   24|   147k|}
secp256k1.c:secp256k1_ecmult_gen:
   54|   147k|static void secp256k1_ecmult_gen(const secp256k1_ecmult_gen_context *ctx, secp256k1_gej *r, const secp256k1_scalar *gn) {
   55|   147k|    uint32_t comb_off;
   56|   147k|    secp256k1_ge add;
   57|   147k|    secp256k1_fe neg;
   58|   147k|    secp256k1_ge_storage adds;
   59|   147k|    secp256k1_scalar d;
   60|       |    /* Array of uint32_t values large enough to store COMB_BITS bits. Only the bottom
   61|       |     * 8 are ever nonzero, but having the zero padding at the end if COMB_BITS>256
   62|       |     * avoids the need to deal with out-of-bounds reads from a scalar. */
   63|   147k|    uint32_t recoded[(COMB_BITS + 31) >> 5] = {0};
   64|   147k|    int first = 1, i;
   65|       |
   66|   147k|    memset(&adds, 0, sizeof(adds));
   67|       |
   68|       |    /* We want to compute R = gn*G.
   69|       |     *
   70|       |     * To blind the scalar used in the computation, we rewrite this to be
   71|       |     * R = (gn - b)*G + b*G, with a blinding value b determined by the context.
   72|       |     *
   73|       |     * The multiplication (gn-b)*G will be performed using a signed-digit multi-comb (see Section
   74|       |     * 3.3 of "Fast and compact elliptic-curve cryptography" by Mike Hamburg,
   75|       |     * https://eprint.iacr.org/2012/309).
   76|       |     *
   77|       |     * Let comb(s, P) = sum((2*s[i]-1)*2^i*P for i=0..COMB_BITS-1), where s[i] is the i'th bit of
   78|       |     * the binary representation of scalar s. So the s[i] values determine whether -2^i*P (s[i]=0)
   79|       |     * or +2^i*P (s[i]=1) are added together. COMB_BITS is at least 256, so all bits of s are
   80|       |     * covered. By manipulating:
   81|       |     *
   82|       |     *     comb(s, P) = sum((2*s[i]-1)*2^i*P for i=0..COMB_BITS-1)
   83|       |     * <=> comb(s, P) = sum((2*s[i]-1)*2^i for i=0..COMB_BITS-1) * P
   84|       |     * <=> comb(s, P) = (2*sum(s[i]*2^i for i=0..COMB_BITS-1) - sum(2^i for i=0..COMB_BITS-1)) * P
   85|       |     * <=> comb(s, P) = (2*s - (2^COMB_BITS - 1)) * P
   86|       |     *
   87|       |     * If we wanted to compute (gn-b)*G as comb(s, G), it would need to hold that
   88|       |     *
   89|       |     *     (gn - b) * G = (2*s - (2^COMB_BITS - 1)) * G
   90|       |     * <=> s = (gn - b + (2^COMB_BITS - 1))/2 (mod order)
   91|       |     *
   92|       |     * We use an alternative here that avoids the modular division by two: instead we compute
   93|       |     * (gn-b)*G as comb(d, G/2). For that to hold it must be the case that
   94|       |     *
   95|       |     *     (gn - b) * G = (2*d - (2^COMB_BITS - 1)) * (G/2)
   96|       |     * <=> d = gn - b + (2^COMB_BITS - 1)/2 (mod order)
   97|       |     *
   98|       |     * Adding precomputation, our final equations become:
   99|       |     *
  100|       |     *     ctx->scalar_offset = (2^COMB_BITS - 1)/2 - b (mod order)
  101|       |     *     ctx->ge_offset = b*G
  102|       |     *     d = gn + ctx->scalar_offset (mod order)
  103|       |     *     R = comb(d, G/2) + ctx->ge_offset
  104|       |     *
  105|       |     * comb(d, G/2) function is then computed by summing + or - 2^(i-1)*G, for i=0..COMB_BITS-1,
  106|       |     * depending on the value of the bits d[i] of the binary representation of scalar d.
  107|       |     */
  108|       |
  109|       |    /* Compute the scalar d = (gn + ctx->scalar_offset). */
  110|   147k|    secp256k1_scalar_add(&d, &ctx->scalar_offset, gn);
  111|       |    /* Convert to recoded array. */
  112|  1.32M|    for (i = 0; i < 8 && i < ((COMB_BITS + 31) >> 5); ++i) {
  ------------------
  |  |   84|  1.18M|#define COMB_BITS (COMB_BLOCKS * COMB_TEETH * COMB_SPACING)
  |  |  ------------------
  |  |  |  |   78|  1.18M|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  |  |  ------------------
  |  |  |  |  |  |  180|  1.18M|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (112:17): [True: 1.18M, False: 147k]
  |  Branch (112:26): [True: 1.18M, False: 0]
  ------------------
  113|  1.18M|        recoded[i] = secp256k1_scalar_get_bits_limb32(&d, 32 * i, 32);
  114|  1.18M|    }
  115|   147k|    secp256k1_scalar_clear(&d);
  116|       |
  117|       |    /* In secp256k1_ecmult_gen_prec_table we have precomputed sums of the
  118|       |     * (2*d[i]-1) * 2^(i-1) * G points, for various combinations of i positions.
  119|       |     * We rewrite our equation in terms of these table entries.
  120|       |     *
  121|       |     * Let mask(b) = sum(2^((b*COMB_TEETH + t)*COMB_SPACING) for t=0..COMB_TEETH-1),
  122|       |     * with b ranging from 0 to COMB_BLOCKS-1. So for example with COMB_BLOCKS=11,
  123|       |     * COMB_TEETH=6, COMB_SPACING=4, we would have:
  124|       |     *   mask(0)  = 2^0   + 2^4   + 2^8   + 2^12  + 2^16  + 2^20,
  125|       |     *   mask(1)  = 2^24  + 2^28  + 2^32  + 2^36  + 2^40  + 2^44,
  126|       |     *   mask(2)  = 2^48  + 2^52  + 2^56  + 2^60  + 2^64  + 2^68,
  127|       |     *   ...
  128|       |     *   mask(10) = 2^240 + 2^244 + 2^248 + 2^252 + 2^256 + 2^260
  129|       |     *
  130|       |     * We will split up the bits d[i] using these masks. Specifically, each mask is
  131|       |     * used COMB_SPACING times, with different shifts:
  132|       |     *
  133|       |     * d = (d & mask(0)<<0) + (d & mask(1)<<0) + ... + (d & mask(COMB_BLOCKS-1)<<0) +
  134|       |     *     (d & mask(0)<<1) + (d & mask(1)<<1) + ... + (d & mask(COMB_BLOCKS-1)<<1) +
  135|       |     *     ...
  136|       |     *     (d & mask(0)<<(COMB_SPACING-1)) + ...
  137|       |     *
  138|       |     * Now define table(b, m) = (m - mask(b)/2) * G, and we will precompute these values for
  139|       |     * b=0..COMB_BLOCKS-1, and for all values m which (d & mask(b)) can take (so m can take on
  140|       |     * 2^COMB_TEETH distinct values).
  141|       |     *
  142|       |     * If m=(d & mask(b)), then table(b, m) is the sum of 2^i * (2*d[i]-1) * G/2, with i
  143|       |     * iterating over the set bits in mask(b). In our example, table(2, 2^48 + 2^56 + 2^68)
  144|       |     * would equal (2^48 - 2^52 + 2^56 - 2^60 - 2^64 + 2^68) * G/2.
  145|       |     *
  146|       |     * With that, we can rewrite comb(d, G/2) as:
  147|       |     *
  148|       |     *     2^0 * (table(0, d>>0 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>0 & mask(COMP_BLOCKS-1)))
  149|       |     *   + 2^1 * (table(0, d>>1 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>1 & mask(COMP_BLOCKS-1)))
  150|       |     *   + 2^2 * (table(0, d>>2 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>2 & mask(COMP_BLOCKS-1)))
  151|       |     *   + ...
  152|       |     *   + 2^(COMB_SPACING-1) * (table(0, d>>(COMB_SPACING-1) & mask(0)) + ...)
  153|       |     *
  154|       |     * Or more generically as
  155|       |     *
  156|       |     *   sum(2^i * sum(table(b, d>>i & mask(b)), b=0..COMB_BLOCKS-1), i=0..COMB_SPACING-1)
  157|       |     *
  158|       |     * This is implemented using an outer loop that runs in reverse order over the lines of this
  159|       |     * equation, which in each iteration runs an inner loop that adds the terms of that line and
  160|       |     * then doubles the result before proceeding to the next line.
  161|       |     *
  162|       |     * In pseudocode:
  163|       |     *   c = infinity
  164|       |     *   for comb_off in range(COMB_SPACING - 1, -1, -1):
  165|       |     *     for block in range(COMB_BLOCKS):
  166|       |     *       c += table(block, (d >> comb_off) & mask(block))
  167|       |     *     if comb_off > 0:
  168|       |     *       c = 2*c
  169|       |     *   return c
  170|       |     *
  171|       |     * This computes c = comb(d, G/2), and thus finally R = c + ctx->ge_offset. Note that it would
  172|       |     * be possible to apply an initial offset instead of a final offset (moving ge_offset to take
  173|       |     * the place of infinity above), but the chosen approach allows using (in a future improvement)
  174|       |     * an incomplete addition formula for most of the multiplication.
  175|       |     *
  176|       |     * The last question is how to implement the table(b, m) function. For any value of b,
  177|       |     * m=(d & mask(b)) can only take on at most 2^COMB_TEETH possible values (the last one may have
  178|       |     * fewer as there mask(b) may exceed the curve order). So we could create COMB_BLOCK tables
  179|       |     * which contain a value for each such m value.
  180|       |     *
  181|       |     * Now note that if m=(d & mask(b)), then flipping the relevant bits of m results in negating
  182|       |     * the result of table(b, m). This is because table(b,m XOR mask(b)) = table(b, mask(b) - m) =
  183|       |     * (mask(b) - m - mask(b)/2)*G = (-m + mask(b)/2)*G = -(m - mask(b)/2)*G = -table(b, m).
  184|       |     * Because of this it suffices to only store the first half of the m values for every b. If an
  185|       |     * entry from the second half is needed, we look up its bit-flipped version instead, and negate
  186|       |     * it.
  187|       |     *
  188|       |     * secp256k1_ecmult_gen_prec_table[b][index] stores the table(b, m) entries. Index
  189|       |     * is the relevant mask(b) bits of m packed together without gaps. */
  190|       |
  191|       |    /* Outer loop: iterate over comb_off from COMB_SPACING - 1 down to 0. */
  192|   147k|    comb_off = COMB_SPACING - 1;
  ------------------
  |  |   78|   147k|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  ------------------
  |  |  |  |  180|   147k|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  ------------------
  ------------------
  193|   147k|    while (1) {
  ------------------
  |  Branch (193:12): [Folded - Ignored]
  ------------------
  194|   147k|        uint32_t block;
  195|   147k|        uint32_t bit_pos = comb_off;
  196|       |        /* Inner loop: for each block, add table entries to the result. */
  197|  6.49M|        for (block = 0; block < COMB_BLOCKS; ++block) {
  ------------------
  |  Branch (197:25): [True: 6.34M, False: 147k]
  ------------------
  198|       |            /* Gather the mask(block)-selected bits of d into bits. They're packed:
  199|       |             * bits[tooth] = d[(block*COMB_TEETH + tooth)*COMB_SPACING + comb_off]. */
  200|  6.34M|            uint32_t bits = 0, sign, abs, index, tooth;
  201|       |            /* Instead of reading individual bits here to construct the bits variable,
  202|       |             * build up the result by xoring rotated reads together. In every iteration,
  203|       |             * one additional bit is made correct, starting at the bottom. The bits
  204|       |             * above that contain junk. This reduces leakage by avoiding computations
  205|       |             * on variables that can have only a low number of possible values (e.g.,
  206|       |             * just two values when reading a single bit into a variable.) See:
  207|       |             * https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-alam.pdf
  208|       |             */
  209|  44.4M|            for (tooth = 0; tooth < COMB_TEETH; ++tooth) {
  ------------------
  |  Branch (209:29): [True: 38.0M, False: 6.34M]
  ------------------
  210|       |                /* Construct bitdata s.t. the bottom bit is the bit we'd like to read.
  211|       |                 *
  212|       |                 * We could just set bitdata = recoded[bit_pos >> 5] >> (bit_pos & 0x1f)
  213|       |                 * but this would simply discard the bits that fall off at the bottom,
  214|       |                 * and thus, for example, bitdata could still have only two values if we
  215|       |                 * happen to shift by exactly 31 positions. We use a rotation instead,
  216|       |                 * which ensures that bitdata doesn't loose entropy. This relies on the
  217|       |                 * rotation being atomic, i.e., the compiler emitting an actual rot
  218|       |                 * instruction. */
  219|  38.0M|                uint32_t bitdata = secp256k1_rotr32(recoded[bit_pos >> 5], bit_pos & 0x1f);
  220|       |
  221|       |                /* Clear the bit at position tooth, but sssh, don't tell clang. */
  222|  38.0M|                uint32_t volatile vmask = ~(1 << tooth);
  223|  38.0M|                bits &= vmask;
  224|       |
  225|       |                /* Write the bit into position tooth (and junk into higher bits). */
  226|  38.0M|                bits ^= bitdata << tooth;
  227|  38.0M|                bit_pos += COMB_SPACING;
  ------------------
  |  |   78|  38.0M|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  ------------------
  |  |  |  |  180|  38.0M|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  ------------------
  ------------------
  228|  38.0M|            }
  229|       |
  230|       |            /* If the top bit of bits is 1, flip them all (corresponding to looking up
  231|       |             * the negated table value), and remember to negate the result in sign. */
  232|  6.34M|            sign = (bits >> (COMB_TEETH - 1)) & 1;
  233|  6.34M|            abs = (bits ^ -sign) & (COMB_POINTS - 1);
  ------------------
  |  |   86|  6.34M|#define COMB_POINTS (1 << (COMB_TEETH - 1))
  ------------------
  234|  6.34M|            VERIFY_CHECK(sign == 0 || sign == 1);
  235|  6.34M|            VERIFY_CHECK(abs < COMB_POINTS);
  236|       |
  237|       |            /** This uses a conditional move to avoid any secret data in array indexes.
  238|       |             *   _Any_ use of secret indexes has been demonstrated to result in timing
  239|       |             *   sidechannels, even when the cache-line access patterns are uniform.
  240|       |             *  See also:
  241|       |             *   "A word of warning", CHES 2013 Rump Session, by Daniel J. Bernstein and Peter Schwabe
  242|       |             *    (https://cryptojedi.org/peter/data/chesrump-20130822.pdf) and
  243|       |             *   "Cache Attacks and Countermeasures: the Case of AES", RSA 2006,
  244|       |             *    by Dag Arne Osvik, Adi Shamir, and Eran Tromer
  245|       |             *    (https://www.tau.ac.il/~tromer/papers/cache.pdf)
  246|       |             */
  247|   209M|            for (index = 0; index < COMB_POINTS; ++index) {
  ------------------
  |  |   86|   209M|#define COMB_POINTS (1 << (COMB_TEETH - 1))
  ------------------
  |  Branch (247:29): [True: 203M, False: 6.34M]
  ------------------
  248|   203M|                secp256k1_ge_storage_cmov(&adds, &secp256k1_ecmult_gen_prec_table[block][index], index == abs);
  249|   203M|            }
  250|       |
  251|       |            /* Set add=adds or add=-adds, in constant time, based on sign. */
  252|  6.34M|            secp256k1_ge_from_storage(&add, &adds);
  253|  6.34M|            secp256k1_fe_negate(&neg, &add.y, 1);
  ------------------
  |  |  211|  6.34M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  6.34M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  6.34M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 6.34M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  6.34M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 6.34M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  6.34M|    } \
  |  |  |  |   84|  6.34M|    stmt; \
  |  |  |  |   85|  6.34M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  254|  6.34M|            secp256k1_fe_cmov(&add.y, &neg, sign);
  ------------------
  |  |   95|  6.34M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  255|       |
  256|       |            /* Add the looked up and conditionally negated value to r. */
  257|  6.34M|            if (EXPECT(first, 0)) {
  ------------------
  |  |  136|  6.34M|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  ------------------
  |  |  |  Branch (136:21): [True: 147k, False: 6.20M]
  |  |  ------------------
  ------------------
  258|       |                /* If this is the first table lookup, we can skip addition. */
  259|   147k|                secp256k1_gej_set_ge(r, &add);
  260|       |                /* Give the entry a random Z coordinate to blind intermediary results. */
  261|   147k|                secp256k1_gej_rescale(r, &ctx->proj_blind);
  262|   147k|                first = 0;
  263|  6.20M|            } else {
  264|  6.20M|                secp256k1_gej_add_ge(r, r, &add);
  265|  6.20M|            }
  266|  6.34M|        }
  267|       |
  268|       |        /* Double the result, except in the last iteration. */
  269|   147k|        if (comb_off-- == 0) break;
  ------------------
  |  Branch (269:13): [True: 147k, False: 0]
  ------------------
  270|      0|        secp256k1_gej_double(r, r);
  271|      0|    }
  272|       |
  273|       |    /* Correct for the scalar_offset added at the start (ge_offset = b*G, while b was
  274|       |     * subtracted from the input scalar gn). */
  275|   147k|    secp256k1_gej_add_ge(r, r, &ctx->ge_offset);
  276|       |
  277|       |    /* Cleanup. */
  278|   147k|    secp256k1_fe_clear(&neg);
  279|   147k|    secp256k1_ge_clear(&add);
  280|   147k|    secp256k1_memclear(&adds, sizeof(adds));
  281|   147k|    secp256k1_memclear(&recoded, sizeof(recoded));
  282|   147k|}

secp256k1.c:secp256k1_ecmult:
  349|  79.6k|static void secp256k1_ecmult(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
  350|  79.6k|    secp256k1_fe aux[ECMULT_TABLE_SIZE(WINDOW_A)];
  351|  79.6k|    secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
  352|  79.6k|    struct secp256k1_strauss_point_state ps[1];
  353|  79.6k|    struct secp256k1_strauss_state state;
  354|       |
  355|  79.6k|    state.aux = aux;
  356|  79.6k|    state.pre_a = pre_a;
  357|  79.6k|    state.ps = ps;
  358|  79.6k|    secp256k1_ecmult_strauss_wnaf(&state, r, 1, a, na, ng);
  359|  79.6k|}
secp256k1.c:secp256k1_ecmult_strauss_wnaf:
  237|  79.6k|static void secp256k1_ecmult_strauss_wnaf(const struct secp256k1_strauss_state *state, secp256k1_gej *r, size_t num, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
  238|  79.6k|    secp256k1_ge tmpa;
  239|  79.6k|    secp256k1_fe Z;
  240|       |    /* Split G factors. */
  241|  79.6k|    secp256k1_scalar ng_1, ng_128;
  242|  79.6k|    int wnaf_ng_1[129];
  243|  79.6k|    int bits_ng_1 = 0;
  244|  79.6k|    int wnaf_ng_128[129];
  245|  79.6k|    int bits_ng_128 = 0;
  246|  79.6k|    int i;
  247|  79.6k|    int bits = 0;
  248|  79.6k|    size_t np;
  249|  79.6k|    size_t no = 0;
  250|       |
  251|  79.6k|    secp256k1_fe_set_int(&Z, 1);
  ------------------
  |  |   83|  79.6k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  252|   159k|    for (np = 0; np < num; ++np) {
  ------------------
  |  Branch (252:18): [True: 79.6k, False: 79.6k]
  ------------------
  253|  79.6k|        secp256k1_gej tmp;
  254|  79.6k|        secp256k1_scalar na_1, na_lam;
  255|  79.6k|        if (secp256k1_scalar_is_zero(&na[np]) || secp256k1_gej_is_infinity(&a[np])) {
  ------------------
  |  Branch (255:13): [True: 0, False: 79.6k]
  |  Branch (255:50): [True: 0, False: 79.6k]
  ------------------
  256|      0|            continue;
  257|      0|        }
  258|       |        /* split na into na_1 and na_lam (where na = na_1 + na_lam*lambda, and na_1 and na_lam are ~128 bit) */
  259|  79.6k|        secp256k1_scalar_split_lambda(&na_1, &na_lam, &na[np]);
  260|       |
  261|       |        /* build wnaf representation for na_1 and na_lam. */
  262|  79.6k|        state->ps[no].bits_na_1   = secp256k1_ecmult_wnaf(state->ps[no].wnaf_na_1,   129, &na_1,   WINDOW_A);
  ------------------
  |  |   32|  79.6k|#  define WINDOW_A 5
  ------------------
  263|  79.6k|        state->ps[no].bits_na_lam = secp256k1_ecmult_wnaf(state->ps[no].wnaf_na_lam, 129, &na_lam, WINDOW_A);
  ------------------
  |  |   32|  79.6k|#  define WINDOW_A 5
  ------------------
  264|  79.6k|        VERIFY_CHECK(state->ps[no].bits_na_1 <= 129);
  265|  79.6k|        VERIFY_CHECK(state->ps[no].bits_na_lam <= 129);
  266|  79.6k|        if (state->ps[no].bits_na_1 > bits) {
  ------------------
  |  Branch (266:13): [True: 79.6k, False: 0]
  ------------------
  267|  79.6k|            bits = state->ps[no].bits_na_1;
  268|  79.6k|        }
  269|  79.6k|        if (state->ps[no].bits_na_lam > bits) {
  ------------------
  |  Branch (269:13): [True: 30.3k, False: 49.3k]
  ------------------
  270|  30.3k|            bits = state->ps[no].bits_na_lam;
  271|  30.3k|        }
  272|       |
  273|       |        /* Calculate odd multiples of a.
  274|       |         * All multiples are brought to the same Z 'denominator', which is stored
  275|       |         * in Z. Due to secp256k1' isomorphism we can do all operations pretending
  276|       |         * that the Z coordinate was 1, use affine addition formulae, and correct
  277|       |         * the Z coordinate of the result once at the end.
  278|       |         * The exception is the precomputed G table points, which are actually
  279|       |         * affine. Compared to the base used for other points, they have a Z ratio
  280|       |         * of 1/Z, so we can use secp256k1_gej_add_zinv_var, which uses the same
  281|       |         * isomorphism to efficiently add with a known Z inverse.
  282|       |         */
  283|  79.6k|        tmp = a[np];
  284|  79.6k|        if (no) {
  ------------------
  |  Branch (284:13): [True: 0, False: 79.6k]
  ------------------
  285|      0|            secp256k1_gej_rescale(&tmp, &Z);
  286|      0|        }
  287|  79.6k|        secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  79.6k|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
                      secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  79.6k|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
                      secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  79.6k|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
  288|  79.6k|        if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   93|      0|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                      if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   41|      0|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
                      if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   41|      0|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
  |  Branch (288:13): [True: 0, False: 79.6k]
  ------------------
  289|       |
  290|  79.6k|        ++no;
  291|  79.6k|    }
  292|       |
  293|       |    /* Bring them to the same Z denominator. */
  294|  79.6k|    if (no) {
  ------------------
  |  Branch (294:9): [True: 79.6k, False: 0]
  ------------------
  295|  79.6k|        secp256k1_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A) * no, state->pre_a, state->aux);
  ------------------
  |  |   41|  79.6k|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
  296|  79.6k|    }
  297|       |
  298|   159k|    for (np = 0; np < no; ++np) {
  ------------------
  |  Branch (298:18): [True: 79.6k, False: 79.6k]
  ------------------
  299|   717k|        for (i = 0; i < ECMULT_TABLE_SIZE(WINDOW_A); i++) {
  ------------------
  |  |   41|   717k|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
  |  Branch (299:21): [True: 637k, False: 79.6k]
  ------------------
  300|   637k|            secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + i], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + i].x, &secp256k1_const_beta);
  ------------------
  |  |   93|   637k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                          secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + i], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + i].x, &secp256k1_const_beta);
  ------------------
  |  |   41|   637k|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
                          secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + i], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + i].x, &secp256k1_const_beta);
  ------------------
  |  |   41|   637k|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
  301|   637k|        }
  302|  79.6k|    }
  303|       |
  304|  79.6k|    if (ng) {
  ------------------
  |  Branch (304:9): [True: 79.6k, False: 0]
  ------------------
  305|       |        /* split ng into ng_1 and ng_128 (where gn = gn_1 + gn_128*2^128, and gn_1 and gn_128 are ~128 bit) */
  306|  79.6k|        secp256k1_scalar_split_128(&ng_1, &ng_128, ng);
  307|       |
  308|       |        /* Build wnaf representation for ng_1 and ng_128 */
  309|  79.6k|        bits_ng_1   = secp256k1_ecmult_wnaf(wnaf_ng_1,   129, &ng_1,   WINDOW_G);
  ------------------
  |  |   29|  79.6k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  310|  79.6k|        bits_ng_128 = secp256k1_ecmult_wnaf(wnaf_ng_128, 129, &ng_128, WINDOW_G);
  ------------------
  |  |   29|  79.6k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  311|  79.6k|        if (bits_ng_1 > bits) {
  ------------------
  |  Branch (311:13): [True: 18.9k, False: 60.7k]
  ------------------
  312|  18.9k|            bits = bits_ng_1;
  313|  18.9k|        }
  314|  79.6k|        if (bits_ng_128 > bits) {
  ------------------
  |  Branch (314:13): [True: 15.1k, False: 64.5k]
  ------------------
  315|  15.1k|            bits = bits_ng_128;
  316|  15.1k|        }
  317|  79.6k|    }
  318|       |
  319|  79.6k|    secp256k1_gej_set_infinity(r);
  320|       |
  321|  10.2M|    for (i = bits - 1; i >= 0; i--) {
  ------------------
  |  Branch (321:24): [True: 10.1M, False: 79.6k]
  ------------------
  322|  10.1M|        int n;
  323|  10.1M|        secp256k1_gej_double_var(r, r, NULL);
  324|  20.3M|        for (np = 0; np < no; ++np) {
  ------------------
  |  Branch (324:22): [True: 10.1M, False: 10.1M]
  ------------------
  325|  10.1M|            if (i < state->ps[np].bits_na_1 && (n = state->ps[np].wnaf_na_1[i])) {
  ------------------
  |  Branch (325:17): [True: 9.96M, False: 195k]
  |  Branch (325:48): [True: 1.72M, False: 8.24M]
  ------------------
  326|  1.72M|                secp256k1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|  1.72M|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   32|  1.72M|#  define WINDOW_A 5
  ------------------
  327|  1.72M|                secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
  328|  1.72M|            }
  329|  10.1M|            if (i < state->ps[np].bits_na_lam && (n = state->ps[np].wnaf_na_lam[i])) {
  ------------------
  |  Branch (329:17): [True: 9.93M, False: 221k]
  |  Branch (329:50): [True: 1.71M, False: 8.22M]
  ------------------
  330|  1.71M|                secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|  1.71M|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|  1.71M|#define ECMULT_TABLE_SIZE(w) (1L << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   32|  1.71M|#  define WINDOW_A 5
  ------------------
  331|  1.71M|                secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
  332|  1.71M|            }
  333|  10.1M|        }
  334|  10.1M|        if (i < bits_ng_1 && (n = wnaf_ng_1[i])) {
  ------------------
  |  Branch (334:13): [True: 9.68M, False: 470k]
  |  Branch (334:30): [True: 675k, False: 9.01M]
  ------------------
  335|   675k|            secp256k1_ecmult_table_get_ge_storage(&tmpa, secp256k1_pre_g, n, WINDOW_G);
  ------------------
  |  |   29|   675k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  336|   675k|            secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);
  337|   675k|        }
  338|  10.1M|        if (i < bits_ng_128 && (n = wnaf_ng_128[i])) {
  ------------------
  |  Branch (338:13): [True: 9.70M, False: 448k]
  |  Branch (338:32): [True: 677k, False: 9.03M]
  ------------------
  339|   677k|            secp256k1_ecmult_table_get_ge_storage(&tmpa, secp256k1_pre_g_128, n, WINDOW_G);
  ------------------
  |  |   29|   677k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  340|   677k|            secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);
  341|   677k|        }
  342|  10.1M|    }
  343|       |
  344|  79.6k|    if (!r->infinity) {
  ------------------
  |  Branch (344:9): [True: 79.6k, False: 0]
  ------------------
  345|  79.6k|        secp256k1_fe_mul(&r->z, &r->z, &Z);
  ------------------
  |  |   93|  79.6k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  346|  79.6k|    }
  347|  79.6k|}
secp256k1.c:secp256k1_ecmult_wnaf:
  162|   318k|static int secp256k1_ecmult_wnaf(int *wnaf, int len, const secp256k1_scalar *a, int w) {
  163|   318k|    secp256k1_scalar s;
  164|   318k|    int last_set_bit = -1;
  165|   318k|    int bit = 0;
  166|   318k|    int sign = 1;
  167|   318k|    int carry = 0;
  168|       |
  169|   318k|    VERIFY_CHECK(wnaf != NULL);
  170|   318k|    VERIFY_CHECK(0 <= len && len <= 256);
  171|   318k|    VERIFY_CHECK(a != NULL);
  172|   318k|    VERIFY_CHECK(2 <= w && w <= 31);
  173|       |
  174|  41.4M|    for (bit = 0; bit < len; bit++) {
  ------------------
  |  Branch (174:19): [True: 41.1M, False: 318k]
  ------------------
  175|  41.1M|        wnaf[bit] = 0;
  176|  41.1M|    }
  177|       |
  178|   318k|    s = *a;
  179|   318k|    if (secp256k1_scalar_get_bits_limb32(&s, 255, 1)) {
  ------------------
  |  Branch (179:9): [True: 77.0k, False: 241k]
  ------------------
  180|  77.0k|        secp256k1_scalar_negate(&s, &s);
  181|  77.0k|        sign = -1;
  182|  77.0k|    }
  183|       |
  184|   318k|    bit = 0;
  185|  10.0M|    while (bit < len) {
  ------------------
  |  Branch (185:12): [True: 9.72M, False: 318k]
  ------------------
  186|  9.72M|        int now;
  187|  9.72M|        int word;
  188|  9.72M|        if (secp256k1_scalar_get_bits_limb32(&s, bit, 1) == (unsigned int)carry) {
  ------------------
  |  Branch (188:13): [True: 4.94M, False: 4.78M]
  ------------------
  189|  4.94M|            bit++;
  190|  4.94M|            continue;
  191|  4.94M|        }
  192|       |
  193|  4.78M|        now = w;
  194|  4.78M|        if (now > len - bit) {
  ------------------
  |  Branch (194:13): [True: 211k, False: 4.57M]
  ------------------
  195|   211k|            now = len - bit;
  196|   211k|        }
  197|       |
  198|  4.78M|        word = secp256k1_scalar_get_bits_var(&s, bit, now) + carry;
  199|       |
  200|  4.78M|        carry = (word >> (w-1)) & 1;
  201|  4.78M|        word -= carry << w;
  202|       |
  203|  4.78M|        wnaf[bit] = sign * word;
  204|  4.78M|        last_set_bit = bit;
  205|       |
  206|  4.78M|        bit += now;
  207|  4.78M|    }
  208|       |#ifdef VERIFY
  209|       |    {
  210|       |        int verify_bit = bit;
  211|       |
  212|       |        VERIFY_CHECK(carry == 0);
  213|       |
  214|       |        while (verify_bit < 256) {
  215|       |            VERIFY_CHECK(secp256k1_scalar_get_bits_limb32(&s, verify_bit, 1) == 0);
  216|       |            verify_bit++;
  217|       |        }
  218|       |    }
  219|       |#endif
  220|   318k|    return last_set_bit + 1;
  221|   318k|}
secp256k1.c:secp256k1_ecmult_odd_multiples_table:
   73|  79.6k|static void secp256k1_ecmult_odd_multiples_table(int n, secp256k1_ge *pre_a, secp256k1_fe *zr, secp256k1_fe *z, const secp256k1_gej *a) {
   74|  79.6k|    secp256k1_gej d, ai;
   75|  79.6k|    secp256k1_ge d_ge;
   76|  79.6k|    int i;
   77|       |
   78|  79.6k|    VERIFY_CHECK(!a->infinity);
   79|       |
   80|  79.6k|    secp256k1_gej_double_var(&d, a, NULL);
   81|       |
   82|       |    /*
   83|       |     * Perform the additions using an isomorphic curve Y^2 = X^3 + 7*C^6 where C := d.z.
   84|       |     * The isomorphism, phi, maps a secp256k1 point (x, y) to the point (x*C^2, y*C^3) on the other curve.
   85|       |     * In Jacobian coordinates phi maps (x, y, z) to (x*C^2, y*C^3, z) or, equivalently to (x, y, z/C).
   86|       |     *
   87|       |     *     phi(x, y, z) = (x*C^2, y*C^3, z) = (x, y, z/C)
   88|       |     *   d_ge := phi(d) = (d.x, d.y, 1)
   89|       |     *     ai := phi(a) = (a.x*C^2, a.y*C^3, a.z)
   90|       |     *
   91|       |     * The group addition functions work correctly on these isomorphic curves.
   92|       |     * In particular phi(d) is easy to represent in affine coordinates under this isomorphism.
   93|       |     * This lets us use the faster secp256k1_gej_add_ge_var group addition function that we wouldn't be able to use otherwise.
   94|       |     */
   95|  79.6k|    secp256k1_ge_set_xy(&d_ge, &d.x, &d.y);
   96|  79.6k|    secp256k1_ge_set_gej_zinv(&pre_a[0], a, &d.z);
   97|  79.6k|    secp256k1_gej_set_ge(&ai, &pre_a[0]);
   98|  79.6k|    ai.z = a->z;
   99|       |
  100|       |    /* pre_a[0] is the point (a.x*C^2, a.y*C^3, a.z*C) which is equivalent to a.
  101|       |     * Set zr[0] to C, which is the ratio between the omitted z(pre_a[0]) value and a.z.
  102|       |     */
  103|  79.6k|    zr[0] = d.z;
  104|       |
  105|   637k|    for (i = 1; i < n; i++) {
  ------------------
  |  Branch (105:17): [True: 557k, False: 79.6k]
  ------------------
  106|   557k|        secp256k1_gej_add_ge_var(&ai, &ai, &d_ge, &zr[i]);
  107|   557k|        secp256k1_ge_set_xy(&pre_a[i], &ai.x, &ai.y);
  108|   557k|    }
  109|       |
  110|       |    /* Multiply the last z-coordinate by C to undo the isomorphism.
  111|       |     * Since the z-coordinates of the pre_a values are implied by the zr array of z-coordinate ratios,
  112|       |     * undoing the isomorphism here undoes the isomorphism for all pre_a values.
  113|       |     */
  114|  79.6k|    secp256k1_fe_mul(z, &ai.z, &d.z);
  ------------------
  |  |   93|  79.6k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  115|  79.6k|}
secp256k1.c:secp256k1_ecmult_table_get_ge:
  125|  1.72M|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge(secp256k1_ge *r, const secp256k1_ge *pre, int n, int w) {
  126|  1.72M|    secp256k1_ecmult_table_verify(n,w);
  127|  1.72M|    if (n > 0) {
  ------------------
  |  Branch (127:9): [True: 870k, False: 849k]
  ------------------
  128|   870k|        *r = pre[(n-1)/2];
  129|   870k|    } else {
  130|   849k|        *r = pre[(-n-1)/2];
  131|   849k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   849k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|   849k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|   849k|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 849k]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|   849k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 849k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|   849k|    } \
  |  |  |  |   84|   849k|    stmt; \
  |  |  |  |   85|   849k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  132|   849k|    }
  133|  1.72M|}
secp256k1.c:secp256k1_ecmult_table_verify:
  117|  4.78M|SECP256K1_INLINE static void secp256k1_ecmult_table_verify(int n, int w) {
  118|  4.78M|    (void)n;
  119|  4.78M|    (void)w;
  120|  4.78M|    VERIFY_CHECK(((n) & 1) == 1);
  121|  4.78M|    VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1));
  122|  4.78M|    VERIFY_CHECK((n) <=  ((1 << ((w)-1)) - 1));
  123|  4.78M|}
secp256k1.c:secp256k1_ecmult_table_get_ge_lambda:
  135|  1.71M|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge_lambda(secp256k1_ge *r, const secp256k1_ge *pre, const secp256k1_fe *x, int n, int w) {
  136|  1.71M|    secp256k1_ecmult_table_verify(n,w);
  137|  1.71M|    if (n > 0) {
  ------------------
  |  Branch (137:9): [True: 863k, False: 849k]
  ------------------
  138|   863k|        secp256k1_ge_set_xy(r, &x[(n-1)/2], &pre[(n-1)/2].y);
  139|   863k|    } else {
  140|   849k|        secp256k1_ge_set_xy(r, &x[(-n-1)/2], &pre[(-n-1)/2].y);
  141|   849k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   849k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|   849k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|   849k|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 849k]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|   849k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 849k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|   849k|    } \
  |  |  |  |   84|   849k|    stmt; \
  |  |  |  |   85|   849k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  142|   849k|    }
  143|  1.71M|}
secp256k1.c:secp256k1_ecmult_table_get_ge_storage:
  145|  1.35M|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge_storage(secp256k1_ge *r, const secp256k1_ge_storage *pre, int n, int w) {
  146|  1.35M|    secp256k1_ecmult_table_verify(n,w);
  147|  1.35M|    if (n > 0) {
  ------------------
  |  Branch (147:9): [True: 748k, False: 604k]
  ------------------
  148|   748k|        secp256k1_ge_from_storage(r, &pre[(n-1)/2]);
  149|   748k|    } else {
  150|   604k|        secp256k1_ge_from_storage(r, &pre[(-n-1)/2]);
  151|   604k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   604k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|   604k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|   604k|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 604k]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|   604k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 604k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|   604k|    } \
  |  |  |  |   84|   604k|    stmt; \
  |  |  |  |   85|   604k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  152|   604k|    }
  153|  1.35M|}

secp256k1.c:secp256k1_fe_impl_sqr:
  345|  99.5M|SECP256K1_INLINE static void secp256k1_fe_impl_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
  346|  99.5M|    secp256k1_fe_sqr_inner(r->n, a->n);
  347|  99.5M|}
secp256k1.c:secp256k1_fe_impl_mul:
  341|   123M|SECP256K1_INLINE static void secp256k1_fe_impl_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b) {
  342|   123M|    secp256k1_fe_mul_inner(r->n, a->n, b->n);
  343|   123M|}
secp256k1.c:secp256k1_fe_impl_add_int:
  329|  49.9k|SECP256K1_INLINE static void secp256k1_fe_impl_add_int(secp256k1_fe *r, int a) {
  330|  49.9k|    r->n[0] += a;
  331|  49.9k|}
secp256k1.c:secp256k1_fe_impl_to_storage:
  428|   251k|static void secp256k1_fe_impl_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
  429|   251k|    r->n[0] = a->n[0] | a->n[1] << 52;
  430|   251k|    r->n[1] = a->n[1] >> 12 | a->n[2] << 40;
  431|   251k|    r->n[2] = a->n[2] >> 24 | a->n[3] << 28;
  432|   251k|    r->n[3] = a->n[3] >> 36 | a->n[4] << 16;
  433|   251k|}
secp256k1.c:secp256k1_fe_impl_from_storage:
  435|  15.6M|static SECP256K1_INLINE void secp256k1_fe_impl_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a) {
  436|  15.6M|    r->n[0] = a->n[0] & 0xFFFFFFFFFFFFFULL;
  437|  15.6M|    r->n[1] = a->n[0] >> 52 | ((a->n[1] << 12) & 0xFFFFFFFFFFFFFULL);
  438|  15.6M|    r->n[2] = a->n[1] >> 40 | ((a->n[2] << 24) & 0xFFFFFFFFFFFFFULL);
  439|  15.6M|    r->n[3] = a->n[2] >> 28 | ((a->n[3] << 36) & 0xFFFFFFFFFFFFFULL);
  440|  15.6M|    r->n[4] = a->n[3] >> 16;
  441|  15.6M|}
secp256k1.c:secp256k1_fe_impl_is_zero:
  206|   125k|SECP256K1_INLINE static int secp256k1_fe_impl_is_zero(const secp256k1_fe *a) {
  207|   125k|    const uint64_t *t = a->n;
  208|   125k|    return (t[0] | t[1] | t[2] | t[3] | t[4]) == 0;
  209|   125k|}
secp256k1.c:secp256k1_fe_impl_cmp_var:
  215|  43.9k|static int secp256k1_fe_impl_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b) {
  216|  43.9k|    int i;
  217|  43.9k|    for (i = 4; i >= 0; i--) {
  ------------------
  |  Branch (217:17): [True: 43.9k, False: 0]
  ------------------
  218|  43.9k|        if (a->n[i] > b->n[i]) {
  ------------------
  |  Branch (218:13): [True: 43.9k, False: 0]
  ------------------
  219|  43.9k|            return 1;
  220|  43.9k|        }
  221|      0|        if (a->n[i] < b->n[i]) {
  ------------------
  |  Branch (221:13): [True: 0, False: 0]
  ------------------
  222|      0|            return -1;
  223|      0|        }
  224|      0|    }
  225|      0|    return 0;
  226|  43.9k|}
secp256k1.c:secp256k1_fe_impl_add:
  333|   122M|SECP256K1_INLINE static void secp256k1_fe_impl_add(secp256k1_fe *r, const secp256k1_fe *a) {
  334|   122M|    r->n[0] += a->n[0];
  335|   122M|    r->n[1] += a->n[1];
  336|   122M|    r->n[2] += a->n[2];
  337|   122M|    r->n[3] += a->n[3];
  338|   122M|    r->n[4] += a->n[4];
  339|   122M|}
secp256k1.c:secp256k1_fe_storage_cmov:
  416|   406M|static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag) {
  417|   406M|    uint64_t mask0, mask1;
  418|   406M|    volatile int vflag = flag;
  419|   406M|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
  ------------------
  |  |   99|   406M|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   406M|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  420|   406M|    mask0 = vflag + ~((uint64_t)0);
  421|   406M|    mask1 = ~mask0;
  422|   406M|    r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
  423|   406M|    r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
  424|   406M|    r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
  425|   406M|    r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
  426|   406M|}
secp256k1.c:secp256k1_fe_impl_negate_unchecked:
  306|  63.9M|SECP256K1_INLINE static void secp256k1_fe_impl_negate_unchecked(secp256k1_fe *r, const secp256k1_fe *a, int m) {
  307|       |    /* For all legal values of m (0..31), the following properties hold: */
  308|  63.9M|    VERIFY_CHECK(0xFFFFEFFFFFC2FULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
  309|  63.9M|    VERIFY_CHECK(0xFFFFFFFFFFFFFULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
  310|  63.9M|    VERIFY_CHECK(0x0FFFFFFFFFFFFULL * 2 * (m + 1) >= 0x0FFFFFFFFFFFFULL * 2 * m);
  311|       |
  312|       |    /* Due to the properties above, the left hand in the subtractions below is never less than
  313|       |     * the right hand. */
  314|  63.9M|    r->n[0] = 0xFFFFEFFFFFC2FULL * 2 * (m + 1) - a->n[0];
  315|  63.9M|    r->n[1] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[1];
  316|  63.9M|    r->n[2] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[2];
  317|  63.9M|    r->n[3] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[3];
  318|  63.9M|    r->n[4] = 0x0FFFFFFFFFFFFULL * 2 * (m + 1) - a->n[4];
  319|  63.9M|}
secp256k1.c:secp256k1_fe_impl_cmov:
  349|  44.4M|SECP256K1_INLINE static void secp256k1_fe_impl_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag) {
  350|  44.4M|    uint64_t mask0, mask1;
  351|  44.4M|    volatile int vflag = flag;
  352|  44.4M|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
  ------------------
  |  |   99|  44.4M|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|  44.4M|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  353|  44.4M|    mask0 = vflag + ~((uint64_t)0);
  354|  44.4M|    mask1 = ~mask0;
  355|  44.4M|    r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
  356|  44.4M|    r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
  357|  44.4M|    r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
  358|  44.4M|    r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
  359|  44.4M|    r->n[4] = (r->n[4] & mask0) | (a->n[4] & mask1);
  360|  44.4M|}
secp256k1.c:secp256k1_fe_impl_mul_int_unchecked:
  321|  22.8M|SECP256K1_INLINE static void secp256k1_fe_impl_mul_int_unchecked(secp256k1_fe *r, int a) {
  322|  22.8M|    r->n[0] *= a;
  323|  22.8M|    r->n[1] *= a;
  324|  22.8M|    r->n[2] *= a;
  325|  22.8M|    r->n[3] *= a;
  326|  22.8M|    r->n[4] *= a;
  327|  22.8M|}
secp256k1.c:secp256k1_fe_impl_half:
  362|  16.5M|static SECP256K1_INLINE void secp256k1_fe_impl_half(secp256k1_fe *r) {
  363|  16.5M|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  364|  16.5M|    uint64_t one = (uint64_t)1;
  365|  16.5M|    uint64_t mask = -(t0 & one) >> 12;
  366|       |
  367|       |    /* Bounds analysis (over the rationals).
  368|       |     *
  369|       |     * Let m = r->magnitude
  370|       |     *     C = 0xFFFFFFFFFFFFFULL * 2
  371|       |     *     D = 0x0FFFFFFFFFFFFULL * 2
  372|       |     *
  373|       |     * Initial bounds: t0..t3 <= C * m
  374|       |     *                     t4 <= D * m
  375|       |     */
  376|       |
  377|  16.5M|    t0 += 0xFFFFEFFFFFC2FULL & mask;
  378|  16.5M|    t1 += mask;
  379|  16.5M|    t2 += mask;
  380|  16.5M|    t3 += mask;
  381|  16.5M|    t4 += mask >> 4;
  382|       |
  383|  16.5M|    VERIFY_CHECK((t0 & one) == 0);
  384|       |
  385|       |    /* t0..t3: added <= C/2
  386|       |     *     t4: added <= D/2
  387|       |     *
  388|       |     * Current bounds: t0..t3 <= C * (m + 1/2)
  389|       |     *                     t4 <= D * (m + 1/2)
  390|       |     */
  391|       |
  392|  16.5M|    r->n[0] = (t0 >> 1) + ((t1 & one) << 51);
  393|  16.5M|    r->n[1] = (t1 >> 1) + ((t2 & one) << 51);
  394|  16.5M|    r->n[2] = (t2 >> 1) + ((t3 & one) << 51);
  395|  16.5M|    r->n[3] = (t3 >> 1) + ((t4 & one) << 51);
  396|  16.5M|    r->n[4] = (t4 >> 1);
  397|       |
  398|       |    /* t0..t3: shifted right and added <= C/4 + 1/2
  399|       |     *     t4: shifted right
  400|       |     *
  401|       |     * Current bounds: t0..t3 <= C * (m/2 + 1/2)
  402|       |     *                     t4 <= D * (m/2 + 1/4)
  403|       |     *
  404|       |     * Therefore the output magnitude (M) has to be set such that:
  405|       |     *     t0..t3: C * M >= C * (m/2 + 1/2)
  406|       |     *         t4: D * M >= D * (m/2 + 1/4)
  407|       |     *
  408|       |     * It suffices for all limbs that, for any input magnitude m:
  409|       |     *     M >= m/2 + 1/2
  410|       |     *
  411|       |     * and since we want the smallest such integer value for M:
  412|       |     *     M == floor(m/2) + 1
  413|       |     */
  414|  16.5M|}
secp256k1.c:secp256k1_fe_impl_normalize_weak:
   80|  79.6k|static void secp256k1_fe_impl_normalize_weak(secp256k1_fe *r) {
   81|  79.6k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
   82|       |
   83|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
   84|  79.6k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
   85|       |
   86|       |    /* The first pass ensures the magnitude is 1, ... */
   87|  79.6k|    t0 += x * 0x1000003D1ULL;
   88|  79.6k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   89|  79.6k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
   90|  79.6k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
   91|  79.6k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
   92|       |
   93|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
   94|  79.6k|    VERIFY_CHECK(t4 >> 49 == 0);
   95|       |
   96|  79.6k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
   97|  79.6k|}
secp256k1.c:secp256k1_fe_impl_normalizes_to_zero:
  137|  12.8M|static int secp256k1_fe_impl_normalizes_to_zero(const secp256k1_fe *r) {
  138|  12.8M|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  139|       |
  140|       |    /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
  141|  12.8M|    uint64_t z0, z1;
  142|       |
  143|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  144|  12.8M|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
  145|       |
  146|       |    /* The first pass ensures the magnitude is 1, ... */
  147|  12.8M|    t0 += x * 0x1000003D1ULL;
  148|  12.8M|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL; z0  = t0; z1  = t0 ^ 0x1000003D0ULL;
  149|  12.8M|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
  150|  12.8M|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
  151|  12.8M|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
  152|  12.8M|                                                z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
  153|       |
  154|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  155|  12.8M|    VERIFY_CHECK(t4 >> 49 == 0);
  156|       |
  157|  12.8M|    return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
  158|  12.8M|}
secp256k1.c:secp256k1_fe_impl_set_int:
  201|  1.09M|SECP256K1_INLINE static void secp256k1_fe_impl_set_int(secp256k1_fe *r, int a) {
  202|  1.09M|    r->n[0] = a;
  203|  1.09M|    r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
  204|  1.09M|}
secp256k1.c:secp256k1_fe_impl_inv:
  479|   148k|static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
  480|   148k|    secp256k1_fe tmp = *x;
  481|   148k|    secp256k1_modinv64_signed62 s;
  482|       |
  483|   148k|    secp256k1_fe_normalize(&tmp);
  ------------------
  |  |   78|   148k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  484|   148k|    secp256k1_fe_to_signed62(&s, &tmp);
  485|   148k|    secp256k1_modinv64(&s, &secp256k1_const_modinfo_fe);
  486|   148k|    secp256k1_fe_from_signed62(r, &s);
  487|   148k|}
secp256k1.c:secp256k1_fe_to_signed62:
  463|   148k|static void secp256k1_fe_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_fe *a) {
  464|   148k|    const uint64_t M62 = UINT64_MAX >> 2;
  465|   148k|    const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4];
  466|       |
  467|   148k|    r->v[0] = (a0       | a1 << 52) & M62;
  468|   148k|    r->v[1] = (a1 >> 10 | a2 << 42) & M62;
  469|   148k|    r->v[2] = (a2 >> 20 | a3 << 32) & M62;
  470|   148k|    r->v[3] = (a3 >> 30 | a4 << 22) & M62;
  471|   148k|    r->v[4] =  a4 >> 40;
  472|   148k|}
secp256k1.c:secp256k1_fe_from_signed62:
  443|   148k|static void secp256k1_fe_from_signed62(secp256k1_fe *r, const secp256k1_modinv64_signed62 *a) {
  444|   148k|    const uint64_t M52 = UINT64_MAX >> 12;
  445|   148k|    const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
  446|       |
  447|       |    /* The output from secp256k1_modinv64{_var} should be normalized to range [0,modulus), and
  448|       |     * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
  449|       |     */
  450|   148k|    VERIFY_CHECK(a0 >> 62 == 0);
  451|   148k|    VERIFY_CHECK(a1 >> 62 == 0);
  452|   148k|    VERIFY_CHECK(a2 >> 62 == 0);
  453|   148k|    VERIFY_CHECK(a3 >> 62 == 0);
  454|   148k|    VERIFY_CHECK(a4 >> 8 == 0);
  455|       |
  456|   148k|    r->n[0] =  a0                   & M52;
  457|   148k|    r->n[1] = (a0 >> 52 | a1 << 10) & M52;
  458|   148k|    r->n[2] = (a1 >> 42 | a2 << 20) & M52;
  459|   148k|    r->n[3] = (a2 >> 32 | a3 << 30) & M52;
  460|   148k|    r->n[4] = (a3 >> 22 | a4 << 40);
  461|   148k|}
secp256k1.c:secp256k1_fe_impl_set_b32_limit:
  265|   139k|static int secp256k1_fe_impl_set_b32_limit(secp256k1_fe *r, const unsigned char *a) {
  266|   139k|    secp256k1_fe_impl_set_b32_mod(r, a);
  267|   139k|    return !((r->n[4] == 0x0FFFFFFFFFFFFULL) & ((r->n[3] & r->n[2] & r->n[1]) == 0xFFFFFFFFFFFFFULL) & (r->n[0] >= 0xFFFFEFFFFFC2FULL));
  268|   139k|}
secp256k1.c:secp256k1_fe_impl_get_b32:
  271|   133k|static void secp256k1_fe_impl_get_b32(unsigned char *r, const secp256k1_fe *a) {
  272|   133k|    r[0] = (a->n[4] >> 40) & 0xFF;
  273|   133k|    r[1] = (a->n[4] >> 32) & 0xFF;
  274|   133k|    r[2] = (a->n[4] >> 24) & 0xFF;
  275|   133k|    r[3] = (a->n[4] >> 16) & 0xFF;
  276|   133k|    r[4] = (a->n[4] >> 8) & 0xFF;
  277|   133k|    r[5] = a->n[4] & 0xFF;
  278|   133k|    r[6] = (a->n[3] >> 44) & 0xFF;
  279|   133k|    r[7] = (a->n[3] >> 36) & 0xFF;
  280|   133k|    r[8] = (a->n[3] >> 28) & 0xFF;
  281|   133k|    r[9] = (a->n[3] >> 20) & 0xFF;
  282|   133k|    r[10] = (a->n[3] >> 12) & 0xFF;
  283|   133k|    r[11] = (a->n[3] >> 4) & 0xFF;
  284|   133k|    r[12] = ((a->n[2] >> 48) & 0xF) | ((a->n[3] & 0xF) << 4);
  285|   133k|    r[13] = (a->n[2] >> 40) & 0xFF;
  286|   133k|    r[14] = (a->n[2] >> 32) & 0xFF;
  287|   133k|    r[15] = (a->n[2] >> 24) & 0xFF;
  288|   133k|    r[16] = (a->n[2] >> 16) & 0xFF;
  289|   133k|    r[17] = (a->n[2] >> 8) & 0xFF;
  290|   133k|    r[18] = a->n[2] & 0xFF;
  291|   133k|    r[19] = (a->n[1] >> 44) & 0xFF;
  292|   133k|    r[20] = (a->n[1] >> 36) & 0xFF;
  293|   133k|    r[21] = (a->n[1] >> 28) & 0xFF;
  294|   133k|    r[22] = (a->n[1] >> 20) & 0xFF;
  295|   133k|    r[23] = (a->n[1] >> 12) & 0xFF;
  296|   133k|    r[24] = (a->n[1] >> 4) & 0xFF;
  297|   133k|    r[25] = ((a->n[0] >> 48) & 0xF) | ((a->n[1] & 0xF) << 4);
  298|   133k|    r[26] = (a->n[0] >> 40) & 0xFF;
  299|   133k|    r[27] = (a->n[0] >> 32) & 0xFF;
  300|   133k|    r[28] = (a->n[0] >> 24) & 0xFF;
  301|   133k|    r[29] = (a->n[0] >> 16) & 0xFF;
  302|   133k|    r[30] = (a->n[0] >> 8) & 0xFF;
  303|   133k|    r[31] = a->n[0] & 0xFF;
  304|   133k|}
secp256k1.c:secp256k1_fe_impl_normalize_var:
   99|   132k|static void secp256k1_fe_impl_normalize_var(secp256k1_fe *r) {
  100|   132k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  101|       |
  102|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  103|   132k|    uint64_t m;
  104|   132k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
  105|       |
  106|       |    /* The first pass ensures the magnitude is 1, ... */
  107|   132k|    t0 += x * 0x1000003D1ULL;
  108|   132k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
  109|   132k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
  110|   132k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
  111|   132k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
  112|       |
  113|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  114|   132k|    VERIFY_CHECK(t4 >> 49 == 0);
  115|       |
  116|       |    /* At most a single final reduction is needed; check if the value is >= the field characteristic */
  117|   132k|    x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
  118|   132k|        & (t0 >= 0xFFFFEFFFFFC2FULL));
  119|       |
  120|   132k|    if (x) {
  ------------------
  |  Branch (120:9): [True: 0, False: 132k]
  ------------------
  121|      0|        t0 += 0x1000003D1ULL;
  122|      0|        t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
  123|      0|        t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
  124|      0|        t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
  125|      0|        t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
  126|       |
  127|       |        /* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
  128|      0|        VERIFY_CHECK(t4 >> 48 == x);
  129|       |
  130|       |        /* Mask off the possible multiple of 2^256 from the final reduction */
  131|      0|        t4 &= 0x0FFFFFFFFFFFFULL;
  132|      0|    }
  133|       |
  134|   132k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
  135|   132k|}
secp256k1.c:secp256k1_fe_impl_is_odd:
  211|  68.6k|SECP256K1_INLINE static int secp256k1_fe_impl_is_odd(const secp256k1_fe *a) {
  212|  68.6k|    return a->n[0] & 1;
  213|  68.6k|}
secp256k1.c:secp256k1_fe_impl_normalizes_to_zero_var:
  160|  5.26M|static int secp256k1_fe_impl_normalizes_to_zero_var(const secp256k1_fe *r) {
  161|  5.26M|    uint64_t t0, t1, t2, t3, t4;
  162|  5.26M|    uint64_t z0, z1;
  163|  5.26M|    uint64_t x;
  164|       |
  165|  5.26M|    t0 = r->n[0];
  166|  5.26M|    t4 = r->n[4];
  167|       |
  168|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  169|  5.26M|    x = t4 >> 48;
  170|       |
  171|       |    /* The first pass ensures the magnitude is 1, ... */
  172|  5.26M|    t0 += x * 0x1000003D1ULL;
  173|       |
  174|       |    /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
  175|  5.26M|    z0 = t0 & 0xFFFFFFFFFFFFFULL;
  176|  5.26M|    z1 = z0 ^ 0x1000003D0ULL;
  177|       |
  178|       |    /* Fast return path should catch the majority of cases */
  179|  5.26M|    if ((z0 != 0ULL) & (z1 != 0xFFFFFFFFFFFFFULL)) {
  ------------------
  |  Branch (179:9): [True: 5.26M, False: 53]
  ------------------
  180|  5.26M|        return 0;
  181|  5.26M|    }
  182|       |
  183|     53|    t1 = r->n[1];
  184|     53|    t2 = r->n[2];
  185|     53|    t3 = r->n[3];
  186|       |
  187|     53|    t4 &= 0x0FFFFFFFFFFFFULL;
  188|       |
  189|     53|    t1 += (t0 >> 52);
  190|     53|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
  191|     53|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
  192|     53|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
  193|     53|                                                z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
  194|       |
  195|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  196|     53|    VERIFY_CHECK(t4 >> 49 == 0);
  197|       |
  198|     53|    return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
  199|  5.26M|}
secp256k1.c:secp256k1_fe_impl_inv_var:
  489|    393|static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
  490|    393|    secp256k1_fe tmp = *x;
  491|    393|    secp256k1_modinv64_signed62 s;
  492|       |
  493|    393|    secp256k1_fe_normalize_var(&tmp);
  ------------------
  |  |   80|    393|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  494|    393|    secp256k1_fe_to_signed62(&s, &tmp);
  495|    393|    secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_fe);
  496|    393|    secp256k1_fe_from_signed62(r, &s);
  497|    393|}
secp256k1.c:secp256k1_fe_impl_set_b32_mod:
  228|   139k|static void secp256k1_fe_impl_set_b32_mod(secp256k1_fe *r, const unsigned char *a) {
  229|   139k|    r->n[0] = (uint64_t)a[31]
  230|   139k|            | ((uint64_t)a[30] << 8)
  231|   139k|            | ((uint64_t)a[29] << 16)
  232|   139k|            | ((uint64_t)a[28] << 24)
  233|   139k|            | ((uint64_t)a[27] << 32)
  234|   139k|            | ((uint64_t)a[26] << 40)
  235|   139k|            | ((uint64_t)(a[25] & 0xF)  << 48);
  236|   139k|    r->n[1] = (uint64_t)((a[25] >> 4) & 0xF)
  237|   139k|            | ((uint64_t)a[24] << 4)
  238|   139k|            | ((uint64_t)a[23] << 12)
  239|   139k|            | ((uint64_t)a[22] << 20)
  240|   139k|            | ((uint64_t)a[21] << 28)
  241|   139k|            | ((uint64_t)a[20] << 36)
  242|   139k|            | ((uint64_t)a[19] << 44);
  243|   139k|    r->n[2] = (uint64_t)a[18]
  244|   139k|            | ((uint64_t)a[17] << 8)
  245|   139k|            | ((uint64_t)a[16] << 16)
  246|   139k|            | ((uint64_t)a[15] << 24)
  247|   139k|            | ((uint64_t)a[14] << 32)
  248|   139k|            | ((uint64_t)a[13] << 40)
  249|   139k|            | ((uint64_t)(a[12] & 0xF) << 48);
  250|   139k|    r->n[3] = (uint64_t)((a[12] >> 4) & 0xF)
  251|   139k|            | ((uint64_t)a[11] << 4)
  252|   139k|            | ((uint64_t)a[10] << 12)
  253|   139k|            | ((uint64_t)a[9]  << 20)
  254|   139k|            | ((uint64_t)a[8]  << 28)
  255|   139k|            | ((uint64_t)a[7]  << 36)
  256|   139k|            | ((uint64_t)a[6]  << 44);
  257|   139k|    r->n[4] = (uint64_t)a[5]
  258|   139k|            | ((uint64_t)a[4] << 8)
  259|   139k|            | ((uint64_t)a[3] << 16)
  260|   139k|            | ((uint64_t)a[2] << 24)
  261|   139k|            | ((uint64_t)a[1] << 32)
  262|   139k|            | ((uint64_t)a[0] << 40);
  263|   139k|}
secp256k1.c:secp256k1_fe_impl_normalize:
   43|   538k|static void secp256k1_fe_impl_normalize(secp256k1_fe *r) {
   44|   538k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
   45|       |
   46|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
   47|   538k|    uint64_t m;
   48|   538k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
   49|       |
   50|       |    /* The first pass ensures the magnitude is 1, ... */
   51|   538k|    t0 += x * 0x1000003D1ULL;
   52|   538k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   53|   538k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
   54|   538k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
   55|   538k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
   56|       |
   57|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
   58|   538k|    VERIFY_CHECK(t4 >> 49 == 0);
   59|       |
   60|       |    /* At most a single final reduction is needed; check if the value is >= the field characteristic */
   61|   538k|    x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
   62|   538k|        & (t0 >= 0xFFFFEFFFFFC2FULL));
   63|       |
   64|       |    /* Apply the final reduction (for constant-time behaviour, we do it always) */
   65|   538k|    t0 += x * 0x1000003D1ULL;
   66|   538k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   67|   538k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
   68|   538k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
   69|   538k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
   70|       |
   71|       |    /* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
   72|   538k|    VERIFY_CHECK(t4 >> 48 == x);
   73|       |
   74|       |    /* Mask off the possible multiple of 2^256 from the final reduction */
   75|   538k|    t4 &= 0x0FFFFFFFFFFFFULL;
   76|       |
   77|   538k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
   78|   538k|}

secp256k1.c:secp256k1_fe_sqr_inner:
  154|  99.5M|SECP256K1_INLINE static void secp256k1_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
  155|  99.5M|    secp256k1_uint128 c, d;
  156|  99.5M|    uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
  157|  99.5M|    uint64_t t3, t4, tx, u0;
  158|  99.5M|    const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
  159|       |
  160|  99.5M|    VERIFY_BITS(a[0], 56);
  161|  99.5M|    VERIFY_BITS(a[1], 56);
  162|  99.5M|    VERIFY_BITS(a[2], 56);
  163|  99.5M|    VERIFY_BITS(a[3], 56);
  164|  99.5M|    VERIFY_BITS(a[4], 52);
  165|       |
  166|       |    /**  [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
  167|       |     *  px is a shorthand for sum(a[i]*a[x-i], i=0..x).
  168|       |     *  Note that [x 0 0 0 0 0] = [x*R].
  169|       |     */
  170|       |
  171|  99.5M|    secp256k1_u128_mul(&d, a0*2, a3);
  172|  99.5M|    secp256k1_u128_accum_mul(&d, a1*2, a2);
  173|  99.5M|    VERIFY_BITS_128(&d, 114);
  174|       |    /* [d 0 0 0] = [p3 0 0 0] */
  175|  99.5M|    secp256k1_u128_mul(&c, a4, a4);
  176|  99.5M|    VERIFY_BITS_128(&c, 112);
  177|       |    /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  178|  99.5M|    secp256k1_u128_accum_mul(&d, R, secp256k1_u128_to_u64(&c)); secp256k1_u128_rshift(&c, 64);
  179|  99.5M|    VERIFY_BITS_128(&d, 115);
  180|  99.5M|    VERIFY_BITS_128(&c, 48);
  181|       |    /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  182|  99.5M|    t3 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  183|  99.5M|    VERIFY_BITS(t3, 52);
  184|  99.5M|    VERIFY_BITS_128(&d, 63);
  185|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  186|       |
  187|  99.5M|    a4 *= 2;
  188|  99.5M|    secp256k1_u128_accum_mul(&d, a0, a4);
  189|  99.5M|    secp256k1_u128_accum_mul(&d, a1*2, a3);
  190|  99.5M|    secp256k1_u128_accum_mul(&d, a2, a2);
  191|  99.5M|    VERIFY_BITS_128(&d, 115);
  192|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  193|  99.5M|    secp256k1_u128_accum_mul(&d, R << 12, secp256k1_u128_to_u64(&c));
  194|  99.5M|    VERIFY_BITS_128(&d, 116);
  195|       |    /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  196|  99.5M|    t4 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  197|  99.5M|    VERIFY_BITS(t4, 52);
  198|  99.5M|    VERIFY_BITS_128(&d, 64);
  199|       |    /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  200|  99.5M|    tx = (t4 >> 48); t4 &= (M >> 4);
  201|  99.5M|    VERIFY_BITS(tx, 4);
  202|  99.5M|    VERIFY_BITS(t4, 48);
  203|       |    /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  204|       |
  205|  99.5M|    secp256k1_u128_mul(&c, a0, a0);
  206|  99.5M|    VERIFY_BITS_128(&c, 112);
  207|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
  208|  99.5M|    secp256k1_u128_accum_mul(&d, a1, a4);
  209|  99.5M|    secp256k1_u128_accum_mul(&d, a2*2, a3);
  210|  99.5M|    VERIFY_BITS_128(&d, 114);
  211|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  212|  99.5M|    u0 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  213|  99.5M|    VERIFY_BITS(u0, 52);
  214|  99.5M|    VERIFY_BITS_128(&d, 62);
  215|       |    /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  216|       |    /* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  217|  99.5M|    u0 = (u0 << 4) | tx;
  218|  99.5M|    VERIFY_BITS(u0, 56);
  219|       |    /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  220|  99.5M|    secp256k1_u128_accum_mul(&c, u0, R >> 4);
  221|  99.5M|    VERIFY_BITS_128(&c, 113);
  222|       |    /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  223|  99.5M|    r[0] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  224|  99.5M|    VERIFY_BITS(r[0], 52);
  225|  99.5M|    VERIFY_BITS_128(&c, 61);
  226|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
  227|       |
  228|  99.5M|    a0 *= 2;
  229|  99.5M|    secp256k1_u128_accum_mul(&c, a0, a1);
  230|  99.5M|    VERIFY_BITS_128(&c, 114);
  231|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
  232|  99.5M|    secp256k1_u128_accum_mul(&d, a2, a4);
  233|  99.5M|    secp256k1_u128_accum_mul(&d, a3, a3);
  234|  99.5M|    VERIFY_BITS_128(&d, 114);
  235|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  236|  99.5M|    secp256k1_u128_accum_mul(&c, secp256k1_u128_to_u64(&d) & M, R); secp256k1_u128_rshift(&d, 52);
  237|  99.5M|    VERIFY_BITS_128(&c, 115);
  238|  99.5M|    VERIFY_BITS_128(&d, 62);
  239|       |    /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  240|  99.5M|    r[1] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  241|  99.5M|    VERIFY_BITS(r[1], 52);
  242|  99.5M|    VERIFY_BITS_128(&c, 63);
  243|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  244|       |
  245|  99.5M|    secp256k1_u128_accum_mul(&c, a0, a2);
  246|  99.5M|    secp256k1_u128_accum_mul(&c, a1, a1);
  247|  99.5M|    VERIFY_BITS_128(&c, 114);
  248|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
  249|  99.5M|    secp256k1_u128_accum_mul(&d, a3, a4);
  250|  99.5M|    VERIFY_BITS_128(&d, 114);
  251|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  252|  99.5M|    secp256k1_u128_accum_mul(&c, R, secp256k1_u128_to_u64(&d)); secp256k1_u128_rshift(&d, 64);
  253|  99.5M|    VERIFY_BITS_128(&c, 115);
  254|  99.5M|    VERIFY_BITS_128(&d, 50);
  255|       |    /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  256|  99.5M|    r[2] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  257|  99.5M|    VERIFY_BITS(r[2], 52);
  258|  99.5M|    VERIFY_BITS_128(&c, 63);
  259|       |    /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  260|       |
  261|  99.5M|    secp256k1_u128_accum_mul(&c, R << 12, secp256k1_u128_to_u64(&d));
  262|  99.5M|    secp256k1_u128_accum_u64(&c, t3);
  263|  99.5M|    VERIFY_BITS_128(&c, 100);
  264|       |    /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  265|  99.5M|    r[3] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  266|  99.5M|    VERIFY_BITS(r[3], 52);
  267|  99.5M|    VERIFY_BITS_128(&c, 48);
  268|       |    /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  269|  99.5M|    r[4] = secp256k1_u128_to_u64(&c) + t4;
  270|  99.5M|    VERIFY_BITS(r[4], 49);
  271|       |    /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  272|  99.5M|}
secp256k1.c:secp256k1_fe_mul_inner:
   18|   123M|SECP256K1_INLINE static void secp256k1_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
   19|   123M|    secp256k1_uint128 c, d;
   20|   123M|    uint64_t t3, t4, tx, u0;
   21|   123M|    uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
   22|   123M|    const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
   23|       |
   24|   123M|    VERIFY_BITS(a[0], 56);
   25|   123M|    VERIFY_BITS(a[1], 56);
   26|   123M|    VERIFY_BITS(a[2], 56);
   27|   123M|    VERIFY_BITS(a[3], 56);
   28|   123M|    VERIFY_BITS(a[4], 52);
   29|   123M|    VERIFY_BITS(b[0], 56);
   30|   123M|    VERIFY_BITS(b[1], 56);
   31|   123M|    VERIFY_BITS(b[2], 56);
   32|   123M|    VERIFY_BITS(b[3], 56);
   33|   123M|    VERIFY_BITS(b[4], 52);
   34|   123M|    VERIFY_CHECK(r != b);
   35|   123M|    VERIFY_CHECK(a != b);
   36|       |
   37|       |    /*  [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
   38|       |     *  for 0 <= x <= 4, px is a shorthand for sum(a[i]*b[x-i], i=0..x).
   39|       |     *  for 4 <= x <= 8, px is a shorthand for sum(a[i]*b[x-i], i=(x-4)..4)
   40|       |     *  Note that [x 0 0 0 0 0] = [x*R].
   41|       |     */
   42|       |
   43|   123M|    secp256k1_u128_mul(&d, a0, b[3]);
   44|   123M|    secp256k1_u128_accum_mul(&d, a1, b[2]);
   45|   123M|    secp256k1_u128_accum_mul(&d, a2, b[1]);
   46|   123M|    secp256k1_u128_accum_mul(&d, a3, b[0]);
   47|   123M|    VERIFY_BITS_128(&d, 114);
   48|       |    /* [d 0 0 0] = [p3 0 0 0] */
   49|   123M|    secp256k1_u128_mul(&c, a4, b[4]);
   50|   123M|    VERIFY_BITS_128(&c, 112);
   51|       |    /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   52|   123M|    secp256k1_u128_accum_mul(&d, R, secp256k1_u128_to_u64(&c)); secp256k1_u128_rshift(&c, 64);
   53|   123M|    VERIFY_BITS_128(&d, 115);
   54|   123M|    VERIFY_BITS_128(&c, 48);
   55|       |    /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   56|   123M|    t3 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   57|   123M|    VERIFY_BITS(t3, 52);
   58|   123M|    VERIFY_BITS_128(&d, 63);
   59|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   60|       |
   61|   123M|    secp256k1_u128_accum_mul(&d, a0, b[4]);
   62|   123M|    secp256k1_u128_accum_mul(&d, a1, b[3]);
   63|   123M|    secp256k1_u128_accum_mul(&d, a2, b[2]);
   64|   123M|    secp256k1_u128_accum_mul(&d, a3, b[1]);
   65|   123M|    secp256k1_u128_accum_mul(&d, a4, b[0]);
   66|   123M|    VERIFY_BITS_128(&d, 115);
   67|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   68|   123M|    secp256k1_u128_accum_mul(&d, R << 12, secp256k1_u128_to_u64(&c));
   69|   123M|    VERIFY_BITS_128(&d, 116);
   70|       |    /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   71|   123M|    t4 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   72|   123M|    VERIFY_BITS(t4, 52);
   73|   123M|    VERIFY_BITS_128(&d, 64);
   74|       |    /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   75|   123M|    tx = (t4 >> 48); t4 &= (M >> 4);
   76|   123M|    VERIFY_BITS(tx, 4);
   77|   123M|    VERIFY_BITS(t4, 48);
   78|       |    /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   79|       |
   80|   123M|    secp256k1_u128_mul(&c, a0, b[0]);
   81|   123M|    VERIFY_BITS_128(&c, 112);
   82|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
   83|   123M|    secp256k1_u128_accum_mul(&d, a1, b[4]);
   84|   123M|    secp256k1_u128_accum_mul(&d, a2, b[3]);
   85|   123M|    secp256k1_u128_accum_mul(&d, a3, b[2]);
   86|   123M|    secp256k1_u128_accum_mul(&d, a4, b[1]);
   87|   123M|    VERIFY_BITS_128(&d, 114);
   88|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   89|   123M|    u0 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   90|   123M|    VERIFY_BITS(u0, 52);
   91|   123M|    VERIFY_BITS_128(&d, 62);
   92|       |    /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   93|       |    /* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   94|   123M|    u0 = (u0 << 4) | tx;
   95|   123M|    VERIFY_BITS(u0, 56);
   96|       |    /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   97|   123M|    secp256k1_u128_accum_mul(&c, u0, R >> 4);
   98|   123M|    VERIFY_BITS_128(&c, 113);
   99|       |    /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  100|   123M|    r[0] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  101|   123M|    VERIFY_BITS(r[0], 52);
  102|   123M|    VERIFY_BITS_128(&c, 61);
  103|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
  104|       |
  105|   123M|    secp256k1_u128_accum_mul(&c, a0, b[1]);
  106|   123M|    secp256k1_u128_accum_mul(&c, a1, b[0]);
  107|   123M|    VERIFY_BITS_128(&c, 114);
  108|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
  109|   123M|    secp256k1_u128_accum_mul(&d, a2, b[4]);
  110|   123M|    secp256k1_u128_accum_mul(&d, a3, b[3]);
  111|   123M|    secp256k1_u128_accum_mul(&d, a4, b[2]);
  112|   123M|    VERIFY_BITS_128(&d, 114);
  113|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  114|   123M|    secp256k1_u128_accum_mul(&c, secp256k1_u128_to_u64(&d) & M, R); secp256k1_u128_rshift(&d, 52);
  115|   123M|    VERIFY_BITS_128(&c, 115);
  116|   123M|    VERIFY_BITS_128(&d, 62);
  117|       |    /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  118|   123M|    r[1] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  119|   123M|    VERIFY_BITS(r[1], 52);
  120|   123M|    VERIFY_BITS_128(&c, 63);
  121|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  122|       |
  123|   123M|    secp256k1_u128_accum_mul(&c, a0, b[2]);
  124|   123M|    secp256k1_u128_accum_mul(&c, a1, b[1]);
  125|   123M|    secp256k1_u128_accum_mul(&c, a2, b[0]);
  126|   123M|    VERIFY_BITS_128(&c, 114);
  127|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
  128|   123M|    secp256k1_u128_accum_mul(&d, a3, b[4]);
  129|   123M|    secp256k1_u128_accum_mul(&d, a4, b[3]);
  130|   123M|    VERIFY_BITS_128(&d, 114);
  131|       |    /* [d 0 0 t4 t3 c t1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  132|   123M|    secp256k1_u128_accum_mul(&c, R, secp256k1_u128_to_u64(&d)); secp256k1_u128_rshift(&d, 64);
  133|   123M|    VERIFY_BITS_128(&c, 115);
  134|   123M|    VERIFY_BITS_128(&d, 50);
  135|       |    /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  136|       |
  137|   123M|    r[2] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  138|   123M|    VERIFY_BITS(r[2], 52);
  139|   123M|    VERIFY_BITS_128(&c, 63);
  140|       |    /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  141|   123M|    secp256k1_u128_accum_mul(&c, R << 12, secp256k1_u128_to_u64(&d));
  142|   123M|    secp256k1_u128_accum_u64(&c, t3);
  143|   123M|    VERIFY_BITS_128(&c, 100);
  144|       |    /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  145|   123M|    r[3] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  146|   123M|    VERIFY_BITS(r[3], 52);
  147|   123M|    VERIFY_BITS_128(&c, 48);
  148|       |    /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  149|   123M|    r[4] = secp256k1_u128_to_u64(&c) + t4;
  150|   123M|    VERIFY_BITS(r[4], 49);
  151|       |    /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  152|   123M|}

secp256k1.c:secp256k1_fe_verify:
  149|   251M|static void secp256k1_fe_verify(const secp256k1_fe *a) { (void)a; }
secp256k1.c:secp256k1_fe_verify_magnitude:
  150|   244M|static void secp256k1_fe_verify_magnitude(const secp256k1_fe *a, int m) { (void)a; (void)m; }
secp256k1.c:secp256k1_fe_sqrt:
   37|  40.4k|static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k1_fe * SECP256K1_RESTRICT a) {
   38|       |    /** Given that p is congruent to 3 mod 4, we can compute the square root of
   39|       |     *  a mod p as the (p+1)/4'th power of a.
   40|       |     *
   41|       |     *  As (p+1)/4 is an even number, it will have the same result for a and for
   42|       |     *  (-a). Only one of these two numbers actually has a square root however,
   43|       |     *  so we test at the end by squaring and comparing to the input.
   44|       |     *  Also because (p+1)/4 is an even number, the computed square root is
   45|       |     *  itself always a square (a ** ((p+1)/4) is the square of a ** ((p+1)/8)).
   46|       |     */
   47|  40.4k|    secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
   48|  40.4k|    int j, ret;
   49|       |
   50|  40.4k|    VERIFY_CHECK(r != a);
   51|  40.4k|    SECP256K1_FE_VERIFY(a);
  ------------------
  |  |  344|  40.4k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   52|  40.4k|    SECP256K1_FE_VERIFY_MAGNITUDE(a, 8);
  ------------------
  |  |  348|  40.4k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   53|       |
   54|       |    /** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
   55|       |     *  { 2, 22, 223 }. Use an addition chain to calculate 2^n - 1 for each block:
   56|       |     *  1, [2], 3, 6, 9, 11, [22], 44, 88, 176, 220, [223]
   57|       |     */
   58|       |
   59|  40.4k|    secp256k1_fe_sqr(&x2, a);
  ------------------
  |  |   94|  40.4k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   60|  40.4k|    secp256k1_fe_mul(&x2, &x2, a);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   61|       |
   62|  40.4k|    secp256k1_fe_sqr(&x3, &x2);
  ------------------
  |  |   94|  40.4k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   63|  40.4k|    secp256k1_fe_mul(&x3, &x3, a);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   64|       |
   65|  40.4k|    x6 = x3;
   66|   161k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (66:15): [True: 121k, False: 40.4k]
  ------------------
   67|   121k|        secp256k1_fe_sqr(&x6, &x6);
  ------------------
  |  |   94|   121k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   68|   121k|    }
   69|  40.4k|    secp256k1_fe_mul(&x6, &x6, &x3);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   70|       |
   71|  40.4k|    x9 = x6;
   72|   161k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (72:15): [True: 121k, False: 40.4k]
  ------------------
   73|   121k|        secp256k1_fe_sqr(&x9, &x9);
  ------------------
  |  |   94|   121k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   74|   121k|    }
   75|  40.4k|    secp256k1_fe_mul(&x9, &x9, &x3);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   76|       |
   77|  40.4k|    x11 = x9;
   78|   121k|    for (j=0; j<2; j++) {
  ------------------
  |  Branch (78:15): [True: 80.9k, False: 40.4k]
  ------------------
   79|  80.9k|        secp256k1_fe_sqr(&x11, &x11);
  ------------------
  |  |   94|  80.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   80|  80.9k|    }
   81|  40.4k|    secp256k1_fe_mul(&x11, &x11, &x2);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   82|       |
   83|  40.4k|    x22 = x11;
   84|   485k|    for (j=0; j<11; j++) {
  ------------------
  |  Branch (84:15): [True: 445k, False: 40.4k]
  ------------------
   85|   445k|        secp256k1_fe_sqr(&x22, &x22);
  ------------------
  |  |   94|   445k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   86|   445k|    }
   87|  40.4k|    secp256k1_fe_mul(&x22, &x22, &x11);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   88|       |
   89|  40.4k|    x44 = x22;
   90|   931k|    for (j=0; j<22; j++) {
  ------------------
  |  Branch (90:15): [True: 890k, False: 40.4k]
  ------------------
   91|   890k|        secp256k1_fe_sqr(&x44, &x44);
  ------------------
  |  |   94|   890k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   92|   890k|    }
   93|  40.4k|    secp256k1_fe_mul(&x44, &x44, &x22);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   94|       |
   95|  40.4k|    x88 = x44;
   96|  1.82M|    for (j=0; j<44; j++) {
  ------------------
  |  Branch (96:15): [True: 1.78M, False: 40.4k]
  ------------------
   97|  1.78M|        secp256k1_fe_sqr(&x88, &x88);
  ------------------
  |  |   94|  1.78M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   98|  1.78M|    }
   99|  40.4k|    secp256k1_fe_mul(&x88, &x88, &x44);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  100|       |
  101|  40.4k|    x176 = x88;
  102|  3.60M|    for (j=0; j<88; j++) {
  ------------------
  |  Branch (102:15): [True: 3.56M, False: 40.4k]
  ------------------
  103|  3.56M|        secp256k1_fe_sqr(&x176, &x176);
  ------------------
  |  |   94|  3.56M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  104|  3.56M|    }
  105|  40.4k|    secp256k1_fe_mul(&x176, &x176, &x88);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  106|       |
  107|  40.4k|    x220 = x176;
  108|  1.82M|    for (j=0; j<44; j++) {
  ------------------
  |  Branch (108:15): [True: 1.78M, False: 40.4k]
  ------------------
  109|  1.78M|        secp256k1_fe_sqr(&x220, &x220);
  ------------------
  |  |   94|  1.78M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  110|  1.78M|    }
  111|  40.4k|    secp256k1_fe_mul(&x220, &x220, &x44);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  112|       |
  113|  40.4k|    x223 = x220;
  114|   161k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (114:15): [True: 121k, False: 40.4k]
  ------------------
  115|   121k|        secp256k1_fe_sqr(&x223, &x223);
  ------------------
  |  |   94|   121k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  116|   121k|    }
  117|  40.4k|    secp256k1_fe_mul(&x223, &x223, &x3);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  118|       |
  119|       |    /* The final result is then assembled using a sliding window over the blocks. */
  120|       |
  121|  40.4k|    t1 = x223;
  122|   971k|    for (j=0; j<23; j++) {
  ------------------
  |  Branch (122:15): [True: 931k, False: 40.4k]
  ------------------
  123|   931k|        secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|   931k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  124|   931k|    }
  125|  40.4k|    secp256k1_fe_mul(&t1, &t1, &x22);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  126|   283k|    for (j=0; j<6; j++) {
  ------------------
  |  Branch (126:15): [True: 242k, False: 40.4k]
  ------------------
  127|   242k|        secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|   242k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  128|   242k|    }
  129|  40.4k|    secp256k1_fe_mul(&t1, &t1, &x2);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  130|  40.4k|    secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|  40.4k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  131|  40.4k|    secp256k1_fe_sqr(r, &t1);
  ------------------
  |  |   94|  40.4k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  132|       |
  133|       |    /* Check that a square root was actually calculated */
  134|       |
  135|  40.4k|    secp256k1_fe_sqr(&t1, r);
  ------------------
  |  |   94|  40.4k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  136|  40.4k|    ret = secp256k1_fe_equal(&t1, a);
  137|       |
  138|       |#ifdef VERIFY
  139|       |    if (!ret) {
  140|       |        secp256k1_fe_negate(&t1, &t1, 1);
  141|       |        secp256k1_fe_normalize_var(&t1);
  142|       |        VERIFY_CHECK(secp256k1_fe_equal(&t1, a));
  143|       |    }
  144|       |#endif
  145|  40.4k|    return ret;
  146|  40.4k|}
secp256k1.c:secp256k1_fe_equal:
   25|   129k|SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
   26|   129k|    secp256k1_fe na;
   27|   129k|    SECP256K1_FE_VERIFY(a);
  ------------------
  |  |  344|   129k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   28|   129k|    SECP256K1_FE_VERIFY(b);
  ------------------
  |  |  344|   129k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   29|   129k|    SECP256K1_FE_VERIFY_MAGNITUDE(a, 1);
  ------------------
  |  |  348|   129k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   30|   129k|    SECP256K1_FE_VERIFY_MAGNITUDE(b, 31);
  ------------------
  |  |  348|   129k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   31|       |
   32|   129k|    secp256k1_fe_negate(&na, a, 1);
  ------------------
  |  |  211|   129k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|   129k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|   129k|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 129k]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|   129k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 129k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|   129k|    } \
  |  |  |  |   84|   129k|    stmt; \
  |  |  |  |   85|   129k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
   33|   129k|    secp256k1_fe_add(&na, b);
  ------------------
  |  |   92|   129k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
   34|   129k|    return secp256k1_fe_normalizes_to_zero(&na);
  ------------------
  |  |   81|   129k|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
   35|   129k|}
secp256k1.c:secp256k1_fe_clear:
   21|   147k|SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe *a) {
   22|   147k|    secp256k1_memclear(a, sizeof(secp256k1_fe));
   23|   147k|}

secp256k1.c:secp256k1_ge_set_xy:
  132|  2.36M|static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y) {
  133|  2.36M|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  344|  2.36M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  134|  2.36M|    SECP256K1_FE_VERIFY(y);
  ------------------
  |  |  344|  2.36M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  135|       |
  136|  2.36M|    r->infinity = 0;
  137|  2.36M|    r->x = *x;
  138|  2.36M|    r->y = *y;
  139|       |
  140|  2.36M|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  206|  2.36M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  141|  2.36M|}
secp256k1.c:secp256k1_ge_verify:
   78|  23.8M|static void secp256k1_ge_verify(const secp256k1_ge *a) {
   79|  23.8M|    SECP256K1_FE_VERIFY(&a->x);
  ------------------
  |  |  344|  23.8M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   80|  23.8M|    SECP256K1_FE_VERIFY(&a->y);
  ------------------
  |  |  344|  23.8M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   81|  23.8M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->x, SECP256K1_GE_X_MAGNITUDE_MAX);
  ------------------
  |  |  348|  23.8M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   82|  23.8M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
  ------------------
  |  |  348|  23.8M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   83|  23.8M|    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
   84|  23.8M|    (void)a;
   85|  23.8M|}
secp256k1.c:secp256k1_ge_is_valid_var:
  408|  9.45k|static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
  409|  9.45k|    secp256k1_fe y2, x3;
  410|  9.45k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  206|  9.45k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  411|       |
  412|  9.45k|    if (a->infinity) {
  ------------------
  |  Branch (412:9): [True: 0, False: 9.45k]
  ------------------
  413|      0|        return 0;
  414|      0|    }
  415|       |    /* y^2 = x^3 + 7 */
  416|  9.45k|    secp256k1_fe_sqr(&y2, &a->y);
  ------------------
  |  |   94|  9.45k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  417|  9.45k|    secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
  ------------------
  |  |   94|  9.45k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
                  secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
  ------------------
  |  |   93|  9.45k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  418|  9.45k|    secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |  102|  9.45k|#  define secp256k1_fe_add_int secp256k1_fe_impl_add_int
  ------------------
                  secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |   73|  9.45k|#define SECP256K1_B 7
  ------------------
  419|  9.45k|    return secp256k1_fe_equal(&y2, &x3);
  420|  9.45k|}
secp256k1.c:secp256k1_ge_is_in_correct_subgroup:
  886|  47.6k|static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge) {
  887|       |#ifdef EXHAUSTIVE_TEST_ORDER
  888|       |    secp256k1_gej out;
  889|       |    int i;
  890|       |    SECP256K1_GE_VERIFY(ge);
  891|       |
  892|       |    /* A very simple EC multiplication ladder that avoids a dependency on ecmult. */
  893|       |    secp256k1_gej_set_infinity(&out);
  894|       |    for (i = 0; i < 32; ++i) {
  895|       |        secp256k1_gej_double_var(&out, &out, NULL);
  896|       |        if ((((uint32_t)EXHAUSTIVE_TEST_ORDER) >> (31 - i)) & 1) {
  897|       |            secp256k1_gej_add_ge_var(&out, &out, ge, NULL);
  898|       |        }
  899|       |    }
  900|       |    return secp256k1_gej_is_infinity(&out);
  901|       |#else
  902|  47.6k|    SECP256K1_GE_VERIFY(ge);
  ------------------
  |  |  206|  47.6k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  903|       |
  904|  47.6k|    (void)ge;
  905|       |    /* The real secp256k1 group has cofactor 1, so the subgroup is the entire curve. */
  906|  47.6k|    return 1;
  907|  47.6k|#endif
  908|  47.6k|}
secp256k1.c:secp256k1_ge_to_bytes:
  937|   125k|static void secp256k1_ge_to_bytes(unsigned char *buf, const secp256k1_ge *a) {
  938|   125k|    secp256k1_ge_storage s;
  939|       |
  940|       |    /* We require that the secp256k1_ge_storage type is exactly 64 bytes.
  941|       |     * This is formally not guaranteed by the C standard, but should hold on any
  942|       |     * sane compiler in the real world. */
  943|   125k|    STATIC_ASSERT(sizeof(secp256k1_ge_storage) == 64);
  ------------------
  |  |   64|   125k|#define STATIC_ASSERT(expr) do { \
  |  |   65|   125k|    switch(0) { \
  |  |  ------------------
  |  |  |  Branch (65:12): [Folded - Ignored]
  |  |  ------------------
  |  |   66|   125k|        case 0: \
  |  |  ------------------
  |  |  |  Branch (66:9): [True: 125k, False: 0]
  |  |  ------------------
  |  |   67|   125k|        /* If expr evaluates to 0, we have two case labels "0", which is illegal. */ \
  |  |   68|   125k|        case /* ERROR: static assertion failed */ (expr): \
  |  |  ------------------
  |  |  |  Branch (68:9): [True: 0, False: 125k]
  |  |  ------------------
  |  |   69|   125k|        ; \
  |  |   70|   125k|    } \
  |  |   71|   125k|} while(0)
  |  |  ------------------
  |  |  |  Branch (71:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  944|   125k|    VERIFY_CHECK(!secp256k1_ge_is_infinity(a));
  945|   125k|    secp256k1_ge_to_storage(&s, a);
  946|   125k|    memcpy(buf, &s, 64);
  947|   125k|}
secp256k1.c:secp256k1_ge_to_storage:
  839|   125k|static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge *a) {
  840|   125k|    secp256k1_fe x, y;
  841|   125k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  206|   125k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  842|   125k|    VERIFY_CHECK(!a->infinity);
  843|       |
  844|   125k|    x = a->x;
  845|   125k|    secp256k1_fe_normalize(&x);
  ------------------
  |  |   78|   125k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  846|   125k|    y = a->y;
  847|   125k|    secp256k1_fe_normalize(&y);
  ------------------
  |  |   78|   125k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  848|   125k|    secp256k1_fe_to_storage(&r->x, &x);
  ------------------
  |  |   96|   125k|#  define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
  ------------------
  849|   125k|    secp256k1_fe_to_storage(&r->y, &y);
  ------------------
  |  |   96|   125k|#  define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
  ------------------
  850|   125k|}
secp256k1.c:secp256k1_ge_clear:
  305|   264k|static void secp256k1_ge_clear(secp256k1_ge *r) {
  306|   264k|    secp256k1_memclear(r, sizeof(secp256k1_ge));
  307|   264k|}
secp256k1.c:secp256k1_ge_from_bytes:
  949|   125k|static void secp256k1_ge_from_bytes(secp256k1_ge *r, const unsigned char *buf) {
  950|   125k|    secp256k1_ge_storage s;
  951|       |
  952|   125k|    STATIC_ASSERT(sizeof(secp256k1_ge_storage) == 64);
  ------------------
  |  |   64|   125k|#define STATIC_ASSERT(expr) do { \
  |  |   65|   125k|    switch(0) { \
  |  |  ------------------
  |  |  |  Branch (65:12): [Folded - Ignored]
  |  |  ------------------
  |  |   66|   125k|        case 0: \
  |  |  ------------------
  |  |  |  Branch (66:9): [True: 125k, False: 0]
  |  |  ------------------
  |  |   67|   125k|        /* If expr evaluates to 0, we have two case labels "0", which is illegal. */ \
  |  |   68|   125k|        case /* ERROR: static assertion failed */ (expr): \
  |  |  ------------------
  |  |  |  Branch (68:9): [True: 0, False: 125k]
  |  |  ------------------
  |  |   69|   125k|        ; \
  |  |   70|   125k|    } \
  |  |   71|   125k|} while(0)
  |  |  ------------------
  |  |  |  Branch (71:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  953|   125k|    memcpy(&s, buf, 64);
  954|   125k|    secp256k1_ge_from_storage(r, &s);
  955|   125k|}
secp256k1.c:secp256k1_ge_from_storage:
  852|  7.82M|static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a) {
  853|  7.82M|    secp256k1_fe_from_storage(&r->x, &a->x);
  ------------------
  |  |   97|  7.82M|#  define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
  ------------------
  854|  7.82M|    secp256k1_fe_from_storage(&r->y, &a->y);
  ------------------
  |  |   97|  7.82M|#  define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
  ------------------
  855|  7.82M|    r->infinity = 0;
  856|       |
  857|  7.82M|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  206|  7.82M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  858|  7.82M|}
secp256k1.c:secp256k1_gej_eq_x_var:
  379|  78.9k|static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a) {
  380|  78.9k|    secp256k1_fe r;
  381|  78.9k|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  344|  78.9k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  382|  78.9k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|  78.9k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  383|  78.9k|    VERIFY_CHECK(!a->infinity);
  384|       |
  385|  78.9k|    secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
  ------------------
  |  |   94|  78.9k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
                  secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
  ------------------
  |  |   93|  78.9k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  386|  78.9k|    return secp256k1_fe_equal(&r, &a->x);
  387|  78.9k|}
secp256k1.c:secp256k1_gej_verify:
   87|  65.4M|static void secp256k1_gej_verify(const secp256k1_gej *a) {
   88|  65.4M|    SECP256K1_FE_VERIFY(&a->x);
  ------------------
  |  |  344|  65.4M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   89|  65.4M|    SECP256K1_FE_VERIFY(&a->y);
  ------------------
  |  |  344|  65.4M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   90|  65.4M|    SECP256K1_FE_VERIFY(&a->z);
  ------------------
  |  |  344|  65.4M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   91|  65.4M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
  ------------------
  |  |  348|  65.4M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   92|  65.4M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
  ------------------
  |  |  348|  65.4M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   93|  65.4M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
  ------------------
  |  |  348|  65.4M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   94|  65.4M|    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
   95|  65.4M|    (void)a;
   96|  65.4M|}
secp256k1.c:secp256k1_ge_storage_cmov:
  872|   203M|static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag) {
  873|   203M|    secp256k1_fe_storage_cmov(&r->x, &a->x, flag);
  874|   203M|    secp256k1_fe_storage_cmov(&r->y, &a->y, flag);
  875|   203M|}
secp256k1.c:secp256k1_gej_rescale:
  823|   147k|static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *s) {
  824|       |    /* Operations: 4 mul, 1 sqr */
  825|   147k|    secp256k1_fe zz;
  826|   147k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|   147k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  827|   147k|    SECP256K1_FE_VERIFY(s);
  ------------------
  |  |  344|   147k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  828|   147k|    VERIFY_CHECK(!secp256k1_fe_normalizes_to_zero_var(s));
  829|       |
  830|   147k|    secp256k1_fe_sqr(&zz, s);
  ------------------
  |  |   94|   147k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  831|   147k|    secp256k1_fe_mul(&r->x, &r->x, &zz);                /* r->x *= s^2 */
  ------------------
  |  |   93|   147k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  832|   147k|    secp256k1_fe_mul(&r->y, &r->y, &zz);
  ------------------
  |  |   93|   147k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  833|   147k|    secp256k1_fe_mul(&r->y, &r->y, s);                  /* r->y *= s^3 */
  ------------------
  |  |   93|   147k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  834|   147k|    secp256k1_fe_mul(&r->z, &r->z, s);                  /* r->z *= s   */
  ------------------
  |  |   93|   147k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  835|       |
  836|   147k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|   147k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  837|   147k|}
secp256k1.c:secp256k1_gej_double:
  422|  10.1M|static SECP256K1_INLINE void secp256k1_gej_double(secp256k1_gej *r, const secp256k1_gej *a) {
  423|       |    /* Operations: 3 mul, 4 sqr, 8 add/half/mul_int/negate */
  424|  10.1M|    secp256k1_fe l, s, t;
  425|  10.1M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|  10.1M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  426|       |
  427|  10.1M|    r->infinity = a->infinity;
  428|       |
  429|       |    /* Formula used:
  430|       |     * L = (3/2) * X1^2
  431|       |     * S = Y1^2
  432|       |     * T = -X1*S
  433|       |     * X3 = L^2 + 2*T
  434|       |     * Y3 = -(L*(X3 + T) + S^2)
  435|       |     * Z3 = Y1*Z1
  436|       |     */
  437|       |
  438|  10.1M|    secp256k1_fe_mul(&r->z, &a->z, &a->y); /* Z3 = Y1*Z1 (1) */
  ------------------
  |  |   93|  10.1M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  439|  10.1M|    secp256k1_fe_sqr(&s, &a->y);           /* S = Y1^2 (1) */
  ------------------
  |  |   94|  10.1M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  440|  10.1M|    secp256k1_fe_sqr(&l, &a->x);           /* L = X1^2 (1) */
  ------------------
  |  |   94|  10.1M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  441|  10.1M|    secp256k1_fe_mul_int(&l, 3);           /* L = 3*X1^2 (3) */
  ------------------
  |  |  233|  10.1M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   77|  10.1M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  10.1M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 10.1M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  10.1M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 10.1M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  10.1M|    } \
  |  |  |  |   84|  10.1M|    stmt; \
  |  |  |  |   85|  10.1M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  442|  10.1M|    secp256k1_fe_half(&l);                 /* L = 3/2*X1^2 (2) */
  ------------------
  |  |  101|  10.1M|#  define secp256k1_fe_half secp256k1_fe_impl_half
  ------------------
  443|  10.1M|    secp256k1_fe_negate(&t, &s, 1);        /* T = -S (2) */
  ------------------
  |  |  211|  10.1M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  10.1M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  10.1M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 10.1M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  10.1M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 10.1M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  10.1M|    } \
  |  |  |  |   84|  10.1M|    stmt; \
  |  |  |  |   85|  10.1M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  444|  10.1M|    secp256k1_fe_mul(&t, &t, &a->x);       /* T = -X1*S (1) */
  ------------------
  |  |   93|  10.1M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  445|  10.1M|    secp256k1_fe_sqr(&r->x, &l);           /* X3 = L^2 (1) */
  ------------------
  |  |   94|  10.1M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  446|  10.1M|    secp256k1_fe_add(&r->x, &t);           /* X3 = L^2 + T (2) */
  ------------------
  |  |   92|  10.1M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  447|  10.1M|    secp256k1_fe_add(&r->x, &t);           /* X3 = L^2 + 2*T (3) */
  ------------------
  |  |   92|  10.1M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  448|  10.1M|    secp256k1_fe_sqr(&s, &s);              /* S' = S^2 (1) */
  ------------------
  |  |   94|  10.1M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  449|  10.1M|    secp256k1_fe_add(&t, &r->x);           /* T' = X3 + T (4) */
  ------------------
  |  |   92|  10.1M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  450|  10.1M|    secp256k1_fe_mul(&r->y, &t, &l);       /* Y3 = L*(X3 + T) (1) */
  ------------------
  |  |   93|  10.1M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  451|  10.1M|    secp256k1_fe_add(&r->y, &s);           /* Y3 = L*(X3 + T) + S^2 (2) */
  ------------------
  |  |   92|  10.1M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  452|  10.1M|    secp256k1_fe_negate(&r->y, &r->y, 2);  /* Y3 = -(L*(X3 + T) + S^2) (3) */
  ------------------
  |  |  211|  10.1M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  10.1M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  10.1M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 10.1M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  10.1M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 10.1M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  10.1M|    } \
  |  |  |  |   84|  10.1M|    stmt; \
  |  |  |  |   85|  10.1M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  453|       |
  454|  10.1M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|  10.1M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  455|  10.1M|}
secp256k1.c:secp256k1_gej_clear:
  301|   147k|static void secp256k1_gej_clear(secp256k1_gej *r) {
  302|   147k|    secp256k1_memclear(r, sizeof(secp256k1_gej));
  303|   147k|}
secp256k1.c:secp256k1_gej_set_infinity:
  284|   159k|static void secp256k1_gej_set_infinity(secp256k1_gej *r) {
  285|   159k|    r->infinity = 1;
  286|   159k|    secp256k1_fe_set_int(&r->x, 0);
  ------------------
  |  |   83|   159k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  287|   159k|    secp256k1_fe_set_int(&r->y, 0);
  ------------------
  |  |   83|   159k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  288|   159k|    secp256k1_fe_set_int(&r->z, 0);
  ------------------
  |  |   83|   159k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  289|       |
  290|   159k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|   159k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  291|   159k|}
secp256k1.c:secp256k1_gej_add_ge:
  686|  6.34M|static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b) {
  687|       |    /* Operations: 7 mul, 5 sqr, 21 add/cmov/half/mul_int/negate/normalizes_to_zero */
  688|  6.34M|    secp256k1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
  689|  6.34M|    secp256k1_fe m_alt, rr_alt;
  690|  6.34M|    int degenerate;
  691|  6.34M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|  6.34M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  692|  6.34M|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  206|  6.34M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  693|  6.34M|    VERIFY_CHECK(!b->infinity);
  694|       |
  695|       |    /*  In:
  696|       |     *    Eric Brier and Marc Joye, Weierstrass Elliptic Curves and Side-Channel Attacks.
  697|       |     *    In D. Naccache and P. Paillier, Eds., Public Key Cryptography, vol. 2274 of Lecture Notes in Computer Science, pages 335-345. Springer-Verlag, 2002.
  698|       |     *  we find as solution for a unified addition/doubling formula:
  699|       |     *    lambda = ((x1 + x2)^2 - x1 * x2 + a) / (y1 + y2), with a = 0 for secp256k1's curve equation.
  700|       |     *    x3 = lambda^2 - (x1 + x2)
  701|       |     *    2*y3 = lambda * (x1 + x2 - 2 * x3) - (y1 + y2).
  702|       |     *
  703|       |     *  Substituting x_i = Xi / Zi^2 and yi = Yi / Zi^3, for i=1,2,3, gives:
  704|       |     *    U1 = X1*Z2^2, U2 = X2*Z1^2
  705|       |     *    S1 = Y1*Z2^3, S2 = Y2*Z1^3
  706|       |     *    Z = Z1*Z2
  707|       |     *    T = U1+U2
  708|       |     *    M = S1+S2
  709|       |     *    Q = -T*M^2
  710|       |     *    R = T^2-U1*U2
  711|       |     *    X3 = R^2+Q
  712|       |     *    Y3 = -(R*(2*X3+Q)+M^4)/2
  713|       |     *    Z3 = M*Z
  714|       |     *  (Note that the paper uses xi = Xi / Zi and yi = Yi / Zi instead.)
  715|       |     *
  716|       |     *  This formula has the benefit of being the same for both addition
  717|       |     *  of distinct points and doubling. However, it breaks down in the
  718|       |     *  case that either point is infinity, or that y1 = -y2. We handle
  719|       |     *  these cases in the following ways:
  720|       |     *
  721|       |     *    - If b is infinity we simply bail by means of a VERIFY_CHECK.
  722|       |     *
  723|       |     *    - If a is infinity, we detect this, and at the end of the
  724|       |     *      computation replace the result (which will be meaningless,
  725|       |     *      but we compute to be constant-time) with b.x : b.y : 1.
  726|       |     *
  727|       |     *    - If a = -b, we have y1 = -y2, which is a degenerate case.
  728|       |     *      But here the answer is infinity, so we simply set the
  729|       |     *      infinity flag of the result, overriding the computed values
  730|       |     *      without even needing to cmov.
  731|       |     *
  732|       |     *    - If y1 = -y2 but x1 != x2, which does occur thanks to certain
  733|       |     *      properties of our curve (specifically, 1 has nontrivial cube
  734|       |     *      roots in our field, and the curve equation has no x coefficient)
  735|       |     *      then the answer is not infinity but also not given by the above
  736|       |     *      equation. In this case, we cmov in place an alternate expression
  737|       |     *      for lambda. Specifically (y1 - y2)/(x1 - x2). Where both these
  738|       |     *      expressions for lambda are defined, they are equal, and can be
  739|       |     *      obtained from each other by multiplication by (y1 + y2)/(y1 + y2)
  740|       |     *      then substitution of x^3 + 7 for y^2 (using the curve equation).
  741|       |     *      For all pairs of nonzero points (a, b) at least one is defined,
  742|       |     *      so this covers everything.
  743|       |     */
  744|       |
  745|  6.34M|    secp256k1_fe_sqr(&zz, &a->z);                       /* z = Z1^2 */
  ------------------
  |  |   94|  6.34M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  746|  6.34M|    u1 = a->x;                                          /* u1 = U1 = X1*Z2^2 (GEJ_X_M) */
  747|  6.34M|    secp256k1_fe_mul(&u2, &b->x, &zz);                  /* u2 = U2 = X2*Z1^2 (1) */
  ------------------
  |  |   93|  6.34M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  748|  6.34M|    s1 = a->y;                                          /* s1 = S1 = Y1*Z2^3 (GEJ_Y_M) */
  749|  6.34M|    secp256k1_fe_mul(&s2, &b->y, &zz);                  /* s2 = Y2*Z1^2 (1) */
  ------------------
  |  |   93|  6.34M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  750|  6.34M|    secp256k1_fe_mul(&s2, &s2, &a->z);                  /* s2 = S2 = Y2*Z1^3 (1) */
  ------------------
  |  |   93|  6.34M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  751|  6.34M|    t = u1; secp256k1_fe_add(&t, &u2);                  /* t = T = U1+U2 (GEJ_X_M+1) */
  ------------------
  |  |   92|  6.34M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  752|  6.34M|    m = s1; secp256k1_fe_add(&m, &s2);                  /* m = M = S1+S2 (GEJ_Y_M+1) */
  ------------------
  |  |   92|  6.34M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  753|  6.34M|    secp256k1_fe_sqr(&rr, &t);                          /* rr = T^2 (1) */
  ------------------
  |  |   94|  6.34M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  754|  6.34M|    secp256k1_fe_negate(&m_alt, &u2, 1);                /* Malt = -X2*Z1^2 (2) */
  ------------------
  |  |  211|  6.34M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  6.34M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  6.34M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 6.34M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  6.34M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 6.34M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  6.34M|    } \
  |  |  |  |   84|  6.34M|    stmt; \
  |  |  |  |   85|  6.34M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  755|  6.34M|    secp256k1_fe_mul(&tt, &u1, &m_alt);                 /* tt = -U1*U2 (1) */
  ------------------
  |  |   93|  6.34M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  756|  6.34M|    secp256k1_fe_add(&rr, &tt);                         /* rr = R = T^2-U1*U2 (2) */
  ------------------
  |  |   92|  6.34M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  757|       |    /* If lambda = R/M = R/0 we have a problem (except in the "trivial"
  758|       |     * case that Z = z1z2 = 0, and this is special-cased later on). */
  759|  6.34M|    degenerate = secp256k1_fe_normalizes_to_zero(&m);
  ------------------
  |  |   81|  6.34M|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
  760|       |    /* This only occurs when y1 == -y2 and x1^3 == x2^3, but x1 != x2.
  761|       |     * This means either x1 == beta*x2 or beta*x1 == x2, where beta is
  762|       |     * a nontrivial cube root of one. In either case, an alternate
  763|       |     * non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
  764|       |     * so we set R/M equal to this. */
  765|  6.34M|    rr_alt = s1;
  766|  6.34M|    secp256k1_fe_mul_int(&rr_alt, 2);       /* rr_alt = Y1*Z2^3 - Y2*Z1^3 (GEJ_Y_M*2) */
  ------------------
  |  |  233|  6.34M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   77|  6.34M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  6.34M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 6.34M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  6.34M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 6.34M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  6.34M|    } \
  |  |  |  |   84|  6.34M|    stmt; \
  |  |  |  |   85|  6.34M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  767|  6.34M|    secp256k1_fe_add(&m_alt, &u1);          /* Malt = X1*Z2^2 - X2*Z1^2 (GEJ_X_M+2) */
  ------------------
  |  |   92|  6.34M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  768|       |
  769|  6.34M|    secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);       /* rr_alt (GEJ_Y_M*2) */
  ------------------
  |  |   95|  6.34M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  770|  6.34M|    secp256k1_fe_cmov(&m_alt, &m, !degenerate);         /* m_alt (GEJ_X_M+2) */
  ------------------
  |  |   95|  6.34M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  771|       |    /* Now Ralt / Malt = lambda and is guaranteed not to be Ralt / 0.
  772|       |     * From here on out Ralt and Malt represent the numerator
  773|       |     * and denominator of lambda; R and M represent the explicit
  774|       |     * expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
  775|  6.34M|    secp256k1_fe_sqr(&n, &m_alt);                       /* n = Malt^2 (1) */
  ------------------
  |  |   94|  6.34M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  776|  6.34M|    secp256k1_fe_negate(&q, &t,
  ------------------
  |  |  211|  6.34M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  6.34M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  6.34M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 6.34M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  6.34M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 6.34M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  6.34M|    } \
  |  |  |  |   84|  6.34M|    stmt; \
  |  |  |  |   85|  6.34M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  777|  6.34M|        SECP256K1_GEJ_X_MAGNITUDE_MAX + 1);             /* q = -T (GEJ_X_M+2) */
  778|  6.34M|    secp256k1_fe_mul(&q, &q, &n);                       /* q = Q = -T*Malt^2 (1) */
  ------------------
  |  |   93|  6.34M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  779|       |    /* These two lines use the observation that either M == Malt or M == 0,
  780|       |     * so M^3 * Malt is either Malt^4 (which is computed by squaring), or
  781|       |     * zero (which is "computed" by cmov). So the cost is one squaring
  782|       |     * versus two multiplications. */
  783|  6.34M|    secp256k1_fe_sqr(&n, &n);                           /* n = Malt^4 (1) */
  ------------------
  |  |   94|  6.34M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  784|  6.34M|    secp256k1_fe_cmov(&n, &m, degenerate);              /* n = M^3 * Malt (GEJ_Y_M+1) */
  ------------------
  |  |   95|  6.34M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  785|  6.34M|    secp256k1_fe_sqr(&t, &rr_alt);                      /* t = Ralt^2 (1) */
  ------------------
  |  |   94|  6.34M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  786|  6.34M|    secp256k1_fe_mul(&r->z, &a->z, &m_alt);             /* r->z = Z3 = Malt*Z (1) */
  ------------------
  |  |   93|  6.34M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  787|  6.34M|    secp256k1_fe_add(&t, &q);                           /* t = Ralt^2 + Q (2) */
  ------------------
  |  |   92|  6.34M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  788|  6.34M|    r->x = t;                                           /* r->x = X3 = Ralt^2 + Q (2) */
  789|  6.34M|    secp256k1_fe_mul_int(&t, 2);                        /* t = 2*X3 (4) */
  ------------------
  |  |  233|  6.34M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   77|  6.34M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  6.34M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 6.34M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  6.34M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 6.34M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  6.34M|    } \
  |  |  |  |   84|  6.34M|    stmt; \
  |  |  |  |   85|  6.34M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  790|  6.34M|    secp256k1_fe_add(&t, &q);                           /* t = 2*X3 + Q (5) */
  ------------------
  |  |   92|  6.34M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  791|  6.34M|    secp256k1_fe_mul(&t, &t, &rr_alt);                  /* t = Ralt*(2*X3 + Q) (1) */
  ------------------
  |  |   93|  6.34M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  792|  6.34M|    secp256k1_fe_add(&t, &n);                           /* t = Ralt*(2*X3 + Q) + M^3*Malt (GEJ_Y_M+2) */
  ------------------
  |  |   92|  6.34M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  793|  6.34M|    secp256k1_fe_negate(&r->y, &t,
  ------------------
  |  |  211|  6.34M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  6.34M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  6.34M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 6.34M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  6.34M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 6.34M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  6.34M|    } \
  |  |  |  |   84|  6.34M|    stmt; \
  |  |  |  |   85|  6.34M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  794|  6.34M|        SECP256K1_GEJ_Y_MAGNITUDE_MAX + 2);             /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (GEJ_Y_M+3) */
  795|  6.34M|    secp256k1_fe_half(&r->y);                           /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 ((GEJ_Y_M+3)/2 + 1) */
  ------------------
  |  |  101|  6.34M|#  define secp256k1_fe_half secp256k1_fe_impl_half
  ------------------
  796|       |
  797|       |    /* In case a->infinity == 1, replace r with (b->x, b->y, 1). */
  798|  6.34M|    secp256k1_fe_cmov(&r->x, &b->x, a->infinity);
  ------------------
  |  |   95|  6.34M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  799|  6.34M|    secp256k1_fe_cmov(&r->y, &b->y, a->infinity);
  ------------------
  |  |   95|  6.34M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  800|  6.34M|    secp256k1_fe_cmov(&r->z, &secp256k1_fe_one, a->infinity);
  ------------------
  |  |   95|  6.34M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  801|       |
  802|       |    /* Set r->infinity if r->z is 0.
  803|       |     *
  804|       |     * If a->infinity is set, then r->infinity = (r->z == 0) = (1 == 0) = false,
  805|       |     * which is correct because the function assumes that b is not infinity.
  806|       |     *
  807|       |     * Now assume !a->infinity. This implies Z = Z1 != 0.
  808|       |     *
  809|       |     * Case y1 = -y2:
  810|       |     * In this case we could have a = -b, namely if x1 = x2.
  811|       |     * We have degenerate = true, r->z = (x1 - x2) * Z.
  812|       |     * Then r->infinity = ((x1 - x2)Z == 0) = (x1 == x2) = (a == -b).
  813|       |     *
  814|       |     * Case y1 != -y2:
  815|       |     * In this case, we can't have a = -b.
  816|       |     * We have degenerate = false, r->z = (y1 + y2) * Z.
  817|       |     * Then r->infinity = ((y1 + y2)Z == 0) = (y1 == -y2) = false. */
  818|  6.34M|    r->infinity = secp256k1_fe_normalizes_to_zero(&r->z);
  ------------------
  |  |   81|  6.34M|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
  819|       |
  820|  6.34M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|  6.34M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  821|  6.34M|}
secp256k1.c:secp256k1_gej_is_infinity:
  402|   159k|static int secp256k1_gej_is_infinity(const secp256k1_gej *a) {
  403|   159k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|   159k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  404|       |
  405|   159k|    return a->infinity;
  406|   159k|}
secp256k1.c:secp256k1_ge_set_gej:
  159|   148k|static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a) {
  160|   148k|    secp256k1_fe z2, z3;
  161|   148k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|   148k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  162|       |
  163|   148k|    r->infinity = a->infinity;
  164|   148k|    secp256k1_fe_inv(&a->z, &a->z);
  ------------------
  |  |   98|   148k|#  define secp256k1_fe_inv secp256k1_fe_impl_inv
  ------------------
  165|   148k|    secp256k1_fe_sqr(&z2, &a->z);
  ------------------
  |  |   94|   148k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  166|   148k|    secp256k1_fe_mul(&z3, &a->z, &z2);
  ------------------
  |  |   93|   148k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  167|   148k|    secp256k1_fe_mul(&a->x, &a->x, &z2);
  ------------------
  |  |   93|   148k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  168|   148k|    secp256k1_fe_mul(&a->y, &a->y, &z3);
  ------------------
  |  |   93|   148k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  169|   148k|    secp256k1_fe_set_int(&a->z, 1);
  ------------------
  |  |   83|   148k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  170|   148k|    r->x = a->x;
  171|   148k|    r->y = a->y;
  172|       |
  173|   148k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|   148k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  174|   148k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  206|   148k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  175|   148k|}
secp256k1.c:secp256k1_ge_set_xo_var:
  309|  40.4k|static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int odd) {
  310|  40.4k|    secp256k1_fe x2, x3;
  311|  40.4k|    int ret;
  312|  40.4k|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  344|  40.4k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  313|       |
  314|  40.4k|    r->x = *x;
  315|  40.4k|    secp256k1_fe_sqr(&x2, x);
  ------------------
  |  |   94|  40.4k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  316|  40.4k|    secp256k1_fe_mul(&x3, x, &x2);
  ------------------
  |  |   93|  40.4k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  317|  40.4k|    r->infinity = 0;
  318|  40.4k|    secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |  102|  40.4k|#  define secp256k1_fe_add_int secp256k1_fe_impl_add_int
  ------------------
                  secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |   73|  40.4k|#define SECP256K1_B 7
  ------------------
  319|  40.4k|    ret = secp256k1_fe_sqrt(&r->y, &x3);
  320|  40.4k|    secp256k1_fe_normalize_var(&r->y);
  ------------------
  |  |   80|  40.4k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  321|  40.4k|    if (secp256k1_fe_is_odd(&r->y) != odd) {
  ------------------
  |  |   85|  40.4k|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  |  Branch (321:9): [True: 4.35k, False: 36.1k]
  ------------------
  322|  4.35k|        secp256k1_fe_negate(&r->y, &r->y, 1);
  ------------------
  |  |  211|  4.35k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  4.35k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  4.35k|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 4.35k]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  4.35k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 4.35k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  4.35k|    } \
  |  |  |  |   84|  4.35k|    stmt; \
  |  |  |  |   85|  4.35k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  323|  4.35k|    }
  324|       |
  325|  40.4k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  206|  40.4k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  326|  40.4k|    return ret;
  327|  40.4k|}
secp256k1.c:secp256k1_gej_set_ge:
  329|   354k|static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a) {
  330|   354k|   SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  206|   354k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  331|       |
  332|   354k|   r->infinity = a->infinity;
  333|   354k|   r->x = a->x;
  334|   354k|   r->y = a->y;
  335|   354k|   secp256k1_fe_set_int(&r->z, 1);
  ------------------
  |  |   83|   354k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  336|       |
  337|   354k|   SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|   354k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  338|   354k|}
secp256k1.c:secp256k1_ge_set_gej_zinv:
   99|  79.6k|static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zi) {
  100|  79.6k|    secp256k1_fe zi2;
  101|  79.6k|    secp256k1_fe zi3;
  102|  79.6k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|  79.6k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  103|  79.6k|    SECP256K1_FE_VERIFY(zi);
  ------------------
  |  |  344|  79.6k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  104|  79.6k|    VERIFY_CHECK(!a->infinity);
  105|       |
  106|  79.6k|    secp256k1_fe_sqr(&zi2, zi);
  ------------------
  |  |   94|  79.6k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  107|  79.6k|    secp256k1_fe_mul(&zi3, &zi2, zi);
  ------------------
  |  |   93|  79.6k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  108|  79.6k|    secp256k1_fe_mul(&r->x, &a->x, &zi2);
  ------------------
  |  |   93|  79.6k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  109|  79.6k|    secp256k1_fe_mul(&r->y, &a->y, &zi3);
  ------------------
  |  |   93|  79.6k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  110|  79.6k|    r->infinity = a->infinity;
  111|       |
  112|  79.6k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  206|  79.6k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  113|  79.6k|}
secp256k1.c:secp256k1_ge_table_set_globalz:
  251|  79.6k|static void secp256k1_ge_table_set_globalz(size_t len, secp256k1_ge *a, const secp256k1_fe *zr) {
  252|  79.6k|    size_t i;
  253|  79.6k|    secp256k1_fe zs;
  254|       |#ifdef VERIFY
  255|       |    for (i = 0; i < len; i++) {
  256|       |        SECP256K1_GE_VERIFY(&a[i]);
  257|       |        SECP256K1_FE_VERIFY(&zr[i]);
  258|       |    }
  259|       |#endif
  260|       |
  261|  79.6k|    if (len > 0) {
  ------------------
  |  Branch (261:9): [True: 79.6k, False: 0]
  ------------------
  262|  79.6k|        i = len - 1;
  263|       |        /* Ensure all y values are in weak normal form for fast negation of points */
  264|  79.6k|        secp256k1_fe_normalize_weak(&a[i].y);
  ------------------
  |  |   79|  79.6k|#  define secp256k1_fe_normalize_weak secp256k1_fe_impl_normalize_weak
  ------------------
  265|  79.6k|        zs = zr[i];
  266|       |
  267|       |        /* Work our way backwards, using the z-ratios to scale the x/y values. */
  268|   637k|        while (i > 0) {
  ------------------
  |  Branch (268:16): [True: 557k, False: 79.6k]
  ------------------
  269|   557k|            if (i != len - 1) {
  ------------------
  |  Branch (269:17): [True: 478k, False: 79.6k]
  ------------------
  270|   478k|                secp256k1_fe_mul(&zs, &zs, &zr[i]);
  ------------------
  |  |   93|   478k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  271|   478k|            }
  272|   557k|            i--;
  273|   557k|            secp256k1_ge_set_ge_zinv(&a[i], &a[i], &zs);
  274|   557k|        }
  275|  79.6k|    }
  276|       |
  277|       |#ifdef VERIFY
  278|       |    for (i = 0; i < len; i++) {
  279|       |        SECP256K1_GE_VERIFY(&a[i]);
  280|       |    }
  281|       |#endif
  282|  79.6k|}
secp256k1.c:secp256k1_ge_set_ge_zinv:
  116|   557k|static void secp256k1_ge_set_ge_zinv(secp256k1_ge *r, const secp256k1_ge *a, const secp256k1_fe *zi) {
  117|   557k|    secp256k1_fe zi2;
  118|   557k|    secp256k1_fe zi3;
  119|   557k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  206|   557k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  120|   557k|    SECP256K1_FE_VERIFY(zi);
  ------------------
  |  |  344|   557k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  121|   557k|    VERIFY_CHECK(!a->infinity);
  122|       |
  123|   557k|    secp256k1_fe_sqr(&zi2, zi);
  ------------------
  |  |   94|   557k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  124|   557k|    secp256k1_fe_mul(&zi3, &zi2, zi);
  ------------------
  |  |   93|   557k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  125|   557k|    secp256k1_fe_mul(&r->x, &a->x, &zi2);
  ------------------
  |  |   93|   557k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  126|   557k|    secp256k1_fe_mul(&r->y, &a->y, &zi3);
  ------------------
  |  |   93|   557k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  127|   557k|    r->infinity = a->infinity;
  128|       |
  129|   557k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  206|   557k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  130|   557k|}
secp256k1.c:secp256k1_gej_double_var:
  457|  10.2M|static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
  458|  10.2M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|  10.2M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  459|       |
  460|       |    /** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity,
  461|       |     *  Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have
  462|       |     *  y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p.
  463|       |     *
  464|       |     *  Having said this, if this function receives a point on a sextic twist, e.g. by
  465|       |     *  a fault attack, it is possible for y to be 0. This happens for y^2 = x^3 + 6,
  466|       |     *  since -6 does have a cube root mod p. For this point, this function will not set
  467|       |     *  the infinity flag even though the point doubles to infinity, and the result
  468|       |     *  point will be gibberish (z = 0 but infinity = 0).
  469|       |     */
  470|  10.2M|    if (a->infinity) {
  ------------------
  |  Branch (470:9): [True: 79.7k, False: 10.1M]
  ------------------
  471|  79.7k|        secp256k1_gej_set_infinity(r);
  472|  79.7k|        if (rzr != NULL) {
  ------------------
  |  Branch (472:13): [True: 0, False: 79.7k]
  ------------------
  473|      0|            secp256k1_fe_set_int(rzr, 1);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  474|      0|        }
  475|  79.7k|        return;
  476|  79.7k|    }
  477|       |
  478|  10.1M|    if (rzr != NULL) {
  ------------------
  |  Branch (478:9): [True: 0, False: 10.1M]
  ------------------
  479|      0|        *rzr = a->y;
  480|      0|        secp256k1_fe_normalize_weak(rzr);
  ------------------
  |  |   79|      0|#  define secp256k1_fe_normalize_weak secp256k1_fe_impl_normalize_weak
  ------------------
  481|      0|    }
  482|       |
  483|  10.1M|    secp256k1_gej_double(r, a);
  484|       |
  485|  10.1M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|  10.1M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  486|  10.1M|}
secp256k1.c:secp256k1_gej_add_ge_var:
  552|  3.99M|static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr) {
  553|       |    /* Operations: 8 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
  554|  3.99M|    secp256k1_fe z12, u1, u2, s1, s2, h, i, h2, h3, t;
  555|  3.99M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|  3.99M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  556|  3.99M|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  206|  3.99M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  557|       |
  558|  3.99M|    if (a->infinity) {
  ------------------
  |  Branch (558:9): [True: 47.5k, False: 3.94M]
  ------------------
  559|  47.5k|        VERIFY_CHECK(rzr == NULL);
  560|  47.5k|        secp256k1_gej_set_ge(r, b);
  561|  47.5k|        return;
  562|  47.5k|    }
  563|  3.94M|    if (b->infinity) {
  ------------------
  |  Branch (563:9): [True: 0, False: 3.94M]
  ------------------
  564|      0|        if (rzr != NULL) {
  ------------------
  |  Branch (564:13): [True: 0, False: 0]
  ------------------
  565|      0|            secp256k1_fe_set_int(rzr, 1);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  566|      0|        }
  567|      0|        *r = *a;
  568|      0|        return;
  569|      0|    }
  570|       |
  571|  3.94M|    secp256k1_fe_sqr(&z12, &a->z);
  ------------------
  |  |   94|  3.94M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  572|  3.94M|    u1 = a->x;
  573|  3.94M|    secp256k1_fe_mul(&u2, &b->x, &z12);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  574|  3.94M|    s1 = a->y;
  575|  3.94M|    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                  secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  576|  3.94M|    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |  211|  3.94M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  3.94M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  3.94M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 3.94M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  3.94M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 3.94M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  3.94M|    } \
  |  |  |  |   84|  3.94M|    stmt; \
  |  |  |  |   85|  3.94M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |   92|  3.94M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  577|  3.94M|    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |  211|  3.94M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  3.94M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  3.94M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 3.94M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  3.94M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 3.94M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  3.94M|    } \
  |  |  |  |   84|  3.94M|    stmt; \
  |  |  |  |   85|  3.94M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |   92|  3.94M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  578|  3.94M|    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
  ------------------
  |  |   82|  3.94M|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (578:9): [True: 4, False: 3.94M]
  ------------------
  579|      4|        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
  ------------------
  |  |   82|      4|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (579:13): [True: 1, False: 3]
  ------------------
  580|      1|            secp256k1_gej_double_var(r, a, rzr);
  581|      3|        } else {
  582|      3|            if (rzr != NULL) {
  ------------------
  |  Branch (582:17): [True: 0, False: 3]
  ------------------
  583|      0|                secp256k1_fe_set_int(rzr, 0);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  584|      0|            }
  585|      3|            secp256k1_gej_set_infinity(r);
  586|      3|        }
  587|      4|        return;
  588|      4|    }
  589|       |
  590|  3.94M|    r->infinity = 0;
  591|  3.94M|    if (rzr != NULL) {
  ------------------
  |  Branch (591:9): [True: 557k, False: 3.38M]
  ------------------
  592|   557k|        *rzr = h;
  593|   557k|    }
  594|  3.94M|    secp256k1_fe_mul(&r->z, &a->z, &h);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  595|       |
  596|  3.94M|    secp256k1_fe_sqr(&h2, &h);
  ------------------
  |  |   94|  3.94M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  597|  3.94M|    secp256k1_fe_negate(&h2, &h2, 1);
  ------------------
  |  |  211|  3.94M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  3.94M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  3.94M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 3.94M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  3.94M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 3.94M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  3.94M|    } \
  |  |  |  |   84|  3.94M|    stmt; \
  |  |  |  |   85|  3.94M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  598|  3.94M|    secp256k1_fe_mul(&h3, &h2, &h);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  599|  3.94M|    secp256k1_fe_mul(&t, &u1, &h2);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  600|       |
  601|  3.94M|    secp256k1_fe_sqr(&r->x, &i);
  ------------------
  |  |   94|  3.94M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  602|  3.94M|    secp256k1_fe_add(&r->x, &h3);
  ------------------
  |  |   92|  3.94M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  603|  3.94M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  3.94M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  604|  3.94M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  3.94M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  605|       |
  606|  3.94M|    secp256k1_fe_add(&t, &r->x);
  ------------------
  |  |   92|  3.94M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  607|  3.94M|    secp256k1_fe_mul(&r->y, &t, &i);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  608|  3.94M|    secp256k1_fe_mul(&h3, &h3, &s1);
  ------------------
  |  |   93|  3.94M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  609|  3.94M|    secp256k1_fe_add(&r->y, &h3);
  ------------------
  |  |   92|  3.94M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  610|       |
  611|  3.94M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|  3.94M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  612|  3.94M|    if (rzr != NULL) SECP256K1_FE_VERIFY(rzr);
  ------------------
  |  |  344|   557k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  |  Branch (612:9): [True: 557k, False: 3.38M]
  ------------------
  613|  3.94M|}
secp256k1.c:secp256k1_gej_add_zinv_var:
  615|  1.35M|static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv) {
  616|       |    /* Operations: 9 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
  617|  1.35M|    secp256k1_fe az, z12, u1, u2, s1, s2, h, i, h2, h3, t;
  618|  1.35M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|  1.35M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  619|  1.35M|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  206|  1.35M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  620|  1.35M|    SECP256K1_FE_VERIFY(bzinv);
  ------------------
  |  |  344|  1.35M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  621|       |
  622|  1.35M|    if (a->infinity) {
  ------------------
  |  Branch (622:9): [True: 32.1k, False: 1.32M]
  ------------------
  623|  32.1k|        secp256k1_fe bzinv2, bzinv3;
  624|  32.1k|        r->infinity = b->infinity;
  625|  32.1k|        secp256k1_fe_sqr(&bzinv2, bzinv);
  ------------------
  |  |   94|  32.1k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  626|  32.1k|        secp256k1_fe_mul(&bzinv3, &bzinv2, bzinv);
  ------------------
  |  |   93|  32.1k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  627|  32.1k|        secp256k1_fe_mul(&r->x, &b->x, &bzinv2);
  ------------------
  |  |   93|  32.1k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  628|  32.1k|        secp256k1_fe_mul(&r->y, &b->y, &bzinv3);
  ------------------
  |  |   93|  32.1k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  629|  32.1k|        secp256k1_fe_set_int(&r->z, 1);
  ------------------
  |  |   83|  32.1k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  630|  32.1k|        SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|  32.1k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  631|  32.1k|        return;
  632|  32.1k|    }
  633|  1.32M|    if (b->infinity) {
  ------------------
  |  Branch (633:9): [True: 0, False: 1.32M]
  ------------------
  634|      0|        *r = *a;
  635|      0|        return;
  636|      0|    }
  637|       |
  638|       |    /** We need to calculate (rx,ry,rz) = (ax,ay,az) + (bx,by,1/bzinv). Due to
  639|       |     *  secp256k1's isomorphism we can multiply the Z coordinates on both sides
  640|       |     *  by bzinv, and get: (rx,ry,rz*bzinv) = (ax,ay,az*bzinv) + (bx,by,1).
  641|       |     *  This means that (rx,ry,rz) can be calculated as
  642|       |     *  (ax,ay,az*bzinv) + (bx,by,1), when not applying the bzinv factor to rz.
  643|       |     *  The variable az below holds the modified Z coordinate for a, which is used
  644|       |     *  for the computation of rx and ry, but not for rz.
  645|       |     */
  646|  1.32M|    secp256k1_fe_mul(&az, &a->z, bzinv);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  647|       |
  648|  1.32M|    secp256k1_fe_sqr(&z12, &az);
  ------------------
  |  |   94|  1.32M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  649|  1.32M|    u1 = a->x;
  650|  1.32M|    secp256k1_fe_mul(&u2, &b->x, &z12);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  651|  1.32M|    s1 = a->y;
  652|  1.32M|    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                  secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  653|  1.32M|    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |  211|  1.32M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  1.32M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  1.32M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 1.32M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  1.32M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 1.32M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  1.32M|    } \
  |  |  |  |   84|  1.32M|    stmt; \
  |  |  |  |   85|  1.32M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |   92|  1.32M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  654|  1.32M|    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |  211|  1.32M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  1.32M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  1.32M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 1.32M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  1.32M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 1.32M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  1.32M|    } \
  |  |  |  |   84|  1.32M|    stmt; \
  |  |  |  |   85|  1.32M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |   92|  1.32M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  655|  1.32M|    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
  ------------------
  |  |   82|  1.32M|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (655:9): [True: 4, False: 1.32M]
  ------------------
  656|      4|        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
  ------------------
  |  |   82|      4|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (656:13): [True: 1, False: 3]
  ------------------
  657|      1|            secp256k1_gej_double_var(r, a, NULL);
  658|      3|        } else {
  659|      3|            secp256k1_gej_set_infinity(r);
  660|      3|        }
  661|      4|        return;
  662|      4|    }
  663|       |
  664|  1.32M|    r->infinity = 0;
  665|  1.32M|    secp256k1_fe_mul(&r->z, &a->z, &h);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  666|       |
  667|  1.32M|    secp256k1_fe_sqr(&h2, &h);
  ------------------
  |  |   94|  1.32M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  668|  1.32M|    secp256k1_fe_negate(&h2, &h2, 1);
  ------------------
  |  |  211|  1.32M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   77|  1.32M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   78|  1.32M|    switch(42) { \
  |  |  |  |   79|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   80|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (80:9): [True: 0, False: 1.32M]
  |  |  |  |  ------------------
  |  |  |  |   81|      0|            break; \
  |  |  |  |   82|  1.32M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (82:9): [True: 1.32M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   83|  1.32M|    } \
  |  |  |  |   84|  1.32M|    stmt; \
  |  |  |  |   85|  1.32M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (85:9): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  669|  1.32M|    secp256k1_fe_mul(&h3, &h2, &h);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  670|  1.32M|    secp256k1_fe_mul(&t, &u1, &h2);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  671|       |
  672|  1.32M|    secp256k1_fe_sqr(&r->x, &i);
  ------------------
  |  |   94|  1.32M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  673|  1.32M|    secp256k1_fe_add(&r->x, &h3);
  ------------------
  |  |   92|  1.32M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  674|  1.32M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  1.32M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  675|  1.32M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  1.32M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  676|       |
  677|  1.32M|    secp256k1_fe_add(&t, &r->x);
  ------------------
  |  |   92|  1.32M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  678|  1.32M|    secp256k1_fe_mul(&r->y, &t, &i);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  679|  1.32M|    secp256k1_fe_mul(&h3, &h3, &s1);
  ------------------
  |  |   93|  1.32M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  680|  1.32M|    secp256k1_fe_add(&r->y, &h3);
  ------------------
  |  |   92|  1.32M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  681|       |
  682|  1.32M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  210|  1.32M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  683|  1.32M|}
secp256k1.c:secp256k1_ge_set_gej_var:
  177|    393|static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a) {
  178|    393|    secp256k1_fe z2, z3;
  179|    393|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|    393|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  180|       |
  181|    393|    if (secp256k1_gej_is_infinity(a)) {
  ------------------
  |  Branch (181:9): [True: 0, False: 393]
  ------------------
  182|      0|        secp256k1_ge_set_infinity(r);
  183|      0|        return;
  184|      0|    }
  185|    393|    r->infinity = 0;
  186|    393|    secp256k1_fe_inv_var(&a->z, &a->z);
  ------------------
  |  |   99|    393|#  define secp256k1_fe_inv_var secp256k1_fe_impl_inv_var
  ------------------
  187|    393|    secp256k1_fe_sqr(&z2, &a->z);
  ------------------
  |  |   94|    393|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  188|    393|    secp256k1_fe_mul(&z3, &a->z, &z2);
  ------------------
  |  |   93|    393|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  189|    393|    secp256k1_fe_mul(&a->x, &a->x, &z2);
  ------------------
  |  |   93|    393|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  190|    393|    secp256k1_fe_mul(&a->y, &a->y, &z3);
  ------------------
  |  |   93|    393|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  191|    393|    secp256k1_fe_set_int(&a->z, 1);
  ------------------
  |  |   83|    393|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  192|    393|    secp256k1_ge_set_xy(r, &a->x, &a->y);
  193|       |
  194|    393|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  210|    393|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  195|    393|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  206|    393|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  196|    393|}
secp256k1.c:secp256k1_ge_is_infinity:
  143|  45.7k|static int secp256k1_ge_is_infinity(const secp256k1_ge *a) {
  144|  45.7k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  206|  45.7k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  145|       |
  146|  45.7k|    return a->infinity;
  147|  45.7k|}

secp256k1.c:secp256k1_sha256_initialize:
   31|   696k|static void secp256k1_sha256_initialize(secp256k1_sha256 *hash) {
   32|   696k|    hash->s[0] = 0x6a09e667ul;
   33|   696k|    hash->s[1] = 0xbb67ae85ul;
   34|   696k|    hash->s[2] = 0x3c6ef372ul;
   35|   696k|    hash->s[3] = 0xa54ff53aul;
   36|   696k|    hash->s[4] = 0x510e527ful;
   37|   696k|    hash->s[5] = 0x9b05688cul;
   38|   696k|    hash->s[6] = 0x1f83d9abul;
   39|   696k|    hash->s[7] = 0x5be0cd19ul;
   40|   696k|    hash->bytes = 0;
   41|   696k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_initialize:
  222|  69.6k|static void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen) {
  223|  69.6k|    secp256k1_hmac_sha256 hmac;
  224|  69.6k|    static const unsigned char zero[1] = {0x00};
  225|  69.6k|    static const unsigned char one[1] = {0x01};
  226|       |
  227|  69.6k|    memset(rng->v, 0x01, 32); /* RFC6979 3.2.b. */
  228|  69.6k|    memset(rng->k, 0x00, 32); /* RFC6979 3.2.c. */
  229|       |
  230|       |    /* RFC6979 3.2.d. */
  231|  69.6k|    secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
  232|  69.6k|    secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
  233|  69.6k|    secp256k1_hmac_sha256_write(&hmac, zero, 1);
  234|  69.6k|    secp256k1_hmac_sha256_write(&hmac, key, keylen);
  235|  69.6k|    secp256k1_hmac_sha256_finalize(&hmac, rng->k);
  236|  69.6k|    secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
  237|  69.6k|    secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
  238|  69.6k|    secp256k1_hmac_sha256_finalize(&hmac, rng->v);
  239|       |
  240|       |    /* RFC6979 3.2.f. */
  241|  69.6k|    secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
  242|  69.6k|    secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
  243|  69.6k|    secp256k1_hmac_sha256_write(&hmac, one, 1);
  244|  69.6k|    secp256k1_hmac_sha256_write(&hmac, key, keylen);
  245|  69.6k|    secp256k1_hmac_sha256_finalize(&hmac, rng->k);
  246|  69.6k|    secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
  247|  69.6k|    secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
  248|  69.6k|    secp256k1_hmac_sha256_finalize(&hmac, rng->v);
  249|  69.6k|    rng->retry = 0;
  250|  69.6k|}
secp256k1.c:secp256k1_hmac_sha256_initialize:
  178|   348k|static void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256 *hash, const unsigned char *key, size_t keylen) {
  179|   348k|    size_t n;
  180|   348k|    unsigned char rkey[64];
  181|   348k|    if (keylen <= sizeof(rkey)) {
  ------------------
  |  Branch (181:9): [True: 348k, False: 0]
  ------------------
  182|   348k|        memcpy(rkey, key, keylen);
  183|   348k|        memset(rkey + keylen, 0, sizeof(rkey) - keylen);
  184|   348k|    } else {
  185|      0|        secp256k1_sha256 sha256;
  186|      0|        secp256k1_sha256_initialize(&sha256);
  187|      0|        secp256k1_sha256_write(&sha256, key, keylen);
  188|      0|        secp256k1_sha256_finalize(&sha256, rkey);
  189|      0|        memset(rkey + 32, 0, 32);
  190|      0|    }
  191|       |
  192|   348k|    secp256k1_sha256_initialize(&hash->outer);
  193|  22.6M|    for (n = 0; n < sizeof(rkey); n++) {
  ------------------
  |  Branch (193:17): [True: 22.2M, False: 348k]
  ------------------
  194|  22.2M|        rkey[n] ^= 0x5c;
  195|  22.2M|    }
  196|   348k|    secp256k1_sha256_write(&hash->outer, rkey, sizeof(rkey));
  197|       |
  198|   348k|    secp256k1_sha256_initialize(&hash->inner);
  199|  22.6M|    for (n = 0; n < sizeof(rkey); n++) {
  ------------------
  |  Branch (199:17): [True: 22.2M, False: 348k]
  ------------------
  200|  22.2M|        rkey[n] ^= 0x5c ^ 0x36;
  201|  22.2M|    }
  202|   348k|    secp256k1_sha256_write(&hash->inner, rkey, sizeof(rkey));
  203|   348k|    secp256k1_memclear(rkey, sizeof(rkey));
  204|   348k|}
secp256k1.c:secp256k1_hmac_sha256_write:
  206|   626k|static void secp256k1_hmac_sha256_write(secp256k1_hmac_sha256 *hash, const unsigned char *data, size_t size) {
  207|   626k|    secp256k1_sha256_write(&hash->inner, data, size);
  208|   626k|}
secp256k1.c:secp256k1_hmac_sha256_finalize:
  210|   348k|static void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256 *hash, unsigned char *out32) {
  211|   348k|    unsigned char temp[32];
  212|   348k|    secp256k1_sha256_finalize(&hash->inner, temp);
  213|   348k|    secp256k1_sha256_write(&hash->outer, temp, 32);
  214|   348k|    secp256k1_memclear(temp, sizeof(temp));
  215|   348k|    secp256k1_sha256_finalize(&hash->outer, out32);
  216|   348k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_generate:
  252|  69.6k|static void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen) {
  253|       |    /* RFC6979 3.2.h. */
  254|  69.6k|    static const unsigned char zero[1] = {0x00};
  255|  69.6k|    if (rng->retry) {
  ------------------
  |  Branch (255:9): [True: 0, False: 69.6k]
  ------------------
  256|      0|        secp256k1_hmac_sha256 hmac;
  257|      0|        secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
  258|      0|        secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
  259|      0|        secp256k1_hmac_sha256_write(&hmac, zero, 1);
  260|      0|        secp256k1_hmac_sha256_finalize(&hmac, rng->k);
  261|      0|        secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
  262|      0|        secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
  263|      0|        secp256k1_hmac_sha256_finalize(&hmac, rng->v);
  264|      0|    }
  265|       |
  266|   139k|    while (outlen > 0) {
  ------------------
  |  Branch (266:12): [True: 69.6k, False: 69.6k]
  ------------------
  267|  69.6k|        secp256k1_hmac_sha256 hmac;
  268|  69.6k|        int now = outlen;
  269|  69.6k|        secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
  270|  69.6k|        secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
  271|  69.6k|        secp256k1_hmac_sha256_finalize(&hmac, rng->v);
  272|  69.6k|        if (now > 32) {
  ------------------
  |  Branch (272:13): [True: 0, False: 69.6k]
  ------------------
  273|      0|            now = 32;
  274|      0|        }
  275|  69.6k|        memcpy(out, rng->v, now);
  276|  69.6k|        out += now;
  277|  69.6k|        outlen -= now;
  278|  69.6k|    }
  279|       |
  280|  69.6k|    rng->retry = 1;
  281|  69.6k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_finalize:
  283|  69.6k|static void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256 *rng) {
  284|  69.6k|    (void) rng;
  285|  69.6k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_clear:
  287|  69.6k|static void secp256k1_rfc6979_hmac_sha256_clear(secp256k1_rfc6979_hmac_sha256 *rng) {
  288|  69.6k|    secp256k1_memclear(rng, sizeof(*rng));
  289|  69.6k|}
secp256k1.c:secp256k1_sha256_write:
  126|  3.06M|static void secp256k1_sha256_write(secp256k1_sha256 *hash, const unsigned char *data, size_t len) {
  127|  3.06M|    size_t bufsize = hash->bytes & 0x3F;
  128|  3.06M|    hash->bytes += len;
  129|  3.06M|    VERIFY_CHECK(hash->bytes >= len);
  130|  4.67M|    while (len >= 64 - bufsize) {
  ------------------
  |  Branch (130:12): [True: 1.60M, False: 3.06M]
  ------------------
  131|       |        /* Fill the buffer, and process it. */
  132|  1.60M|        size_t chunk_len = 64 - bufsize;
  133|  1.60M|        memcpy(hash->buf + bufsize, data, chunk_len);
  134|  1.60M|        data += chunk_len;
  135|  1.60M|        len -= chunk_len;
  136|  1.60M|        secp256k1_sha256_transform(hash->s, hash->buf);
  137|  1.60M|        bufsize = 0;
  138|  1.60M|    }
  139|  3.06M|    if (len) {
  ------------------
  |  Branch (139:9): [True: 1.67M, False: 1.39M]
  ------------------
  140|       |        /* Fill the buffer with what remains. */
  141|  1.67M|        memcpy(hash->buf + bufsize, data, len);
  142|  1.67M|    }
  143|  3.06M|}
secp256k1.c:secp256k1_sha256_transform:
   44|  1.60M|static void secp256k1_sha256_transform(uint32_t* s, const unsigned char* buf) {
   45|  1.60M|    uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
   46|  1.60M|    uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
   47|       |
   48|  1.60M|    Round(a, b, c, d, e, f, g, h, 0x428a2f98,  w0 = secp256k1_read_be32(&buf[0]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   49|  1.60M|    Round(h, a, b, c, d, e, f, g, 0x71374491,  w1 = secp256k1_read_be32(&buf[4]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   50|  1.60M|    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf,  w2 = secp256k1_read_be32(&buf[8]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   51|  1.60M|    Round(f, g, h, a, b, c, d, e, 0xe9b5dba5,  w3 = secp256k1_read_be32(&buf[12]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   52|  1.60M|    Round(e, f, g, h, a, b, c, d, 0x3956c25b,  w4 = secp256k1_read_be32(&buf[16]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   53|  1.60M|    Round(d, e, f, g, h, a, b, c, 0x59f111f1,  w5 = secp256k1_read_be32(&buf[20]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   54|  1.60M|    Round(c, d, e, f, g, h, a, b, 0x923f82a4,  w6 = secp256k1_read_be32(&buf[24]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   55|  1.60M|    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5,  w7 = secp256k1_read_be32(&buf[28]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   56|  1.60M|    Round(a, b, c, d, e, f, g, h, 0xd807aa98,  w8 = secp256k1_read_be32(&buf[32]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   57|  1.60M|    Round(h, a, b, c, d, e, f, g, 0x12835b01,  w9 = secp256k1_read_be32(&buf[36]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   58|  1.60M|    Round(g, h, a, b, c, d, e, f, 0x243185be, w10 = secp256k1_read_be32(&buf[40]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   59|  1.60M|    Round(f, g, h, a, b, c, d, e, 0x550c7dc3, w11 = secp256k1_read_be32(&buf[44]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   60|  1.60M|    Round(e, f, g, h, a, b, c, d, 0x72be5d74, w12 = secp256k1_read_be32(&buf[48]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   61|  1.60M|    Round(d, e, f, g, h, a, b, c, 0x80deb1fe, w13 = secp256k1_read_be32(&buf[52]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   62|  1.60M|    Round(c, d, e, f, g, h, a, b, 0x9bdc06a7, w14 = secp256k1_read_be32(&buf[56]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   63|  1.60M|    Round(b, c, d, e, f, g, h, a, 0xc19bf174, w15 = secp256k1_read_be32(&buf[60]));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   64|       |
   65|  1.60M|    Round(a, b, c, d, e, f, g, h, 0xe49b69c1, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   66|  1.60M|    Round(h, a, b, c, d, e, f, g, 0xefbe4786, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   67|  1.60M|    Round(g, h, a, b, c, d, e, f, 0x0fc19dc6, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   68|  1.60M|    Round(f, g, h, a, b, c, d, e, 0x240ca1cc, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   69|  1.60M|    Round(e, f, g, h, a, b, c, d, 0x2de92c6f, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   70|  1.60M|    Round(d, e, f, g, h, a, b, c, 0x4a7484aa, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   71|  1.60M|    Round(c, d, e, f, g, h, a, b, 0x5cb0a9dc, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   72|  1.60M|    Round(b, c, d, e, f, g, h, a, 0x76f988da, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   73|  1.60M|    Round(a, b, c, d, e, f, g, h, 0x983e5152, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   74|  1.60M|    Round(h, a, b, c, d, e, f, g, 0xa831c66d, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   75|  1.60M|    Round(g, h, a, b, c, d, e, f, 0xb00327c8, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   76|  1.60M|    Round(f, g, h, a, b, c, d, e, 0xbf597fc7, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   77|  1.60M|    Round(e, f, g, h, a, b, c, d, 0xc6e00bf3, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   78|  1.60M|    Round(d, e, f, g, h, a, b, c, 0xd5a79147, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   79|  1.60M|    Round(c, d, e, f, g, h, a, b, 0x06ca6351, w14 += sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   80|  1.60M|    Round(b, c, d, e, f, g, h, a, 0x14292967, w15 += sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   81|       |
   82|  1.60M|    Round(a, b, c, d, e, f, g, h, 0x27b70a85, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   83|  1.60M|    Round(h, a, b, c, d, e, f, g, 0x2e1b2138, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   84|  1.60M|    Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   85|  1.60M|    Round(f, g, h, a, b, c, d, e, 0x53380d13, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   86|  1.60M|    Round(e, f, g, h, a, b, c, d, 0x650a7354, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   87|  1.60M|    Round(d, e, f, g, h, a, b, c, 0x766a0abb, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   88|  1.60M|    Round(c, d, e, f, g, h, a, b, 0x81c2c92e, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   89|  1.60M|    Round(b, c, d, e, f, g, h, a, 0x92722c85, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   90|  1.60M|    Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   91|  1.60M|    Round(h, a, b, c, d, e, f, g, 0xa81a664b, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   92|  1.60M|    Round(g, h, a, b, c, d, e, f, 0xc24b8b70, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   93|  1.60M|    Round(f, g, h, a, b, c, d, e, 0xc76c51a3, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   94|  1.60M|    Round(e, f, g, h, a, b, c, d, 0xd192e819, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   95|  1.60M|    Round(d, e, f, g, h, a, b, c, 0xd6990624, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   96|  1.60M|    Round(c, d, e, f, g, h, a, b, 0xf40e3585, w14 += sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   97|  1.60M|    Round(b, c, d, e, f, g, h, a, 0x106aa070, w15 += sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   98|       |
   99|  1.60M|    Round(a, b, c, d, e, f, g, h, 0x19a4c116, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  100|  1.60M|    Round(h, a, b, c, d, e, f, g, 0x1e376c08, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  101|  1.60M|    Round(g, h, a, b, c, d, e, f, 0x2748774c, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  102|  1.60M|    Round(f, g, h, a, b, c, d, e, 0x34b0bcb5, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  103|  1.60M|    Round(e, f, g, h, a, b, c, d, 0x391c0cb3, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  104|  1.60M|    Round(d, e, f, g, h, a, b, c, 0x4ed8aa4a, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  105|  1.60M|    Round(c, d, e, f, g, h, a, b, 0x5b9cca4f, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  106|  1.60M|    Round(b, c, d, e, f, g, h, a, 0x682e6ff3, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  107|  1.60M|    Round(a, b, c, d, e, f, g, h, 0x748f82ee, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  108|  1.60M|    Round(h, a, b, c, d, e, f, g, 0x78a5636f, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  109|  1.60M|    Round(g, h, a, b, c, d, e, f, 0x84c87814, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  110|  1.60M|    Round(f, g, h, a, b, c, d, e, 0x8cc70208, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  111|  1.60M|    Round(e, f, g, h, a, b, c, d, 0x90befffa, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  112|  1.60M|    Round(d, e, f, g, h, a, b, c, 0xa4506ceb, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  113|  1.60M|    Round(c, d, e, f, g, h, a, b, 0xbef9a3f7, w14 + sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  114|  1.60M|    Round(b, c, d, e, f, g, h, a, 0xc67178f2, w15 + sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|  1.60M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.60M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.60M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.60M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.60M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.60M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.60M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.60M|    (d) += t1; \
  |  |   28|  1.60M|    (h) = t1 + t2; \
  |  |   29|  1.60M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  115|       |
  116|  1.60M|    s[0] += a;
  117|  1.60M|    s[1] += b;
  118|  1.60M|    s[2] += c;
  119|  1.60M|    s[3] += d;
  120|  1.60M|    s[4] += e;
  121|  1.60M|    s[5] += f;
  122|  1.60M|    s[6] += g;
  123|  1.60M|    s[7] += h;
  124|  1.60M|}
secp256k1.c:secp256k1_sha256_finalize:
  145|   696k|static void secp256k1_sha256_finalize(secp256k1_sha256 *hash, unsigned char *out32) {
  146|   696k|    static const unsigned char pad[64] = {0x80};
  147|   696k|    unsigned char sizedesc[8];
  148|   696k|    int i;
  149|       |    /* The maximum message size of SHA256 is 2^64-1 bits. */
  150|   696k|    VERIFY_CHECK(hash->bytes < ((uint64_t)1 << 61));
  151|   696k|    secp256k1_write_be32(&sizedesc[0], hash->bytes >> 29);
  152|   696k|    secp256k1_write_be32(&sizedesc[4], hash->bytes << 3);
  153|   696k|    secp256k1_sha256_write(hash, pad, 1 + ((119 - (hash->bytes % 64)) % 64));
  154|   696k|    secp256k1_sha256_write(hash, sizedesc, 8);
  155|  6.26M|    for (i = 0; i < 8; i++) {
  ------------------
  |  Branch (155:17): [True: 5.57M, False: 696k]
  ------------------
  156|  5.57M|        secp256k1_write_be32(&out32[4*i], hash->s[i]);
  157|  5.57M|        hash->s[i] = 0;
  158|  5.57M|    }
  159|   696k|}

secp256k1.c:secp256k1_u128_mul:
   11|   668M|static SECP256K1_INLINE void secp256k1_u128_mul(secp256k1_uint128 *r, uint64_t a, uint64_t b) {
   12|   668M|   *r = (uint128_t)a * b;
   13|   668M|}
secp256k1.c:secp256k1_u128_accum_mul:
   15|  5.24G|static SECP256K1_INLINE void secp256k1_u128_accum_mul(secp256k1_uint128 *r, uint64_t a, uint64_t b) {
   16|  5.24G|   *r += (uint128_t)a * b;
   17|  5.24G|}
secp256k1.c:secp256k1_u128_to_u64:
   28|  2.90G|static SECP256K1_INLINE uint64_t secp256k1_u128_to_u64(const secp256k1_uint128 *a) {
   29|  2.90G|   return (uint64_t)(*a);
   30|  2.90G|}
secp256k1.c:secp256k1_u128_rshift:
   23|  2.23G|static SECP256K1_INLINE void secp256k1_u128_rshift(secp256k1_uint128 *r, unsigned int n) {
   24|  2.23G|   VERIFY_CHECK(n < 128);
   25|  2.23G|   *r >>= n;
   26|  2.23G|}
secp256k1.c:secp256k1_u128_accum_u64:
   19|   239M|static SECP256K1_INLINE void secp256k1_u128_accum_u64(secp256k1_uint128 *r, uint64_t a) {
   20|   239M|   *r += a;
   21|   239M|}
secp256k1.c:secp256k1_u128_from_u64:
   36|  2.63M|static SECP256K1_INLINE void secp256k1_u128_from_u64(secp256k1_uint128 *r, uint64_t a) {
   37|  2.63M|   *r = a;
   38|  2.63M|}
secp256k1.c:secp256k1_i128_mul:
   49|  11.5M|static SECP256K1_INLINE void secp256k1_i128_mul(secp256k1_int128 *r, int64_t a, int64_t b) {
   50|  11.5M|   *r = (int128_t)a * b;
   51|  11.5M|}
secp256k1.c:secp256k1_i128_accum_mul:
   53|   114M|static SECP256K1_INLINE void secp256k1_i128_accum_mul(secp256k1_int128 *r, int64_t a, int64_t b) {
   54|   114M|   int128_t ab = (int128_t)a * b;
   55|   114M|   VERIFY_CHECK(0 <= ab ? *r <= INT128_MAX - ab : INT128_MIN - ab <= *r);
   56|   114M|   *r += ab;
   57|   114M|}
secp256k1.c:secp256k1_i128_to_u64:
   71|  48.8M|static SECP256K1_INLINE uint64_t secp256k1_i128_to_u64(const secp256k1_int128 *a) {
   72|  48.8M|   return (uint64_t)*a;
   73|  48.8M|}
secp256k1.c:secp256k1_i128_rshift:
   66|  54.6M|static SECP256K1_INLINE void secp256k1_i128_rshift(secp256k1_int128 *r, unsigned int n) {
   67|  54.6M|   VERIFY_CHECK(n < 128);
   68|  54.6M|   *r >>= n;
   69|  54.6M|}
secp256k1.c:secp256k1_i128_to_i64:
   75|  11.5M|static SECP256K1_INLINE int64_t secp256k1_i128_to_i64(const secp256k1_int128 *a) {
   76|  11.5M|   VERIFY_CHECK(INT64_MIN <= *a && *a <= INT64_MAX);
   77|  11.5M|   return *a;
   78|  11.5M|}

secp256k1.c:secp256k1_modinv64_var:
  637|  79.3k|static void secp256k1_modinv64_var(secp256k1_modinv64_signed62 *x, const secp256k1_modinv64_modinfo *modinfo) {
  638|       |    /* Start with d=0, e=1, f=modulus, g=x, eta=-1. */
  639|  79.3k|    secp256k1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
  640|  79.3k|    secp256k1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
  641|  79.3k|    secp256k1_modinv64_signed62 f = modinfo->modulus;
  642|  79.3k|    secp256k1_modinv64_signed62 g = *x;
  643|       |#ifdef VERIFY
  644|       |    int i = 0;
  645|       |#endif
  646|  79.3k|    int j, len = 5;
  647|  79.3k|    int64_t eta = -1; /* eta = -delta; delta is initially 1 */
  648|  79.3k|    int64_t cond, fn, gn;
  649|       |
  650|       |    /* Do iterations of 62 divsteps each until g=0. */
  651|   713k|    while (1) {
  ------------------
  |  Branch (651:12): [Folded - Ignored]
  ------------------
  652|       |        /* Compute transition matrix and new eta after 62 divsteps. */
  653|   713k|        secp256k1_modinv64_trans2x2 t;
  654|   713k|        eta = secp256k1_modinv64_divsteps_62_var(eta, f.v[0], g.v[0], &t);
  655|       |        /* Update d,e using that transition matrix. */
  656|   713k|        secp256k1_modinv64_update_de_62(&d, &e, &t, modinfo);
  657|       |        /* Update f,g using that transition matrix. */
  658|   713k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
  659|   713k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  660|   713k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
  661|   713k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  662|       |
  663|   713k|        secp256k1_modinv64_update_fg_62_var(len, &f, &g, &t);
  664|       |        /* If the bottom limb of g is zero, there is a chance that g=0. */
  665|   713k|        if (g.v[0] == 0) {
  ------------------
  |  Branch (665:13): [True: 79.3k, False: 634k]
  ------------------
  666|  79.3k|            cond = 0;
  667|       |            /* Check if the other limbs are also 0. */
  668|  79.3k|            for (j = 1; j < len; ++j) {
  ------------------
  |  Branch (668:25): [True: 0, False: 79.3k]
  ------------------
  669|      0|                cond |= g.v[j];
  670|      0|            }
  671|       |            /* If so, we're done. */
  672|  79.3k|            if (cond == 0) break;
  ------------------
  |  Branch (672:17): [True: 79.3k, False: 0]
  ------------------
  673|  79.3k|        }
  674|       |
  675|       |        /* Determine if len>1 and limb (len-1) of both f and g is 0 or -1. */
  676|   634k|        fn = f.v[len - 1];
  677|   634k|        gn = g.v[len - 1];
  678|   634k|        cond = ((int64_t)len - 2) >> 63;
  679|   634k|        cond |= fn ^ (fn >> 63);
  680|   634k|        cond |= gn ^ (gn >> 63);
  681|       |        /* If so, reduce length, propagating the sign of f and g's top limb into the one below. */
  682|   634k|        if (cond == 0) {
  ------------------
  |  Branch (682:13): [True: 317k, False: 317k]
  ------------------
  683|   317k|            f.v[len - 2] |= (uint64_t)fn << 62;
  684|   317k|            g.v[len - 2] |= (uint64_t)gn << 62;
  685|   317k|            --len;
  686|   317k|        }
  687|       |
  688|   634k|        VERIFY_CHECK(++i < 12); /* We should never need more than 12*62 = 744 divsteps */
  689|   634k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
  690|   634k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  691|   634k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
  692|   634k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  693|   634k|    }
  694|       |
  695|       |    /* At this point g is 0 and (if g was not originally 0) f must now equal +/- GCD of
  696|       |     * the initial f, g values i.e. +/- 1, and d now contains +/- the modular inverse. */
  697|       |
  698|       |    /* g == 0 */
  699|  79.3k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &SECP256K1_SIGNED62_ONE, 0) == 0);
  700|       |    /* |f| == 1, or (x == 0 and d == 0 and f == modulus) */
  701|  79.3k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
  702|  79.3k|                 secp256k1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
  703|  79.3k|                 (secp256k1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  704|  79.3k|                  secp256k1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  705|  79.3k|                  secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) == 0));
  706|       |
  707|       |    /* Optionally negate d, normalize to [0,modulus), and return it. */
  708|  79.3k|    secp256k1_modinv64_normalize_62(&d, f.v[len - 1], modinfo);
  709|  79.3k|    *x = d;
  710|  79.3k|}
secp256k1.c:secp256k1_modinv64_divsteps_62_var:
  239|   713k|static int64_t secp256k1_modinv64_divsteps_62_var(int64_t eta, uint64_t f0, uint64_t g0, secp256k1_modinv64_trans2x2 *t) {
  240|       |    /* Transformation matrix; see comments in secp256k1_modinv64_divsteps_62. */
  241|   713k|    uint64_t u = 1, v = 0, q = 0, r = 1;
  242|   713k|    uint64_t f = f0, g = g0, m;
  243|   713k|    uint32_t w;
  244|   713k|    int i = 62, limit, zeros;
  245|       |
  246|  11.6M|    for (;;) {
  247|       |        /* Use a sentinel bit to count zeros only up to i. */
  248|  11.6M|        zeros = secp256k1_ctz64_var(g | (UINT64_MAX << i));
  249|       |        /* Perform zeros divsteps at once; they all just divide g by two. */
  250|  11.6M|        g >>= zeros;
  251|  11.6M|        u <<= zeros;
  252|  11.6M|        v <<= zeros;
  253|  11.6M|        eta -= zeros;
  254|  11.6M|        i -= zeros;
  255|       |        /* We're done once we've done 62 divsteps. */
  256|  11.6M|        if (i == 0) break;
  ------------------
  |  Branch (256:13): [True: 713k, False: 10.9M]
  ------------------
  257|  10.9M|        VERIFY_CHECK((f & 1) == 1);
  258|  10.9M|        VERIFY_CHECK((g & 1) == 1);
  259|  10.9M|        VERIFY_CHECK((u * f0 + v * g0) == f << (62 - i));
  260|  10.9M|        VERIFY_CHECK((q * f0 + r * g0) == g << (62 - i));
  261|       |        /* Bounds on eta that follow from the bounds on iteration count (max 12*62 divsteps). */
  262|  10.9M|        VERIFY_CHECK(eta >= -745 && eta <= 745);
  263|       |        /* If eta is negative, negate it and replace f,g with g,-f. */
  264|  10.9M|        if (eta < 0) {
  ------------------
  |  Branch (264:13): [True: 10.5M, False: 377k]
  ------------------
  265|  10.5M|            uint64_t tmp;
  266|  10.5M|            eta = -eta;
  267|  10.5M|            tmp = f; f = g; g = -tmp;
  268|  10.5M|            tmp = u; u = q; q = -tmp;
  269|  10.5M|            tmp = v; v = r; r = -tmp;
  270|       |            /* Use a formula to cancel out up to 6 bits of g. Also, no more than i can be cancelled
  271|       |             * out (as we'd be done before that point), and no more than eta+1 can be done as its
  272|       |             * sign will flip again once that happens. */
  273|  10.5M|            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
  ------------------
  |  Branch (273:21): [True: 212k, False: 10.3M]
  ------------------
  274|  10.5M|            VERIFY_CHECK(limit > 0 && limit <= 62);
  275|       |            /* m is a mask for the bottom min(limit, 6) bits. */
  276|  10.5M|            m = (UINT64_MAX >> (64 - limit)) & 63U;
  277|       |            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 6)
  278|       |             * bits. */
  279|  10.5M|            w = (f * g * (f * f - 2)) & m;
  280|  10.5M|        } else {
  281|       |            /* In this branch, use a simpler formula that only lets us cancel up to 4 bits of g, as
  282|       |             * eta tends to be smaller here. */
  283|   377k|            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
  ------------------
  |  Branch (283:21): [True: 2.49k, False: 375k]
  ------------------
  284|   377k|            VERIFY_CHECK(limit > 0 && limit <= 62);
  285|       |            /* m is a mask for the bottom min(limit, 4) bits. */
  286|   377k|            m = (UINT64_MAX >> (64 - limit)) & 15U;
  287|       |            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 4)
  288|       |             * bits. */
  289|   377k|            w = f + (((f + 1) & 4) << 1);
  290|   377k|            w = (-w * g) & m;
  291|   377k|        }
  292|  10.9M|        g += f * w;
  293|  10.9M|        q += u * w;
  294|  10.9M|        r += v * w;
  295|  10.9M|        VERIFY_CHECK((g & m) == 0);
  296|  10.9M|    }
  297|       |    /* Return data in t and return value. */
  298|   713k|    t->u = (int64_t)u;
  299|   713k|    t->v = (int64_t)v;
  300|   713k|    t->q = (int64_t)q;
  301|   713k|    t->r = (int64_t)r;
  302|       |
  303|       |    /* The determinant of t must be a power of two. This guarantees that multiplication with t
  304|       |     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
  305|       |     * will be divided out again). As each divstep's individual matrix has determinant 2, the
  306|       |     * aggregate of 62 of them will have determinant 2^62. */
  307|   713k|    VERIFY_CHECK(secp256k1_modinv64_det_check_pow2(t, 62, 0));
  308|       |
  309|   713k|    return eta;
  310|   713k|}
secp256k1.c:secp256k1_modinv64_update_de_62:
  411|  2.89M|static void secp256k1_modinv64_update_de_62(secp256k1_modinv64_signed62 *d, secp256k1_modinv64_signed62 *e, const secp256k1_modinv64_trans2x2 *t, const secp256k1_modinv64_modinfo* modinfo) {
  412|  2.89M|    const uint64_t M62 = UINT64_MAX >> 2;
  413|  2.89M|    const int64_t d0 = d->v[0], d1 = d->v[1], d2 = d->v[2], d3 = d->v[3], d4 = d->v[4];
  414|  2.89M|    const int64_t e0 = e->v[0], e1 = e->v[1], e2 = e->v[2], e3 = e->v[3], e4 = e->v[4];
  415|  2.89M|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  416|  2.89M|    int64_t md, me, sd, se;
  417|  2.89M|    secp256k1_int128 cd, ce;
  418|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
  419|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
  420|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
  421|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
  422|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_abs(u) <= (((int64_t)1 << 62) - secp256k1_modinv64_abs(v))); /* |u|+|v| <= 2^62 */
  423|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_abs(q) <= (((int64_t)1 << 62) - secp256k1_modinv64_abs(r))); /* |q|+|r| <= 2^62 */
  424|       |
  425|       |    /* [md,me] start as zero; plus [u,q] if d is negative; plus [v,r] if e is negative. */
  426|  2.89M|    sd = d4 >> 63;
  427|  2.89M|    se = e4 >> 63;
  428|  2.89M|    md = (u & sd) + (v & se);
  429|  2.89M|    me = (q & sd) + (r & se);
  430|       |    /* Begin computing t*[d,e]. */
  431|  2.89M|    secp256k1_i128_mul(&cd, u, d0);
  432|  2.89M|    secp256k1_i128_accum_mul(&cd, v, e0);
  433|  2.89M|    secp256k1_i128_mul(&ce, q, d0);
  434|  2.89M|    secp256k1_i128_accum_mul(&ce, r, e0);
  435|       |    /* Correct md,me so that t*[d,e]+modulus*[md,me] has 62 zero bottom bits. */
  436|  2.89M|    md -= (modinfo->modulus_inv62 * secp256k1_i128_to_u64(&cd) + md) & M62;
  437|  2.89M|    me -= (modinfo->modulus_inv62 * secp256k1_i128_to_u64(&ce) + me) & M62;
  438|       |    /* Update the beginning of computation for t*[d,e]+modulus*[md,me] now md,me are known. */
  439|  2.89M|    secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[0], md);
  440|  2.89M|    secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[0], me);
  441|       |    /* Verify that the low 62 bits of the computation are indeed zero, and then throw them away. */
  442|  2.89M|    VERIFY_CHECK((secp256k1_i128_to_u64(&cd) & M62) == 0); secp256k1_i128_rshift(&cd, 62);
  443|  2.89M|    VERIFY_CHECK((secp256k1_i128_to_u64(&ce) & M62) == 0); secp256k1_i128_rshift(&ce, 62);
  444|       |    /* Compute limb 1 of t*[d,e]+modulus*[md,me], and store it as output limb 0 (= down shift). */
  445|  2.89M|    secp256k1_i128_accum_mul(&cd, u, d1);
  446|  2.89M|    secp256k1_i128_accum_mul(&cd, v, e1);
  447|  2.89M|    secp256k1_i128_accum_mul(&ce, q, d1);
  448|  2.89M|    secp256k1_i128_accum_mul(&ce, r, e1);
  449|  2.89M|    if (modinfo->modulus.v[1]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (449:9): [True: 1.40M, False: 1.48M]
  ------------------
  450|  1.40M|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[1], md);
  451|  1.40M|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[1], me);
  452|  1.40M|    }
  453|  2.89M|    d->v[0] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  454|  2.89M|    e->v[0] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  455|       |    /* Compute limb 2 of t*[d,e]+modulus*[md,me], and store it as output limb 1. */
  456|  2.89M|    secp256k1_i128_accum_mul(&cd, u, d2);
  457|  2.89M|    secp256k1_i128_accum_mul(&cd, v, e2);
  458|  2.89M|    secp256k1_i128_accum_mul(&ce, q, d2);
  459|  2.89M|    secp256k1_i128_accum_mul(&ce, r, e2);
  460|  2.89M|    if (modinfo->modulus.v[2]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (460:9): [True: 1.40M, False: 1.48M]
  ------------------
  461|  1.40M|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[2], md);
  462|  1.40M|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[2], me);
  463|  1.40M|    }
  464|  2.89M|    d->v[1] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  465|  2.89M|    e->v[1] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  466|       |    /* Compute limb 3 of t*[d,e]+modulus*[md,me], and store it as output limb 2. */
  467|  2.89M|    secp256k1_i128_accum_mul(&cd, u, d3);
  468|  2.89M|    secp256k1_i128_accum_mul(&cd, v, e3);
  469|  2.89M|    secp256k1_i128_accum_mul(&ce, q, d3);
  470|  2.89M|    secp256k1_i128_accum_mul(&ce, r, e3);
  471|  2.89M|    if (modinfo->modulus.v[3]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (471:9): [True: 0, False: 2.89M]
  ------------------
  472|      0|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[3], md);
  473|      0|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[3], me);
  474|      0|    }
  475|  2.89M|    d->v[2] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  476|  2.89M|    e->v[2] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  477|       |    /* Compute limb 4 of t*[d,e]+modulus*[md,me], and store it as output limb 3. */
  478|  2.89M|    secp256k1_i128_accum_mul(&cd, u, d4);
  479|  2.89M|    secp256k1_i128_accum_mul(&cd, v, e4);
  480|  2.89M|    secp256k1_i128_accum_mul(&ce, q, d4);
  481|  2.89M|    secp256k1_i128_accum_mul(&ce, r, e4);
  482|  2.89M|    secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[4], md);
  483|  2.89M|    secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[4], me);
  484|  2.89M|    d->v[3] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  485|  2.89M|    e->v[3] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  486|       |    /* What remains is limb 5 of t*[d,e]+modulus*[md,me]; store it as output limb 4. */
  487|  2.89M|    d->v[4] = secp256k1_i128_to_i64(&cd);
  488|  2.89M|    e->v[4] = secp256k1_i128_to_i64(&ce);
  489|       |
  490|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
  491|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
  492|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
  493|  2.89M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
  494|  2.89M|}
secp256k1.c:secp256k1_modinv64_update_fg_62_var:
  553|   713k|static void secp256k1_modinv64_update_fg_62_var(int len, secp256k1_modinv64_signed62 *f, secp256k1_modinv64_signed62 *g, const secp256k1_modinv64_trans2x2 *t) {
  554|   713k|    const uint64_t M62 = UINT64_MAX >> 2;
  555|   713k|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  556|   713k|    int64_t fi, gi;
  557|   713k|    secp256k1_int128 cf, cg;
  558|   713k|    int i;
  559|   713k|    VERIFY_CHECK(len > 0);
  560|       |    /* Start computing t*[f,g]. */
  561|   713k|    fi = f->v[0];
  562|   713k|    gi = g->v[0];
  563|   713k|    secp256k1_i128_mul(&cf, u, fi);
  564|   713k|    secp256k1_i128_accum_mul(&cf, v, gi);
  565|   713k|    secp256k1_i128_mul(&cg, q, fi);
  566|   713k|    secp256k1_i128_accum_mul(&cg, r, gi);
  567|       |    /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
  568|   713k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cf) & M62) == 0); secp256k1_i128_rshift(&cf, 62);
  569|   713k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cg) & M62) == 0); secp256k1_i128_rshift(&cg, 62);
  570|       |    /* Now iteratively compute limb i=1..len of t*[f,g], and store them in output limb i-1 (shifting
  571|       |     * down by 62 bits). */
  572|  1.98M|    for (i = 1; i < len; ++i) {
  ------------------
  |  Branch (572:17): [True: 1.26M, False: 713k]
  ------------------
  573|  1.26M|        fi = f->v[i];
  574|  1.26M|        gi = g->v[i];
  575|  1.26M|        secp256k1_i128_accum_mul(&cf, u, fi);
  576|  1.26M|        secp256k1_i128_accum_mul(&cf, v, gi);
  577|  1.26M|        secp256k1_i128_accum_mul(&cg, q, fi);
  578|  1.26M|        secp256k1_i128_accum_mul(&cg, r, gi);
  579|  1.26M|        f->v[i - 1] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  580|  1.26M|        g->v[i - 1] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  581|  1.26M|    }
  582|       |    /* What remains is limb (len) of t*[f,g]; store it as output limb (len-1). */
  583|   713k|    f->v[len - 1] = secp256k1_i128_to_i64(&cf);
  584|   713k|    g->v[len - 1] = secp256k1_i128_to_i64(&cg);
  585|   713k|}
secp256k1.c:secp256k1_modinv64_normalize_62:
   88|   296k|static void secp256k1_modinv64_normalize_62(secp256k1_modinv64_signed62 *r, int64_t sign, const secp256k1_modinv64_modinfo *modinfo) {
   89|   296k|    const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
   90|   296k|    int64_t r0 = r->v[0], r1 = r->v[1], r2 = r->v[2], r3 = r->v[3], r4 = r->v[4];
   91|   296k|    volatile int64_t cond_add, cond_negate;
   92|       |
   93|       |#ifdef VERIFY
   94|       |    /* Verify that all limbs are in range (-2^62,2^62). */
   95|       |    int i;
   96|       |    for (i = 0; i < 5; ++i) {
   97|       |        VERIFY_CHECK(r->v[i] >= -M62);
   98|       |        VERIFY_CHECK(r->v[i] <= M62);
   99|       |    }
  100|       |    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, -2) > 0); /* r > -2*modulus */
  101|       |    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
  102|       |#endif
  103|       |
  104|       |    /* In a first step, add the modulus if the input is negative, and then negate if requested.
  105|       |     * This brings r from range (-2*modulus,modulus) to range (-modulus,modulus). As all input
  106|       |     * limbs are in range (-2^62,2^62), this cannot overflow an int64_t. Note that the right
  107|       |     * shifts below are signed sign-extending shifts (see assumptions.h for tests that that is
  108|       |     * indeed the behavior of the right shift operator). */
  109|   296k|    cond_add = r4 >> 63;
  110|   296k|    r0 += modinfo->modulus.v[0] & cond_add;
  111|   296k|    r1 += modinfo->modulus.v[1] & cond_add;
  112|   296k|    r2 += modinfo->modulus.v[2] & cond_add;
  113|   296k|    r3 += modinfo->modulus.v[3] & cond_add;
  114|   296k|    r4 += modinfo->modulus.v[4] & cond_add;
  115|   296k|    cond_negate = sign >> 63;
  116|   296k|    r0 = (r0 ^ cond_negate) - cond_negate;
  117|   296k|    r1 = (r1 ^ cond_negate) - cond_negate;
  118|   296k|    r2 = (r2 ^ cond_negate) - cond_negate;
  119|   296k|    r3 = (r3 ^ cond_negate) - cond_negate;
  120|   296k|    r4 = (r4 ^ cond_negate) - cond_negate;
  121|       |    /* Propagate the top bits, to bring limbs back to range (-2^62,2^62). */
  122|   296k|    r1 += r0 >> 62; r0 &= M62;
  123|   296k|    r2 += r1 >> 62; r1 &= M62;
  124|   296k|    r3 += r2 >> 62; r2 &= M62;
  125|   296k|    r4 += r3 >> 62; r3 &= M62;
  126|       |
  127|       |    /* In a second step add the modulus again if the result is still negative, bringing
  128|       |     * r to range [0,modulus). */
  129|   296k|    cond_add = r4 >> 63;
  130|   296k|    r0 += modinfo->modulus.v[0] & cond_add;
  131|   296k|    r1 += modinfo->modulus.v[1] & cond_add;
  132|   296k|    r2 += modinfo->modulus.v[2] & cond_add;
  133|   296k|    r3 += modinfo->modulus.v[3] & cond_add;
  134|   296k|    r4 += modinfo->modulus.v[4] & cond_add;
  135|       |    /* And propagate again. */
  136|   296k|    r1 += r0 >> 62; r0 &= M62;
  137|   296k|    r2 += r1 >> 62; r1 &= M62;
  138|   296k|    r3 += r2 >> 62; r2 &= M62;
  139|   296k|    r4 += r3 >> 62; r3 &= M62;
  140|       |
  141|   296k|    r->v[0] = r0;
  142|   296k|    r->v[1] = r1;
  143|   296k|    r->v[2] = r2;
  144|   296k|    r->v[3] = r3;
  145|   296k|    r->v[4] = r4;
  146|       |
  147|   296k|    VERIFY_CHECK(r0 >> 62 == 0);
  148|   296k|    VERIFY_CHECK(r1 >> 62 == 0);
  149|   296k|    VERIFY_CHECK(r2 >> 62 == 0);
  150|   296k|    VERIFY_CHECK(r3 >> 62 == 0);
  151|   296k|    VERIFY_CHECK(r4 >> 62 == 0);
  152|   296k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 0) >= 0); /* r >= 0 */
  153|   296k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
  154|   296k|}
secp256k1.c:secp256k1_modinv64:
  588|   217k|static void secp256k1_modinv64(secp256k1_modinv64_signed62 *x, const secp256k1_modinv64_modinfo *modinfo) {
  589|       |    /* Start with d=0, e=1, f=modulus, g=x, zeta=-1. */
  590|   217k|    secp256k1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
  591|   217k|    secp256k1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
  592|   217k|    secp256k1_modinv64_signed62 f = modinfo->modulus;
  593|   217k|    secp256k1_modinv64_signed62 g = *x;
  594|   217k|    int i;
  595|   217k|    int64_t zeta = -1; /* zeta = -(delta+1/2); delta starts at 1/2. */
  596|       |
  597|       |    /* Do 10 iterations of 59 divsteps each = 590 divsteps. This suffices for 256-bit inputs. */
  598|  2.39M|    for (i = 0; i < 10; ++i) {
  ------------------
  |  Branch (598:17): [True: 2.17M, False: 217k]
  ------------------
  599|       |        /* Compute transition matrix and new zeta after 59 divsteps. */
  600|  2.17M|        secp256k1_modinv64_trans2x2 t;
  601|  2.17M|        zeta = secp256k1_modinv64_divsteps_59(zeta, f.v[0], g.v[0], &t);
  602|       |        /* Update d,e using that transition matrix. */
  603|  2.17M|        secp256k1_modinv64_update_de_62(&d, &e, &t, modinfo);
  604|       |        /* Update f,g using that transition matrix. */
  605|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
  606|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  607|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
  608|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  609|       |
  610|  2.17M|        secp256k1_modinv64_update_fg_62(&f, &g, &t);
  611|       |
  612|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
  613|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  614|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
  615|  2.17M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  616|  2.17M|    }
  617|       |
  618|       |    /* At this point sufficient iterations have been performed that g must have reached 0
  619|       |     * and (if g was not originally 0) f must now equal +/- GCD of the initial f, g
  620|       |     * values i.e. +/- 1, and d now contains +/- the modular inverse. */
  621|       |
  622|       |    /* g == 0 */
  623|   217k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &SECP256K1_SIGNED62_ONE, 0) == 0);
  624|       |    /* |f| == 1, or (x == 0 and d == 0 and f == modulus) */
  625|   217k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
  626|   217k|                 secp256k1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
  627|   217k|                 (secp256k1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  628|   217k|                  secp256k1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  629|   217k|                  secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) == 0));
  630|       |
  631|       |    /* Optionally negate d, normalize to [0,modulus), and return it. */
  632|   217k|    secp256k1_modinv64_normalize_62(&d, f.v[4], modinfo);
  633|   217k|    *x = d;
  634|   217k|}
secp256k1.c:secp256k1_modinv64_divsteps_59:
  167|  2.17M|static int64_t secp256k1_modinv64_divsteps_59(int64_t zeta, uint64_t f0, uint64_t g0, secp256k1_modinv64_trans2x2 *t) {
  168|       |    /* u,v,q,r are the elements of the transformation matrix being built up,
  169|       |     * starting with the identity matrix times 8 (because the caller expects
  170|       |     * a result scaled by 2^62). Semantically they are signed integers
  171|       |     * in range [-2^62,2^62], but here represented as unsigned mod 2^64. This
  172|       |     * permits left shifting (which is UB for negative numbers). The range
  173|       |     * being inside [-2^63,2^63) means that casting to signed works correctly.
  174|       |     */
  175|  2.17M|    uint64_t u = 8, v = 0, q = 0, r = 8;
  176|  2.17M|    volatile uint64_t c1, c2;
  177|  2.17M|    uint64_t mask1, mask2, f = f0, g = g0, x, y, z;
  178|  2.17M|    int i;
  179|       |
  180|   130M|    for (i = 3; i < 62; ++i) {
  ------------------
  |  Branch (180:17): [True: 128M, False: 2.17M]
  ------------------
  181|   128M|        VERIFY_CHECK((f & 1) == 1); /* f must always be odd */
  182|   128M|        VERIFY_CHECK((u * f0 + v * g0) == f << i);
  183|   128M|        VERIFY_CHECK((q * f0 + r * g0) == g << i);
  184|       |        /* Compute conditional masks for (zeta < 0) and for (g & 1). */
  185|   128M|        c1 = zeta >> 63;
  186|   128M|        mask1 = c1;
  187|   128M|        c2 = g & 1;
  188|   128M|        mask2 = -c2;
  189|       |        /* Compute x,y,z, conditionally negated versions of f,u,v. */
  190|   128M|        x = (f ^ mask1) - mask1;
  191|   128M|        y = (u ^ mask1) - mask1;
  192|   128M|        z = (v ^ mask1) - mask1;
  193|       |        /* Conditionally add x,y,z to g,q,r. */
  194|   128M|        g += x & mask2;
  195|   128M|        q += y & mask2;
  196|   128M|        r += z & mask2;
  197|       |        /* In what follows, c1 is a condition mask for (zeta < 0) and (g & 1). */
  198|   128M|        mask1 &= mask2;
  199|       |        /* Conditionally change zeta into -zeta-2 or zeta-1. */
  200|   128M|        zeta = (zeta ^ mask1) - 1;
  201|       |        /* Conditionally add g,q,r to f,u,v. */
  202|   128M|        f += g & mask1;
  203|   128M|        u += q & mask1;
  204|   128M|        v += r & mask1;
  205|       |        /* Shifts */
  206|   128M|        g >>= 1;
  207|   128M|        u <<= 1;
  208|   128M|        v <<= 1;
  209|       |        /* Bounds on zeta that follow from the bounds on iteration count (max 10*59 divsteps). */
  210|   128M|        VERIFY_CHECK(zeta >= -591 && zeta <= 591);
  211|   128M|    }
  212|       |    /* Return data in t and return value. */
  213|  2.17M|    t->u = (int64_t)u;
  214|  2.17M|    t->v = (int64_t)v;
  215|  2.17M|    t->q = (int64_t)q;
  216|  2.17M|    t->r = (int64_t)r;
  217|       |
  218|       |    /* The determinant of t must be a power of two. This guarantees that multiplication with t
  219|       |     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
  220|       |     * will be divided out again). As each divstep's individual matrix has determinant 2, the
  221|       |     * aggregate of 59 of them will have determinant 2^59. Multiplying with the initial
  222|       |     * 8*identity (which has determinant 2^6) means the overall outputs has determinant
  223|       |     * 2^65. */
  224|  2.17M|    VERIFY_CHECK(secp256k1_modinv64_det_check_pow2(t, 65, 0));
  225|       |
  226|  2.17M|    return zeta;
  227|  2.17M|}
secp256k1.c:secp256k1_modinv64_update_fg_62:
  500|  2.17M|static void secp256k1_modinv64_update_fg_62(secp256k1_modinv64_signed62 *f, secp256k1_modinv64_signed62 *g, const secp256k1_modinv64_trans2x2 *t) {
  501|  2.17M|    const uint64_t M62 = UINT64_MAX >> 2;
  502|  2.17M|    const int64_t f0 = f->v[0], f1 = f->v[1], f2 = f->v[2], f3 = f->v[3], f4 = f->v[4];
  503|  2.17M|    const int64_t g0 = g->v[0], g1 = g->v[1], g2 = g->v[2], g3 = g->v[3], g4 = g->v[4];
  504|  2.17M|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  505|  2.17M|    secp256k1_int128 cf, cg;
  506|       |    /* Start computing t*[f,g]. */
  507|  2.17M|    secp256k1_i128_mul(&cf, u, f0);
  508|  2.17M|    secp256k1_i128_accum_mul(&cf, v, g0);
  509|  2.17M|    secp256k1_i128_mul(&cg, q, f0);
  510|  2.17M|    secp256k1_i128_accum_mul(&cg, r, g0);
  511|       |    /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
  512|  2.17M|    VERIFY_CHECK((secp256k1_i128_to_u64(&cf) & M62) == 0); secp256k1_i128_rshift(&cf, 62);
  513|  2.17M|    VERIFY_CHECK((secp256k1_i128_to_u64(&cg) & M62) == 0); secp256k1_i128_rshift(&cg, 62);
  514|       |    /* Compute limb 1 of t*[f,g], and store it as output limb 0 (= down shift). */
  515|  2.17M|    secp256k1_i128_accum_mul(&cf, u, f1);
  516|  2.17M|    secp256k1_i128_accum_mul(&cf, v, g1);
  517|  2.17M|    secp256k1_i128_accum_mul(&cg, q, f1);
  518|  2.17M|    secp256k1_i128_accum_mul(&cg, r, g1);
  519|  2.17M|    f->v[0] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  520|  2.17M|    g->v[0] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  521|       |    /* Compute limb 2 of t*[f,g], and store it as output limb 1. */
  522|  2.17M|    secp256k1_i128_accum_mul(&cf, u, f2);
  523|  2.17M|    secp256k1_i128_accum_mul(&cf, v, g2);
  524|  2.17M|    secp256k1_i128_accum_mul(&cg, q, f2);
  525|  2.17M|    secp256k1_i128_accum_mul(&cg, r, g2);
  526|  2.17M|    f->v[1] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  527|  2.17M|    g->v[1] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  528|       |    /* Compute limb 3 of t*[f,g], and store it as output limb 2. */
  529|  2.17M|    secp256k1_i128_accum_mul(&cf, u, f3);
  530|  2.17M|    secp256k1_i128_accum_mul(&cf, v, g3);
  531|  2.17M|    secp256k1_i128_accum_mul(&cg, q, f3);
  532|  2.17M|    secp256k1_i128_accum_mul(&cg, r, g3);
  533|  2.17M|    f->v[2] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  534|  2.17M|    g->v[2] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  535|       |    /* Compute limb 4 of t*[f,g], and store it as output limb 3. */
  536|  2.17M|    secp256k1_i128_accum_mul(&cf, u, f4);
  537|  2.17M|    secp256k1_i128_accum_mul(&cf, v, g4);
  538|  2.17M|    secp256k1_i128_accum_mul(&cg, q, f4);
  539|  2.17M|    secp256k1_i128_accum_mul(&cg, r, g4);
  540|  2.17M|    f->v[3] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  541|  2.17M|    g->v[3] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  542|       |    /* What remains is limb 5 of t*[f,g]; store it as output limb 4. */
  543|  2.17M|    f->v[4] = secp256k1_i128_to_i64(&cf);
  544|  2.17M|    g->v[4] = secp256k1_i128_to_i64(&cg);
  545|  2.17M|}

secp256k1_xonly_pubkey_parse:
   22|  1.72k|int secp256k1_xonly_pubkey_parse(const secp256k1_context* ctx, secp256k1_xonly_pubkey *pubkey, const unsigned char *input32) {
   23|  1.72k|    secp256k1_ge pk;
   24|  1.72k|    secp256k1_fe x;
   25|       |
   26|  1.72k|    VERIFY_CHECK(ctx != NULL);
   27|  1.72k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  1.72k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.72k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  1.72k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 1.72k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.72k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   28|  1.72k|    memset(pubkey, 0, sizeof(*pubkey));
   29|  1.72k|    ARG_CHECK(input32 != NULL);
  ------------------
  |  |   45|  1.72k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.72k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  1.72k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 1.72k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.72k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
   30|       |
   31|  1.72k|    if (!secp256k1_fe_set_b32_limit(&x, input32)) {
  ------------------
  |  |   88|  1.72k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  |  Branch (31:9): [True: 10, False: 1.71k]
  ------------------
   32|     10|        return 0;
   33|     10|    }
   34|  1.71k|    if (!secp256k1_ge_set_xo_var(&pk, &x, 0)) {
  ------------------
  |  Branch (34:9): [True: 922, False: 794]
  ------------------
   35|    922|        return 0;
   36|    922|    }
   37|    794|    if (!secp256k1_ge_is_in_correct_subgroup(&pk)) {
  ------------------
  |  Branch (37:9): [True: 0, False: 794]
  ------------------
   38|      0|        return 0;
   39|      0|    }
   40|    794|    secp256k1_xonly_pubkey_save(pubkey, &pk);
   41|    794|    return 1;
   42|    794|}
secp256k1_xonly_pubkey_tweak_add_check:
  135|    386|int secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context* ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
  136|    386|    secp256k1_ge pk;
  137|    386|    unsigned char pk_expected32[32];
  138|       |
  139|    386|    VERIFY_CHECK(ctx != NULL);
  140|    386|    ARG_CHECK(internal_pubkey != NULL);
  ------------------
  |  |   45|    386|#define ARG_CHECK(cond) do { \
  |  |   46|    386|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|    386|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 386]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    386|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  141|    386|    ARG_CHECK(tweaked_pubkey32 != NULL);
  ------------------
  |  |   45|    386|#define ARG_CHECK(cond) do { \
  |  |   46|    386|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|    386|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 386]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    386|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  142|    386|    ARG_CHECK(tweak32 != NULL);
  ------------------
  |  |   45|    386|#define ARG_CHECK(cond) do { \
  |  |   46|    386|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|    386|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 386]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    386|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  143|       |
  144|    386|    if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
  ------------------
  |  Branch (144:9): [True: 0, False: 386]
  ------------------
  145|    386|        || !secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
  ------------------
  |  Branch (145:12): [True: 0, False: 386]
  ------------------
  146|      0|        return 0;
  147|      0|    }
  148|    386|    secp256k1_fe_normalize_var(&pk.x);
  ------------------
  |  |   80|    386|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  149|    386|    secp256k1_fe_normalize_var(&pk.y);
  ------------------
  |  |   80|    386|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  150|    386|    secp256k1_fe_get_b32(pk_expected32, &pk.x);
  ------------------
  |  |   89|    386|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
  151|       |
  152|    386|    return secp256k1_memcmp_var(&pk_expected32, tweaked_pubkey32, 32) == 0
  ------------------
  |  Branch (152:12): [True: 0, False: 386]
  ------------------
  153|    386|            && secp256k1_fe_is_odd(&pk.y) == tweaked_pk_parity;
  ------------------
  |  |   85|      0|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  |  Branch (153:16): [True: 0, False: 0]
  ------------------
  154|    386|}
secp256k1.c:secp256k1_xonly_pubkey_save:
   18|    794|static SECP256K1_INLINE void secp256k1_xonly_pubkey_save(secp256k1_xonly_pubkey *pubkey, secp256k1_ge *ge) {
   19|    794|    secp256k1_pubkey_save((secp256k1_pubkey *) pubkey, ge);
   20|    794|}
secp256k1.c:secp256k1_xonly_pubkey_load:
   14|    779|static SECP256K1_INLINE int secp256k1_xonly_pubkey_load(const secp256k1_context* ctx, secp256k1_ge *ge, const secp256k1_xonly_pubkey *pubkey) {
   15|    779|    return secp256k1_pubkey_load(ctx, ge, (const secp256k1_pubkey *) pubkey);
   16|    779|}

secp256k1_schnorrsig_verify:
  221|    408|int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_xonly_pubkey *pubkey) {
  222|    408|    secp256k1_scalar s;
  223|    408|    secp256k1_scalar e;
  224|    408|    secp256k1_gej rj;
  225|    408|    secp256k1_ge pk;
  226|    408|    secp256k1_gej pkj;
  227|    408|    secp256k1_fe rx;
  228|    408|    secp256k1_ge r;
  229|    408|    unsigned char buf[32];
  230|    408|    int overflow;
  231|       |
  232|    408|    VERIFY_CHECK(ctx != NULL);
  233|    408|    ARG_CHECK(sig64 != NULL);
  ------------------
  |  |   45|    408|#define ARG_CHECK(cond) do { \
  |  |   46|    408|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|    408|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 408]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    408|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  234|    408|    ARG_CHECK(msg != NULL || msglen == 0);
  ------------------
  |  |   45|    408|#define ARG_CHECK(cond) do { \
  |  |   46|    408|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|    408|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 408]
  |  |  |  |  |  Branch (136:39): [True: 408, False: 0]
  |  |  |  |  |  Branch (136:39): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    408|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  235|    408|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|    408|#define ARG_CHECK(cond) do { \
  |  |   46|    408|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|    408|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 408]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    408|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  236|       |
  237|    408|    if (!secp256k1_fe_set_b32_limit(&rx, &sig64[0])) {
  ------------------
  |  |   88|    408|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  |  Branch (237:9): [True: 6, False: 402]
  ------------------
  238|      6|        return 0;
  239|      6|    }
  240|       |
  241|    402|    secp256k1_scalar_set_b32(&s, &sig64[32], &overflow);
  242|    402|    if (overflow) {
  ------------------
  |  Branch (242:9): [True: 9, False: 393]
  ------------------
  243|      9|        return 0;
  244|      9|    }
  245|       |
  246|    393|    if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
  ------------------
  |  Branch (246:9): [True: 0, False: 393]
  ------------------
  247|      0|        return 0;
  248|      0|    }
  249|       |
  250|       |    /* Compute e. */
  251|    393|    secp256k1_fe_get_b32(buf, &pk.x);
  ------------------
  |  |   89|    393|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
  252|    393|    secp256k1_schnorrsig_challenge(&e, &sig64[0], msg, msglen, buf);
  253|       |
  254|       |    /* Compute rj =  s*G + (-e)*pkj */
  255|    393|    secp256k1_scalar_negate(&e, &e);
  256|    393|    secp256k1_gej_set_ge(&pkj, &pk);
  257|    393|    secp256k1_ecmult(&rj, &pkj, &e, &s);
  258|       |
  259|    393|    secp256k1_ge_set_gej_var(&r, &rj);
  260|    393|    if (secp256k1_ge_is_infinity(&r)) {
  ------------------
  |  Branch (260:9): [True: 0, False: 393]
  ------------------
  261|      0|        return 0;
  262|      0|    }
  263|       |
  264|    393|    secp256k1_fe_normalize_var(&r.y);
  ------------------
  |  |   80|    393|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  265|    393|    return !secp256k1_fe_is_odd(&r.y) &&
  ------------------
  |  |   85|    393|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  |  Branch (265:12): [True: 208, False: 185]
  ------------------
  266|    393|           secp256k1_fe_equal(&rx, &r.x);
  ------------------
  |  Branch (266:12): [True: 0, False: 208]
  ------------------
  267|    393|}
secp256k1.c:secp256k1_schnorrsig_challenge:
  118|    393|{
  119|    393|    unsigned char buf[32];
  120|    393|    secp256k1_sha256 sha;
  121|       |
  122|       |    /* tagged hash(r.x, pk.x, msg) */
  123|    393|    secp256k1_schnorrsig_sha256_tagged(&sha);
  124|    393|    secp256k1_sha256_write(&sha, r32, 32);
  125|    393|    secp256k1_sha256_write(&sha, pubkey32, 32);
  126|    393|    secp256k1_sha256_write(&sha, msg, msglen);
  127|    393|    secp256k1_sha256_finalize(&sha, buf);
  128|       |    /* Set scalar e to the challenge hash modulo the curve order as per
  129|       |     * BIP340. */
  130|    393|    secp256k1_scalar_set_b32(e, buf, NULL);
  131|    393|}
secp256k1.c:secp256k1_schnorrsig_sha256_tagged:
  104|    393|static void secp256k1_schnorrsig_sha256_tagged(secp256k1_sha256 *sha) {
  105|    393|    secp256k1_sha256_initialize(sha);
  106|    393|    sha->s[0] = 0x9cecba11ul;
  107|    393|    sha->s[1] = 0x23925381ul;
  108|    393|    sha->s[2] = 0x11679112ul;
  109|    393|    sha->s[3] = 0xd1627e0ful;
  110|    393|    sha->s[4] = 0x97c87550ul;
  111|    393|    sha->s[5] = 0x003cc765ul;
  112|    393|    sha->s[6] = 0x90f61164ul;
  113|    393|    sha->s[7] = 0x33e9b66aul;
  114|    393|    sha->bytes = 64;
  115|    393|}

secp256k1.c:secp256k1_scalar_set_b32:
  144|   956k|static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
  145|   956k|    int over;
  146|   956k|    r->d[0] = secp256k1_read_be64(&b32[24]);
  147|   956k|    r->d[1] = secp256k1_read_be64(&b32[16]);
  148|   956k|    r->d[2] = secp256k1_read_be64(&b32[8]);
  149|   956k|    r->d[3] = secp256k1_read_be64(&b32[0]);
  150|   956k|    over = secp256k1_scalar_reduce(r, secp256k1_scalar_check_overflow(r));
  151|   956k|    if (overflow) {
  ------------------
  |  Branch (151:9): [True: 738k, False: 218k]
  ------------------
  152|   738k|        *overflow = over;
  153|   738k|    }
  154|       |
  155|   956k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   956k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  156|   956k|}
secp256k1.c:secp256k1_scalar_reduce:
   74|  1.86M|SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, unsigned int overflow) {
   75|  1.86M|    secp256k1_uint128 t;
   76|  1.86M|    VERIFY_CHECK(overflow <= 1);
   77|       |
   78|  1.86M|    secp256k1_u128_from_u64(&t, r->d[0]);
   79|  1.86M|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_0);
  ------------------
  |  |   22|  1.86M|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|  1.86M|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
   80|  1.86M|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   81|  1.86M|    secp256k1_u128_accum_u64(&t, r->d[1]);
   82|  1.86M|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_1);
  ------------------
  |  |   23|  1.86M|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|  1.86M|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
   83|  1.86M|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   84|  1.86M|    secp256k1_u128_accum_u64(&t, r->d[2]);
   85|  1.86M|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_2);
  ------------------
  |  |   24|  1.86M|#define SECP256K1_N_C_2 (1)
  ------------------
   86|  1.86M|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   87|  1.86M|    secp256k1_u128_accum_u64(&t, r->d[3]);
   88|  1.86M|    r->d[3] = secp256k1_u128_to_u64(&t);
   89|       |
   90|  1.86M|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  1.86M|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   91|  1.86M|    return overflow;
   92|  1.86M|}
secp256k1.c:secp256k1_scalar_check_overflow:
   62|  1.86M|SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) {
   63|  1.86M|    int yes = 0;
   64|  1.86M|    int no = 0;
   65|  1.86M|    no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */
  ------------------
  |  |   19|  1.86M|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
   66|  1.86M|    no |= (a->d[2] < SECP256K1_N_2);
  ------------------
  |  |   18|  1.86M|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
   67|  1.86M|    yes |= (a->d[2] > SECP256K1_N_2) & ~no;
  ------------------
  |  |   18|  1.86M|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
   68|  1.86M|    no |= (a->d[1] < SECP256K1_N_1);
  ------------------
  |  |   17|  1.86M|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
   69|  1.86M|    yes |= (a->d[1] > SECP256K1_N_1) & ~no;
  ------------------
  |  |   17|  1.86M|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
   70|  1.86M|    yes |= (a->d[0] >= SECP256K1_N_0) & ~no;
  ------------------
  |  |   16|  1.86M|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
   71|  1.86M|    return yes;
   72|  1.86M|}
secp256k1.c:secp256k1_scalar_get_b32:
  158|   354k|static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
  159|   354k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   354k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  160|       |
  161|   354k|    secp256k1_write_be64(&bin[0],  a->d[3]);
  162|   354k|    secp256k1_write_be64(&bin[8],  a->d[2]);
  163|   354k|    secp256k1_write_be64(&bin[16], a->d[1]);
  164|   354k|    secp256k1_write_be64(&bin[24], a->d[0]);
  165|   354k|}
secp256k1.c:secp256k1_scalar_is_high:
  241|   258k|static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
  242|   258k|    int yes = 0;
  243|   258k|    int no = 0;
  244|   258k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   258k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  245|       |
  246|   258k|    no |= (a->d[3] < SECP256K1_N_H_3);
  ------------------
  |  |   30|   258k|#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
  ------------------
  247|   258k|    yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
  ------------------
  |  |   30|   258k|#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
  ------------------
  248|   258k|    no |= (a->d[2] < SECP256K1_N_H_2) & ~yes; /* No need for a > check. */
  ------------------
  |  |   29|   258k|#define SECP256K1_N_H_2 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  249|   258k|    no |= (a->d[1] < SECP256K1_N_H_1) & ~yes;
  ------------------
  |  |   28|   258k|#define SECP256K1_N_H_1 ((uint64_t)0x5D576E7357A4501DULL)
  ------------------
  250|   258k|    yes |= (a->d[1] > SECP256K1_N_H_1) & ~no;
  ------------------
  |  |   28|   258k|#define SECP256K1_N_H_1 ((uint64_t)0x5D576E7357A4501DULL)
  ------------------
  251|   258k|    yes |= (a->d[0] > SECP256K1_N_H_0) & ~no;
  ------------------
  |  |   27|   258k|#define SECP256K1_N_H_0 ((uint64_t)0xDFE92F46681B20A0ULL)
  ------------------
  252|   258k|    return yes;
  253|   258k|}
secp256k1.c:secp256k1_scalar_negate:
  173|   157k|static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
  174|   157k|    uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (secp256k1_scalar_is_zero(a) == 0);
  175|   157k|    secp256k1_uint128 t;
  176|   157k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   157k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  177|       |
  178|   157k|    secp256k1_u128_from_u64(&t, ~a->d[0]);
  179|   157k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_0 + 1);
  ------------------
  |  |   16|   157k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
  180|   157k|    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  181|   157k|    secp256k1_u128_accum_u64(&t, ~a->d[1]);
  182|   157k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_1);
  ------------------
  |  |   17|   157k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
  183|   157k|    r->d[1] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  184|   157k|    secp256k1_u128_accum_u64(&t, ~a->d[2]);
  185|   157k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_2);
  ------------------
  |  |   18|   157k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
  186|   157k|    r->d[2] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  187|   157k|    secp256k1_u128_accum_u64(&t, ~a->d[3]);
  188|   157k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_3);
  ------------------
  |  |   19|   157k|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  189|   157k|    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
  190|       |
  191|   157k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   157k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  192|   157k|}
secp256k1.c:secp256k1_scalar_inverse_var:
  979|  78.9k|static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *x) {
  980|  78.9k|    secp256k1_modinv64_signed62 s;
  981|       |#ifdef VERIFY
  982|       |    int zero_in = secp256k1_scalar_is_zero(x);
  983|       |#endif
  984|  78.9k|    SECP256K1_SCALAR_VERIFY(x);
  ------------------
  |  |  103|  78.9k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  985|       |
  986|  78.9k|    secp256k1_scalar_to_signed62(&s, x);
  987|  78.9k|    secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_scalar);
  988|  78.9k|    secp256k1_scalar_from_signed62(r, &s);
  989|       |
  990|  78.9k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  78.9k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  991|  78.9k|    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
  992|  78.9k|}
secp256k1.c:secp256k1_scalar_to_signed62:
  947|   148k|static void secp256k1_scalar_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_scalar *a) {
  948|   148k|    const uint64_t M62 = UINT64_MAX >> 2;
  949|   148k|    const uint64_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3];
  950|   148k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   148k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  951|       |
  952|   148k|    r->v[0] =  a0                   & M62;
  953|   148k|    r->v[1] = (a0 >> 62 | a1 <<  2) & M62;
  954|   148k|    r->v[2] = (a1 >> 60 | a2 <<  4) & M62;
  955|   148k|    r->v[3] = (a2 >> 58 | a3 <<  6) & M62;
  956|   148k|    r->v[4] =  a3 >> 56;
  957|   148k|}
secp256k1.c:secp256k1_scalar_from_signed62:
  927|   148k|static void secp256k1_scalar_from_signed62(secp256k1_scalar *r, const secp256k1_modinv64_signed62 *a) {
  928|   148k|    const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
  929|       |
  930|       |    /* The output from secp256k1_modinv64{_var} should be normalized to range [0,modulus), and
  931|       |     * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
  932|       |     */
  933|   148k|    VERIFY_CHECK(a0 >> 62 == 0);
  934|   148k|    VERIFY_CHECK(a1 >> 62 == 0);
  935|   148k|    VERIFY_CHECK(a2 >> 62 == 0);
  936|   148k|    VERIFY_CHECK(a3 >> 62 == 0);
  937|   148k|    VERIFY_CHECK(a4 >> 8 == 0);
  938|       |
  939|   148k|    r->d[0] = a0      | a1 << 62;
  940|   148k|    r->d[1] = a1 >> 2 | a2 << 60;
  941|   148k|    r->d[2] = a2 >> 4 | a3 << 58;
  942|   148k|    r->d[3] = a3 >> 6 | a4 << 56;
  943|       |
  944|   148k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   148k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  945|   148k|}
secp256k1.c:secp256k1_scalar_mul:
  855|   536k|static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
  856|   536k|    uint64_t l[8];
  857|   536k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   536k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  858|   536k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|   536k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  859|       |
  860|   536k|    secp256k1_scalar_mul_512(l, a, b);
  861|   536k|    secp256k1_scalar_reduce_512(r, l);
  862|       |
  863|   536k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   536k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  864|   536k|}
secp256k1.c:secp256k1_scalar_mul_512:
  678|   695k|static void secp256k1_scalar_mul_512(uint64_t *l8, const secp256k1_scalar *a, const secp256k1_scalar *b) {
  679|   695k|#ifdef USE_ASM_X86_64
  680|   695k|    const uint64_t *pb = b->d;
  681|   695k|    __asm__ __volatile__(
  682|       |    /* Preload */
  683|   695k|    "movq 0(%%rdi), %%r15\n"
  684|   695k|    "movq 8(%%rdi), %%rbx\n"
  685|   695k|    "movq 16(%%rdi), %%rcx\n"
  686|   695k|    "movq 0(%%rdx), %%r11\n"
  687|   695k|    "movq 8(%%rdx), %%r12\n"
  688|   695k|    "movq 16(%%rdx), %%r13\n"
  689|   695k|    "movq 24(%%rdx), %%r14\n"
  690|       |    /* (rax,rdx) = a0 * b0 */
  691|   695k|    "movq %%r15, %%rax\n"
  692|   695k|    "mulq %%r11\n"
  693|       |    /* Extract l8[0] */
  694|   695k|    "movq %%rax, 0(%%rsi)\n"
  695|       |    /* (r8,r9,r10) = (rdx) */
  696|   695k|    "movq %%rdx, %%r8\n"
  697|   695k|    "xorq %%r9, %%r9\n"
  698|   695k|    "xorq %%r10, %%r10\n"
  699|       |    /* (r8,r9,r10) += a0 * b1 */
  700|   695k|    "movq %%r15, %%rax\n"
  701|   695k|    "mulq %%r12\n"
  702|   695k|    "addq %%rax, %%r8\n"
  703|   695k|    "adcq %%rdx, %%r9\n"
  704|   695k|    "adcq $0, %%r10\n"
  705|       |    /* (r8,r9,r10) += a1 * b0 */
  706|   695k|    "movq %%rbx, %%rax\n"
  707|   695k|    "mulq %%r11\n"
  708|   695k|    "addq %%rax, %%r8\n"
  709|   695k|    "adcq %%rdx, %%r9\n"
  710|   695k|    "adcq $0, %%r10\n"
  711|       |    /* Extract l8[1] */
  712|   695k|    "movq %%r8, 8(%%rsi)\n"
  713|   695k|    "xorq %%r8, %%r8\n"
  714|       |    /* (r9,r10,r8) += a0 * b2 */
  715|   695k|    "movq %%r15, %%rax\n"
  716|   695k|    "mulq %%r13\n"
  717|   695k|    "addq %%rax, %%r9\n"
  718|   695k|    "adcq %%rdx, %%r10\n"
  719|   695k|    "adcq $0, %%r8\n"
  720|       |    /* (r9,r10,r8) += a1 * b1 */
  721|   695k|    "movq %%rbx, %%rax\n"
  722|   695k|    "mulq %%r12\n"
  723|   695k|    "addq %%rax, %%r9\n"
  724|   695k|    "adcq %%rdx, %%r10\n"
  725|   695k|    "adcq $0, %%r8\n"
  726|       |    /* (r9,r10,r8) += a2 * b0 */
  727|   695k|    "movq %%rcx, %%rax\n"
  728|   695k|    "mulq %%r11\n"
  729|   695k|    "addq %%rax, %%r9\n"
  730|   695k|    "adcq %%rdx, %%r10\n"
  731|   695k|    "adcq $0, %%r8\n"
  732|       |    /* Extract l8[2] */
  733|   695k|    "movq %%r9, 16(%%rsi)\n"
  734|   695k|    "xorq %%r9, %%r9\n"
  735|       |    /* (r10,r8,r9) += a0 * b3 */
  736|   695k|    "movq %%r15, %%rax\n"
  737|   695k|    "mulq %%r14\n"
  738|   695k|    "addq %%rax, %%r10\n"
  739|   695k|    "adcq %%rdx, %%r8\n"
  740|   695k|    "adcq $0, %%r9\n"
  741|       |    /* Preload a3 */
  742|   695k|    "movq 24(%%rdi), %%r15\n"
  743|       |    /* (r10,r8,r9) += a1 * b2 */
  744|   695k|    "movq %%rbx, %%rax\n"
  745|   695k|    "mulq %%r13\n"
  746|   695k|    "addq %%rax, %%r10\n"
  747|   695k|    "adcq %%rdx, %%r8\n"
  748|   695k|    "adcq $0, %%r9\n"
  749|       |    /* (r10,r8,r9) += a2 * b1 */
  750|   695k|    "movq %%rcx, %%rax\n"
  751|   695k|    "mulq %%r12\n"
  752|   695k|    "addq %%rax, %%r10\n"
  753|   695k|    "adcq %%rdx, %%r8\n"
  754|   695k|    "adcq $0, %%r9\n"
  755|       |    /* (r10,r8,r9) += a3 * b0 */
  756|   695k|    "movq %%r15, %%rax\n"
  757|   695k|    "mulq %%r11\n"
  758|   695k|    "addq %%rax, %%r10\n"
  759|   695k|    "adcq %%rdx, %%r8\n"
  760|   695k|    "adcq $0, %%r9\n"
  761|       |    /* Extract l8[3] */
  762|   695k|    "movq %%r10, 24(%%rsi)\n"
  763|   695k|    "xorq %%r10, %%r10\n"
  764|       |    /* (r8,r9,r10) += a1 * b3 */
  765|   695k|    "movq %%rbx, %%rax\n"
  766|   695k|    "mulq %%r14\n"
  767|   695k|    "addq %%rax, %%r8\n"
  768|   695k|    "adcq %%rdx, %%r9\n"
  769|   695k|    "adcq $0, %%r10\n"
  770|       |    /* (r8,r9,r10) += a2 * b2 */
  771|   695k|    "movq %%rcx, %%rax\n"
  772|   695k|    "mulq %%r13\n"
  773|   695k|    "addq %%rax, %%r8\n"
  774|   695k|    "adcq %%rdx, %%r9\n"
  775|   695k|    "adcq $0, %%r10\n"
  776|       |    /* (r8,r9,r10) += a3 * b1 */
  777|   695k|    "movq %%r15, %%rax\n"
  778|   695k|    "mulq %%r12\n"
  779|   695k|    "addq %%rax, %%r8\n"
  780|   695k|    "adcq %%rdx, %%r9\n"
  781|   695k|    "adcq $0, %%r10\n"
  782|       |    /* Extract l8[4] */
  783|   695k|    "movq %%r8, 32(%%rsi)\n"
  784|   695k|    "xorq %%r8, %%r8\n"
  785|       |    /* (r9,r10,r8) += a2 * b3 */
  786|   695k|    "movq %%rcx, %%rax\n"
  787|   695k|    "mulq %%r14\n"
  788|   695k|    "addq %%rax, %%r9\n"
  789|   695k|    "adcq %%rdx, %%r10\n"
  790|   695k|    "adcq $0, %%r8\n"
  791|       |    /* (r9,r10,r8) += a3 * b2 */
  792|   695k|    "movq %%r15, %%rax\n"
  793|   695k|    "mulq %%r13\n"
  794|   695k|    "addq %%rax, %%r9\n"
  795|   695k|    "adcq %%rdx, %%r10\n"
  796|   695k|    "adcq $0, %%r8\n"
  797|       |    /* Extract l8[5] */
  798|   695k|    "movq %%r9, 40(%%rsi)\n"
  799|       |    /* (r10,r8) += a3 * b3 */
  800|   695k|    "movq %%r15, %%rax\n"
  801|   695k|    "mulq %%r14\n"
  802|   695k|    "addq %%rax, %%r10\n"
  803|   695k|    "adcq %%rdx, %%r8\n"
  804|       |    /* Extract l8[6] */
  805|   695k|    "movq %%r10, 48(%%rsi)\n"
  806|       |    /* Extract l8[7] */
  807|   695k|    "movq %%r8, 56(%%rsi)\n"
  808|   695k|    : "+d"(pb)
  809|   695k|    : "S"(l8), "D"(a->d)
  810|   695k|    : "rax", "rbx", "rcx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory");
  811|       |
  812|   695k|    SECP256K1_CHECKMEM_MSAN_DEFINE(l8, sizeof(*l8) * 8);
  ------------------
  |  |   60|   695k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   695k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  813|       |
  814|       |#else
  815|       |    /* 160 bit accumulator. */
  816|       |    uint64_t c0 = 0, c1 = 0;
  817|       |    uint32_t c2 = 0;
  818|       |
  819|       |    /* l8[0..7] = a[0..3] * b[0..3]. */
  820|       |    muladd_fast(a->d[0], b->d[0]);
  821|       |    extract_fast(l8[0]);
  822|       |    muladd(a->d[0], b->d[1]);
  823|       |    muladd(a->d[1], b->d[0]);
  824|       |    extract(l8[1]);
  825|       |    muladd(a->d[0], b->d[2]);
  826|       |    muladd(a->d[1], b->d[1]);
  827|       |    muladd(a->d[2], b->d[0]);
  828|       |    extract(l8[2]);
  829|       |    muladd(a->d[0], b->d[3]);
  830|       |    muladd(a->d[1], b->d[2]);
  831|       |    muladd(a->d[2], b->d[1]);
  832|       |    muladd(a->d[3], b->d[0]);
  833|       |    extract(l8[3]);
  834|       |    muladd(a->d[1], b->d[3]);
  835|       |    muladd(a->d[2], b->d[2]);
  836|       |    muladd(a->d[3], b->d[1]);
  837|       |    extract(l8[4]);
  838|       |    muladd(a->d[2], b->d[3]);
  839|       |    muladd(a->d[3], b->d[2]);
  840|       |    extract(l8[5]);
  841|       |    muladd_fast(a->d[3], b->d[3]);
  842|       |    extract_fast(l8[6]);
  843|       |    VERIFY_CHECK(c1 == 0);
  844|       |    l8[7] = c0;
  845|       |#endif
  846|   695k|}
secp256k1.c:secp256k1_scalar_reduce_512:
  347|   536k|static void secp256k1_scalar_reduce_512(secp256k1_scalar *r, const uint64_t *l) {
  348|   536k|#ifdef USE_ASM_X86_64
  349|       |    /* Reduce 512 bits into 385. */
  350|   536k|    uint64_t m0, m1, m2, m3, m4, m5, m6;
  351|   536k|    uint64_t p0, p1, p2, p3, p4;
  352|   536k|    uint64_t c;
  353|       |
  354|   536k|    __asm__ __volatile__(
  355|       |    /* Preload. */
  356|   536k|    "movq 32(%%rsi), %%r11\n"
  357|   536k|    "movq 40(%%rsi), %%r12\n"
  358|   536k|    "movq 48(%%rsi), %%r13\n"
  359|   536k|    "movq 56(%%rsi), %%r14\n"
  360|       |    /* Initialize r8,r9,r10 */
  361|   536k|    "movq 0(%%rsi), %%r8\n"
  362|   536k|    "xorq %%r9, %%r9\n"
  363|   536k|    "xorq %%r10, %%r10\n"
  364|       |    /* (r8,r9) += n0 * c0 */
  365|   536k|    "movq %8, %%rax\n"
  366|   536k|    "mulq %%r11\n"
  367|   536k|    "addq %%rax, %%r8\n"
  368|   536k|    "adcq %%rdx, %%r9\n"
  369|       |    /* extract m0 */
  370|   536k|    "movq %%r8, %q0\n"
  371|   536k|    "xorq %%r8, %%r8\n"
  372|       |    /* (r9,r10) += l1 */
  373|   536k|    "addq 8(%%rsi), %%r9\n"
  374|   536k|    "adcq $0, %%r10\n"
  375|       |    /* (r9,r10,r8) += n1 * c0 */
  376|   536k|    "movq %8, %%rax\n"
  377|   536k|    "mulq %%r12\n"
  378|   536k|    "addq %%rax, %%r9\n"
  379|   536k|    "adcq %%rdx, %%r10\n"
  380|   536k|    "adcq $0, %%r8\n"
  381|       |    /* (r9,r10,r8) += n0 * c1 */
  382|   536k|    "movq %9, %%rax\n"
  383|   536k|    "mulq %%r11\n"
  384|   536k|    "addq %%rax, %%r9\n"
  385|   536k|    "adcq %%rdx, %%r10\n"
  386|   536k|    "adcq $0, %%r8\n"
  387|       |    /* extract m1 */
  388|   536k|    "movq %%r9, %q1\n"
  389|   536k|    "xorq %%r9, %%r9\n"
  390|       |    /* (r10,r8,r9) += l2 */
  391|   536k|    "addq 16(%%rsi), %%r10\n"
  392|   536k|    "adcq $0, %%r8\n"
  393|   536k|    "adcq $0, %%r9\n"
  394|       |    /* (r10,r8,r9) += n2 * c0 */
  395|   536k|    "movq %8, %%rax\n"
  396|   536k|    "mulq %%r13\n"
  397|   536k|    "addq %%rax, %%r10\n"
  398|   536k|    "adcq %%rdx, %%r8\n"
  399|   536k|    "adcq $0, %%r9\n"
  400|       |    /* (r10,r8,r9) += n1 * c1 */
  401|   536k|    "movq %9, %%rax\n"
  402|   536k|    "mulq %%r12\n"
  403|   536k|    "addq %%rax, %%r10\n"
  404|   536k|    "adcq %%rdx, %%r8\n"
  405|   536k|    "adcq $0, %%r9\n"
  406|       |    /* (r10,r8,r9) += n0 */
  407|   536k|    "addq %%r11, %%r10\n"
  408|   536k|    "adcq $0, %%r8\n"
  409|   536k|    "adcq $0, %%r9\n"
  410|       |    /* extract m2 */
  411|   536k|    "movq %%r10, %q2\n"
  412|   536k|    "xorq %%r10, %%r10\n"
  413|       |    /* (r8,r9,r10) += l3 */
  414|   536k|    "addq 24(%%rsi), %%r8\n"
  415|   536k|    "adcq $0, %%r9\n"
  416|   536k|    "adcq $0, %%r10\n"
  417|       |    /* (r8,r9,r10) += n3 * c0 */
  418|   536k|    "movq %8, %%rax\n"
  419|   536k|    "mulq %%r14\n"
  420|   536k|    "addq %%rax, %%r8\n"
  421|   536k|    "adcq %%rdx, %%r9\n"
  422|   536k|    "adcq $0, %%r10\n"
  423|       |    /* (r8,r9,r10) += n2 * c1 */
  424|   536k|    "movq %9, %%rax\n"
  425|   536k|    "mulq %%r13\n"
  426|   536k|    "addq %%rax, %%r8\n"
  427|   536k|    "adcq %%rdx, %%r9\n"
  428|   536k|    "adcq $0, %%r10\n"
  429|       |    /* (r8,r9,r10) += n1 */
  430|   536k|    "addq %%r12, %%r8\n"
  431|   536k|    "adcq $0, %%r9\n"
  432|   536k|    "adcq $0, %%r10\n"
  433|       |    /* extract m3 */
  434|   536k|    "movq %%r8, %q3\n"
  435|   536k|    "xorq %%r8, %%r8\n"
  436|       |    /* (r9,r10,r8) += n3 * c1 */
  437|   536k|    "movq %9, %%rax\n"
  438|   536k|    "mulq %%r14\n"
  439|   536k|    "addq %%rax, %%r9\n"
  440|   536k|    "adcq %%rdx, %%r10\n"
  441|   536k|    "adcq $0, %%r8\n"
  442|       |    /* (r9,r10,r8) += n2 */
  443|   536k|    "addq %%r13, %%r9\n"
  444|   536k|    "adcq $0, %%r10\n"
  445|   536k|    "adcq $0, %%r8\n"
  446|       |    /* extract m4 */
  447|   536k|    "movq %%r9, %q4\n"
  448|       |    /* (r10,r8) += n3 */
  449|   536k|    "addq %%r14, %%r10\n"
  450|   536k|    "adcq $0, %%r8\n"
  451|       |    /* extract m5 */
  452|   536k|    "movq %%r10, %q5\n"
  453|       |    /* extract m6 */
  454|   536k|    "movq %%r8, %q6\n"
  455|   536k|    : "=&g"(m0), "=&g"(m1), "=&g"(m2), "=g"(m3), "=g"(m4), "=g"(m5), "=g"(m6)
  456|   536k|    : "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   536k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   536k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   536k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   536k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  457|   536k|    : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc");
  458|       |
  459|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m0, sizeof(m0));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  460|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m1, sizeof(m1));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  461|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m2, sizeof(m2));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  462|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m3, sizeof(m3));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  463|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m4, sizeof(m4));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  464|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m5, sizeof(m5));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  465|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m6, sizeof(m6));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  466|       |
  467|       |    /* Reduce 385 bits into 258. */
  468|   536k|    __asm__ __volatile__(
  469|       |    /* Preload */
  470|   536k|    "movq %q9, %%r11\n"
  471|   536k|    "movq %q10, %%r12\n"
  472|   536k|    "movq %q11, %%r13\n"
  473|       |    /* Initialize (r8,r9,r10) */
  474|   536k|    "movq %q5, %%r8\n"
  475|   536k|    "xorq %%r9, %%r9\n"
  476|   536k|    "xorq %%r10, %%r10\n"
  477|       |    /* (r8,r9) += m4 * c0 */
  478|   536k|    "movq %12, %%rax\n"
  479|   536k|    "mulq %%r11\n"
  480|   536k|    "addq %%rax, %%r8\n"
  481|   536k|    "adcq %%rdx, %%r9\n"
  482|       |    /* extract p0 */
  483|   536k|    "movq %%r8, %q0\n"
  484|   536k|    "xorq %%r8, %%r8\n"
  485|       |    /* (r9,r10) += m1 */
  486|   536k|    "addq %q6, %%r9\n"
  487|   536k|    "adcq $0, %%r10\n"
  488|       |    /* (r9,r10,r8) += m5 * c0 */
  489|   536k|    "movq %12, %%rax\n"
  490|   536k|    "mulq %%r12\n"
  491|   536k|    "addq %%rax, %%r9\n"
  492|   536k|    "adcq %%rdx, %%r10\n"
  493|   536k|    "adcq $0, %%r8\n"
  494|       |    /* (r9,r10,r8) += m4 * c1 */
  495|   536k|    "movq %13, %%rax\n"
  496|   536k|    "mulq %%r11\n"
  497|   536k|    "addq %%rax, %%r9\n"
  498|   536k|    "adcq %%rdx, %%r10\n"
  499|   536k|    "adcq $0, %%r8\n"
  500|       |    /* extract p1 */
  501|   536k|    "movq %%r9, %q1\n"
  502|   536k|    "xorq %%r9, %%r9\n"
  503|       |    /* (r10,r8,r9) += m2 */
  504|   536k|    "addq %q7, %%r10\n"
  505|   536k|    "adcq $0, %%r8\n"
  506|   536k|    "adcq $0, %%r9\n"
  507|       |    /* (r10,r8,r9) += m6 * c0 */
  508|   536k|    "movq %12, %%rax\n"
  509|   536k|    "mulq %%r13\n"
  510|   536k|    "addq %%rax, %%r10\n"
  511|   536k|    "adcq %%rdx, %%r8\n"
  512|   536k|    "adcq $0, %%r9\n"
  513|       |    /* (r10,r8,r9) += m5 * c1 */
  514|   536k|    "movq %13, %%rax\n"
  515|   536k|    "mulq %%r12\n"
  516|   536k|    "addq %%rax, %%r10\n"
  517|   536k|    "adcq %%rdx, %%r8\n"
  518|   536k|    "adcq $0, %%r9\n"
  519|       |    /* (r10,r8,r9) += m4 */
  520|   536k|    "addq %%r11, %%r10\n"
  521|   536k|    "adcq $0, %%r8\n"
  522|   536k|    "adcq $0, %%r9\n"
  523|       |    /* extract p2 */
  524|   536k|    "movq %%r10, %q2\n"
  525|       |    /* (r8,r9) += m3 */
  526|   536k|    "addq %q8, %%r8\n"
  527|   536k|    "adcq $0, %%r9\n"
  528|       |    /* (r8,r9) += m6 * c1 */
  529|   536k|    "movq %13, %%rax\n"
  530|   536k|    "mulq %%r13\n"
  531|   536k|    "addq %%rax, %%r8\n"
  532|   536k|    "adcq %%rdx, %%r9\n"
  533|       |    /* (r8,r9) += m5 */
  534|   536k|    "addq %%r12, %%r8\n"
  535|   536k|    "adcq $0, %%r9\n"
  536|       |    /* extract p3 */
  537|   536k|    "movq %%r8, %q3\n"
  538|       |    /* (r9) += m6 */
  539|   536k|    "addq %%r13, %%r9\n"
  540|       |    /* extract p4 */
  541|   536k|    "movq %%r9, %q4\n"
  542|   536k|    : "=&g"(p0), "=&g"(p1), "=&g"(p2), "=g"(p3), "=g"(p4)
  543|   536k|    : "g"(m0), "g"(m1), "g"(m2), "g"(m3), "g"(m4), "g"(m5), "g"(m6), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   536k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   536k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "g"(m0), "g"(m1), "g"(m2), "g"(m3), "g"(m4), "g"(m5), "g"(m6), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   536k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   536k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  544|   536k|    : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc");
  545|       |
  546|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p0, sizeof(p0));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  547|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p1, sizeof(p1));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  548|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p2, sizeof(p2));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  549|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p3, sizeof(p3));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  550|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p4, sizeof(p4));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  551|       |
  552|       |    /* Reduce 258 bits into 256. */
  553|   536k|    __asm__ __volatile__(
  554|       |    /* Preload */
  555|   536k|    "movq %q5, %%r10\n"
  556|       |    /* (rax,rdx) = p4 * c0 */
  557|   536k|    "movq %7, %%rax\n"
  558|   536k|    "mulq %%r10\n"
  559|       |    /* (rax,rdx) += p0 */
  560|   536k|    "addq %q1, %%rax\n"
  561|   536k|    "adcq $0, %%rdx\n"
  562|       |    /* extract r0 */
  563|   536k|    "movq %%rax, 0(%q6)\n"
  564|       |    /* Move to (r8,r9) */
  565|   536k|    "movq %%rdx, %%r8\n"
  566|   536k|    "xorq %%r9, %%r9\n"
  567|       |    /* (r8,r9) += p1 */
  568|   536k|    "addq %q2, %%r8\n"
  569|   536k|    "adcq $0, %%r9\n"
  570|       |    /* (r8,r9) += p4 * c1 */
  571|   536k|    "movq %8, %%rax\n"
  572|   536k|    "mulq %%r10\n"
  573|   536k|    "addq %%rax, %%r8\n"
  574|   536k|    "adcq %%rdx, %%r9\n"
  575|       |    /* Extract r1 */
  576|   536k|    "movq %%r8, 8(%q6)\n"
  577|   536k|    "xorq %%r8, %%r8\n"
  578|       |    /* (r9,r8) += p4 */
  579|   536k|    "addq %%r10, %%r9\n"
  580|   536k|    "adcq $0, %%r8\n"
  581|       |    /* (r9,r8) += p2 */
  582|   536k|    "addq %q3, %%r9\n"
  583|   536k|    "adcq $0, %%r8\n"
  584|       |    /* Extract r2 */
  585|   536k|    "movq %%r9, 16(%q6)\n"
  586|   536k|    "xorq %%r9, %%r9\n"
  587|       |    /* (r8,r9) += p3 */
  588|   536k|    "addq %q4, %%r8\n"
  589|   536k|    "adcq $0, %%r9\n"
  590|       |    /* Extract r3 */
  591|   536k|    "movq %%r8, 24(%q6)\n"
  592|       |    /* Extract c */
  593|   536k|    "movq %%r9, %q0\n"
  594|   536k|    : "=g"(c)
  595|   536k|    : "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   536k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   536k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   536k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   536k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  596|   536k|    : "rax", "rdx", "r8", "r9", "r10", "cc", "memory");
  597|       |
  598|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(r, sizeof(*r));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  599|   536k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&c, sizeof(c));
  ------------------
  |  |   60|   536k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   536k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  600|       |
  601|       |#else
  602|       |    secp256k1_uint128 c128;
  603|       |    uint64_t c, c0, c1, c2;
  604|       |    uint64_t n0 = l[4], n1 = l[5], n2 = l[6], n3 = l[7];
  605|       |    uint64_t m0, m1, m2, m3, m4, m5;
  606|       |    uint32_t m6;
  607|       |    uint64_t p0, p1, p2, p3;
  608|       |    uint32_t p4;
  609|       |
  610|       |    /* Reduce 512 bits into 385. */
  611|       |    /* m[0..6] = l[0..3] + n[0..3] * SECP256K1_N_C. */
  612|       |    c0 = l[0]; c1 = 0; c2 = 0;
  613|       |    muladd_fast(n0, SECP256K1_N_C_0);
  614|       |    extract_fast(m0);
  615|       |    sumadd_fast(l[1]);
  616|       |    muladd(n1, SECP256K1_N_C_0);
  617|       |    muladd(n0, SECP256K1_N_C_1);
  618|       |    extract(m1);
  619|       |    sumadd(l[2]);
  620|       |    muladd(n2, SECP256K1_N_C_0);
  621|       |    muladd(n1, SECP256K1_N_C_1);
  622|       |    sumadd(n0);
  623|       |    extract(m2);
  624|       |    sumadd(l[3]);
  625|       |    muladd(n3, SECP256K1_N_C_0);
  626|       |    muladd(n2, SECP256K1_N_C_1);
  627|       |    sumadd(n1);
  628|       |    extract(m3);
  629|       |    muladd(n3, SECP256K1_N_C_1);
  630|       |    sumadd(n2);
  631|       |    extract(m4);
  632|       |    sumadd_fast(n3);
  633|       |    extract_fast(m5);
  634|       |    VERIFY_CHECK(c0 <= 1);
  635|       |    m6 = c0;
  636|       |
  637|       |    /* Reduce 385 bits into 258. */
  638|       |    /* p[0..4] = m[0..3] + m[4..6] * SECP256K1_N_C. */
  639|       |    c0 = m0; c1 = 0; c2 = 0;
  640|       |    muladd_fast(m4, SECP256K1_N_C_0);
  641|       |    extract_fast(p0);
  642|       |    sumadd_fast(m1);
  643|       |    muladd(m5, SECP256K1_N_C_0);
  644|       |    muladd(m4, SECP256K1_N_C_1);
  645|       |    extract(p1);
  646|       |    sumadd(m2);
  647|       |    muladd(m6, SECP256K1_N_C_0);
  648|       |    muladd(m5, SECP256K1_N_C_1);
  649|       |    sumadd(m4);
  650|       |    extract(p2);
  651|       |    sumadd_fast(m3);
  652|       |    muladd_fast(m6, SECP256K1_N_C_1);
  653|       |    sumadd_fast(m5);
  654|       |    extract_fast(p3);
  655|       |    p4 = c0 + m6;
  656|       |    VERIFY_CHECK(p4 <= 2);
  657|       |
  658|       |    /* Reduce 258 bits into 256. */
  659|       |    /* r[0..3] = p[0..3] + p[4] * SECP256K1_N_C. */
  660|       |    secp256k1_u128_from_u64(&c128, p0);
  661|       |    secp256k1_u128_accum_mul(&c128, SECP256K1_N_C_0, p4);
  662|       |    r->d[0] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  663|       |    secp256k1_u128_accum_u64(&c128, p1);
  664|       |    secp256k1_u128_accum_mul(&c128, SECP256K1_N_C_1, p4);
  665|       |    r->d[1] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  666|       |    secp256k1_u128_accum_u64(&c128, p2);
  667|       |    secp256k1_u128_accum_u64(&c128, p4);
  668|       |    r->d[2] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  669|       |    secp256k1_u128_accum_u64(&c128, p3);
  670|       |    r->d[3] = secp256k1_u128_to_u64(&c128);
  671|       |    c = secp256k1_u128_hi_u64(&c128);
  672|       |#endif
  673|       |
  674|       |    /* Final reduction of r. */
  675|   536k|    secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
  676|   536k|}
secp256k1.c:secp256k1_scalar_get_bits_limb32:
   41|  15.5M|SECP256K1_INLINE static uint32_t secp256k1_scalar_get_bits_limb32(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
   42|  15.5M|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  15.5M|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   43|  15.5M|    VERIFY_CHECK(count > 0 && count <= 32);
   44|  15.5M|    VERIFY_CHECK((offset + count - 1) >> 6 == offset >> 6);
   45|       |
   46|  15.5M|    return (a->d[offset >> 6] >> (offset & 0x3F)) & (0xFFFFFFFF >> (32 - count));
   47|  15.5M|}
secp256k1.c:secp256k1_scalar_add:
   94|   376k|static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
   95|   376k|    int overflow;
   96|   376k|    secp256k1_uint128 t;
   97|   376k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   376k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   98|   376k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|   376k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   99|       |
  100|   376k|    secp256k1_u128_from_u64(&t, a->d[0]);
  101|   376k|    secp256k1_u128_accum_u64(&t, b->d[0]);
  102|   376k|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  103|   376k|    secp256k1_u128_accum_u64(&t, a->d[1]);
  104|   376k|    secp256k1_u128_accum_u64(&t, b->d[1]);
  105|   376k|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  106|   376k|    secp256k1_u128_accum_u64(&t, a->d[2]);
  107|   376k|    secp256k1_u128_accum_u64(&t, b->d[2]);
  108|   376k|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  109|   376k|    secp256k1_u128_accum_u64(&t, a->d[3]);
  110|   376k|    secp256k1_u128_accum_u64(&t, b->d[3]);
  111|   376k|    r->d[3] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  112|   376k|    overflow = secp256k1_u128_to_u64(&t) + secp256k1_scalar_check_overflow(r);
  113|   376k|    VERIFY_CHECK(overflow == 0 || overflow == 1);
  114|   376k|    secp256k1_scalar_reduce(r, overflow);
  115|       |
  116|   376k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   376k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  117|   376k|    return overflow;
  118|   376k|}
secp256k1.c:secp256k1_scalar_inverse:
  964|  69.6k|static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *x) {
  965|  69.6k|    secp256k1_modinv64_signed62 s;
  966|       |#ifdef VERIFY
  967|       |    int zero_in = secp256k1_scalar_is_zero(x);
  968|       |#endif
  969|  69.6k|    SECP256K1_SCALAR_VERIFY(x);
  ------------------
  |  |  103|  69.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  970|       |
  971|  69.6k|    secp256k1_scalar_to_signed62(&s, x);
  972|  69.6k|    secp256k1_modinv64(&s, &secp256k1_const_modinfo_scalar);
  973|  69.6k|    secp256k1_scalar_from_signed62(r, &s);
  974|       |
  975|  69.6k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  69.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  976|  69.6k|    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
  977|  69.6k|}
secp256k1.c:secp256k1_scalar_cond_negate:
  255|  69.6k|static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
  256|       |    /* If we are flag = 0, mask = 00...00 and this is a no-op;
  257|       |     * if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */
  258|  69.6k|    volatile int vflag = flag;
  259|  69.6k|    uint64_t mask = -vflag;
  260|  69.6k|    uint64_t nonzero = (secp256k1_scalar_is_zero(r) != 0) - 1;
  261|  69.6k|    secp256k1_uint128 t;
  262|  69.6k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  69.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  263|       |
  264|  69.6k|    secp256k1_u128_from_u64(&t, r->d[0] ^ mask);
  265|  69.6k|    secp256k1_u128_accum_u64(&t, (SECP256K1_N_0 + 1) & mask);
  ------------------
  |  |   16|  69.6k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
  266|  69.6k|    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  267|  69.6k|    secp256k1_u128_accum_u64(&t, r->d[1] ^ mask);
  268|  69.6k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_1 & mask);
  ------------------
  |  |   17|  69.6k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
  269|  69.6k|    r->d[1] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  270|  69.6k|    secp256k1_u128_accum_u64(&t, r->d[2] ^ mask);
  271|  69.6k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_2 & mask);
  ------------------
  |  |   18|  69.6k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
  272|  69.6k|    r->d[2] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  273|  69.6k|    secp256k1_u128_accum_u64(&t, r->d[3] ^ mask);
  274|  69.6k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_3 & mask);
  ------------------
  |  |   19|  69.6k|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  275|  69.6k|    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
  276|       |
  277|  69.6k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  69.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  278|  69.6k|    return 2 * (mask == 0) - 1;
  279|  69.6k|}
secp256k1.c:secp256k1_scalar_cmov:
  911|   286k|static SECP256K1_INLINE void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag) {
  912|   286k|    uint64_t mask0, mask1;
  913|   286k|    volatile int vflag = flag;
  914|   286k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   286k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  915|   286k|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->d, sizeof(r->d));
  ------------------
  |  |   99|   286k|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   286k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  916|       |
  917|   286k|    mask0 = vflag + ~((uint64_t)0);
  918|   286k|    mask1 = ~mask0;
  919|   286k|    r->d[0] = (r->d[0] & mask0) | (a->d[0] & mask1);
  920|   286k|    r->d[1] = (r->d[1] & mask0) | (a->d[1] & mask1);
  921|   286k|    r->d[2] = (r->d[2] & mask0) | (a->d[2] & mask1);
  922|   286k|    r->d[3] = (r->d[3] & mask0) | (a->d[3] & mask1);
  923|       |
  924|   286k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   286k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  925|   286k|}
secp256k1.c:secp256k1_scalar_mul_shift_var:
  889|   159k|SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift) {
  890|   159k|    uint64_t l[8];
  891|   159k|    unsigned int shiftlimbs;
  892|   159k|    unsigned int shiftlow;
  893|   159k|    unsigned int shifthigh;
  894|   159k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   159k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  895|   159k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|   159k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  896|   159k|    VERIFY_CHECK(shift >= 256);
  897|       |
  898|   159k|    secp256k1_scalar_mul_512(l, a, b);
  899|   159k|    shiftlimbs = shift >> 6;
  900|   159k|    shiftlow = shift & 0x3F;
  901|   159k|    shifthigh = 64 - shiftlow;
  902|   159k|    r->d[0] = shift < 512 ? (l[0 + shiftlimbs] >> shiftlow | (shift < 448 && shiftlow ? (l[1 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (902:15): [True: 159k, False: 0]
  |  Branch (902:63): [True: 159k, False: 0]
  |  Branch (902:78): [True: 0, False: 159k]
  ------------------
  903|   159k|    r->d[1] = shift < 448 ? (l[1 + shiftlimbs] >> shiftlow | (shift < 384 && shiftlow ? (l[2 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (903:15): [True: 159k, False: 0]
  |  Branch (903:63): [True: 0, False: 159k]
  |  Branch (903:78): [True: 0, False: 0]
  ------------------
  904|   159k|    r->d[2] = shift < 384 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (904:15): [True: 0, False: 159k]
  |  Branch (904:63): [True: 0, False: 0]
  |  Branch (904:78): [True: 0, False: 0]
  ------------------
  905|   159k|    r->d[3] = shift < 320 ? (l[3 + shiftlimbs] >> shiftlow) : 0;
  ------------------
  |  Branch (905:15): [True: 0, False: 159k]
  ------------------
  906|   159k|    secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
  907|       |
  908|   159k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   159k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  909|   159k|}
secp256k1.c:secp256k1_scalar_cadd_bit:
  120|   159k|static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
  121|   159k|    secp256k1_uint128 t;
  122|   159k|    volatile int vflag = flag;
  123|   159k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   159k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  124|   159k|    VERIFY_CHECK(bit < 256);
  125|       |
  126|   159k|    bit += ((uint32_t) vflag - 1) & 0x100;  /* forcing (bit >> 6) > 3 makes this a noop */
  127|   159k|    secp256k1_u128_from_u64(&t, r->d[0]);
  128|   159k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 0)) << (bit & 0x3F));
  129|   159k|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  130|   159k|    secp256k1_u128_accum_u64(&t, r->d[1]);
  131|   159k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 1)) << (bit & 0x3F));
  132|   159k|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  133|   159k|    secp256k1_u128_accum_u64(&t, r->d[2]);
  134|   159k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 2)) << (bit & 0x3F));
  135|   159k|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  136|   159k|    secp256k1_u128_accum_u64(&t, r->d[3]);
  137|   159k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 3)) << (bit & 0x3F));
  138|   159k|    r->d[3] = secp256k1_u128_to_u64(&t);
  139|       |
  140|   159k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   159k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  141|   159k|    VERIFY_CHECK(secp256k1_u128_hi_u64(&t) == 0);
  142|   159k|}
secp256k1.c:secp256k1_scalar_get_bits_var:
   49|  4.78M|SECP256K1_INLINE static uint32_t secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
   50|  4.78M|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  4.78M|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   51|  4.78M|    VERIFY_CHECK(count > 0 && count <= 32);
   52|  4.78M|    VERIFY_CHECK(offset + count <= 256);
   53|       |
   54|  4.78M|    if ((offset + count - 1) >> 6 == offset >> 6) {
  ------------------
  |  Branch (54:9): [True: 4.33M, False: 454k]
  ------------------
   55|  4.33M|        return secp256k1_scalar_get_bits_limb32(a, offset, count);
   56|  4.33M|    } else {
   57|   454k|        VERIFY_CHECK((offset >> 6) + 1 < 4);
   58|   454k|        return ((a->d[offset >> 6] >> (offset & 0x3F)) | (a->d[(offset >> 6) + 1] << (64 - (offset & 0x3F)))) & (0xFFFFFFFF >> (32 - count));
   59|   454k|    }
   60|  4.78M|}
secp256k1.c:secp256k1_scalar_split_128:
  866|  79.6k|static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *k) {
  867|  79.6k|    SECP256K1_SCALAR_VERIFY(k);
  ------------------
  |  |  103|  79.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  868|       |
  869|  79.6k|    r1->d[0] = k->d[0];
  870|  79.6k|    r1->d[1] = k->d[1];
  871|  79.6k|    r1->d[2] = 0;
  872|  79.6k|    r1->d[3] = 0;
  873|  79.6k|    r2->d[0] = k->d[2];
  874|  79.6k|    r2->d[1] = k->d[3];
  875|  79.6k|    r2->d[2] = 0;
  876|  79.6k|    r2->d[3] = 0;
  877|       |
  878|  79.6k|    SECP256K1_SCALAR_VERIFY(r1);
  ------------------
  |  |  103|  79.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  879|  79.6k|    SECP256K1_SCALAR_VERIFY(r2);
  ------------------
  |  |  103|  79.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  880|  79.6k|}
secp256k1.c:secp256k1_scalar_is_zero:
  167|   832k|SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
  168|   832k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   832k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  169|       |
  170|   832k|    return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
  171|   832k|}

secp256k1.c:secp256k1_scalar_verify:
   42|  30.4M|static void secp256k1_scalar_verify(const secp256k1_scalar *r) {
   43|  30.4M|    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
   44|       |
   45|  30.4M|    (void)r;
   46|  30.4M|}
secp256k1.c:secp256k1_scalar_set_b32_seckey:
   34|   229k|static int secp256k1_scalar_set_b32_seckey(secp256k1_scalar *r, const unsigned char *bin) {
   35|   229k|    int overflow;
   36|   229k|    secp256k1_scalar_set_b32(r, bin, &overflow);
   37|       |
   38|   229k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   229k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   39|   229k|    return (!overflow) & (!secp256k1_scalar_is_zero(r));
   40|   229k|}
secp256k1.c:secp256k1_scalar_clear:
   30|   516k|SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) {
   31|   516k|    secp256k1_memclear(r, sizeof(secp256k1_scalar));
   32|   516k|}
secp256k1.c:secp256k1_scalar_split_lambda:
  142|  79.6k|static void secp256k1_scalar_split_lambda(secp256k1_scalar * SECP256K1_RESTRICT r1, secp256k1_scalar * SECP256K1_RESTRICT r2, const secp256k1_scalar * SECP256K1_RESTRICT k) {
  143|  79.6k|    secp256k1_scalar c1, c2;
  144|  79.6k|    static const secp256k1_scalar minus_b1 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  79.6k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  145|  79.6k|        0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL,
  146|  79.6k|        0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C3UL
  147|  79.6k|    );
  148|  79.6k|    static const secp256k1_scalar minus_b2 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  79.6k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  149|  79.6k|        0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
  150|  79.6k|        0x8A280AC5UL, 0x0774346DUL, 0xD765CDA8UL, 0x3DB1562CUL
  151|  79.6k|    );
  152|  79.6k|    static const secp256k1_scalar g1 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  79.6k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  153|  79.6k|        0x3086D221UL, 0xA7D46BCDUL, 0xE86C90E4UL, 0x9284EB15UL,
  154|  79.6k|        0x3DAA8A14UL, 0x71E8CA7FUL, 0xE893209AUL, 0x45DBB031UL
  155|  79.6k|    );
  156|  79.6k|    static const secp256k1_scalar g2 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  79.6k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  157|  79.6k|        0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C4UL,
  158|  79.6k|        0x221208ACUL, 0x9DF506C6UL, 0x1571B4AEUL, 0x8AC47F71UL
  159|  79.6k|    );
  160|  79.6k|    SECP256K1_SCALAR_VERIFY(k);
  ------------------
  |  |  103|  79.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  161|  79.6k|    VERIFY_CHECK(r1 != k);
  162|  79.6k|    VERIFY_CHECK(r2 != k);
  163|  79.6k|    VERIFY_CHECK(r1 != r2);
  164|       |
  165|       |    /* these _var calls are constant time since the shift amount is constant */
  166|  79.6k|    secp256k1_scalar_mul_shift_var(&c1, k, &g1, 384);
  167|  79.6k|    secp256k1_scalar_mul_shift_var(&c2, k, &g2, 384);
  168|  79.6k|    secp256k1_scalar_mul(&c1, &c1, &minus_b1);
  169|  79.6k|    secp256k1_scalar_mul(&c2, &c2, &minus_b2);
  170|  79.6k|    secp256k1_scalar_add(r2, &c1, &c2);
  171|  79.6k|    secp256k1_scalar_mul(r1, r2, &secp256k1_const_lambda);
  172|  79.6k|    secp256k1_scalar_negate(r1, r1);
  173|  79.6k|    secp256k1_scalar_add(r1, r1, k);
  174|       |
  175|  79.6k|    SECP256K1_SCALAR_VERIFY(r1);
  ------------------
  |  |  103|  79.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  176|  79.6k|    SECP256K1_SCALAR_VERIFY(r2);
  ------------------
  |  |  103|  79.6k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  177|       |#ifdef VERIFY
  178|       |    secp256k1_scalar_split_lambda_verify(r1, r2, k);
  179|       |#endif
  180|  79.6k|}

secp256k1_context_preallocated_destroy:
  176|      2|void secp256k1_context_preallocated_destroy(secp256k1_context* ctx) {
  177|      2|    ARG_CHECK_VOID(ctx == NULL || secp256k1_context_is_proper(ctx));
  ------------------
  |  |   52|      2|#define ARG_CHECK_VOID(cond) do { \
  |  |   53|      2|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|      4|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 2]
  |  |  |  |  |  Branch (136:39): [True: 0, False: 2]
  |  |  |  |  |  Branch (136:39): [True: 2, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   54|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   55|      0|        return; \
  |  |   56|      0|    } \
  |  |   57|      2|} while(0)
  |  |  ------------------
  |  |  |  Branch (57:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  178|       |
  179|       |    /* Defined as noop */
  180|      2|    if (ctx == NULL) {
  ------------------
  |  Branch (180:9): [True: 0, False: 2]
  ------------------
  181|      0|        return;
  182|      0|    }
  183|       |
  184|      2|    secp256k1_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx);
  185|      2|}
secp256k1_context_destroy:
  187|      2|void secp256k1_context_destroy(secp256k1_context* ctx) {
  188|      2|    ARG_CHECK_VOID(ctx == NULL || secp256k1_context_is_proper(ctx));
  ------------------
  |  |   52|      2|#define ARG_CHECK_VOID(cond) do { \
  |  |   53|      2|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|      4|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 2]
  |  |  |  |  |  Branch (136:39): [True: 0, False: 2]
  |  |  |  |  |  Branch (136:39): [True: 2, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   54|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   55|      0|        return; \
  |  |   56|      0|    } \
  |  |   57|      2|} while(0)
  |  |  ------------------
  |  |  |  Branch (57:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  189|       |
  190|       |    /* Defined as noop */
  191|      2|    if (ctx == NULL) {
  ------------------
  |  Branch (191:9): [True: 0, False: 2]
  ------------------
  192|      0|        return;
  193|      0|    }
  194|       |
  195|      2|    secp256k1_context_preallocated_destroy(ctx);
  196|      2|    free(ctx);
  197|      2|}
secp256k1_ec_pubkey_parse:
  250|  48.8k|int secp256k1_ec_pubkey_parse(const secp256k1_context* ctx, secp256k1_pubkey* pubkey, const unsigned char *input, size_t inputlen) {
  251|  48.8k|    secp256k1_ge Q;
  252|       |
  253|  48.8k|    VERIFY_CHECK(ctx != NULL);
  254|  48.8k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  48.8k|#define ARG_CHECK(cond) do { \
  |  |   46|  48.8k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  48.8k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 48.8k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  48.8k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  255|  48.8k|    memset(pubkey, 0, sizeof(*pubkey));
  256|  48.8k|    ARG_CHECK(input != NULL);
  ------------------
  |  |   45|  48.8k|#define ARG_CHECK(cond) do { \
  |  |   46|  48.8k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  48.8k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 48.8k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  48.8k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  257|  48.8k|    if (!secp256k1_eckey_pubkey_parse(&Q, input, inputlen)) {
  ------------------
  |  Branch (257:9): [True: 1.96k, False: 46.8k]
  ------------------
  258|  1.96k|        return 0;
  259|  1.96k|    }
  260|  46.8k|    if (!secp256k1_ge_is_in_correct_subgroup(&Q)) {
  ------------------
  |  Branch (260:9): [True: 0, False: 46.8k]
  ------------------
  261|      0|        return 0;
  262|      0|    }
  263|  46.8k|    secp256k1_pubkey_save(pubkey, &Q);
  264|  46.8k|    secp256k1_ge_clear(&Q);
  265|  46.8k|    return 1;
  266|  46.8k|}
secp256k1_ec_pubkey_serialize:
  268|  45.3k|int secp256k1_ec_pubkey_serialize(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey* pubkey, unsigned int flags) {
  269|  45.3k|    secp256k1_ge Q;
  270|  45.3k|    size_t len;
  271|  45.3k|    int ret = 0;
  272|       |
  273|  45.3k|    VERIFY_CHECK(ctx != NULL);
  274|  45.3k|    ARG_CHECK(outputlen != NULL);
  ------------------
  |  |   45|  45.3k|#define ARG_CHECK(cond) do { \
  |  |   46|  45.3k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  45.3k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 45.3k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  45.3k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  275|  45.3k|    ARG_CHECK(*outputlen >= ((flags & SECP256K1_FLAGS_BIT_COMPRESSION) ? 33u : 65u));
  ------------------
  |  |   45|  45.3k|#define ARG_CHECK(cond) do { \
  |  |   46|  45.3k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  90.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 45.3k]
  |  |  |  |  |  Branch (136:39): [True: 27.5k, False: 17.7k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  45.3k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  276|  45.3k|    len = *outputlen;
  277|  45.3k|    *outputlen = 0;
  278|  45.3k|    ARG_CHECK(output != NULL);
  ------------------
  |  |   45|  45.3k|#define ARG_CHECK(cond) do { \
  |  |   46|  45.3k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  45.3k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 45.3k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  45.3k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  279|  45.3k|    memset(output, 0, len);
  280|  45.3k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  45.3k|#define ARG_CHECK(cond) do { \
  |  |   46|  45.3k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  45.3k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 45.3k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  45.3k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  281|  45.3k|    ARG_CHECK((flags & SECP256K1_FLAGS_TYPE_MASK) == SECP256K1_FLAGS_TYPE_COMPRESSION);
  ------------------
  |  |   45|  45.3k|#define ARG_CHECK(cond) do { \
  |  |   46|  45.3k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  45.3k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 45.3k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  45.3k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  282|  45.3k|    if (secp256k1_pubkey_load(ctx, &Q, pubkey)) {
  ------------------
  |  Branch (282:9): [True: 45.3k, False: 0]
  ------------------
  283|  45.3k|        ret = secp256k1_eckey_pubkey_serialize(&Q, output, &len, flags & SECP256K1_FLAGS_BIT_COMPRESSION);
  ------------------
  |  |  198|  45.3k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  ------------------
  284|  45.3k|        if (ret) {
  ------------------
  |  Branch (284:13): [True: 45.3k, False: 0]
  ------------------
  285|  45.3k|            *outputlen = len;
  286|  45.3k|        }
  287|  45.3k|    }
  288|  45.3k|    return ret;
  289|  45.3k|}
secp256k1_ecdsa_signature_parse_compact:
  385|   219k|int secp256k1_ecdsa_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input64) {
  386|   219k|    secp256k1_scalar r, s;
  387|   219k|    int ret = 1;
  388|   219k|    int overflow = 0;
  389|       |
  390|   219k|    VERIFY_CHECK(ctx != NULL);
  391|   219k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|   219k|#define ARG_CHECK(cond) do { \
  |  |   46|   219k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|   219k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 219k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   219k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  392|   219k|    ARG_CHECK(input64 != NULL);
  ------------------
  |  |   45|   219k|#define ARG_CHECK(cond) do { \
  |  |   46|   219k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|   219k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 219k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   219k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  393|       |
  394|   219k|    secp256k1_scalar_set_b32(&r, &input64[0], &overflow);
  395|   219k|    ret &= !overflow;
  396|   219k|    secp256k1_scalar_set_b32(&s, &input64[32], &overflow);
  397|   219k|    ret &= !overflow;
  398|   219k|    if (ret) {
  ------------------
  |  Branch (398:9): [True: 219k, False: 0]
  ------------------
  399|   219k|        secp256k1_ecdsa_signature_save(sig, &r, &s);
  400|   219k|    } else {
  401|      0|        memset(sig, 0, sizeof(*sig));
  402|      0|    }
  403|   219k|    return ret;
  404|   219k|}
secp256k1_ecdsa_signature_serialize_der:
  406|  33.5k|int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature* sig) {
  407|  33.5k|    secp256k1_scalar r, s;
  408|       |
  409|  33.5k|    VERIFY_CHECK(ctx != NULL);
  410|  33.5k|    ARG_CHECK(output != NULL);
  ------------------
  |  |   45|  33.5k|#define ARG_CHECK(cond) do { \
  |  |   46|  33.5k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  33.5k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 33.5k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  33.5k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  411|  33.5k|    ARG_CHECK(outputlen != NULL);
  ------------------
  |  |   45|  33.5k|#define ARG_CHECK(cond) do { \
  |  |   46|  33.5k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  33.5k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 33.5k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  33.5k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  412|  33.5k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  33.5k|#define ARG_CHECK(cond) do { \
  |  |   46|  33.5k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  33.5k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 33.5k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  33.5k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  413|       |
  414|  33.5k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  415|  33.5k|    return secp256k1_ecdsa_sig_serialize(output, outputlen, &r, &s);
  416|  33.5k|}
secp256k1_ecdsa_signature_serialize_compact:
  418|  69.6k|int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, const secp256k1_ecdsa_signature* sig) {
  419|  69.6k|    secp256k1_scalar r, s;
  420|       |
  421|  69.6k|    VERIFY_CHECK(ctx != NULL);
  422|  69.6k|    ARG_CHECK(output64 != NULL);
  ------------------
  |  |   45|  69.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  69.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  69.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 69.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  69.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  423|  69.6k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  69.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  69.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  69.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 69.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  69.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  424|       |
  425|  69.6k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  426|  69.6k|    secp256k1_scalar_get_b32(&output64[0], &r);
  427|  69.6k|    secp256k1_scalar_get_b32(&output64[32], &s);
  428|  69.6k|    return 1;
  429|  69.6k|}
secp256k1_ecdsa_signature_normalize:
  431|   109k|int secp256k1_ecdsa_signature_normalize(const secp256k1_context* ctx, secp256k1_ecdsa_signature *sigout, const secp256k1_ecdsa_signature *sigin) {
  432|   109k|    secp256k1_scalar r, s;
  433|   109k|    int ret = 0;
  434|       |
  435|   109k|    VERIFY_CHECK(ctx != NULL);
  436|   109k|    ARG_CHECK(sigin != NULL);
  ------------------
  |  |   45|   109k|#define ARG_CHECK(cond) do { \
  |  |   46|   109k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|   109k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 109k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   109k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  437|       |
  438|   109k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sigin);
  439|   109k|    ret = secp256k1_scalar_is_high(&s);
  440|   109k|    if (sigout != NULL) {
  ------------------
  |  Branch (440:9): [True: 45.3k, False: 64.3k]
  ------------------
  441|  45.3k|        if (ret) {
  ------------------
  |  Branch (441:13): [True: 0, False: 45.3k]
  ------------------
  442|      0|            secp256k1_scalar_negate(&s, &s);
  443|      0|        }
  444|  45.3k|        secp256k1_ecdsa_signature_save(sigout, &r, &s);
  445|  45.3k|    }
  446|       |
  447|   109k|    return ret;
  448|   109k|}
secp256k1_ecdsa_verify:
  450|  78.9k|int secp256k1_ecdsa_verify(const secp256k1_context* ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const secp256k1_pubkey *pubkey) {
  451|  78.9k|    secp256k1_ge q;
  452|  78.9k|    secp256k1_scalar r, s;
  453|  78.9k|    secp256k1_scalar m;
  454|  78.9k|    VERIFY_CHECK(ctx != NULL);
  455|  78.9k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  78.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  78.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  78.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 78.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  78.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  456|  78.9k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  78.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  78.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  78.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 78.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  78.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  457|  78.9k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  78.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  78.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  78.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 78.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  78.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  458|       |
  459|  78.9k|    secp256k1_scalar_set_b32(&m, msghash32, NULL);
  460|  78.9k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  461|  78.9k|    return (!secp256k1_scalar_is_high(&s) &&
  ------------------
  |  Branch (461:13): [True: 78.9k, False: 0]
  ------------------
  462|  78.9k|            secp256k1_pubkey_load(ctx, &q, pubkey) &&
  ------------------
  |  Branch (462:13): [True: 78.9k, False: 0]
  ------------------
  463|  78.9k|            secp256k1_ecdsa_sig_verify(&r, &s, &q, &m));
  ------------------
  |  Branch (463:13): [True: 34.9k, False: 43.9k]
  ------------------
  464|  78.9k|}
secp256k1_ecdsa_sign:
  566|  69.6k|int secp256k1_ecdsa_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
  567|  69.6k|    secp256k1_scalar r, s;
  568|  69.6k|    int ret;
  569|  69.6k|    VERIFY_CHECK(ctx != NULL);
  570|  69.6k|    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
  ------------------
  |  |   45|  69.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  69.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  69.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 69.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  69.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  571|  69.6k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  69.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  69.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  69.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 69.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  69.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  572|  69.6k|    ARG_CHECK(signature != NULL);
  ------------------
  |  |   45|  69.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  69.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  69.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 69.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  69.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  573|  69.6k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  69.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  69.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  69.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 69.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  69.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  574|       |
  575|  69.6k|    ret = secp256k1_ecdsa_sign_inner(ctx, &r, &s, NULL, msghash32, seckey, noncefp, noncedata);
  576|  69.6k|    secp256k1_ecdsa_signature_save(signature, &r, &s);
  577|  69.6k|    return ret;
  578|  69.6k|}
secp256k1_ec_seckey_verify:
  580|  11.9k|int secp256k1_ec_seckey_verify(const secp256k1_context* ctx, const unsigned char *seckey) {
  581|  11.9k|    secp256k1_scalar sec;
  582|  11.9k|    int ret;
  583|  11.9k|    VERIFY_CHECK(ctx != NULL);
  584|  11.9k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  11.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  11.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  11.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 11.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  11.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  585|       |
  586|  11.9k|    ret = secp256k1_scalar_set_b32_seckey(&sec, seckey);
  587|  11.9k|    secp256k1_scalar_clear(&sec);
  588|  11.9k|    return ret;
  589|  11.9k|}
secp256k1_ec_pubkey_create:
  604|  77.9k|int secp256k1_ec_pubkey_create(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) {
  605|  77.9k|    secp256k1_ge p;
  606|  77.9k|    secp256k1_scalar seckey_scalar;
  607|  77.9k|    int ret = 0;
  608|  77.9k|    VERIFY_CHECK(ctx != NULL);
  609|  77.9k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  77.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  77.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  77.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 77.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  77.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  610|  77.9k|    memset(pubkey, 0, sizeof(*pubkey));
  611|  77.9k|    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
  ------------------
  |  |   45|  77.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  77.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  77.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 77.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  77.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  612|  77.9k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  77.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  77.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|  77.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 77.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  77.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  613|       |
  614|  77.9k|    ret = secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &seckey_scalar, &p, seckey);
  615|  77.9k|    secp256k1_pubkey_save(pubkey, &p);
  616|  77.9k|    secp256k1_memczero(pubkey, sizeof(*pubkey), !ret);
  617|       |
  618|  77.9k|    secp256k1_scalar_clear(&seckey_scalar);
  619|  77.9k|    return ret;
  620|  77.9k|}
secp256k1.c:secp256k1_context_is_proper:
   82|      4|static int secp256k1_context_is_proper(const secp256k1_context* ctx) {
   83|      4|    return secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx);
   84|      4|}
secp256k1.c:secp256k1_pubkey_save:
  246|   125k|static void secp256k1_pubkey_save(secp256k1_pubkey* pubkey, secp256k1_ge* ge) {
  247|   125k|    secp256k1_ge_to_bytes(pubkey->data, ge);
  248|   125k|}
secp256k1.c:secp256k1_pubkey_load:
  240|   125k|static int secp256k1_pubkey_load(const secp256k1_context* ctx, secp256k1_ge* ge, const secp256k1_pubkey* pubkey) {
  241|   125k|    secp256k1_ge_from_bytes(ge, pubkey->data);
  242|   125k|    ARG_CHECK(!secp256k1_fe_is_zero(&ge->x));
  ------------------
  |  |   45|   125k|#define ARG_CHECK(cond) do { \
  |  |   46|   125k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  136|   125k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (136:21): [True: 0, False: 125k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   125k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded - Ignored]
  |  |  ------------------
  ------------------
  243|   125k|    return 1;
  244|   125k|}
secp256k1.c:secp256k1_ecdsa_signature_save:
  359|   334k|static void secp256k1_ecdsa_signature_save(secp256k1_ecdsa_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s) {
  360|   334k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (360:9): [Folded - Ignored]
  ------------------
  361|   334k|        memcpy(&sig->data[0], r, 32);
  362|   334k|        memcpy(&sig->data[32], s, 32);
  363|   334k|    } else {
  364|      0|        secp256k1_scalar_get_b32(&sig->data[0], r);
  365|      0|        secp256k1_scalar_get_b32(&sig->data[32], s);
  366|      0|    }
  367|   334k|}
secp256k1.c:secp256k1_ecdsa_signature_load:
  345|   291k|static void secp256k1_ecdsa_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_ecdsa_signature* sig) {
  346|   291k|    (void)ctx;
  347|   291k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (347:9): [Folded - Ignored]
  ------------------
  348|       |        /* When the secp256k1_scalar type is exactly 32 byte, use its
  349|       |         * representation inside secp256k1_ecdsa_signature, as conversion is very fast.
  350|       |         * Note that secp256k1_ecdsa_signature_save must use the same representation. */
  351|   291k|        memcpy(r, &sig->data[0], 32);
  352|   291k|        memcpy(s, &sig->data[32], 32);
  353|   291k|    } else {
  354|      0|        secp256k1_scalar_set_b32(r, &sig->data[0], NULL);
  355|      0|        secp256k1_scalar_set_b32(s, &sig->data[32], NULL);
  356|      0|    }
  357|   291k|}
secp256k1.c:nonce_function_rfc6979:
  471|  69.6k|static int nonce_function_rfc6979(unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
  472|  69.6k|   unsigned char keydata[112];
  473|  69.6k|   unsigned int offset = 0;
  474|  69.6k|   secp256k1_rfc6979_hmac_sha256 rng;
  475|  69.6k|   unsigned int i;
  476|  69.6k|   secp256k1_scalar msg;
  477|  69.6k|   unsigned char msgmod32[32];
  478|  69.6k|   secp256k1_scalar_set_b32(&msg, msg32, NULL);
  479|  69.6k|   secp256k1_scalar_get_b32(msgmod32, &msg);
  480|       |   /* We feed a byte array to the PRNG as input, consisting of:
  481|       |    * - the private key (32 bytes) and reduced message (32 bytes), see RFC 6979 3.2d.
  482|       |    * - optionally 32 extra bytes of data, see RFC 6979 3.6 Additional Data.
  483|       |    * - optionally 16 extra bytes with the algorithm name.
  484|       |    * Because the arguments have distinct fixed lengths it is not possible for
  485|       |    *  different argument mixtures to emulate each other and result in the same
  486|       |    *  nonces.
  487|       |    */
  488|  69.6k|   buffer_append(keydata, &offset, key32, 32);
  489|  69.6k|   buffer_append(keydata, &offset, msgmod32, 32);
  490|  69.6k|   if (data != NULL) {
  ------------------
  |  Branch (490:8): [True: 36.0k, False: 33.5k]
  ------------------
  491|  36.0k|       buffer_append(keydata, &offset, data, 32);
  492|  36.0k|   }
  493|  69.6k|   if (algo16 != NULL) {
  ------------------
  |  Branch (493:8): [True: 0, False: 69.6k]
  ------------------
  494|      0|       buffer_append(keydata, &offset, algo16, 16);
  495|      0|   }
  496|  69.6k|   secp256k1_rfc6979_hmac_sha256_initialize(&rng, keydata, offset);
  497|   139k|   for (i = 0; i <= counter; i++) {
  ------------------
  |  Branch (497:16): [True: 69.6k, False: 69.6k]
  ------------------
  498|  69.6k|       secp256k1_rfc6979_hmac_sha256_generate(&rng, nonce32, 32);
  499|  69.6k|   }
  500|  69.6k|   secp256k1_rfc6979_hmac_sha256_finalize(&rng);
  501|       |
  502|  69.6k|   secp256k1_memclear(keydata, sizeof(keydata));
  503|  69.6k|   secp256k1_rfc6979_hmac_sha256_clear(&rng);
  504|  69.6k|   return 1;
  505|  69.6k|}
secp256k1.c:buffer_append:
  466|   175k|static SECP256K1_INLINE void buffer_append(unsigned char *buf, unsigned int *offset, const void *data, unsigned int len) {
  467|   175k|    memcpy(buf + *offset, data, len);
  468|   175k|    *offset += len;
  469|   175k|}
secp256k1.c:secp256k1_ecdsa_sign_inner:
  510|  69.6k|static int secp256k1_ecdsa_sign_inner(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, int* recid, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
  511|  69.6k|    secp256k1_scalar sec, non, msg;
  512|  69.6k|    int ret = 0;
  513|  69.6k|    int is_sec_valid;
  514|  69.6k|    unsigned char nonce32[32];
  515|  69.6k|    unsigned int count = 0;
  516|       |    /* Default initialization here is important so we won't pass uninit values to the cmov in the end */
  517|  69.6k|    *r = secp256k1_scalar_zero;
  518|  69.6k|    *s = secp256k1_scalar_zero;
  519|  69.6k|    if (recid) {
  ------------------
  |  Branch (519:9): [True: 0, False: 69.6k]
  ------------------
  520|      0|        *recid = 0;
  521|      0|    }
  522|  69.6k|    if (noncefp == NULL) {
  ------------------
  |  Branch (522:9): [True: 0, False: 69.6k]
  ------------------
  523|      0|        noncefp = secp256k1_nonce_function_default;
  524|      0|    }
  525|       |
  526|       |    /* Fail if the secret key is invalid. */
  527|  69.6k|    is_sec_valid = secp256k1_scalar_set_b32_seckey(&sec, seckey);
  528|  69.6k|    secp256k1_scalar_cmov(&sec, &secp256k1_scalar_one, !is_sec_valid);
  529|  69.6k|    secp256k1_scalar_set_b32(&msg, msg32, NULL);
  530|  69.6k|    while (1) {
  ------------------
  |  Branch (530:12): [Folded - Ignored]
  ------------------
  531|  69.6k|        int is_nonce_valid;
  532|  69.6k|        ret = !!noncefp(nonce32, msg32, seckey, NULL, (void*)noncedata, count);
  533|  69.6k|        if (!ret) {
  ------------------
  |  Branch (533:13): [True: 0, False: 69.6k]
  ------------------
  534|      0|            break;
  535|      0|        }
  536|  69.6k|        is_nonce_valid = secp256k1_scalar_set_b32_seckey(&non, nonce32);
  537|       |        /* The nonce is still secret here, but it being invalid is less likely than 1:2^255. */
  538|  69.6k|        secp256k1_declassify(ctx, &is_nonce_valid, sizeof(is_nonce_valid));
  539|  69.6k|        if (is_nonce_valid) {
  ------------------
  |  Branch (539:13): [True: 69.6k, False: 0]
  ------------------
  540|  69.6k|            ret = secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, r, s, &sec, &msg, &non, recid);
  541|       |            /* The final signature is no longer a secret, nor is the fact that we were successful or not. */
  542|  69.6k|            secp256k1_declassify(ctx, &ret, sizeof(ret));
  543|  69.6k|            if (ret) {
  ------------------
  |  Branch (543:17): [True: 69.6k, False: 0]
  ------------------
  544|  69.6k|                break;
  545|  69.6k|            }
  546|  69.6k|        }
  547|      0|        count++;
  548|      0|    }
  549|       |    /* We don't want to declassify is_sec_valid and therefore the range of
  550|       |     * seckey. As a result is_sec_valid is included in ret only after ret was
  551|       |     * used as a branching variable. */
  552|  69.6k|    ret &= is_sec_valid;
  553|  69.6k|    secp256k1_memclear(nonce32, sizeof(nonce32));
  554|  69.6k|    secp256k1_scalar_clear(&msg);
  555|  69.6k|    secp256k1_scalar_clear(&non);
  556|  69.6k|    secp256k1_scalar_clear(&sec);
  557|  69.6k|    secp256k1_scalar_cmov(r, &secp256k1_scalar_zero, !ret);
  558|  69.6k|    secp256k1_scalar_cmov(s, &secp256k1_scalar_zero, !ret);
  559|  69.6k|    if (recid) {
  ------------------
  |  Branch (559:9): [True: 0, False: 69.6k]
  ------------------
  560|      0|        const int zero = 0;
  561|      0|        secp256k1_int_cmov(recid, &zero, !ret);
  562|      0|    }
  563|  69.6k|    return ret;
  564|  69.6k|}
secp256k1.c:secp256k1_ec_pubkey_create_helper:
  591|  77.9k|static int secp256k1_ec_pubkey_create_helper(const secp256k1_ecmult_gen_context *ecmult_gen_ctx, secp256k1_scalar *seckey_scalar, secp256k1_ge *p, const unsigned char *seckey) {
  592|  77.9k|    secp256k1_gej pj;
  593|  77.9k|    int ret;
  594|       |
  595|  77.9k|    ret = secp256k1_scalar_set_b32_seckey(seckey_scalar, seckey);
  596|  77.9k|    secp256k1_scalar_cmov(seckey_scalar, &secp256k1_scalar_one, !ret);
  597|       |
  598|  77.9k|    secp256k1_ecmult_gen(ecmult_gen_ctx, &pj, seckey_scalar);
  599|  77.9k|    secp256k1_ge_set_gej(p, &pj);
  600|  77.9k|    secp256k1_gej_clear(&pj);
  601|  77.9k|    return ret;
  602|  77.9k|}
secp256k1.c:secp256k1_ec_pubkey_tweak_add_helper:
  688|    386|static int secp256k1_ec_pubkey_tweak_add_helper(secp256k1_ge *p, const unsigned char *tweak32) {
  689|    386|    secp256k1_scalar term;
  690|    386|    int overflow = 0;
  691|    386|    secp256k1_scalar_set_b32(&term, tweak32, &overflow);
  692|    386|    return !overflow && secp256k1_eckey_pubkey_tweak_add(p, &term);
  ------------------
  |  Branch (692:12): [True: 386, False: 0]
  |  Branch (692:25): [True: 386, False: 0]
  ------------------
  693|    386|}
secp256k1.c:secp256k1_declassify:
  236|   139k|static SECP256K1_INLINE void secp256k1_declassify(const secp256k1_context* ctx, const void *p, size_t len) {
  237|   139k|    if (EXPECT(ctx->declassify, 0)) SECP256K1_CHECKMEM_DEFINE(p, len);
  ------------------
  |  |  136|   139k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  ------------------
  |  |  |  Branch (136:21): [True: 0, False: 139k]
  |  |  ------------------
  ------------------
                  if (EXPECT(ctx->declassify, 0)) SECP256K1_CHECKMEM_DEFINE(p, len);
  ------------------
  |  |   91|      0|#  define SECP256K1_CHECKMEM_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|      0|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded - Ignored]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  238|   139k|}

secp256k1.c:secp256k1_memcmp_var:
  255|    386|static SECP256K1_INLINE int secp256k1_memcmp_var(const void *s1, const void *s2, size_t n) {
  256|    386|    const unsigned char *p1 = s1, *p2 = s2;
  257|    386|    size_t i;
  258|       |
  259|    410|    for (i = 0; i < n; i++) {
  ------------------
  |  Branch (259:17): [True: 410, False: 0]
  ------------------
  260|    410|        int diff = p1[i] - p2[i];
  261|    410|        if (diff != 0) {
  ------------------
  |  Branch (261:13): [True: 386, False: 24]
  ------------------
  262|    386|            return diff;
  263|    386|        }
  264|    410|    }
  265|      0|    return 0;
  266|    386|}
secp256k1.c:secp256k1_read_be64:
  416|  3.82M|SECP256K1_INLINE static uint64_t secp256k1_read_be64(const unsigned char* p) {
  417|  3.82M|    return (uint64_t)p[0] << 56 |
  418|  3.82M|           (uint64_t)p[1] << 48 |
  419|  3.82M|           (uint64_t)p[2] << 40 |
  420|  3.82M|           (uint64_t)p[3] << 32 |
  421|  3.82M|           (uint64_t)p[4] << 24 |
  422|  3.82M|           (uint64_t)p[5] << 16 |
  423|  3.82M|           (uint64_t)p[6] << 8  |
  424|  3.82M|           (uint64_t)p[7];
  425|  3.82M|}
secp256k1.c:secp256k1_write_be64:
  428|  1.41M|SECP256K1_INLINE static void secp256k1_write_be64(unsigned char* p, uint64_t x) {
  429|  1.41M|    p[7] = x;
  430|  1.41M|    p[6] = x >>  8;
  431|  1.41M|    p[5] = x >> 16;
  432|  1.41M|    p[4] = x >> 24;
  433|  1.41M|    p[3] = x >> 32;
  434|  1.41M|    p[2] = x >> 40;
  435|  1.41M|    p[1] = x >> 48;
  436|  1.41M|    p[0] = x >> 56;
  437|  1.41M|}
secp256k1.c:secp256k1_ctz64_var:
  382|  11.6M|static SECP256K1_INLINE int secp256k1_ctz64_var(uint64_t x) {
  383|  11.6M|    VERIFY_CHECK(x != 0);
  384|  11.6M|#if (__has_builtin(__builtin_ctzl) || SECP256K1_GNUC_PREREQ(3,4))
  385|       |    /* If the unsigned long type is sufficient to represent the largest uint64_t, consider __builtin_ctzl. */
  386|  11.6M|    if (((unsigned long)UINT64_MAX) == UINT64_MAX) {
  ------------------
  |  Branch (386:9): [Folded - Ignored]
  ------------------
  387|  11.6M|        return __builtin_ctzl(x);
  388|  11.6M|    }
  389|      0|#endif
  390|      0|#if (__has_builtin(__builtin_ctzll) || SECP256K1_GNUC_PREREQ(3,4))
  391|       |    /* Otherwise consider __builtin_ctzll (the unsigned long long type is always at least 64 bits). */
  392|      0|    return __builtin_ctzll(x);
  393|       |#else
  394|       |    /* If no suitable CTZ builtin is available, use a (variable time) software emulation. */
  395|       |    return secp256k1_ctz64_var_debruijn(x);
  396|       |#endif
  397|  11.6M|}
secp256k1.c:secp256k1_rotr32:
  440|  38.0M|SECP256K1_INLINE static uint32_t secp256k1_rotr32(const uint32_t x, const unsigned int by) {
  441|       |#if defined(_MSC_VER)
  442|       |    return _rotr(x, by);  /* needs <stdlib.h> */
  443|       |#else
  444|       |    /* Reduce rotation amount to avoid UB when shifting. */
  445|  38.0M|    const unsigned int mask = CHAR_BIT * sizeof(x) - 1;
  446|       |    /* Turned into a rot instruction by GCC and clang. */
  447|  38.0M|    return (x >> (by & mask)) | (x << ((-by) & mask));
  448|  38.0M|#endif
  449|  38.0M|}
secp256k1.c:secp256k1_memczero:
  208|  77.9k|static SECP256K1_INLINE void secp256k1_memczero(void *s, size_t len, int flag) {
  209|  77.9k|    unsigned char *p = (unsigned char *)s;
  210|       |    /* Access flag with a volatile-qualified lvalue.
  211|       |       This prevents clang from figuring out (after inlining) that flag can
  212|       |       take only be 0 or 1, which leads to variable time code. */
  213|  77.9k|    volatile int vflag = flag;
  214|  77.9k|    unsigned char mask = -(unsigned char) vflag;
  215|  5.06M|    while (len) {
  ------------------
  |  Branch (215:12): [True: 4.99M, False: 77.9k]
  ------------------
  216|  4.99M|        *p &= ~mask;
  217|  4.99M|        p++;
  218|  4.99M|        len--;
  219|  4.99M|    }
  220|  77.9k|}
secp256k1.c:secp256k1_read_be32:
  400|  25.6M|SECP256K1_INLINE static uint32_t secp256k1_read_be32(const unsigned char* p) {
  401|  25.6M|    return (uint32_t)p[0] << 24 |
  402|  25.6M|           (uint32_t)p[1] << 16 |
  403|  25.6M|           (uint32_t)p[2] << 8  |
  404|  25.6M|           (uint32_t)p[3];
  405|  25.6M|}
secp256k1.c:secp256k1_write_be32:
  408|  6.96M|SECP256K1_INLINE static void secp256k1_write_be32(unsigned char* p, uint32_t x) {
  409|  6.96M|    p[3] = x;
  410|  6.96M|    p[2] = x >>  8;
  411|  6.96M|    p[1] = x >> 16;
  412|  6.96M|    p[0] = x >> 24;
  413|  6.96M|}
secp256k1.c:secp256k1_memclear:
  223|  2.27M|static SECP256K1_INLINE void secp256k1_memclear(void *ptr, size_t len) {
  224|       |#if defined(_MSC_VER)
  225|       |    /* SecureZeroMemory is guaranteed not to be optimized out by MSVC. */
  226|       |    SecureZeroMemory(ptr, len);
  227|       |#elif defined(__GNUC__)
  228|       |    /* We use a memory barrier that scares the compiler away from optimizing out the memset.
  229|       |     *
  230|       |     * Quoting Adam Langley <agl@google.com> in commit ad1907fe73334d6c696c8539646c21b11178f20f
  231|       |     * in BoringSSL (ISC License):
  232|       |     *    As best as we can tell, this is sufficient to break any optimisations that
  233|       |     *    might try to eliminate "superfluous" memsets.
  234|       |     * This method is used in memzero_explicit() the Linux kernel, too. Its advantage is that it
  235|       |     * is pretty efficient, because the compiler can still implement the memset() efficently,
  236|       |     * just not remove it entirely. See "Dead Store Elimination (Still) Considered Harmful" by
  237|       |     * Yang et al. (USENIX Security 2017) for more background.
  238|       |     */
  239|  2.27M|    memset(ptr, 0, len);
  240|  2.27M|    __asm__ __volatile__("" : : "r"(ptr) : "memory");
  241|       |#else
  242|       |    void *(*volatile const volatile_memset)(void *, int, size_t) = memset;
  243|       |    volatile_memset(ptr, 0, len);
  244|       |#endif
  245|       |#ifdef VERIFY
  246|       |    SECP256K1_CHECKMEM_UNDEFINE(ptr, len);
  247|       |#endif
  248|  2.27M|}

_ZN17CompactSizeWriterC2Em:
  615|  25.2k|    explicit CompactSizeWriter(uint64_t n_in) : n(n_in) { }
_ZN12SizeComputer5writeE4SpanIKSt4byteE:
 1069|  19.6k|    {
 1070|  19.6k|        this->nSize += src.size();
 1071|  19.6k|    }
_ZNK12SizeComputer4sizeEv:
 1086|  9.24k|    size_t size() const {
 1087|  9.24k|        return nSize;
 1088|  9.24k|    }
_ZNK20TransactionSerParamsclIRK12CTransactionEEDaOT_:
 1228|  17.1k|    {                                                                                    \
 1229|  17.1k|        return ParamsWrapper{*this, t};                                                  \
 1230|  17.1k|    }
_Z6AsBaseI9prevectorILj28EhjiE7CScriptERKT_RKT0_:
  151|  6.12M|{
  152|  6.12M|    static_assert(std::is_base_of_v<Out, In>);
  153|  6.12M|    return x;
  154|  6.12M|}
_ZNK20TransactionSerParamsclIR19CMutableTransactionEEDaOT_:
 1228|  20.0k|    {                                                                                    \
 1229|  20.0k|        return ParamsWrapper{*this, t};                                                  \
 1230|  20.0k|    }
_ZN12SizeComputerC2Ev:
 1066|  9.24k|    SizeComputer() = default;
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEEC2ESA_:
  481|  18.1k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEEC2ESA_:
  481|  17.1k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEEC2ESB_:
  481|  24.5k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsEC2ES1_RKS2_:
 1127|  20.0k|    ParamsStream(SubStream&& substream, const Params& params LIFETIMEBOUND) : m_params{params}, m_substream{std::forward<SubStream>(substream)} {}
_Z14ser_readdata32I12ParamsStreamIR10DataStream20TransactionSerParamsEEjRT_:
  102|   337k|{
  103|   337k|    uint32_t obj;
  104|   337k|    s.read(AsWritableBytes(Span{&obj, 1}));
  105|   337k|    return le32toh_internal(obj);
  106|   337k|}
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsE4readE4SpanISt4byteE:
 1136|  1.04M|    void read(Span<std::byte> dst) { GetStream().read(dst); }
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsE9GetStreamEv:
 1154|  1.04M|    {
 1155|       |        if constexpr (ContainsStream<SubStream>) {
 1156|       |            return m_substream.GetStream();
 1157|  1.04M|        } else {
 1158|  1.04M|            return m_substream;
 1159|  1.04M|        }
 1160|  1.04M|    }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEvRT_Rj:
  277|   337k|template<typename Stream> inline void Unserialize(Stream& s, uint32_t& a) { a = ser_readdata32(s); }
_Z15ReadCompactSizeI12ParamsStreamIR10DataStream20TransactionSerParamsEEmRT_b:
  340|   365k|{
  341|   365k|    uint8_t chSize = ser_readdata8(is);
  342|   365k|    uint64_t nSizeRet = 0;
  343|   365k|    if (chSize < 253)
  ------------------
  |  Branch (343:9): [True: 364k, False: 834]
  ------------------
  344|   364k|    {
  345|   364k|        nSizeRet = chSize;
  346|   364k|    }
  347|    834|    else if (chSize == 253)
  ------------------
  |  Branch (347:14): [True: 415, False: 419]
  ------------------
  348|    415|    {
  349|    415|        nSizeRet = ser_readdata16(is);
  350|    415|        if (nSizeRet < 253)
  ------------------
  |  Branch (350:13): [True: 5, False: 410]
  ------------------
  351|      5|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  352|    415|    }
  353|    419|    else if (chSize == 254)
  ------------------
  |  Branch (353:14): [True: 172, False: 247]
  ------------------
  354|    172|    {
  355|    172|        nSizeRet = ser_readdata32(is);
  356|    172|        if (nSizeRet < 0x10000u)
  ------------------
  |  Branch (356:13): [True: 13, False: 159]
  ------------------
  357|     13|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  358|    172|    }
  359|    247|    else
  360|    247|    {
  361|    247|        nSizeRet = ser_readdata64(is);
  362|    247|        if (nSizeRet < 0x100000000ULL)
  ------------------
  |  Branch (362:13): [True: 41, False: 206]
  ------------------
  363|     41|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  364|    247|    }
  365|   365k|    if (range_check && nSizeRet > MAX_SIZE) {
  ------------------
  |  Branch (365:9): [True: 365k, False: 87]
  |  Branch (365:24): [True: 140, False: 365k]
  ------------------
  366|    140|        throw std::ios_base::failure("ReadCompactSize(): size too large");
  367|    140|    }
  368|   365k|    return nSizeRet;
  369|   365k|}
_Z13ser_readdata8I12ParamsStreamIR10DataStream20TransactionSerParamsEEhRT_:
   84|   372k|{
   85|   372k|    uint8_t obj;
   86|   372k|    s.read(AsWritableBytes(Span{&obj, 1}));
   87|   372k|    return obj;
   88|   372k|}
_Z14ser_readdata16I12ParamsStreamIR10DataStream20TransactionSerParamsEEtRT_:
   90|    415|{
   91|    415|    uint16_t obj;
   92|    415|    s.read(AsWritableBytes(Span{&obj, 1}));
   93|    415|    return le16toh_internal(obj);
   94|    415|}
_Z14ser_readdata64I12ParamsStreamIR10DataStream20TransactionSerParamsEEmRT_:
  114|  20.1k|{
  115|  20.1k|    uint64_t obj;
  116|  20.1k|    s.read(AsWritableBytes(Span{&obj, 1}));
  117|  20.1k|    return le64toh_internal(obj);
  118|  20.1k|}
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsErsIRjEERS3_OT_:
 1134|  33.5k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsErsIRNSt3__16vectorI5CTxInNS5_9allocatorIS7_EEEEEERS3_OT_:
 1134|  15.6k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsE5CTxInNSt3__19allocatorIS5_EEEvRT_RNS6_6vectorIT0_T1_EE:
  866|  15.6k|{
  867|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  868|       |        // Limit size per read so bogus size value won't cause out of memory
  869|       |        v.clear();
  870|       |        unsigned int nSize = ReadCompactSize(is);
  871|       |        unsigned int i = 0;
  872|       |        while (i < nSize) {
  873|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  874|       |            v.resize(i + blk);
  875|       |            is.read(AsWritableBytes(Span{&v[i], blk}));
  876|       |            i += blk;
  877|       |        }
  878|  15.6k|    } else {
  879|  15.6k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  880|  15.6k|    }
  881|  15.6k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS9_9allocatorISB_EEEEEQ14UnserializableIT0_T_EEvRSI_OSH_:
  762|  15.6k|{
  763|  15.6k|    a.Unserialize(is);
  764|  15.6k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  483|  15.6k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsENSt3__16vectorI5CTxInNS8_9allocatorISA_EEEEEEvRT_RT0_:
  672|  15.6k|    {
  673|  15.6k|        Formatter formatter;
  674|  15.6k|        v.clear();
  675|  15.6k|        size_t size = ReadCompactSize(s);
  676|  15.6k|        size_t allocated = 0;
  677|  23.7k|        while (allocated < size) {
  ------------------
  |  Branch (677:16): [True: 8.08k, False: 15.6k]
  ------------------
  678|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  679|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  680|       |            // X MiB of data to make us allocate X+5 Mib.
  681|  8.08k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  682|  8.08k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  683|  8.08k|            v.reserve(allocated);
  684|   160k|            while (v.size() < allocated) {
  ------------------
  |  Branch (684:20): [True: 152k, False: 8.08k]
  ------------------
  685|   152k|                v.emplace_back();
  686|   152k|                formatter.Unser(s, v.back());
  687|   152k|            }
  688|  8.08k|        }
  689|  15.6k|    };
_ZN16DefaultFormatter5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsE5CTxInEEvRT_RT0_:
  777|   152k|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsER5CTxInQ14UnserializableIT0_T_EEvRS8_OS7_:
  762|   152k|{
  763|   152k|    a.Unserialize(is);
  764|   152k|}
_ZN5CTxIn11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  228|   152k|    {                                                                                               \
  229|   152k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|   152k|        Unser(s, *this);                                                                            \
  231|   152k|    }
_ZN5CTxIn5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_RS_:
  180|   152k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJR9COutPointR7CScriptRjEEEvRT_DpOT0_:
 1033|   152k|    {
 1034|   152k|        ::UnserializeMany(s, args...);
 1035|   152k|    }
_Z15UnserializeManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJR9COutPointR7CScriptRjEEvRT_DpOT0_:
 1001|   152k|{
 1002|   152k|    (::Unserialize(s, args), ...);
 1003|   152k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsER9COutPointQ14UnserializableIT0_T_EEvRS8_OS7_:
  762|   152k|{
  763|   152k|    a.Unserialize(is);
  764|   152k|}
_ZN9COutPoint11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  228|   152k|    {                                                                                               \
  229|   152k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|   152k|        Unser(s, *this);                                                                            \
  231|   152k|    }
_ZN9COutPoint5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_RS_:
  180|   152k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJR22transaction_identifierILb0EERjEEEvRT_DpOT0_:
 1033|   152k|    {
 1034|   152k|        ::UnserializeMany(s, args...);
 1035|   152k|    }
_Z15UnserializeManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJR22transaction_identifierILb0EERjEEvRT_DpOT0_:
 1001|   152k|{
 1002|   152k|    (::Unserialize(s, args), ...);
 1003|   152k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsER22transaction_identifierILb0EEQ14UnserializableIT0_T_EEvRS9_OS8_:
  762|   152k|{
  763|   152k|    a.Unserialize(is);
  764|   152k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsER7CScriptQ14UnserializableIT0_T_EEvRS8_OS7_:
  762|   171k|{
  763|   171k|    a.Unserialize(is);
  764|   171k|}
_ZN7CScript11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  228|   171k|    {                                                                                               \
  229|   171k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|   171k|        Unser(s, *this);                                                                            \
  231|   171k|    }
_ZN7CScript5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_RS_:
  180|   171k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJR9prevectorILj28EhjiEEEEvRT_DpOT0_:
 1033|   171k|    {
 1034|   171k|        ::UnserializeMany(s, args...);
 1035|   171k|    }
_Z15UnserializeManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJR9prevectorILj28EhjiEEEvRT_DpOT0_:
 1001|   171k|{
 1002|   171k|    (::Unserialize(s, args), ...);
 1003|   171k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsELj28EhEvRT_R9prevectorIXT0_ET1_jiE:
  823|   171k|{
  824|   171k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  825|       |        // Limit size per read so bogus size value won't cause out of memory
  826|   171k|        v.clear();
  827|   171k|        unsigned int nSize = ReadCompactSize(is);
  828|   171k|        unsigned int i = 0;
  829|   216k|        while (i < nSize) {
  ------------------
  |  Branch (829:16): [True: 44.4k, False: 171k]
  ------------------
  830|  44.4k|            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  831|  44.4k|            v.resize_uninitialized(i + blk);
  832|  44.4k|            is.read(AsWritableBytes(Span{&v[i], blk}));
  833|  44.4k|            i += blk;
  834|  44.4k|        }
  835|       |    } else {
  836|       |        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  837|       |    }
  838|   171k|}
_Z6AsBaseI9prevectorILj28EhjiE7CScriptERT_RT0_:
  145|   175k|{
  146|   175k|    static_assert(std::is_base_of_v<Out, In>);
  147|   175k|    return x;
  148|   175k|}
block.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSC_:
  497|  15.6k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEEC2ES9_:
  481|  15.6k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsErsIRhEERS3_OT_:
 1134|  7.27k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEvRT_Rh:
  273|  7.27k|template<typename Stream> inline void Unserialize(Stream& s, uint8_t& a ) { a = ser_readdata8(s); }
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsErsIRNSt3__16vectorI6CTxOutNS5_9allocatorIS7_EEEEEERS3_OT_:
 1134|  7.68k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsE6CTxOutNSt3__19allocatorIS5_EEEvRT_RNS6_6vectorIT0_T1_EE:
  866|  7.68k|{
  867|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  868|       |        // Limit size per read so bogus size value won't cause out of memory
  869|       |        v.clear();
  870|       |        unsigned int nSize = ReadCompactSize(is);
  871|       |        unsigned int i = 0;
  872|       |        while (i < nSize) {
  873|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  874|       |            v.resize(i + blk);
  875|       |            is.read(AsWritableBytes(Span{&v[i], blk}));
  876|       |            i += blk;
  877|       |        }
  878|  7.68k|    } else {
  879|  7.68k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  880|  7.68k|    }
  881|  7.68k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS9_9allocatorISB_EEEEEQ14UnserializableIT0_T_EEvRSI_OSH_:
  762|  7.68k|{
  763|  7.68k|    a.Unserialize(is);
  764|  7.68k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  483|  7.68k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsENSt3__16vectorI6CTxOutNS8_9allocatorISA_EEEEEEvRT_RT0_:
  672|  7.68k|    {
  673|  7.68k|        Formatter formatter;
  674|  7.68k|        v.clear();
  675|  7.68k|        size_t size = ReadCompactSize(s);
  676|  7.68k|        size_t allocated = 0;
  677|  8.80k|        while (allocated < size) {
  ------------------
  |  Branch (677:16): [True: 1.11k, False: 7.68k]
  ------------------
  678|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  679|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  680|       |            // X MiB of data to make us allocate X+5 Mib.
  681|  1.11k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  682|  1.11k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  683|  1.11k|            v.reserve(allocated);
  684|  21.0k|            while (v.size() < allocated) {
  ------------------
  |  Branch (684:20): [True: 19.9k, False: 1.11k]
  ------------------
  685|  19.9k|                v.emplace_back();
  686|  19.9k|                formatter.Unser(s, v.back());
  687|  19.9k|            }
  688|  1.11k|        }
  689|  7.68k|    };
_ZN16DefaultFormatter5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsE6CTxOutEEvRT_RT0_:
  777|  19.9k|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsER6CTxOutQ14UnserializableIT0_T_EEvRS8_OS7_:
  762|  19.9k|{
  763|  19.9k|    a.Unserialize(is);
  764|  19.9k|}
_ZN6CTxOut11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  228|  19.9k|    {                                                                                               \
  229|  19.9k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|  19.9k|        Unser(s, *this);                                                                            \
  231|  19.9k|    }
_ZN6CTxOut5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_RS_:
  180|  19.9k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJRlR7CScriptEEEvRT_DpOT0_:
 1033|  19.9k|    {
 1034|  19.9k|        ::UnserializeMany(s, args...);
 1035|  19.9k|    }
_Z15UnserializeManyI12ParamsStreamIR10DataStream20TransactionSerParamsEJRlR7CScriptEEvRT_DpOT0_:
 1001|  19.9k|{
 1002|  19.9k|    (::Unserialize(s, args), ...);
 1003|  19.9k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEvRT_Rl:
  278|  19.9k|template<typename Stream> inline void Unserialize(Stream& s, int64_t& a ) { a = ser_readdata64(s); }
block.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSC_:
  497|  7.68k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEEC2ES9_:
  481|  7.68k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN12ParamsStreamIR10DataStream20TransactionSerParamsErsIRNSt3__16vectorINS6_IhNS5_9allocatorIhEEEENS7_IS9_EEEEEERS3_OT_:
 1134|  25.1k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsENSt3__16vectorIhNS5_9allocatorIhEEEENS7_IS9_EEEvRT_RNS6_IT0_T1_EE:
  866|  25.1k|{
  867|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  868|       |        // Limit size per read so bogus size value won't cause out of memory
  869|       |        v.clear();
  870|       |        unsigned int nSize = ReadCompactSize(is);
  871|       |        unsigned int i = 0;
  872|       |        while (i < nSize) {
  873|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  874|       |            v.resize(i + blk);
  875|       |            is.read(AsWritableBytes(Span{&v[i], blk}));
  876|       |            i += blk;
  877|       |        }
  878|  25.1k|    } else {
  879|  25.1k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  880|  25.1k|    }
  881|  25.1k|}
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINSA_IhNS9_9allocatorIhEEEENSB_ISD_EEEEEQ14UnserializableIT0_T_EEvRSJ_OSI_:
  762|  25.1k|{
  763|  25.1k|    a.Unserialize(is);
  764|  25.1k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  483|  25.1k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsENSt3__16vectorINS9_IhNS8_9allocatorIhEEEENSA_ISC_EEEEEEvRT_RT0_:
  672|  25.1k|    {
  673|  25.1k|        Formatter formatter;
  674|  25.1k|        v.clear();
  675|  25.1k|        size_t size = ReadCompactSize(s);
  676|  25.1k|        size_t allocated = 0;
  677|  34.6k|        while (allocated < size) {
  ------------------
  |  Branch (677:16): [True: 9.52k, False: 25.1k]
  ------------------
  678|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  679|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  680|       |            // X MiB of data to make us allocate X+5 Mib.
  681|  9.52k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  682|  9.52k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  683|  9.52k|            v.reserve(allocated);
  684|   154k|            while (v.size() < allocated) {
  ------------------
  |  Branch (684:20): [True: 145k, False: 9.52k]
  ------------------
  685|   145k|                v.emplace_back();
  686|   145k|                formatter.Unser(s, v.back());
  687|   145k|            }
  688|  9.52k|        }
  689|  25.1k|    };
_ZN16DefaultFormatter5UnserI12ParamsStreamIR10DataStream20TransactionSerParamsENSt3__16vectorIhNS6_9allocatorIhEEEEEEvRT_RT0_:
  777|   145k|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEhNSt3__19allocatorIhEEEvRT_RNS5_6vectorIT0_T1_EE:
  866|   145k|{
  867|   145k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  868|       |        // Limit size per read so bogus size value won't cause out of memory
  869|   145k|        v.clear();
  870|   145k|        unsigned int nSize = ReadCompactSize(is);
  871|   145k|        unsigned int i = 0;
  872|   262k|        while (i < nSize) {
  ------------------
  |  Branch (872:16): [True: 117k, False: 145k]
  ------------------
  873|   117k|            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  874|   117k|            v.resize(i + blk);
  875|   117k|            is.read(AsWritableBytes(Span{&v[i], blk}));
  876|   117k|            i += blk;
  877|   117k|        }
  878|       |    } else {
  879|       |        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  880|       |    }
  881|   145k|}
block.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE7WrapperIT_RT0_EOSD_:
  497|  25.1k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEEC2ESA_:
  481|  25.1k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZNK12ParamsStreamIR10DataStream20TransactionSerParamsE9GetParamsIS2_EERKDav:
 1144|  20.0k|    {
 1145|  20.0k|        if constexpr (std::is_convertible_v<Params, P>) {
 1146|  20.0k|            return m_params;
 1147|       |        } else {
 1148|       |            return m_substream.template GetParams<P>();
 1149|       |        }
 1150|  20.0k|    }
_Z14ser_readdata32I10DataStreamEjRT_:
  102|   498k|{
  103|   498k|    uint32_t obj;
  104|   498k|    s.read(AsWritableBytes(Span{&obj, 1}));
  105|   498k|    return le32toh_internal(obj);
  106|   498k|}
_Z11UnserializeI10DataStreamEvRT_Rj:
  277|   497k|template<typename Stream> inline void Unserialize(Stream& s, uint32_t& a) { a = ser_readdata32(s); }
_Z15ReadCompactSizeI10DataStreamEmRT_b:
  340|  40.3k|{
  341|  40.3k|    uint8_t chSize = ser_readdata8(is);
  342|  40.3k|    uint64_t nSizeRet = 0;
  343|  40.3k|    if (chSize < 253)
  ------------------
  |  Branch (343:9): [True: 38.0k, False: 2.29k]
  ------------------
  344|  38.0k|    {
  345|  38.0k|        nSizeRet = chSize;
  346|  38.0k|    }
  347|  2.29k|    else if (chSize == 253)
  ------------------
  |  Branch (347:14): [True: 168, False: 2.13k]
  ------------------
  348|    168|    {
  349|    168|        nSizeRet = ser_readdata16(is);
  350|    168|        if (nSizeRet < 253)
  ------------------
  |  Branch (350:13): [True: 12, False: 156]
  ------------------
  351|     12|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  352|    168|    }
  353|  2.13k|    else if (chSize == 254)
  ------------------
  |  Branch (353:14): [True: 182, False: 1.94k]
  ------------------
  354|    182|    {
  355|    182|        nSizeRet = ser_readdata32(is);
  356|    182|        if (nSizeRet < 0x10000u)
  ------------------
  |  Branch (356:13): [True: 37, False: 145]
  ------------------
  357|     37|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  358|    182|    }
  359|  1.94k|    else
  360|  1.94k|    {
  361|  1.94k|        nSizeRet = ser_readdata64(is);
  362|  1.94k|        if (nSizeRet < 0x100000000ULL)
  ------------------
  |  Branch (362:13): [True: 54, False: 1.89k]
  ------------------
  363|     54|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  364|  1.94k|    }
  365|  40.2k|    if (range_check && nSizeRet > MAX_SIZE) {
  ------------------
  |  Branch (365:9): [True: 38.6k, False: 1.63k]
  |  Branch (365:24): [True: 293, False: 38.3k]
  ------------------
  366|    293|        throw std::ios_base::failure("ReadCompactSize(): size too large");
  367|    293|    }
  368|  39.9k|    return nSizeRet;
  369|  40.2k|}
_Z13ser_readdata8I10DataStreamEhRT_:
   84|  83.8k|{
   85|  83.8k|    uint8_t obj;
   86|  83.8k|    s.read(AsWritableBytes(Span{&obj, 1}));
   87|  83.8k|    return obj;
   88|  83.8k|}
_Z14ser_readdata16I10DataStreamEtRT_:
   90|    168|{
   91|    168|    uint16_t obj;
   92|    168|    s.read(AsWritableBytes(Span{&obj, 1}));
   93|    168|    return le16toh_internal(obj);
   94|    168|}
_Z14ser_readdata64I10DataStreamEmRT_:
  114|  12.5k|{
  115|  12.5k|    uint64_t obj;
  116|  12.5k|    s.read(AsWritableBytes(Span{&obj, 1}));
  117|  12.5k|    return le64toh_internal(obj);
  118|  12.5k|}
_Z11UnserializeI10DataStreamR7WrapperI15VarIntFormatterIL10VarIntMode0EERjEQ14UnserializableIT0_T_EEvRS9_OS8_:
  762|  10.6k|{
  763|  10.6k|    a.Unserialize(is);
  764|  10.6k|}
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERjE11UnserializeI10DataStreamEEvRT_:
  483|  21.5k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VarIntFormatterIL10VarIntMode0EE5UnserI10DataStreamjEEvRT_RT0_:
  514|  21.5k|    {
  515|  21.5k|        v = ReadVarInt<Stream,Mode,typename std::remove_cv<I>::type>(s);
  516|  21.5k|    }
_Z10ReadVarIntI10DataStreamL10VarIntMode0EjET1_RT_:
  453|  21.5k|{
  454|  21.5k|    CheckVarIntMode<Mode, I>();
  455|  21.5k|    I n = 0;
  456|  27.2k|    while(true) {
  ------------------
  |  Branch (456:11): [Folded - Ignored]
  ------------------
  457|  27.2k|        unsigned char chData = ser_readdata8(is);
  458|  27.2k|        if (n > (std::numeric_limits<I>::max() >> 7)) {
  ------------------
  |  Branch (458:13): [True: 31, False: 27.1k]
  ------------------
  459|     31|           throw std::ios_base::failure("ReadVarInt(): size too large");
  460|     31|        }
  461|  27.1k|        n = (n << 7) | (chData & 0x7F);
  462|  27.1k|        if (chData & 0x80) {
  ------------------
  |  Branch (462:13): [True: 5.71k, False: 21.4k]
  ------------------
  463|  5.71k|            if (n == std::numeric_limits<I>::max()) {
  ------------------
  |  Branch (463:17): [True: 1, False: 5.71k]
  ------------------
  464|      1|                throw std::ios_base::failure("ReadVarInt(): size too large");
  465|      1|            }
  466|  5.71k|            n++;
  467|  21.4k|        } else {
  468|  21.4k|            return n;
  469|  21.4k|        }
  470|  27.1k|    }
  471|  21.5k|}
_ZN15CheckVarIntModeIL10VarIntMode0EjEC2Ev:
  410|  21.5k|    {
  411|  21.5k|        static_assert(Mode != VarIntMode::DEFAULT || std::is_unsigned<I>::value, "Unsigned type required with mode DEFAULT.");
  412|  21.5k|        static_assert(Mode != VarIntMode::NONNEGATIVE_SIGNED || std::is_signed<I>::value, "Signed type required with mode NONNEGATIVE_SIGNED.");
  413|  21.5k|    }
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERjEC2ES3_:
  481|  21.5k|    explicit Wrapper(T obj) : m_object(obj) {}
_Z11UnserializeI10DataStreamR7WrapperI15VarIntFormatterIL10VarIntMode0EERmEQ14UnserializableIT0_T_EEvRS9_OS8_:
  762|  10.7k|{
  763|  10.7k|    a.Unserialize(is);
  764|  10.7k|}
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERmE11UnserializeI10DataStreamEEvRT_:
  483|  10.7k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VarIntFormatterIL10VarIntMode0EE5UnserI10DataStreammEEvRT_RT0_:
  514|  10.7k|    {
  515|  10.7k|        v = ReadVarInt<Stream,Mode,typename std::remove_cv<I>::type>(s);
  516|  10.7k|    }
_Z10ReadVarIntI10DataStreamL10VarIntMode0EmET1_RT_:
  453|  10.7k|{
  454|  10.7k|    CheckVarIntMode<Mode, I>();
  455|  10.7k|    I n = 0;
  456|  16.2k|    while(true) {
  ------------------
  |  Branch (456:11): [Folded - Ignored]
  ------------------
  457|  16.2k|        unsigned char chData = ser_readdata8(is);
  458|  16.2k|        if (n > (std::numeric_limits<I>::max() >> 7)) {
  ------------------
  |  Branch (458:13): [True: 42, False: 16.2k]
  ------------------
  459|     42|           throw std::ios_base::failure("ReadVarInt(): size too large");
  460|     42|        }
  461|  16.2k|        n = (n << 7) | (chData & 0x7F);
  462|  16.2k|        if (chData & 0x80) {
  ------------------
  |  Branch (462:13): [True: 5.53k, False: 10.6k]
  ------------------
  463|  5.53k|            if (n == std::numeric_limits<I>::max()) {
  ------------------
  |  Branch (463:17): [True: 1, False: 5.53k]
  ------------------
  464|      1|                throw std::ios_base::failure("ReadVarInt(): size too large");
  465|      1|            }
  466|  5.53k|            n++;
  467|  10.6k|        } else {
  468|  10.6k|            return n;
  469|  10.6k|        }
  470|  16.2k|    }
  471|  10.7k|}
_ZN15CheckVarIntModeIL10VarIntMode0EmEC2Ev:
  410|  10.7k|    {
  411|  10.7k|        static_assert(Mode != VarIntMode::DEFAULT || std::is_unsigned<I>::value, "Unsigned type required with mode DEFAULT.");
  412|  10.7k|        static_assert(Mode != VarIntMode::NONNEGATIVE_SIGNED || std::is_signed<I>::value, "Signed type required with mode NONNEGATIVE_SIGNED.");
  413|  10.7k|    }
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERmEC2ES3_:
  481|  10.7k|    explicit Wrapper(T obj) : m_object(obj) {}
_Z11UnserializeI10DataStreamR9COutPointQ14UnserializableIT0_T_EEvRS4_OS3_:
  762|  11.6k|{
  763|  11.6k|    a.Unserialize(is);
  764|  11.6k|}
_ZN9COutPoint11UnserializeI10DataStreamEEvRT_:
  228|  11.6k|    {                                                                                               \
  229|  11.6k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|  11.6k|        Unser(s, *this);                                                                            \
  231|  11.6k|    }
_ZN9COutPoint5UnserI10DataStreamEEvRT_RS_:
  180|  11.6k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10DataStreamJR22transaction_identifierILb0EERjEEEvRT_DpOT0_:
 1033|  11.6k|    {
 1034|  11.6k|        ::UnserializeMany(s, args...);
 1035|  11.6k|    }
_Z15UnserializeManyI10DataStreamJR22transaction_identifierILb0EERjEEvRT_DpOT0_:
 1001|  11.6k|{
 1002|  11.6k|    (::Unserialize(s, args), ...);
 1003|  11.6k|}
_Z11UnserializeI10DataStreamR22transaction_identifierILb0EEQ14UnserializableIT0_T_EEvRS5_OS4_:
  762|  11.6k|{
  763|  11.6k|    a.Unserialize(is);
  764|  11.6k|}
_Z11UnserializeI10DataStreamR13ParamsWrapperI20TransactionSerParams19CMutableTransactionEQ14UnserializableIT0_T_EEvRS7_OS6_:
  762|  20.0k|{
  763|  20.0k|    a.Unserialize(is);
  764|  20.0k|}
_ZN13ParamsWrapperI20TransactionSerParams19CMutableTransactionE11UnserializeI10DataStreamEEvRT_:
 1205|  20.0k|    {
 1206|  20.0k|        ParamsStream ss{s, m_params};
 1207|  20.0k|        ::Unserialize(ss, m_object);
 1208|  20.0k|    }
_Z11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsER19CMutableTransactionQ14UnserializableIT0_T_EEvRS8_OS7_:
  762|  20.0k|{
  763|  20.0k|    a.Unserialize(is);
  764|  20.0k|}
_ZN13ParamsWrapperI20TransactionSerParams19CMutableTransactionEC2ERKS0_RS1_:
 1195|  20.0k|    explicit ParamsWrapper(const Params& params, T& obj) : m_params{params}, m_object{obj} {}
_Z11UnserializeI10DataStreamR4CoinQ14UnserializableIT0_T_EEvRS4_OS3_:
  762|  10.8k|{
  763|  10.8k|    a.Unserialize(is);
  764|  10.8k|}
_Z11UnserializeI10DataStream7WrapperI15VarIntFormatterIL10VarIntMode0EERjEQ14UnserializableIT0_T_EEvRS8_OS7_:
  762|  10.8k|{
  763|  10.8k|    a.Unserialize(is);
  764|  10.8k|}
coins_view.cpp:_ZL5UsingI15VarIntFormatterIL10VarIntMode0EERjE7WrapperIT_RT0_EOS6_:
  497|  21.5k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_Z11UnserializeI10DataStream7WrapperI16TxOutCompressionR6CTxOutEQ14UnserializableIT0_T_EEvRS7_OS6_:
  762|  10.7k|{
  763|  10.7k|    a.Unserialize(is);
  764|  10.7k|}
_ZN7WrapperI16TxOutCompressionR6CTxOutE11UnserializeI10DataStreamEEvRT_:
  483|  10.7k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN16TxOutCompression5UnserI10DataStreamEEvRT_R6CTxOut:
  180|  10.7k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10DataStreamJ7WrapperI17AmountCompressionRlES2_I17ScriptCompressionR7CScriptEEEEvRT_DpOT0_:
 1033|  10.7k|    {
 1034|  10.7k|        ::UnserializeMany(s, args...);
 1035|  10.7k|    }
_Z15UnserializeManyI10DataStreamJR7WrapperI17AmountCompressionRlERS1_I17ScriptCompressionR7CScriptEEEvRT_DpOT0_:
 1001|  10.7k|{
 1002|  10.7k|    (::Unserialize(s, args), ...);
 1003|  10.7k|}
_Z11UnserializeI10DataStreamR7WrapperI17AmountCompressionRlEQ14UnserializableIT0_T_EEvRS7_OS6_:
  762|  10.7k|{
  763|  10.7k|    a.Unserialize(is);
  764|  10.7k|}
_ZN7WrapperI17AmountCompressionRlE11UnserializeI10DataStreamEEvRT_:
  483|  10.7k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
coins_view.cpp:_ZL5UsingI15VarIntFormatterIL10VarIntMode0EERmE7WrapperIT_RT0_EOS6_:
  497|  10.7k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_Z11UnserializeI10DataStreamR7WrapperI17ScriptCompressionR7CScriptEQ14UnserializableIT0_T_EEvRS8_OS7_:
  762|  10.6k|{
  763|  10.6k|    a.Unserialize(is);
  764|  10.6k|}
_ZN7WrapperI17ScriptCompressionR7CScriptE11UnserializeI10DataStreamEEvRT_:
  483|  10.6k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_Z11UnserializeI10DataStreamTk9BasicBytehEvRT_4SpanIT0_E:
  283|  27.6k|template <typename Stream, BasicByte B> void Unserialize(Stream& s, Span<B> span) { s.read(AsWritableBytes(span)); }
coins_view.cpp:_ZL5UsingI17AmountCompressionRlE7WrapperIT_RT0_EOS4_:
  497|  10.7k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN7WrapperI17AmountCompressionRlEC2ES1_:
  481|  10.7k|    explicit Wrapper(T obj) : m_object(obj) {}
coins_view.cpp:_ZL5UsingI17ScriptCompressionR7CScriptE7WrapperIT_RT0_EOS5_:
  497|  10.7k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN7WrapperI17ScriptCompressionR7CScriptEC2ES2_:
  481|  10.7k|    explicit Wrapper(T obj) : m_object(obj) {}
coins_view.cpp:_ZL5UsingI16TxOutCompressionR6CTxOutE7WrapperIT_RT0_EOS5_:
  497|  10.7k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN7WrapperI16TxOutCompressionR6CTxOutEC2ES2_:
  481|  10.7k|    explicit Wrapper(T obj) : m_object(obj) {}
_Z14ser_writedata8I10DataStreamEvRT_h:
   55|  27.7k|{
   56|  27.7k|    s.write(AsBytes(Span{&obj, 1}));
   57|  27.7k|}
_Z9SerializeI10DataStreamTk9BasicByteKhEvRT_4SpanIT0_E:
  268|  9.24k|template <typename Stream, BasicByte B> void Serialize(Stream& s, Span<B> span) { s.write(AsBytes(span)); }
_Z16WriteCompactSizeI10DataStreamEvRT_m:
  309|  27.7k|{
  310|  27.7k|    if (nSize < 253)
  ------------------
  |  Branch (310:9): [True: 26.5k, False: 1.17k]
  ------------------
  311|  26.5k|    {
  312|  26.5k|        ser_writedata8(os, nSize);
  313|  26.5k|    }
  314|  1.17k|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (314:14): [True: 1.16k, False: 4]
  ------------------
  315|  1.16k|    {
  316|  1.16k|        ser_writedata8(os, 253);
  317|  1.16k|        ser_writedata16(os, nSize);
  318|  1.16k|    }
  319|      4|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (319:14): [True: 4, False: 0]
  ------------------
  320|      4|    {
  321|      4|        ser_writedata8(os, 254);
  322|      4|        ser_writedata32(os, nSize);
  323|      4|    }
  324|      0|    else
  325|      0|    {
  326|      0|        ser_writedata8(os, 255);
  327|      0|        ser_writedata64(os, nSize);
  328|      0|    }
  329|  27.7k|    return;
  330|  27.7k|}
_Z15ser_writedata16I10DataStreamEvRT_t:
   59|  1.16k|{
   60|  1.16k|    obj = htole16_internal(obj);
   61|  1.16k|    s.write(AsBytes(Span{&obj, 1}));
   62|  1.16k|}
_Z15ser_writedata32I10DataStreamEvRT_j:
   69|   234k|{
   70|   234k|    obj = htole32_internal(obj);
   71|   234k|    s.write(AsBytes(Span{&obj, 1}));
   72|   234k|}
_Z9SerializeI10DataStreamEvRT_j:
  262|   234k|template<typename Stream> inline void Serialize(Stream& s, uint32_t a) { ser_writedata32(s, a); }
_Z11UnserializeI10DataStreamEvRT_Rl:
  278|  11.9k|template<typename Stream> inline void Unserialize(Stream& s, int64_t& a ) { a = ser_readdata64(s); }
_Z11UnserializeI10DataStreamR7CPubKeyQ14UnserializableIT0_T_EEvRS4_OS3_:
  762|  19.8k|{
  763|  19.8k|    a.Unserialize(is);
  764|  19.8k|}
_Z11UnserializeI10DataStreamR7CScriptQ14UnserializableIT0_T_EEvRS4_OS3_:
  762|  3.61k|{
  763|  3.61k|    a.Unserialize(is);
  764|  3.61k|}
_ZN7CScript11UnserializeI10DataStreamEEvRT_:
  228|  3.61k|    {                                                                                               \
  229|  3.61k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|  3.61k|        Unser(s, *this);                                                                            \
  231|  3.61k|    }
_ZN7CScript5UnserI10DataStreamEEvRT_RS_:
  180|  3.61k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10DataStreamJR9prevectorILj28EhjiEEEEvRT_DpOT0_:
 1033|  3.61k|    {
 1034|  3.61k|        ::UnserializeMany(s, args...);
 1035|  3.61k|    }
_Z15UnserializeManyI10DataStreamJR9prevectorILj28EhjiEEEvRT_DpOT0_:
 1001|  3.61k|{
 1002|  3.61k|    (::Unserialize(s, args), ...);
 1003|  3.61k|}
_Z11UnserializeI10DataStreamLj28EhEvRT_R9prevectorIXT0_ET1_jiE:
  823|  3.61k|{
  824|  3.61k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  825|       |        // Limit size per read so bogus size value won't cause out of memory
  826|  3.61k|        v.clear();
  827|  3.61k|        unsigned int nSize = ReadCompactSize(is);
  828|  3.61k|        unsigned int i = 0;
  829|  5.02k|        while (i < nSize) {
  ------------------
  |  Branch (829:16): [True: 1.40k, False: 3.61k]
  ------------------
  830|  1.40k|            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  831|  1.40k|            v.resize_uninitialized(i + blk);
  832|  1.40k|            is.read(AsWritableBytes(Span{&v[i], blk}));
  833|  1.40k|            i += blk;
  834|  1.40k|        }
  835|       |    } else {
  836|       |        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  837|       |    }
  838|  3.61k|}
_Z11UnserializeI10DataStreamR13KeyOriginInfoQ14UnserializableIT0_T_EEvRS4_OS3_:
  762|  16.8k|{
  763|  16.8k|    a.Unserialize(is);
  764|  16.8k|}
_ZN13KeyOriginInfo11UnserializeI10DataStreamEEvRT_:
  228|  16.8k|    {                                                                                               \
  229|  16.8k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|  16.8k|        Unser(s, *this);                                                                            \
  231|  16.8k|    }
_ZN13KeyOriginInfo5UnserI10DataStreamEEvRT_RS_:
  180|  16.8k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10DataStreamJRA4_hRNSt3__16vectorIjNS4_9allocatorIjEEEEEEEvRT_DpOT0_:
 1033|  16.8k|    {
 1034|  16.8k|        ::UnserializeMany(s, args...);
 1035|  16.8k|    }
_Z15UnserializeManyI10DataStreamJRA4_hRNSt3__16vectorIjNS3_9allocatorIjEEEEEEvRT_DpOT0_:
 1001|  16.8k|{
 1002|  16.8k|    (::Unserialize(s, args), ...);
 1003|  16.8k|}
_Z11UnserializeI10DataStreamTk9BasicBytehLi4EEvRT_RAT1__T0_:
  280|  17.0k|template <typename Stream, BasicByte B, int N> void Unserialize(Stream& s, B (&a)[N]) { s.read(MakeWritableByteSpan(a)); }
_Z11UnserializeI10DataStreamjNSt3__19allocatorIjEEEvRT_RNS1_6vectorIT0_T1_EE:
  866|  16.2k|{
  867|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  868|       |        // Limit size per read so bogus size value won't cause out of memory
  869|       |        v.clear();
  870|       |        unsigned int nSize = ReadCompactSize(is);
  871|       |        unsigned int i = 0;
  872|       |        while (i < nSize) {
  873|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  874|       |            v.resize(i + blk);
  875|       |            is.read(AsWritableBytes(Span{&v[i], blk}));
  876|       |            i += blk;
  877|       |        }
  878|  16.2k|    } else {
  879|  16.2k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  880|  16.2k|    }
  881|  16.2k|}
_Z11UnserializeI10DataStream7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS5_9allocatorIjEEEEEQ14UnserializableIT0_T_EEvRSD_OSC_:
  762|  16.2k|{
  763|  16.2k|    a.Unserialize(is);
  764|  16.2k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS3_9allocatorIjEEEEE11UnserializeI10DataStreamEEvRT_:
  483|  16.2k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI10DataStreamNSt3__16vectorIjNS4_9allocatorIjEEEEEEvRT_RT0_:
  672|  16.2k|    {
  673|  16.2k|        Formatter formatter;
  674|  16.2k|        v.clear();
  675|  16.2k|        size_t size = ReadCompactSize(s);
  676|  16.2k|        size_t allocated = 0;
  677|  19.3k|        while (allocated < size) {
  ------------------
  |  Branch (677:16): [True: 3.04k, False: 16.2k]
  ------------------
  678|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  679|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  680|       |            // X MiB of data to make us allocate X+5 Mib.
  681|  3.04k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  682|  3.04k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  683|  3.04k|            v.reserve(allocated);
  684|   326k|            while (v.size() < allocated) {
  ------------------
  |  Branch (684:20): [True: 323k, False: 3.04k]
  ------------------
  685|   323k|                v.emplace_back();
  686|   323k|                formatter.Unser(s, v.back());
  687|   323k|            }
  688|  3.04k|        }
  689|  16.2k|    };
_ZN16DefaultFormatter5UnserI10DataStreamjEEvRT_RT0_:
  777|   323k|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
deserialize.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS3_9allocatorIjEEEEE7WrapperIT_RT0_EOSB_:
  497|  16.2k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS3_9allocatorIjEEEEEC2ES8_:
  481|  16.2k|    explicit Wrapper(T obj) : m_object(obj) {}
_Z9SerializeI10DataStreamTk9BasicBytehLi4EEvRT_RAT1__KT0_:
  265|  9.24k|template <typename Stream, BasicByte B, int N> void Serialize(Stream& s, const B (&a)[N]) { s.write(MakeByteSpan(a)); }
_Z11UnserializeI10DataStreamR6CTxOutQ14UnserializableIT0_T_EEvRS4_OS3_:
  762|  11.9k|{
  763|  11.9k|    a.Unserialize(is);
  764|  11.9k|}
_ZN6CTxOut11UnserializeI10DataStreamEEvRT_:
  228|  11.9k|    {                                                                                               \
  229|  11.9k|        static_assert(std::is_same<cls&, decltype(*this)>::value, "Unserialize type mismatch");     \
  230|  11.9k|        Unser(s, *this);                                                                            \
  231|  11.9k|    }
_ZN6CTxOut5UnserI10DataStreamEEvRT_RS_:
  180|  11.9k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10DataStreamJRlR7CScriptEEEvRT_DpOT0_:
 1033|  11.9k|    {
 1034|  11.9k|        ::UnserializeMany(s, args...);
 1035|  11.9k|    }
_Z15UnserializeManyI10DataStreamJRlR7CScriptEEvRT_DpOT0_:
 1001|  11.9k|{
 1002|  11.9k|    (::Unserialize(s, args), ...);
 1003|  11.9k|}
_Z9SerializeI12SizeComputer17CompactSizeWriterQ12SerializableIT0_T_EEvRS3_RKS2_:
  753|  9.24k|{
  754|  9.24k|    a.Serialize(os);
  755|  9.24k|}
_ZNK17CompactSizeWriter9SerializeI12SizeComputerEEvRT_:
  618|  9.24k|    void Serialize(Stream &s) const {
  619|  9.24k|        WriteCompactSize<Stream>(s, n);
  620|  9.24k|    }
_Z16WriteCompactSizeI12SizeComputerEvRT_m:
  309|  9.24k|{
  310|  9.24k|    if (nSize < 253)
  ------------------
  |  Branch (310:9): [True: 8.12k, False: 1.12k]
  ------------------
  311|  8.12k|    {
  312|  8.12k|        ser_writedata8(os, nSize);
  313|  8.12k|    }
  314|  1.12k|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (314:14): [True: 1.12k, False: 0]
  ------------------
  315|  1.12k|    {
  316|  1.12k|        ser_writedata8(os, 253);
  317|  1.12k|        ser_writedata16(os, nSize);
  318|  1.12k|    }
  319|      0|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (319:14): [True: 0, False: 0]
  ------------------
  320|      0|    {
  321|      0|        ser_writedata8(os, 254);
  322|      0|        ser_writedata32(os, nSize);
  323|      0|    }
  324|      0|    else
  325|      0|    {
  326|      0|        ser_writedata8(os, 255);
  327|      0|        ser_writedata64(os, nSize);
  328|      0|    }
  329|  9.24k|    return;
  330|  9.24k|}
_Z14ser_writedata8I12SizeComputerEvRT_h:
   55|  9.24k|{
   56|  9.24k|    s.write(AsBytes(Span{&obj, 1}));
   57|  9.24k|}
_Z15ser_writedata16I12SizeComputerEvRT_t:
   59|  1.12k|{
   60|  1.12k|    obj = htole16_internal(obj);
   61|  1.12k|    s.write(AsBytes(Span{&obj, 1}));
   62|  1.12k|}
_Z9SerializeI10DataStream17CompactSizeWriterQ12SerializableIT0_T_EEvRS3_RKS2_:
  753|  9.24k|{
  754|  9.24k|    a.Serialize(os);
  755|  9.24k|}
_ZNK17CompactSizeWriter9SerializeI10DataStreamEEvRT_:
  618|  9.24k|    void Serialize(Stream &s) const {
  619|  9.24k|        WriteCompactSize<Stream>(s, n);
  620|  9.24k|    }
_Z13SerializeManyI12SizeComputerJ17CompactSizeWriter4SpanIKhEEEvRT_DpRKT0_:
  995|  9.24k|{
  996|  9.24k|    (::Serialize(s, args), ...);
  997|  9.24k|}
_Z9SerializeI12SizeComputerTk9BasicByteKhEvRT_4SpanIT0_E:
  268|  9.24k|template <typename Stream, BasicByte B> void Serialize(Stream& s, Span<B> span) { s.write(AsBytes(span)); }
_Z13SerializeManyI10DataStreamJ17CompactSizeWriter4SpanIKhEEEvRT_DpRKT0_:
  995|  9.24k|{
  996|  9.24k|    (::Serialize(s, args), ...);
  997|  9.24k|}
transaction.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSD_:
  497|  18.1k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
transaction.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSD_:
  497|  17.1k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
transaction.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE7WrapperIT_RT0_EOSE_:
  497|  24.5k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_ZN13ParamsWrapperI20TransactionSerParamsK12CTransactionEC2ERKS0_RS2_:
 1195|  17.1k|    explicit ParamsWrapper(const Params& params, T& obj) : m_params{params}, m_object{obj} {}
_Z9SerializeI10HashWriterEvRT_j:
  262|  11.0M|template<typename Stream> inline void Serialize(Stream& s, uint32_t a) { ser_writedata32(s, a); }
_Z15ser_writedata32I10HashWriterEvRT_j:
   69|  12.0M|{
   70|  12.0M|    obj = htole32_internal(obj);
   71|  12.0M|    s.write(AsBytes(Span{&obj, 1}));
   72|  12.0M|}
_Z16WriteCompactSizeI10HashWriterEvRT_m:
  309|  6.10M|{
  310|  6.10M|    if (nSize < 253)
  ------------------
  |  Branch (310:9): [True: 6.10M, False: 862]
  ------------------
  311|  6.10M|    {
  312|  6.10M|        ser_writedata8(os, nSize);
  313|  6.10M|    }
  314|    862|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (314:14): [True: 677, False: 185]
  ------------------
  315|    677|    {
  316|    677|        ser_writedata8(os, 253);
  317|    677|        ser_writedata16(os, nSize);
  318|    677|    }
  319|    185|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (319:14): [True: 185, False: 0]
  ------------------
  320|    185|    {
  321|    185|        ser_writedata8(os, 254);
  322|    185|        ser_writedata32(os, nSize);
  323|    185|    }
  324|      0|    else
  325|      0|    {
  326|      0|        ser_writedata8(os, 255);
  327|      0|        ser_writedata64(os, nSize);
  328|      0|    }
  329|  6.10M|    return;
  330|  6.10M|}
_Z14ser_writedata8I10HashWriterEvRT_h:
   55|  6.10M|{
   56|  6.10M|    s.write(AsBytes(Span{&obj, 1}));
   57|  6.10M|}
_Z15ser_writedata16I10HashWriterEvRT_t:
   59|    677|{
   60|    677|    obj = htole16_internal(obj);
   61|    677|    s.write(AsBytes(Span{&obj, 1}));
   62|    677|}
_Z15ser_writedata64I10HashWriterEvRT_m:
   79|   256k|{
   80|   256k|    obj = htole64_internal(obj);
   81|   256k|    s.write(AsBytes(Span{&obj, 1}));
   82|   256k|}
_Z9SerializeI10HashWriterhNSt3__19allocatorIhEEEvRT_RKNS1_6vectorIT0_T1_EE:
  846|    214|{
  847|    214|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  848|    214|        WriteCompactSize(os, v.size());
  849|    214|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (849:13): [True: 214, False: 0]
  ------------------
  850|       |    } else if constexpr (std::is_same_v<T, bool>) {
  851|       |        // A special case for std::vector<bool>, as dereferencing
  852|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  853|       |        // due to std::vector's special casing for bool arguments.
  854|       |        WriteCompactSize(os, v.size());
  855|       |        for (bool elem : v) {
  856|       |            ::Serialize(os, elem);
  857|       |        }
  858|       |    } else {
  859|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  860|       |    }
  861|    214|}
_Z9SerializeI10HashWriter7uint256Q12SerializableIT0_T_EEvRS3_RKS2_:
  753|  58.1k|{
  754|  58.1k|    a.Serialize(os);
  755|  58.1k|}
_Z9SerializeI10HashWriterTk9BasicByteKhEvRT_4SpanIT0_E:
  268|  5.95M|template <typename Stream, BasicByte B> void Serialize(Stream& s, Span<B> span) { s.write(AsBytes(span)); }
_Z9SerializeI10HashWriterEvRT_h:
  258|  2.64k|template<typename Stream> inline void Serialize(Stream& s, uint8_t a ) { ser_writedata8(s, a); }
_Z9SerializeI10HashWriterEvRT_i:
  261|   961k|template<typename Stream> inline void Serialize(Stream& s, int32_t a ) { ser_writedata32(s, a); }
_Z9SerializeI10HashWriter9COutPointQ12SerializableIT0_T_EEvRS3_RKS2_:
  753|  5.89M|{
  754|  5.89M|    a.Serialize(os);
  755|  5.89M|}
_ZNK9COutPoint9SerializeI10HashWriterEEvRT_:
  222|  5.89M|    {                                                                                               \
  223|  5.89M|        static_assert(std::is_same<const cls&, decltype(*this)>::value, "Serialize type mismatch"); \
  224|  5.89M|        Ser(s, *this);                                                                              \
  225|  5.89M|    }                                                                                               \
_ZN9COutPoint3SerI10HashWriterEEvRT_RKS_:
  178|  5.89M|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI10HashWriterJ22transaction_identifierILb0EEjEEEvRT_DpRKT0_:
 1013|  5.89M|    {
 1014|  5.89M|        ::SerializeMany(s, args...);
 1015|  5.89M|    }
_Z13SerializeManyI10HashWriterJ22transaction_identifierILb0EEjEEvRT_DpRKT0_:
  995|  5.89M|{
  996|  5.89M|    (::Serialize(s, args), ...);
  997|  5.89M|}
_Z9SerializeI10HashWriter22transaction_identifierILb0EEQ12SerializableIT0_T_EEvRS4_RKS3_:
  753|  5.89M|{
  754|  5.89M|    a.Serialize(os);
  755|  5.89M|}
_Z9SerializeI10HashWriter6CTxOutQ12SerializableIT0_T_EEvRS3_RKS2_:
  753|   233k|{
  754|   233k|    a.Serialize(os);
  755|   233k|}
_ZNK6CTxOut9SerializeI10HashWriterEEvRT_:
  222|   233k|    {                                                                                               \
  223|   233k|        static_assert(std::is_same<const cls&, decltype(*this)>::value, "Serialize type mismatch"); \
  224|   233k|        Ser(s, *this);                                                                              \
  225|   233k|    }                                                                                               \
_ZN6CTxOut3SerI10HashWriterEEvRT_RKS_:
  178|   233k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI10HashWriterJl7CScriptEEEvRT_DpRKT0_:
 1013|   233k|    {
 1014|   233k|        ::SerializeMany(s, args...);
 1015|   233k|    }
_Z13SerializeManyI10HashWriterJl7CScriptEEvRT_DpRKT0_:
  995|   233k|{
  996|   233k|    (::Serialize(s, args), ...);
  997|   233k|}
_Z9SerializeI10HashWriterEvRT_l:
  263|   256k|template<typename Stream> inline void Serialize(Stream& s, int64_t a ) { ser_writedata64(s, a); }
_Z9SerializeI10HashWriter7CScriptQ12SerializableIT0_T_EEvRS3_RKS2_:
  753|  5.92M|{
  754|  5.92M|    a.Serialize(os);
  755|  5.92M|}
_ZNK7CScript9SerializeI10HashWriterEEvRT_:
  222|  5.92M|    {                                                                                               \
  223|  5.92M|        static_assert(std::is_same<const cls&, decltype(*this)>::value, "Serialize type mismatch"); \
  224|  5.92M|        Ser(s, *this);                                                                              \
  225|  5.92M|    }                                                                                               \
_ZN7CScript3SerI10HashWriterEEvRT_RKS_:
  178|  5.92M|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI10HashWriterJ9prevectorILj28EhjiEEEEvRT_DpRKT0_:
 1013|  5.92M|    {
 1014|  5.92M|        ::SerializeMany(s, args...);
 1015|  5.92M|    }
_Z13SerializeManyI10HashWriterJ9prevectorILj28EhjiEEEvRT_DpRKT0_:
  995|  5.92M|{
  996|  5.92M|    (::Serialize(s, args), ...);
  997|  5.92M|}
_Z9SerializeI10HashWriterLj28EhEvRT_RK9prevectorIXT0_ET1_jiE:
  811|  5.92M|{
  812|  5.92M|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  813|  5.92M|        WriteCompactSize(os, v.size());
  814|  5.92M|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (814:13): [True: 137k, False: 5.78M]
  ------------------
  815|       |    } else {
  816|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  817|       |    }
  818|  5.92M|}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsEC2ES1_RKS2_:
 1127|  17.1k|    ParamsStream(SubStream&& substream, const Params& params LIFETIMEBOUND) : m_params{params}, m_substream{std::forward<SubStream>(substream)} {}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsIjEERS3_RKT_:
 1133|  34.3k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_j:
  262|   382k|template<typename Stream> inline void Serialize(Stream& s, uint32_t a) { ser_writedata32(s, a); }
_Z15ser_writedata32I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_j:
   69|   382k|{
   70|   382k|    obj = htole32_internal(obj);
   71|   382k|    s.write(AsBytes(Span{&obj, 1}));
   72|   382k|}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsE5writeE4SpanIKSt4byteE:
 1135|  1.13M|    void write(Span<const std::byte> src) { GetStream().write(src); }
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsE9GetStreamEv:
 1154|  1.13M|    {
 1155|       |        if constexpr (ContainsStream<SubStream>) {
 1156|       |            return m_substream.GetStream();
 1157|  1.13M|        } else {
 1158|  1.13M|            return m_substream;
 1159|  1.13M|        }
 1160|  1.13M|    }
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsINSt3__16vectorI5CTxInNS5_9allocatorIS7_EEEEEERS3_RKT_:
 1133|  18.1k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE5CTxInNSt3__19allocatorIS5_EEEvRT_RKNS6_6vectorIT0_T1_EE:
  846|  18.1k|{
  847|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  848|       |        WriteCompactSize(os, v.size());
  849|       |        if (!v.empty()) os.write(MakeByteSpan(v));
  850|       |    } else if constexpr (std::is_same_v<T, bool>) {
  851|       |        // A special case for std::vector<bool>, as dereferencing
  852|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  853|       |        // due to std::vector's special casing for bool arguments.
  854|       |        WriteCompactSize(os, v.size());
  855|       |        for (bool elem : v) {
  856|       |            ::Serialize(os, elem);
  857|       |        }
  858|  18.1k|    } else {
  859|  18.1k|        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  860|  18.1k|    }
  861|  18.1k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS9_9allocatorISB_EEEEEQ12SerializableIT0_T_EEvRSJ_RKSI_:
  753|  18.1k|{
  754|  18.1k|    a.Serialize(os);
  755|  18.1k|}
_ZNK7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  482|  18.1k|    template<typename Stream> void Serialize(Stream &s) const { Formatter().Ser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorI5CTxInNS8_9allocatorISA_EEEEEEvRT_RKT0_:
  662|  18.1k|    {
  663|  18.1k|        Formatter formatter;
  664|  18.1k|        WriteCompactSize(s, v.size());
  665|   174k|        for (const typename V::value_type& elem : v) {
  ------------------
  |  Branch (665:49): [True: 174k, False: 18.1k]
  ------------------
  666|   174k|            formatter.Ser(s, elem);
  667|   174k|        }
  668|  18.1k|    }
_Z16WriteCompactSizeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_m:
  309|   393k|{
  310|   393k|    if (nSize < 253)
  ------------------
  |  Branch (310:9): [True: 393k, False: 285]
  ------------------
  311|   393k|    {
  312|   393k|        ser_writedata8(os, nSize);
  313|   393k|    }
  314|    285|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (314:14): [True: 250, False: 35]
  ------------------
  315|    250|    {
  316|    250|        ser_writedata8(os, 253);
  317|    250|        ser_writedata16(os, nSize);
  318|    250|    }
  319|     35|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (319:14): [True: 35, False: 0]
  ------------------
  320|     35|    {
  321|     35|        ser_writedata8(os, 254);
  322|     35|        ser_writedata32(os, nSize);
  323|     35|    }
  324|      0|    else
  325|      0|    {
  326|      0|        ser_writedata8(os, 255);
  327|      0|        ser_writedata64(os, nSize);
  328|      0|    }
  329|   393k|    return;
  330|   393k|}
_Z14ser_writedata8I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_h:
   55|   394k|{
   56|   394k|    s.write(AsBytes(Span{&obj, 1}));
   57|   394k|}
_Z15ser_writedata16I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_t:
   59|    250|{
   60|    250|    obj = htole16_internal(obj);
   61|    250|    s.write(AsBytes(Span{&obj, 1}));
   62|    250|}
_Z15ser_writedata64I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_m:
   79|  24.8k|{
   80|  24.8k|    obj = htole64_internal(obj);
   81|  24.8k|    s.write(AsBytes(Span{&obj, 1}));
   82|  24.8k|}
_ZN16DefaultFormatter3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsE5CTxInEEvRT_RKT0_:
  774|   174k|    static void Ser(Stream& s, const T& t) { Serialize(s, t); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE5CTxInQ12SerializableIT0_T_EEvRS7_RKS6_:
  753|   174k|{
  754|   174k|    a.Serialize(os);
  755|   174k|}
_ZNK5CTxIn9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  222|   174k|    {                                                                                               \
  223|   174k|        static_assert(std::is_same<const cls&, decltype(*this)>::value, "Serialize type mismatch"); \
  224|   174k|        Ser(s, *this);                                                                              \
  225|   174k|    }                                                                                               \
_ZN5CTxIn3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  178|   174k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9COutPoint7CScriptjEEEvRT_DpRKT0_:
 1013|   174k|    {
 1014|   174k|        ::SerializeMany(s, args...);
 1015|   174k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9COutPoint7CScriptjEEvRT_DpRKT0_:
  995|   174k|{
  996|   174k|    (::Serialize(s, args), ...);
  997|   174k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE9COutPointQ12SerializableIT0_T_EEvRS7_RKS6_:
  753|   174k|{
  754|   174k|    a.Serialize(os);
  755|   174k|}
_ZNK9COutPoint9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  222|   174k|    {                                                                                               \
  223|   174k|        static_assert(std::is_same<const cls&, decltype(*this)>::value, "Serialize type mismatch"); \
  224|   174k|        Ser(s, *this);                                                                              \
  225|   174k|    }                                                                                               \
_ZN9COutPoint3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  178|   174k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ22transaction_identifierILb0EEjEEEvRT_DpRKT0_:
 1013|   174k|    {
 1014|   174k|        ::SerializeMany(s, args...);
 1015|   174k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ22transaction_identifierILb0EEjEEvRT_DpRKT0_:
  995|   174k|{
  996|   174k|    (::Serialize(s, args), ...);
  997|   174k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE22transaction_identifierILb0EEQ12SerializableIT0_T_EEvRS8_RKS7_:
  753|   174k|{
  754|   174k|    a.Serialize(os);
  755|   174k|}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsI4SpanIKhEEERS3_RKT_:
 1133|   174k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsETk9BasicByteKhEvRT_4SpanIT0_E:
  268|   174k|template <typename Stream, BasicByte B> void Serialize(Stream& s, Span<B> span) { s.write(AsBytes(span)); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7CScriptQ12SerializableIT0_T_EEvRS7_RKS6_:
  753|   198k|{
  754|   198k|    a.Serialize(os);
  755|   198k|}
_ZNK7CScript9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  222|   198k|    {                                                                                               \
  223|   198k|        static_assert(std::is_same<const cls&, decltype(*this)>::value, "Serialize type mismatch"); \
  224|   198k|        Ser(s, *this);                                                                              \
  225|   198k|    }                                                                                               \
_ZN7CScript3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  178|   198k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9prevectorILj28EhjiEEEEvRT_DpRKT0_:
 1013|   198k|    {
 1014|   198k|        ::SerializeMany(s, args...);
 1015|   198k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9prevectorILj28EhjiEEEvRT_DpRKT0_:
  995|   198k|{
  996|   198k|    (::Serialize(s, args), ...);
  997|   198k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsELj28EhEvRT_RK9prevectorIXT0_ET1_jiE:
  811|   198k|{
  812|   198k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  813|   198k|        WriteCompactSize(os, v.size());
  814|   198k|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (814:13): [True: 54.6k, False: 144k]
  ------------------
  815|       |    } else {
  816|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  817|       |    }
  818|   198k|}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsIhEERS3_RKT_:
 1133|  1.02k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_h:
  258|  1.02k|template<typename Stream> inline void Serialize(Stream& s, uint8_t a ) { ser_writedata8(s, a); }
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsINSt3__16vectorI6CTxOutNS5_9allocatorIS7_EEEEEERS3_RKT_:
 1133|  17.1k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE6CTxOutNSt3__19allocatorIS5_EEEvRT_RKNS6_6vectorIT0_T1_EE:
  846|  17.1k|{
  847|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  848|       |        WriteCompactSize(os, v.size());
  849|       |        if (!v.empty()) os.write(MakeByteSpan(v));
  850|       |    } else if constexpr (std::is_same_v<T, bool>) {
  851|       |        // A special case for std::vector<bool>, as dereferencing
  852|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  853|       |        // due to std::vector's special casing for bool arguments.
  854|       |        WriteCompactSize(os, v.size());
  855|       |        for (bool elem : v) {
  856|       |            ::Serialize(os, elem);
  857|       |        }
  858|  17.1k|    } else {
  859|  17.1k|        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  860|  17.1k|    }
  861|  17.1k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS9_9allocatorISB_EEEEEQ12SerializableIT0_T_EEvRSJ_RKSI_:
  753|  17.1k|{
  754|  17.1k|    a.Serialize(os);
  755|  17.1k|}
_ZNK7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  482|  17.1k|    template<typename Stream> void Serialize(Stream &s) const { Formatter().Ser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorI6CTxOutNS8_9allocatorISA_EEEEEEvRT_RKT0_:
  662|  17.1k|    {
  663|  17.1k|        Formatter formatter;
  664|  17.1k|        WriteCompactSize(s, v.size());
  665|  24.8k|        for (const typename V::value_type& elem : v) {
  ------------------
  |  Branch (665:49): [True: 24.8k, False: 17.1k]
  ------------------
  666|  24.8k|            formatter.Ser(s, elem);
  667|  24.8k|        }
  668|  17.1k|    }
_ZN16DefaultFormatter3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsE6CTxOutEEvRT_RKT0_:
  774|  24.8k|    static void Ser(Stream& s, const T& t) { Serialize(s, t); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE6CTxOutQ12SerializableIT0_T_EEvRS7_RKS6_:
  753|  24.8k|{
  754|  24.8k|    a.Serialize(os);
  755|  24.8k|}
_ZNK6CTxOut9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  222|  24.8k|    {                                                                                               \
  223|  24.8k|        static_assert(std::is_same<const cls&, decltype(*this)>::value, "Serialize type mismatch"); \
  224|  24.8k|        Ser(s, *this);                                                                              \
  225|  24.8k|    }                                                                                               \
_ZN6CTxOut3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  178|  24.8k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJl7CScriptEEEvRT_DpRKT0_:
 1013|  24.8k|    {
 1014|  24.8k|        ::SerializeMany(s, args...);
 1015|  24.8k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJl7CScriptEEvRT_DpRKT0_:
  995|  24.8k|{
  996|  24.8k|    (::Serialize(s, args), ...);
  997|  24.8k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_l:
  263|  24.8k|template<typename Stream> inline void Serialize(Stream& s, int64_t a ) { ser_writedata64(s, a); }
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsINSt3__16vectorINS6_IhNS5_9allocatorIhEEEENS7_IS9_EEEEEERS3_RKT_:
 1133|  24.5k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorIhNS5_9allocatorIhEEEENS7_IS9_EEEvRT_RKNS6_IT0_T1_EE:
  846|  24.5k|{
  847|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  848|       |        WriteCompactSize(os, v.size());
  849|       |        if (!v.empty()) os.write(MakeByteSpan(v));
  850|       |    } else if constexpr (std::is_same_v<T, bool>) {
  851|       |        // A special case for std::vector<bool>, as dereferencing
  852|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  853|       |        // due to std::vector's special casing for bool arguments.
  854|       |        WriteCompactSize(os, v.size());
  855|       |        for (bool elem : v) {
  856|       |            ::Serialize(os, elem);
  857|       |        }
  858|  24.5k|    } else {
  859|  24.5k|        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  860|  24.5k|    }
  861|  24.5k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINSA_IhNS9_9allocatorIhEEEENSB_ISD_EEEEEQ12SerializableIT0_T_EEvRSK_RKSJ_:
  753|  24.5k|{
  754|  24.5k|    a.Serialize(os);
  755|  24.5k|}
_ZNK7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  482|  24.5k|    template<typename Stream> void Serialize(Stream &s) const { Formatter().Ser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorINS9_IhNS8_9allocatorIhEEEENSA_ISC_EEEEEEvRT_RKT0_:
  662|  24.5k|    {
  663|  24.5k|        Formatter formatter;
  664|  24.5k|        WriteCompactSize(s, v.size());
  665|   134k|        for (const typename V::value_type& elem : v) {
  ------------------
  |  Branch (665:49): [True: 134k, False: 24.5k]
  ------------------
  666|   134k|            formatter.Ser(s, elem);
  667|   134k|        }
  668|  24.5k|    }
_ZN16DefaultFormatter3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorIhNS6_9allocatorIhEEEEEEvRT_RKT0_:
  774|   134k|    static void Ser(Stream& s, const T& t) { Serialize(s, t); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEhNSt3__19allocatorIhEEEvRT_RKNS5_6vectorIT0_T1_EE:
  846|   134k|{
  847|   134k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  848|   134k|        WriteCompactSize(os, v.size());
  849|   134k|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (849:13): [True: 108k, False: 26.2k]
  ------------------
  850|       |    } else if constexpr (std::is_same_v<T, bool>) {
  851|       |        // A special case for std::vector<bool>, as dereferencing
  852|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  853|       |        // due to std::vector's special casing for bool arguments.
  854|       |        WriteCompactSize(os, v.size());
  855|       |        for (bool elem : v) {
  856|       |            ::Serialize(os, elem);
  857|       |        }
  858|       |    } else {
  859|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  860|       |    }
  861|   134k|}
_ZNK12ParamsStreamIR10HashWriter20TransactionSerParamsE9GetParamsIS2_EERKDav:
 1144|  17.1k|    {
 1145|  17.1k|        if constexpr (std::is_convertible_v<Params, P>) {
 1146|  17.1k|            return m_params;
 1147|       |        } else {
 1148|       |            return m_substream.template GetParams<P>();
 1149|       |        }
 1150|  17.1k|    }
_Z9SerializeI10HashWriter13ParamsWrapperI20TransactionSerParamsK12CTransactionEQ12SerializableIT0_T_EEvRS7_RKS6_:
  753|  17.1k|{
  754|  17.1k|    a.Serialize(os);
  755|  17.1k|}
_ZNK13ParamsWrapperI20TransactionSerParamsK12CTransactionE9SerializeI10HashWriterEEvRT_:
 1199|  17.1k|    {
 1200|  17.1k|        ParamsStream ss{s, m_params};
 1201|  17.1k|        ::Serialize(ss, m_object);
 1202|  17.1k|    }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE12CTransactionQ12SerializableIT0_T_EEvRS7_RKS6_:
  753|  17.1k|{
  754|  17.1k|    a.Serialize(os);
  755|  17.1k|}
interpreter.cpp:_Z9SerializeI10HashWriterN12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionEEQ12SerializableIT0_T_EEvRS6_RKS5_:
  753|  17.3k|{
  754|  17.3k|    a.Serialize(os);
  755|  17.3k|}
interpreter.cpp:_Z9SerializeI10HashWriterN12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionEEQ12SerializableIT0_T_EEvRS6_RKS5_:
  753|  42.1k|{
  754|  42.1k|    a.Serialize(os);
  755|  42.1k|}
_Z9SerializeI10HashWriter17CompactSizeWriterQ12SerializableIT0_T_EEvRS3_RKS2_:
  753|  1.27k|{
  754|  1.27k|    a.Serialize(os);
  755|  1.27k|}
_ZNK17CompactSizeWriter9SerializeI10HashWriterEEvRT_:
  618|  1.27k|    void Serialize(Stream &s) const {
  619|  1.27k|        WriteCompactSize<Stream>(s, n);
  620|  1.27k|    }

_Z9UCharCastPh:
  281|  11.9k|inline unsigned char* UCharCast(unsigned char* c) { return c; }
_Z9UCharCastPKh:
  285|   116k|inline const unsigned char* UCharCast(const unsigned char* c) { return c; }
_Z9UCharCastPKSt4byte:
  287|  25.8M|inline const unsigned char* UCharCast(const std::byte* c) { return reinterpret_cast<const unsigned char*>(c); }
_ZNK4SpanIKSt4byteE4sizeEv:
  187|  25.7M|    constexpr std::size_t size() const noexcept { return m_size; }
_ZNK4SpanIKSt4byteE4dataEv:
  174|  25.8M|    constexpr C* data() const noexcept { return m_data; }
_ZNK4SpanIKhE4sizeEv:
  187|   406k|    constexpr std::size_t size() const noexcept { return m_size; }
_ZNK4SpanIKhE5beginEv:
  175|   190k|    constexpr C* begin() const noexcept { return m_data; }
_ZNK4SpanIKhE3endEv:
  176|   117k|    constexpr C* end() const noexcept { return m_data + m_size; }
_ZNK4SpanIhE4sizeEv:
  187|   203k|    constexpr std::size_t size() const noexcept { return m_size; }
_ZNK4SpanIhE4dataEv:
  174|  7.56M|    constexpr C* data() const noexcept { return m_data; }
_ZNK4SpanIKhE4dataEv:
  174|  6.94M|    constexpr C* data() const noexcept { return m_data; }
_ZNK4SpanIKhE5firstEm:
  206|  96.6k|    {
  207|  96.6k|        ASSERT_IF_DEBUG(size() >= count);
  208|  96.6k|        return Span<C>(m_data, count);
  209|  96.6k|    }
_ZNK4SpanIKhE7subspanEmm:
  201|  2.82k|    {
  202|  2.82k|        ASSERT_IF_DEBUG(size() >= offset + count);
  203|  2.82k|        return Span<C>(m_data + offset, count);
  204|  2.82k|    }
_ZNK4SpanISt4byteE4sizeEv:
  187|  5.06M|    constexpr std::size_t size() const noexcept { return m_size; }
_ZNK4SpanISt4byteE4dataEv:
  174|  1.67M|    constexpr C* data() const noexcept { return m_data; }
_ZNK4SpanIKSt4byteE5beginEv:
  175|   281k|    constexpr C* begin() const noexcept { return m_data; }
_ZNK4SpanIKSt4byteE3endEv:
  176|   281k|    constexpr C* end() const noexcept { return m_data + m_size; }
_Z13UCharSpanCastIKhE4SpanINSt3__114remove_pointerIDTcl9UCharCastcldtfp_4dataEEEE4typeEES1_IT_E:
  293|   116k|template <typename T> constexpr auto UCharSpanCast(Span<T> s) -> Span<typename std::remove_pointer<decltype(UCharCast(s.data()))>::type> { return {UCharCast(s.data()), s.size()}; }
_Z13MakeUCharSpanIRK4SpanIKhEEDTcl13UCharSpanCasttlS0_clsr3stdE7forwardIT_Efp_EEEEOS5_:
  296|  95.8k|template <typename V> constexpr auto MakeUCharSpan(V&& v) -> decltype(UCharSpanCast(Span{std::forward<V>(v)})) { return UCharSpanCast(Span{std::forward<V>(v)}); }
_ZNK4SpanIKhE10size_bytesEv:
  188|  6.61M|    constexpr std::size_t size_bytes() const noexcept { return sizeof(C) * m_size; }
_Z7AsBytesIKhE4SpanIKSt4byteES1_IT_E:
  259|  6.61M|{
  260|  6.61M|    return {reinterpret_cast<const std::byte*>(s.data()), s.size_bytes()};
  261|  6.61M|}
_Z12MakeByteSpanIRKNSt3__16vectorIhNS0_9allocatorIhEEEEE4SpanIKSt4byteEOT_:
  270|   108k|{
  271|   108k|    return AsBytes(Span{std::forward<V>(v)});
  272|   108k|}
_ZN4SpanIKhEC2INSt3__16vectorIhNS3_9allocatorIhEEEEEERKT_NS3_9enable_ifIXaaaantsr7is_SpanIS8_EE5valuesr3std14is_convertibleIPA_NS3_14remove_pointerIDTcldtclsr3stdE7declvalISA_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalISA_EE4sizeEEmEE5valueEDnE4typeE:
  172|   268k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIKSt4byteEC2IS1_TnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_S1_EE5valueEiE4typeELi0EEEPS6_m:
  119|  26.0M|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_ZN4SpanIKhEC2INSt3__16vectorIhNS3_9allocatorIhEEEEEERT_NS3_9enable_ifIXaaaantsr7is_SpanIS8_EE5valuesr3std14is_convertibleIPA_NS3_14remove_pointerIDTcldtclsr3stdE7declvalIS9_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS9_EE4sizeEEmEE5valueEDnE4typeE:
  165|   184k|        : m_data(other.data()), m_size(other.size()){}
_ZNK4SpanIjE4dataEv:
  174|  13.4M|    constexpr C* data() const noexcept { return m_data; }
_ZNK4SpanIjE10size_bytesEv:
  188|  13.4M|    constexpr std::size_t size_bytes() const noexcept { return sizeof(C) * m_size; }
_Z7AsBytesIjE4SpanIKSt4byteES0_IT_E:
  259|  12.6M|{
  260|  12.6M|    return {reinterpret_cast<const std::byte*>(s.data()), s.size_bytes()};
  261|  12.6M|}
_ZNK4SpanIhE10size_bytesEv:
  188|  7.36M|    constexpr std::size_t size_bytes() const noexcept { return sizeof(C) * m_size; }
_Z7AsBytesIhE4SpanIKSt4byteES0_IT_E:
  259|  6.53M|{
  260|  6.53M|    return {reinterpret_cast<const std::byte*>(s.data()), s.size_bytes()};
  261|  6.53M|}
_ZNK4SpanItE4dataEv:
  174|  3.80k|    constexpr C* data() const noexcept { return m_data; }
_ZNK4SpanItE10size_bytesEv:
  188|  3.80k|    constexpr std::size_t size_bytes() const noexcept { return sizeof(C) * m_size; }
_Z7AsBytesItE4SpanIKSt4byteES0_IT_E:
  259|  3.21k|{
  260|  3.21k|    return {reinterpret_cast<const std::byte*>(s.data()), s.size_bytes()};
  261|  3.21k|}
_ZNK4SpanImE4dataEv:
  174|   314k|    constexpr C* data() const noexcept { return m_data; }
_ZNK4SpanImE10size_bytesEv:
  188|   314k|    constexpr std::size_t size_bytes() const noexcept { return sizeof(C) * m_size; }
_Z7AsBytesImE4SpanIKSt4byteES0_IT_E:
  259|   281k|{
  260|   281k|    return {reinterpret_cast<const std::byte*>(s.data()), s.size_bytes()};
  261|   281k|}
_Z12MakeByteSpanIRK9prevectorILj28EhjiEE4SpanIKSt4byteEOT_:
  270|   191k|{
  271|   191k|    return AsBytes(Span{std::forward<V>(v)});
  272|   191k|}
_ZN4SpanIKhEC2IS0_TnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_S0_EE5valueEiE4typeELi0EEEPS5_m:
  119|   275k|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_ZN4SpanISt4byteEC2IS0_TnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_S0_EE5valueEiE4typeELi0EEEPS5_m:
  119|  1.69M|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_Z15AsWritableBytesIhE4SpanISt4byteES0_IT_E:
  264|   828k|{
  265|   828k|    return {reinterpret_cast<std::byte*>(s.data()), s.size_bytes()};
  266|   828k|}
_ZN4SpanIhEC2IhTnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_hEE5valueEiE4typeELi0EEEPS4_m:
  119|  7.17M|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_Z15AsWritableBytesItE4SpanISt4byteES0_IT_E:
  264|    583|{
  265|    583|    return {reinterpret_cast<std::byte*>(s.data()), s.size_bytes()};
  266|    583|}
_ZN4SpanItEC2ItTnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_tEE5valueEiE4typeELi0EEEPS4_m:
  119|  3.80k|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_Z15AsWritableBytesIjE4SpanISt4byteES0_IT_E:
  264|   835k|{
  265|   835k|    return {reinterpret_cast<std::byte*>(s.data()), s.size_bytes()};
  266|   835k|}
_ZN4SpanIjEC2IjTnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_jEE5valueEiE4typeELi0EEEPS4_m:
  119|  13.4M|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_Z15AsWritableBytesImE4SpanISt4byteES0_IT_E:
  264|  32.6k|{
  265|  32.6k|    return {reinterpret_cast<std::byte*>(s.data()), s.size_bytes()};
  266|  32.6k|}
_ZN4SpanImEC2ImTnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_mEE5valueEiE4typeELi0EEEPS4_m:
  119|   314k|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_ZN4SpanIKhEC2INSt3__14spanIS0_Lm18446744073709551615EEEEERT_NS3_9enable_ifIXaaaantsr7is_SpanIS6_EE5valuesr3std14is_convertibleIPA_NS3_14remove_pointerIDTcldtclsr3stdE7declvalIS7_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS7_EE4sizeEEmEE5valueEDnE4typeE:
  165|  9.57k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIKhEC2INSt3__15arrayIhLm32EEEEERKT_NS3_9enable_ifIXaaaantsr7is_SpanIS6_EE5valuesr3std14is_convertibleIPA_NS3_14remove_pointerIDTcldtclsr3stdE7declvalIS8_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS8_EE4sizeEEmEE5valueEDnE4typeE:
  172|  6.12M|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIKhEC2I9prevectorILj28EhjiEEERKT_NSt3__19enable_ifIXaaaantsr7is_SpanIS5_EE5valuesr3std14is_convertibleIPA_NS8_14remove_pointerIDTcldtclsr3stdE7declvalIS7_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS7_EE4sizeEEmEE5valueEDnE4typeE:
  172|   191k|        : m_data(other.data()), m_size(other.size()){}
_Z20MakeWritableByteSpanIRNSt3__15arrayIhLm32EEEE4SpanISt4byteEOT_:
  275|   163k|{
  276|   163k|    return AsWritableBytes(Span{std::forward<V>(v)});
  277|   163k|}
_ZN4SpanIhEC2INSt3__15arrayIhLm32EEEEERT_NS2_9enable_ifIXaaaantsr7is_SpanIS5_EE5valuesr3std14is_convertibleIPA_NS2_14remove_pointerIDTcldtclsr3stdE7declvalIS6_EE4dataEEE4typeEPA_hEE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS6_EE4sizeEEmEE5valueEDnE4typeE:
  165|   163k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIhEC2I9prevectorILj33EhjiEEERT_NSt3__19enable_ifIXaaaantsr7is_SpanIS4_EE5valuesr3std14is_convertibleIPA_NS6_14remove_pointerIDTcldtclsr3stdE7declvalIS5_EE4dataEEE4typeEPA_hEE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS5_EE4sizeEEmEE5valueEDnE4typeE:
  165|  6.82k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIhEC2I7CScriptEERT_NSt3__19enable_ifIXaaaantsr7is_SpanIS3_EE5valuesr3std14is_convertibleIPA_NS5_14remove_pointerIDTcldtclsr3stdE7declvalIS4_EE4dataEEE4typeEPA_hEE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS4_EE4sizeEEmEE5valueEDnE4typeE:
  165|  3.66k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIhEC2I7uint160EERT_NSt3__19enable_ifIXaaaantsr7is_SpanIS3_EE5valuesr3std14is_convertibleIPA_NS5_14remove_pointerIDTcldtclsr3stdE7declvalIS4_EE4dataEEE4typeEPA_hEE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS4_EE4sizeEEmEE5valueEDnE4typeE:
  165|   116k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIhEC2INSt3__16vectorIhNS2_9allocatorIhEEEEEERT_NS2_9enable_ifIXaaaantsr7is_SpanIS7_EE5valuesr3std14is_convertibleIPA_NS2_14remove_pointerIDTcldtclsr3stdE7declvalIS8_EE4dataEEE4typeEPA_hEE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS8_EE4sizeEEmEE5valueEDnE4typeE:
  165|  86.7k|        : m_data(other.data()), m_size(other.size()){}
_Z20MakeWritableByteSpanIRA4_hE4SpanISt4byteEOT_:
  275|  17.0k|{
  276|  17.0k|    return AsWritableBytes(Span{std::forward<V>(v)});
  277|  17.0k|}
_ZN4SpanIhEC2ILi4EEERAT__h:
  151|  17.0k|    constexpr Span(C (&a)[N]) noexcept : m_data(a), m_size(N) {}
_Z12MakeByteSpanIRA4_KhE4SpanIKSt4byteEOT_:
  270|  9.24k|{
  271|  9.24k|    return AsBytes(Span{std::forward<V>(v)});
  272|  9.24k|}
_ZN4SpanIKhEC2ILi4EEERAT__S0_:
  151|  9.24k|    constexpr Span(C (&a)[N]) noexcept : m_data(a), m_size(N) {}
_ZN4SpanIKhEC2ILi65EEERAT__S0_:
  151|  95.8k|    constexpr Span(C (&a)[N]) noexcept : m_data(a), m_size(N) {}
_ZN4SpanIKhEC2I7CPubKeyEERKT_NSt3__19enable_ifIXaaaantsr7is_SpanIS4_EE5valuesr3std14is_convertibleIPA_NS7_14remove_pointerIDTcldtclsr3stdE7declvalIS6_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS6_EE4sizeEEmEE5valueEDnE4typeE:
  172|  9.24k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIKhEC2I7CScriptEERKT_NSt3__19enable_ifIXaaaantsr7is_SpanIS4_EE5valuesr3std14is_convertibleIPA_NS7_14remove_pointerIDTcldtclsr3stdE7declvalIS6_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS6_EE4sizeEEmEE5valueEDnE4typeE:
  172|  21.0k|        : m_data(other.data()), m_size(other.size()){}
_ZN4SpanIN10miniscript8internal11InputResultEEC2INSt3__16vectorIS2_NS5_9allocatorIS2_EEEEEERT_NS5_9enable_ifIXaaaantsr7is_SpanISA_EE5valuesr3std14is_convertibleIPA_NS5_14remove_pointerIDTcldtclsr3stdE7declvalISB_EE4dataEEE4typeEPA_S2_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalISB_EE4sizeEEmEE5valueEDnE4typeE:
  165|     71|        : m_data(other.data()), m_size(other.size()){}
_ZNK4SpanIN10miniscript8internal11InputResultEE4lastEm:
  211|     71|    {
  212|     71|         ASSERT_IF_DEBUG(size() >= count);
  213|     71|         return Span<C>(m_data + m_size - count, count);
  214|     71|    }
_ZN4SpanIN10miniscript8internal11InputResultEEC2IS2_TnNSt3__19enable_ifIXsr3std14is_convertibleIPA_T_PA_S2_EE5valueEiE4typeELi0EEEPS7_m:
  119|     71|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_Z13MakeUCharSpanIRK7CScriptEDTcl13UCharSpanCasttl4Spanclsr3stdE7forwardIT_Efp_EEEEOS4_:
  296|  21.0k|template <typename V> constexpr auto MakeUCharSpan(V&& v) -> decltype(UCharSpanCast(Span{std::forward<V>(v)})) { return UCharSpanCast(Span{std::forward<V>(v)}); }
_ZN4SpanIKhEC2ILi33EEERAT__S0_:
  151|  2.30k|    constexpr Span(C (&a)[N]) noexcept : m_data(a), m_size(N) {}
_ZN4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEEC2INS1_IS4_NS2_IS4_EEEEEERKT_NS0_9enable_ifIXaaaantsr7is_SpanISA_EE5valuesr3std14is_convertibleIPA_NS0_14remove_pointerIDTcldtclsr3stdE7declvalISC_EE4dataEEE4typeEPA_S5_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalISC_EE4sizeEEmEE5valueEDnE4typeE:
  172|  42.9k|        : m_data(other.data()), m_size(other.size()){}
_ZNK4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEE4sizeEv:
  187|  61.4k|    constexpr std::size_t size() const noexcept { return m_size; }
_ZNK4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEE4backEv:
  183|  14.4k|    {
  184|  14.4k|        ASSERT_IF_DEBUG(size() > 0);
  185|  14.4k|        return m_data[m_size - 1];
  186|  14.4k|    }
_ZNK4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEE5beginEv:
  175|  18.2k|    constexpr C* begin() const noexcept { return m_data; }
_ZNK4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEE3endEv:
  176|  18.2k|    constexpr C* end() const noexcept { return m_data + m_size; }
_Z11SpanPopBackIKNSt3__16vectorIhNS0_9allocatorIhEEEEERT_R4SpanIS6_E:
  249|  10.0k|{
  250|  10.0k|    size_t size = span.size();
  251|  10.0k|    T& back = span.back();
  252|  10.0k|    span = span.first(size - 1);
  253|  10.0k|    return back;
  254|  10.0k|}
_ZNK4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEE5firstEm:
  206|  10.0k|    {
  207|  10.0k|        ASSERT_IF_DEBUG(size() >= count);
  208|  10.0k|        return Span<C>(m_data, count);
  209|  10.0k|    }
_ZN4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEEC2IS5_TnNS0_9enable_ifIXsr3std14is_convertibleIPA_T_PA_S5_EE5valueEiE4typeELi0EEEPS9_m:
  119|  10.0k|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_ZNK4SpanINSt3__18optionalINS0_3setI7CPubKeyZNK10miniscript4NodeIS3_E17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS0_9allocatorIS3_EEEEEEE5beginEv:
  175|    202|    constexpr C* begin() const noexcept { return m_data; }
_ZNK4SpanINSt3__18optionalINS0_3setI7CPubKeyZNK10miniscript4NodeIS3_E17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS0_9allocatorIS3_EEEEEEE3endEv:
  176|    202|    constexpr C* end() const noexcept { return m_data + m_size; }
_ZN4SpanINSt3__18optionalINS0_3setI7CPubKeyZNK10miniscript4NodeIS3_E17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS0_9allocatorIS3_EEEEEEEC2INS0_6vectorISG_NSD_ISG_EEEEEERS9_NS0_9enable_ifIXaaaantsr7is_SpanIS9_EE5valuesr3std14is_convertibleIPA_NS0_14remove_pointerIDTcldtclsr3stdE7declvalISM_EE4dataEEE4typeEPA_SG_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalISM_EE4sizeEEmEE5valueEDnE4typeE:
  165|    101|        : m_data(other.data()), m_size(other.size()){}
_ZNK4SpanINSt3__18optionalINS0_3setI7CPubKeyZNK10miniscript4NodeIS3_E17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS0_9allocatorIS3_EEEEEEE4lastEm:
  211|    101|    {
  212|    101|         ASSERT_IF_DEBUG(size() >= count);
  213|    101|         return Span<C>(m_data + m_size - count, count);
  214|    101|    }
_ZN4SpanINSt3__18optionalINS0_3setI7CPubKeyZNK10miniscript4NodeIS3_E17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS0_9allocatorIS3_EEEEEEEC2ISG_TnNS0_9enable_ifIXsr3std14is_convertibleIPA_S9_PA_SG_EE5valueEiE4typeELi0EEEPS9_m:
  119|    101|    constexpr Span(T* begin, std::size_t size) noexcept : m_data(begin), m_size(size) {}
_ZN4SpanIKhEC2I7uint256EERT_NSt3__19enable_ifIXaaaantsr7is_SpanIS4_EE5valuesr3std14is_convertibleIPA_NS6_14remove_pointerIDTcldtclsr3stdE7declvalIS5_EE4dataEEE4typeEPA_S0_EE5valuesr3std14is_convertibleIDTcldtclsr3stdE7declvalIS5_EE4sizeEEmEE5valueEDnE4typeE:
  165|  1.54k|        : m_data(other.data()), m_size(other.size()){}
_ZNK4SpanIKNSt3__16vectorIhNS0_9allocatorIhEEEEE5frontEv:
  178|  3.09k|    {
  179|  3.09k|        ASSERT_IF_DEBUG(size() > 0);
  180|  3.09k|        return m_data[0];
  181|  3.09k|    }
_Z11SpanPopBackIKhERT_R4SpanIS1_E:
  249|    797|{
  250|    797|    size_t size = span.size();
  251|    797|    T& back = span.back();
  252|    797|    span = span.first(size - 1);
  253|    797|    return back;
  254|    797|}
_ZNK4SpanIKhE4backEv:
  183|    797|    {
  184|    797|        ASSERT_IF_DEBUG(size() > 0);
  185|    797|        return m_data[m_size - 1];
  186|    797|    }

_ZN10DataStreamC2E4SpanIKhE:
  165|   103k|    explicit DataStream(Span<const uint8_t> sp) : DataStream{AsBytes(sp)} {}
_ZN10DataStreamC2E4SpanIKSt4byteE:
  166|   103k|    explicit DataStream(Span<const value_type> sp) : vch(sp.data(), sp.data() + sp.size()) {}
_ZN10DataStream4readE4SpanISt4byteE:
  219|  1.69M|    {
  220|  1.69M|        if (dst.size() == 0) return;
  ------------------
  |  Branch (220:13): [True: 2.80k, False: 1.69M]
  ------------------
  221|       |
  222|       |        // Read from the beginning of the buffer
  223|  1.69M|        auto next_read_pos{CheckedAdd(m_read_pos, dst.size())};
  224|  1.69M|        if (!next_read_pos.has_value() || next_read_pos.value() > vch.size()) {
  ------------------
  |  Branch (224:13): [True: 0, False: 1.69M]
  |  Branch (224:43): [True: 19.6k, False: 1.67M]
  ------------------
  225|  19.6k|            throw std::ios_base::failure("DataStream::read(): end of data");
  226|  19.6k|        }
  227|  1.67M|        memcpy(dst.data(), &vch[m_read_pos], dst.size());
  228|  1.67M|        if (next_read_pos.value() == vch.size()) {
  ------------------
  |  Branch (228:13): [True: 14.4k, False: 1.66M]
  ------------------
  229|  14.4k|            m_read_pos = 0;
  230|  14.4k|            vch.clear();
  231|  14.4k|            return;
  232|  14.4k|        }
  233|  1.66M|        m_read_pos = next_read_pos.value();
  234|  1.66M|    }
_ZN10DataStream6ignoreEm:
  237|  1.71k|    {
  238|       |        // Ignore from the beginning of the buffer
  239|  1.71k|        auto next_read_pos{CheckedAdd(m_read_pos, num_ignore)};
  240|  1.71k|        if (!next_read_pos.has_value() || next_read_pos.value() > vch.size()) {
  ------------------
  |  Branch (240:13): [True: 0, False: 1.71k]
  |  Branch (240:43): [True: 931, False: 786]
  ------------------
  241|    931|            throw std::ios_base::failure("DataStream::ignore(): end of data");
  242|    931|        }
  243|    786|        if (next_read_pos.value() == vch.size()) {
  ------------------
  |  Branch (243:13): [True: 285, False: 501]
  ------------------
  244|    285|            m_read_pos = 0;
  245|    285|            vch.clear();
  246|    285|            return;
  247|    285|        }
  248|    501|        m_read_pos = next_read_pos.value();
  249|    501|    }
_ZN10DataStream5writeE4SpanIKSt4byteE:
  252|   281k|    {
  253|       |        // Write to the end of the buffer
  254|   281k|        vch.insert(vch.end(), src.begin(), src.end());
  255|   281k|    }
_ZN10DataStreamC2Ev:
  164|  23.9k|    explicit DataStream() = default;
_ZN10DataStreamrsIR9COutPointEERS_OT_:
  266|  11.6k|    {
  267|  11.6k|        ::Unserialize(*this, obj);
  268|  11.6k|        return (*this);
  269|  11.6k|    }
_ZN10DataStreamrsI13ParamsWrapperI20TransactionSerParams19CMutableTransactionEEERS_OT_:
  266|  20.0k|    {
  267|  20.0k|        ::Unserialize(*this, obj);
  268|  20.0k|        return (*this);
  269|  20.0k|    }
_ZN10DataStreamrsIR4CoinEERS_OT_:
  266|  10.8k|    {
  267|  10.8k|        ::Unserialize(*this, obj);
  268|  10.8k|        return (*this);
  269|  10.8k|    }
_ZN10DataStreamrsI7WrapperI15VarIntFormatterIL10VarIntMode0EERmEEERS_OT_:
  266|  10.7k|    {
  267|  10.7k|        ::Unserialize(*this, obj);
  268|  10.7k|        return (*this);
  269|  10.7k|    }
_ZN10DataStreamrsI7WrapperI15VarIntFormatterIL10VarIntMode0EERjEEERS_OT_:
  266|  10.6k|    {
  267|  10.6k|        ::Unserialize(*this, obj);
  268|  10.6k|        return (*this);
  269|  10.6k|    }
_ZN10DataStreamrsI4SpanIhEEERS_OT_:
  266|  27.6k|    {
  267|  27.6k|        ::Unserialize(*this, obj);
  268|  27.6k|        return (*this);
  269|  27.6k|    }
_ZN10DataStreamrsIR7CPubKeyEERS_OT_:
  266|  19.8k|    {
  267|  19.8k|        ::Unserialize(*this, obj);
  268|  19.8k|        return (*this);
  269|  19.8k|    }
_ZN10DataStreamrsIR13KeyOriginInfoEERS_OT_:
  266|  16.8k|    {
  267|  16.8k|        ::Unserialize(*this, obj);
  268|  16.8k|        return (*this);
  269|  16.8k|    }
_ZN10DataStreamrsIRA4_hEERS_OT_:
  266|    167|    {
  267|    167|        ::Unserialize(*this, obj);
  268|    167|        return (*this);
  269|    167|    }
_ZN10DataStreamrsIRjEERS_OT_:
  266|   163k|    {
  267|   163k|        ::Unserialize(*this, obj);
  268|   163k|        return (*this);
  269|   163k|    }
_ZN10DataStreamlsIA4_hEERS_RKT_:
  259|  9.24k|    {
  260|  9.24k|        ::Serialize(*this, obj);
  261|  9.24k|        return (*this);
  262|  9.24k|    }
_ZN10DataStreamlsIjEERS_RKT_:
  259|   234k|    {
  260|   234k|        ::Serialize(*this, obj);
  261|   234k|        return (*this);
  262|   234k|    }
_ZN10DataStreamrsIR6CTxOutEERS_OT_:
  266|  11.9k|    {
  267|  11.9k|        ::Unserialize(*this, obj);
  268|  11.9k|        return (*this);
  269|  11.9k|    }

_Z18make_secure_uniqueINSt3__15arrayIhLm32EEEJEENS0_10unique_ptrIT_19SecureUniqueDeleterIS4_EEEDpOT0_:
   72|  87.5k|{
   73|  87.5k|    T* p = secure_allocator<T>().allocate(1);
   74|       |
   75|       |    // initialize in place, and return as secure_unique_ptr
   76|  87.5k|    try {
   77|  87.5k|        return secure_unique_ptr<T>(new (p) T(std::forward<Args>(as)...));
   78|  87.5k|    } catch (...) {
   79|      0|        secure_allocator<T>().deallocate(p, 1);
   80|      0|        throw;
   81|      0|    }
   82|  87.5k|}
_ZN16secure_allocatorINSt3__15arrayIhLm32EEEE8allocateEm:
   28|  87.5k|    {
   29|  87.5k|        T* allocation = static_cast<T*>(LockedPoolManager::Instance().alloc(sizeof(T) * n));
   30|  87.5k|        if (!allocation) {
  ------------------
  |  Branch (30:13): [True: 0, False: 87.5k]
  ------------------
   31|      0|            throw std::bad_alloc();
   32|      0|        }
   33|  87.5k|        return allocation;
   34|  87.5k|    }
_ZN16secure_allocatorINSt3__15arrayIhLm32EEEE10deallocateEPS2_m:
   37|  87.5k|    {
   38|  87.5k|        if (p != nullptr) {
  ------------------
  |  Branch (38:13): [True: 87.5k, False: 0]
  ------------------
   39|  87.5k|            memory_cleanse(p, sizeof(T) * n);
   40|  87.5k|        }
   41|  87.5k|        LockedPoolManager::Instance().free(p);
   42|  87.5k|    }
_ZN19SecureUniqueDeleterINSt3__15arrayIhLm32EEEEclEPS2_:
   62|  87.5k|    void operator()(T* t) noexcept {
   63|  87.5k|        secure_allocator<T>().deallocate(t, 1);
   64|  87.5k|    }

_ZN25zero_after_free_allocatorISt4byteE10deallocateEPS0_m:
   30|  85.4k|    {
   31|  85.4k|        if (p != nullptr)
  ------------------
  |  Branch (31:13): [True: 85.4k, False: 0]
  ------------------
   32|  85.4k|            memory_cleanse(p, sizeof(T) * n);
   33|  85.4k|        std::allocator<T>{}.deallocate(p, n);
   34|  85.4k|    }
_ZN25zero_after_free_allocatorISt4byteE8allocateEm:
   25|  85.4k|    {
   26|  85.4k|        return std::allocator<T>{}.allocate(n);
   27|  85.4k|    }

_Z14memory_cleansePvm:
   15|   173k|{
   16|       |#if defined(WIN32)
   17|       |    /* SecureZeroMemory is guaranteed not to be optimized out. */
   18|       |    SecureZeroMemory(ptr, len);
   19|       |#else
   20|   173k|    std::memset(ptr, 0, len);
   21|       |
   22|       |    /* Memory barrier that scares the compiler away from optimizing out the memset.
   23|       |     *
   24|       |     * Quoting Adam Langley <agl@google.com> in commit ad1907fe73334d6c696c8539646c21b11178f20f
   25|       |     * in BoringSSL (ISC License):
   26|       |     *    As best as we can tell, this is sufficient to break any optimisations that
   27|       |     *    might try to eliminate "superfluous" memsets.
   28|       |     * This method is used in memzero_explicit() the Linux kernel, too. Its advantage is that it
   29|       |     * is pretty efficient because the compiler can still implement the memset() efficiently,
   30|       |     * just not remove it entirely. See "Dead Store Elimination (Still) Considered Harmful" by
   31|       |     * Yang et al. (USENIX Security 2017) for more background.
   32|       |     */
   33|   173k|    __asm__ __volatile__("" : : "r"(ptr) : "memory");
   34|   173k|#endif
   35|   173k|}

_ZN5Arena5allocEm:
   52|  87.5k|{
   53|       |    // Round to next multiple of alignment
   54|  87.5k|    size = align_up(size, alignment);
   55|       |
   56|       |    // Don't handle zero-sized chunks
   57|  87.5k|    if (size == 0)
  ------------------
  |  Branch (57:9): [True: 0, False: 87.5k]
  ------------------
   58|      0|        return nullptr;
   59|       |
   60|       |    // Pick a large enough free-chunk. Returns an iterator pointing to the first element that is not less than key.
   61|       |    // This allocation strategy is best-fit. According to "Dynamic Storage Allocation: A Survey and Critical Review",
   62|       |    // Wilson et. al. 1995, https://www.scs.stanford.edu/14wi-cs140/sched/readings/wilson.pdf, best-fit and first-fit
   63|       |    // policies seem to work well in practice.
   64|  87.5k|    auto size_ptr_it = size_to_free_chunk.lower_bound(size);
   65|  87.5k|    if (size_ptr_it == size_to_free_chunk.end())
  ------------------
  |  Branch (65:9): [True: 0, False: 87.5k]
  ------------------
   66|      0|        return nullptr;
   67|       |
   68|       |    // Create the used-chunk, taking its space from the end of the free-chunk
   69|  87.5k|    const size_t size_remaining = size_ptr_it->first - size;
   70|  87.5k|    char* const free_chunk = static_cast<char*>(size_ptr_it->second);
   71|  87.5k|    auto allocated = chunks_used.emplace(free_chunk + size_remaining, size).first;
   72|  87.5k|    chunks_free_end.erase(free_chunk + size_ptr_it->first);
   73|  87.5k|    if (size_ptr_it->first == size) {
  ------------------
  |  Branch (73:9): [True: 0, False: 87.5k]
  ------------------
   74|       |        // whole chunk is used up
   75|      0|        chunks_free.erase(size_ptr_it->second);
   76|  87.5k|    } else {
   77|       |        // still some memory left in the chunk
   78|  87.5k|        auto it_remaining = size_to_free_chunk.emplace(size_remaining, size_ptr_it->second);
   79|  87.5k|        chunks_free[size_ptr_it->second] = it_remaining;
   80|  87.5k|        chunks_free_end.emplace(free_chunk + size_remaining, it_remaining);
   81|  87.5k|    }
   82|  87.5k|    size_to_free_chunk.erase(size_ptr_it);
   83|       |
   84|  87.5k|    return allocated->first;
   85|  87.5k|}
_ZN5Arena4freeEPv:
   88|  87.5k|{
   89|       |    // Freeing the nullptr pointer is OK.
   90|  87.5k|    if (ptr == nullptr) {
  ------------------
  |  Branch (90:9): [True: 0, False: 87.5k]
  ------------------
   91|      0|        return;
   92|      0|    }
   93|       |
   94|       |    // Remove chunk from used map
   95|  87.5k|    auto i = chunks_used.find(ptr);
   96|  87.5k|    if (i == chunks_used.end()) {
  ------------------
  |  Branch (96:9): [True: 0, False: 87.5k]
  ------------------
   97|      0|        throw std::runtime_error("Arena: invalid or double free");
   98|      0|    }
   99|  87.5k|    auto freed = std::make_pair(static_cast<char*>(i->first), i->second);
  100|  87.5k|    chunks_used.erase(i);
  101|       |
  102|       |    // coalesce freed with previous chunk
  103|  87.5k|    auto prev = chunks_free_end.find(freed.first);
  104|  87.5k|    if (prev != chunks_free_end.end()) {
  ------------------
  |  Branch (104:9): [True: 77.5k, False: 9.98k]
  ------------------
  105|  77.5k|        freed.first -= prev->second->first;
  106|  77.5k|        freed.second += prev->second->first;
  107|  77.5k|        size_to_free_chunk.erase(prev->second);
  108|  77.5k|        chunks_free_end.erase(prev);
  109|  77.5k|    }
  110|       |
  111|       |    // coalesce freed with chunk after freed
  112|  87.5k|    auto next = chunks_free.find(freed.first + freed.second);
  113|  87.5k|    if (next != chunks_free.end()) {
  ------------------
  |  Branch (113:9): [True: 9.98k, False: 77.5k]
  ------------------
  114|  9.98k|        freed.second += next->second->first;
  115|  9.98k|        size_to_free_chunk.erase(next->second);
  116|  9.98k|        chunks_free.erase(next);
  117|  9.98k|    }
  118|       |
  119|       |    // Add/set space with coalesced free chunk
  120|  87.5k|    auto it = size_to_free_chunk.emplace(freed.second, freed.first);
  121|  87.5k|    chunks_free[freed.first] = it;
  122|  87.5k|    chunks_free_end[freed.first + freed.second] = it;
  123|  87.5k|}
_ZN10LockedPool5allocEm:
  286|  87.5k|{
  287|  87.5k|    std::lock_guard<std::mutex> lock(mutex);
  288|       |
  289|       |    // Don't handle impossible sizes
  290|  87.5k|    if (size == 0 || size > ARENA_SIZE)
  ------------------
  |  Branch (290:9): [True: 0, False: 87.5k]
  |  Branch (290:22): [True: 0, False: 87.5k]
  ------------------
  291|      0|        return nullptr;
  292|       |
  293|       |    // Try allocating from each current arena
  294|  87.5k|    for (auto &arena: arenas) {
  ------------------
  |  Branch (294:21): [True: 87.5k, False: 0]
  ------------------
  295|  87.5k|        void *addr = arena.alloc(size);
  296|  87.5k|        if (addr) {
  ------------------
  |  Branch (296:13): [True: 87.5k, False: 0]
  ------------------
  297|  87.5k|            return addr;
  298|  87.5k|        }
  299|  87.5k|    }
  300|       |    // If that fails, create a new one
  301|      0|    if (new_arena(ARENA_SIZE, ARENA_ALIGN)) {
  ------------------
  |  Branch (301:9): [True: 0, False: 0]
  ------------------
  302|      0|        return arenas.back().alloc(size);
  303|      0|    }
  304|      0|    return nullptr;
  305|      0|}
_ZN10LockedPool4freeEPv:
  308|  87.5k|{
  309|  87.5k|    std::lock_guard<std::mutex> lock(mutex);
  310|       |    // TODO we can do better than this linear search by keeping a map of arena
  311|       |    // extents to arena, and looking up the address.
  312|  87.5k|    for (auto &arena: arenas) {
  ------------------
  |  Branch (312:21): [True: 87.5k, False: 0]
  ------------------
  313|  87.5k|        if (arena.addressInArena(ptr)) {
  ------------------
  |  Branch (313:13): [True: 87.5k, False: 0]
  ------------------
  314|  87.5k|            arena.free(ptr);
  315|  87.5k|            return;
  316|  87.5k|        }
  317|  87.5k|    }
  318|      0|    throw std::runtime_error("LockedPool: invalid address not pointing to any arena");
  319|  87.5k|}
lockedpool.cpp:_ZL8align_upmm:
   33|  87.5k|{
   34|  87.5k|    return (x + align - 1) & ~(align - 1);
   35|  87.5k|}

_ZNK5Arena14addressInArenaEPv:
   90|  87.5k|    bool addressInArena(void *ptr) const { return ptr >= base && ptr < end; }
  ------------------
  |  Branch (90:51): [True: 87.5k, False: 0]
  |  Branch (90:66): [True: 87.5k, False: 0]
  ------------------
_ZN17LockedPoolManager8InstanceEv:
  223|   175k|    {
  224|   175k|        static std::once_flag init_flag;
  225|   175k|        std::call_once(init_flag, LockedPoolManager::CreateInstance);
  226|   175k|        return *LockedPoolManager::_instance;
  227|   175k|    }

_Z13LeaveCriticalv:
   76|   123k|inline void LeaveCritical() {}
_Z10DeleteLockPv:
   82|  11.9k|inline void DeleteLock(void* cs) {}
_Z17MaybeCheckNotHeldI14AnnotatedMixinINSt3__115recursive_mutexEEERT_S5_:
  253|   123k|inline MutexType& MaybeCheckNotHeld(MutexType& m) LOCKS_EXCLUDED(m) LOCK_RETURNED(m) { return m; }
_Z13EnterCriticalINSt3__115recursive_mutexEEvPKcS3_iPT_b:
   75|   123k|inline void EnterCritical(const char* pszName, const char* pszFile, int nLine, MutexType* cs, bool fTry = false) {}
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEE5EnterEPKcS6_i:
  157|   123k|    {
  158|   123k|        EnterCritical(pszName, pszFile, nLine, Base::mutex());
  159|       |#ifdef DEBUG_LOCKCONTENTION
  160|       |        if (Base::try_lock()) return;
  161|       |        LOG_TIME_MICROS_WITH_CATEGORY(strprintf("lock contention %s, %s:%d", pszName, pszFile, nLine), BCLog::LOCK);
  162|       |#endif
  163|   123k|        Base::lock();
  164|   123k|    }
_Z22AssertLockHeldInternalI14AnnotatedMixinINSt3__115recursive_mutexEEEvPKcS5_iPT_:
   79|  9.98k|inline void AssertLockHeldInternal(const char* pszName, const char* pszFile, int nLine, MutexType* cs) EXCLUSIVE_LOCKS_REQUIRED(cs) {}
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEEC2ERS3_PKcS7_ib:
  177|   123k|    UniqueLock(MutexType& mutexIn, const char* pszName, const char* pszFile, int nLine, bool fTry = false) EXCLUSIVE_LOCK_FUNCTION(mutexIn) : Base(mutexIn, std::defer_lock)
  178|   123k|    {
  179|   123k|        if (fTry)
  ------------------
  |  Branch (179:13): [True: 0, False: 123k]
  ------------------
  180|      0|            TryEnter(pszName, pszFile, nLine);
  181|   123k|        else
  182|   123k|            Enter(pszName, pszFile, nLine);
  183|   123k|    }
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEED2Ev:
  197|   123k|    {
  198|   123k|        if (Base::owns_lock())
  ------------------
  |  Branch (198:13): [True: 123k, False: 0]
  ------------------
  199|   123k|            LeaveCritical();
  200|   123k|    }
_ZN14AnnotatedMixinINSt3__115recursive_mutexEED2Ev:
   94|  11.9k|    ~AnnotatedMixin() {
   95|  11.9k|        DeleteLock((void*)this);
   96|  11.9k|    }

_ZN18FuzzedDataProviderC2EPKhm:
   37|  11.9k|      : data_ptr_(data), remaining_bytes_(size) {}
_ZN18FuzzedDataProvider15ConsumeIntegralIlEET_v:
  195|  33.1k|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  33.1k|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  33.1k|                                std::numeric_limits<T>::max());
  198|  33.1k|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIlEET_S1_S1_:
  205|  47.2k|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  47.2k|  static_assert(std::is_integral<T>::value, "An integral type is required.");
  207|  47.2k|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  47.2k|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 47.2k]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  47.2k|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  47.2k|  uint64_t result = 0;
  215|  47.2k|  size_t offset = 0;
  216|       |
  217|   341k|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 308k, False: 32.9k]
  |  Branch (217:43): [True: 294k, False: 13.7k]
  ------------------
  218|   341k|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 294k, False: 635]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|   294k|    --remaining_bytes_;
  226|   294k|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|   294k|    offset += CHAR_BIT;
  228|   294k|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  47.2k|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 14.1k, False: 33.1k]
  ------------------
  232|  14.1k|    result = result % (range + 1);
  233|       |
  234|  47.2k|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  47.2k|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeImEET_S1_S1_:
  205|  11.6M|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  11.6M|  static_assert(std::is_integral<T>::value, "An integral type is required.");
  207|  11.6M|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  11.6M|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 11.6M]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  11.6M|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  11.6M|  uint64_t result = 0;
  215|  11.6M|  size_t offset = 0;
  216|       |
  217|  23.2M|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 23.2M, False: 0]
  |  Branch (217:43): [True: 11.6M, False: 11.5M]
  ------------------
  218|  23.2M|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 11.5M, False: 3.04k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  11.5M|    --remaining_bytes_;
  226|  11.5M|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  11.5M|    offset += CHAR_BIT;
  228|  11.5M|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  11.6M|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 11.6M, False: 0]
  ------------------
  232|  11.6M|    result = result % (range + 1);
  233|       |
  234|  11.6M|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  11.6M|}
_ZN18FuzzedDataProvider15ConsumeIntegralIiEET_v:
  195|  11.0k|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  11.0k|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  11.0k|                                std::numeric_limits<T>::max());
  198|  11.0k|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIiEET_S1_S1_:
  205|  16.6k|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  16.6k|  static_assert(std::is_integral<T>::value, "An integral type is required.");
  207|  16.6k|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  16.6k|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 16.6k]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  16.6k|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  16.6k|  uint64_t result = 0;
  215|  16.6k|  size_t offset = 0;
  216|       |
  217|  40.1k|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 35.7k, False: 4.41k]
  |  Branch (217:43): [True: 30.1k, False: 5.55k]
  ------------------
  218|  40.1k|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 23.4k, False: 6.68k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  23.4k|    --remaining_bytes_;
  226|  23.4k|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  23.4k|    offset += CHAR_BIT;
  228|  23.4k|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  16.6k|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 16.6k, False: 0]
  ------------------
  232|  16.6k|    result = result % (range + 1);
  233|       |
  234|  16.6k|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  16.6k|}
_ZN18FuzzedDataProvider15ConsumeIntegralIjEET_v:
  195|  11.9k|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  11.9k|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  11.9k|                                std::numeric_limits<T>::max());
  198|  11.9k|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIjEET_S1_S1_:
  205|  11.5M|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  11.5M|  static_assert(std::is_integral<T>::value, "An integral type is required.");
  207|  11.5M|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  11.5M|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 11.5M]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  11.5M|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  11.5M|  uint64_t result = 0;
  215|  11.5M|  size_t offset = 0;
  216|       |
  217|  23.0M|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 23.0M, False: 6.83k]
  |  Branch (217:43): [True: 11.5M, False: 11.5M]
  ------------------
  218|  23.0M|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 11.5M, False: 5.60k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  11.5M|    --remaining_bytes_;
  226|  11.5M|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  11.5M|    offset += CHAR_BIT;
  228|  11.5M|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  11.5M|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 11.5M, False: 0]
  ------------------
  232|  11.5M|    result = result % (range + 1);
  233|       |
  234|  11.5M|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  11.5M|}
_ZN18FuzzedDataProvider15ConsumeIntegralIhEET_v:
  195|  11.7M|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  11.7M|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  11.7M|                                std::numeric_limits<T>::max());
  198|  11.7M|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIhEET_S1_S1_:
  205|  11.7M|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  11.7M|  static_assert(std::is_integral<T>::value, "An integral type is required.");
  207|  11.7M|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  11.7M|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 11.7M]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  11.7M|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  11.7M|  uint64_t result = 0;
  215|  11.7M|  size_t offset = 0;
  216|       |
  217|  23.5M|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 11.7M, False: 11.7M]
  |  Branch (217:43): [True: 11.7M, False: 0]
  ------------------
  218|  23.5M|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 11.7M, False: 41.9k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  11.7M|    --remaining_bytes_;
  226|  11.7M|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  11.7M|    offset += CHAR_BIT;
  228|  11.7M|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  11.7M|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 11.7M, False: 0]
  ------------------
  232|  11.7M|    result = result % (range + 1);
  233|       |
  234|  11.7M|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  11.7M|}
_ZN18FuzzedDataProvider25ConsumeRandomLengthStringEm:
  153|   129k|FuzzedDataProvider::ConsumeRandomLengthString(size_t max_length) {
  154|       |  // Reads bytes from the start of |data_ptr_|. Maps "\\" to "\", and maps "\"
  155|       |  // followed by anything else to the end of the string. As a result of this
  156|       |  // logic, a fuzzer can insert characters into the string, and the string
  157|       |  // will be lengthened to include those new characters, resulting in a more
  158|       |  // stable fuzzer than picking the length of a string independently from
  159|       |  // picking its contents.
  160|   129k|  std::string result;
  161|       |
  162|       |  // Reserve the anticipated capacity to prevent several reallocations.
  163|   129k|  result.reserve(std::min(max_length, remaining_bytes_));
  164|  48.7M|  for (size_t i = 0; i < max_length && remaining_bytes_ != 0; ++i) {
  ------------------
  |  Branch (164:22): [True: 48.7M, False: 22.2k]
  |  Branch (164:40): [True: 48.7M, False: 783]
  ------------------
  165|  48.7M|    char next = ConvertUnsignedToSigned<char>(data_ptr_[0]);
  166|  48.7M|    Advance(1);
  167|  48.7M|    if (next == '\\' && remaining_bytes_ != 0) {
  ------------------
  |  Branch (167:9): [True: 116k, False: 48.6M]
  |  Branch (167:25): [True: 116k, False: 53]
  ------------------
  168|   116k|      next = ConvertUnsignedToSigned<char>(data_ptr_[0]);
  169|   116k|      Advance(1);
  170|   116k|      if (next != '\\')
  ------------------
  |  Branch (170:11): [True: 106k, False: 10.3k]
  ------------------
  171|   106k|        break;
  172|   116k|    }
  173|  48.6M|    result += next;
  174|  48.6M|  }
  175|       |
  176|   129k|  result.shrink_to_fit();
  177|   129k|  return result;
  178|   129k|}
_ZN18FuzzedDataProvider25ConsumeRandomLengthStringEv:
  181|   103k|inline std::string FuzzedDataProvider::ConsumeRandomLengthString() {
  182|   103k|  return ConsumeRandomLengthString(remaining_bytes_);
  183|   103k|}
_ZN18FuzzedDataProvider11ConsumeBoolEv:
  289|  11.7M|inline bool FuzzedDataProvider::ConsumeBool() {
  290|  11.7M|  return 1 & ConsumeIntegral<uint8_t>();
  291|  11.7M|}
_ZN18FuzzedDataProvider14CopyAndAdvanceEPvm:
  339|  10.1k|                                               size_t num_bytes) {
  340|  10.1k|  std::memcpy(destination, data_ptr_, num_bytes);
  341|  10.1k|  Advance(num_bytes);
  342|  10.1k|}
_ZN18FuzzedDataProvider7AdvanceEm:
  344|  48.8M|inline void FuzzedDataProvider::Advance(size_t num_bytes) {
  345|  48.8M|  if (num_bytes > remaining_bytes_)
  ------------------
  |  Branch (345:7): [True: 0, False: 48.8M]
  ------------------
  346|      0|    abort();
  347|       |
  348|  48.8M|  data_ptr_ += num_bytes;
  349|  48.8M|  remaining_bytes_ -= num_bytes;
  350|  48.8M|}
_ZN18FuzzedDataProvider23ConvertUnsignedToSignedIchEET_T0_:
  379|  48.8M|TS FuzzedDataProvider::ConvertUnsignedToSigned(TU value) {
  380|  48.8M|  static_assert(sizeof(TS) == sizeof(TU), "Incompatible data types.");
  381|  48.8M|  static_assert(!std::numeric_limits<TU>::is_signed,
  382|  48.8M|                "Source type must be unsigned.");
  383|       |
  384|       |  // TODO(Dor1s): change to `if constexpr` once C++17 becomes mainstream.
  385|  48.8M|  if (std::numeric_limits<TS>::is_modulo)
  ------------------
  |  Branch (385:7): [Folded - Ignored]
  ------------------
  386|      0|    return static_cast<TS>(value);
  387|       |
  388|       |  // Avoid using implementation-defined unsigned to signed conversions.
  389|       |  // To learn more, see https://stackoverflow.com/questions/13150449.
  390|  48.8M|  if (value <= std::numeric_limits<TS>::max()) {
  ------------------
  |  Branch (390:7): [True: 35.5M, False: 13.2M]
  ------------------
  391|  35.5M|    return static_cast<TS>(value);
  392|  35.5M|  } else {
  393|  13.2M|    constexpr auto TS_min = std::numeric_limits<TS>::min();
  394|  13.2M|    return TS_min + static_cast<TS>(value - TS_min);
  395|  13.2M|  }
  396|  48.8M|}
_ZN18FuzzedDataProvider12ConsumeBytesIhEENSt3__16vectorIT_NS1_9allocatorIS3_EEEEm:
  109|  12.1k|std::vector<T> FuzzedDataProvider::ConsumeBytes(size_t num_bytes) {
  110|  12.1k|  num_bytes = std::min(num_bytes, remaining_bytes_);
  111|  12.1k|  return ConsumeBytes<T>(num_bytes, num_bytes);
  112|  12.1k|}
_ZN18FuzzedDataProvider12ConsumeBytesIhEENSt3__16vectorIT_NS1_9allocatorIS3_EEEEmm:
  353|  12.1k|std::vector<T> FuzzedDataProvider::ConsumeBytes(size_t size, size_t num_bytes) {
  354|  12.1k|  static_assert(sizeof(T) == sizeof(uint8_t), "Incompatible data type.");
  355|       |
  356|       |  // The point of using the size-based constructor below is to increase the
  357|       |  // odds of having a vector object with capacity being equal to the length.
  358|       |  // That part is always implementation specific, but at least both libc++ and
  359|       |  // libstdc++ allocate the requested number of bytes in that constructor,
  360|       |  // which seems to be a natural choice for other implementations as well.
  361|       |  // To increase the odds even more, we also call |shrink_to_fit| below.
  362|  12.1k|  std::vector<T> result(size);
  363|  12.1k|  if (size == 0) {
  ------------------
  |  Branch (363:7): [True: 1.96k, False: 10.1k]
  ------------------
  364|  1.96k|    if (num_bytes != 0)
  ------------------
  |  Branch (364:9): [True: 0, False: 1.96k]
  ------------------
  365|      0|      abort();
  366|  1.96k|    return result;
  367|  1.96k|  }
  368|       |
  369|  10.1k|  CopyAndAdvance(result.data(), num_bytes);
  370|       |
  371|       |  // Even though |shrink_to_fit| is also implementation specific, we expect it
  372|       |  // to provide an additional assurance in case vector's constructor allocated
  373|       |  // a buffer which is larger than the actual amount of data we put inside it.
  374|  10.1k|  result.shrink_to_fit();
  375|  10.1k|  return result;
  376|  12.1k|}
_ZN18FuzzedDataProvider16PickValueInArrayI10SigVersionEET_St16initializer_listIKS2_E:
  316|  1.47k|T FuzzedDataProvider::PickValueInArray(std::initializer_list<const T> list) {
  317|       |  // TODO(Dor1s): switch to static_assert once C++14 is allowed.
  318|  1.47k|  if (!list.size())
  ------------------
  |  Branch (318:7): [True: 0, False: 1.47k]
  ------------------
  319|      0|    abort();
  320|       |
  321|  1.47k|  return *(list.begin() + ConsumeIntegralInRange<size_t>(0, list.size() - 1));
  322|  1.47k|}
_ZN18FuzzedDataProvider16PickValueInArrayIiEET_St16initializer_listIKS1_E:
  316|  36.4k|T FuzzedDataProvider::PickValueInArray(std::initializer_list<const T> list) {
  317|       |  // TODO(Dor1s): switch to static_assert once C++14 is allowed.
  318|  36.4k|  if (!list.size())
  ------------------
  |  Branch (318:7): [True: 0, False: 36.4k]
  ------------------
  319|      0|    abort();
  320|       |
  321|  36.4k|  return *(list.begin() + ConsumeIntegralInRange<size_t>(0, list.size() - 1));
  322|  36.4k|}

LLVMFuzzerTestOneInput:
  222|  11.9k|{
  223|  11.9k|    test_one_input({data, size});
  224|  11.9k|    return 0;
  225|  11.9k|}
fuzz.cpp:_ZL14test_one_inputNSt3__14spanIKhLm18446744073709551615EEE:
   83|  11.9k|{
   84|  11.9k|    CheckGlobals check{};
   85|  11.9k|    (*Assert(g_test_one_input))(buffer);
  ------------------
  |  |   85|  11.9k|#define Assert(val) inline_assertion_check<true>(val, __FILE__, __LINE__, __func__, #val)
  ------------------
   86|  11.9k|}

_Z23script_sign_fuzz_targetNSt3__14spanIKhLm18446744073709551615EEE:
   35|  11.9k|{
   36|  11.9k|    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
   37|  11.9k|    const std::vector<uint8_t> key = ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);
   38|       |
   39|  11.9k|    {
   40|  11.9k|        DataStream random_data_stream{ConsumeDataStream(fuzzed_data_provider)};
   41|  11.9k|        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
   42|  11.9k|        try {
   43|  11.9k|            DeserializeHDKeypaths(random_data_stream, key, hd_keypaths);
   44|  11.9k|        } catch (const std::ios_base::failure&) {
   45|  11.9k|        }
   46|  11.9k|        DataStream serialized{};
   47|  11.9k|        SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));
   48|  11.9k|    }
   49|       |
   50|  11.9k|    {
   51|  11.9k|        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
   52|  19.8k|        LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
  ------------------
  |  |   23|  27.8k|    for (unsigned _count{limit}; (condition) && _count; --_count)
  |  |  ------------------
  |  |  |  Branch (23:34): [True: 19.8k, False: 8.03k]
  |  |  |  Branch (23:49): [True: 19.8k, False: 0]
  |  |  ------------------
  ------------------
   53|  19.8k|            const std::optional<CPubKey> pub_key = ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
   54|  19.8k|            if (!pub_key) {
  ------------------
  |  Branch (54:17): [True: 2.99k, False: 16.8k]
  ------------------
   55|  2.99k|                break;
   56|  2.99k|            }
   57|  16.8k|            const std::optional<KeyOriginInfo> key_origin_info = ConsumeDeserializable<KeyOriginInfo>(fuzzed_data_provider);
   58|  16.8k|            if (!key_origin_info) {
  ------------------
  |  Branch (58:17): [True: 940, False: 15.9k]
  ------------------
   59|    940|                break;
   60|    940|            }
   61|  15.9k|            hd_keypaths[*pub_key] = *key_origin_info;
   62|  15.9k|        }
   63|  11.9k|        DataStream serialized{};
   64|  11.9k|        try {
   65|  11.9k|            SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));
   66|  11.9k|        } catch (const std::ios_base::failure&) {
   67|    354|        }
   68|  11.9k|        std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;
   69|  11.9k|        try {
   70|  11.9k|            DeserializeHDKeypaths(serialized, key, hd_keypaths);
   71|  11.9k|        } catch (const std::ios_base::failure&) {
   72|  11.9k|        }
   73|  11.9k|        assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());
   74|  11.9k|    }
   75|       |
   76|  11.9k|    {
   77|  11.9k|        SignatureData signature_data_1{ConsumeScript(fuzzed_data_provider)};
   78|  11.9k|        SignatureData signature_data_2{ConsumeScript(fuzzed_data_provider)};
   79|  11.9k|        signature_data_1.MergeSignatureData(signature_data_2);
   80|  11.9k|    }
   81|       |
   82|  11.9k|    FillableSigningProvider provider;
   83|  11.9k|    CKey k = ConsumePrivateKey(fuzzed_data_provider);
   84|  11.9k|    if (k.IsValid()) {
  ------------------
  |  Branch (84:9): [True: 9.98k, False: 1.98k]
  ------------------
   85|  9.98k|        provider.AddKey(k);
   86|  9.98k|    }
   87|       |
   88|  11.9k|    {
   89|  11.9k|        const std::optional<CMutableTransaction> mutable_transaction = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider, TX_WITH_WITNESS);
   90|  11.9k|        const std::optional<CTxOut> tx_out = ConsumeDeserializable<CTxOut>(fuzzed_data_provider);
   91|  11.9k|        const unsigned int n_in = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
   92|  11.9k|        if (mutable_transaction && tx_out && mutable_transaction->vin.size() > n_in) {
  ------------------
  |  Branch (92:13): [True: 8.06k, False: 3.90k]
  |  Branch (92:36): [True: 2.86k, False: 5.20k]
  |  Branch (92:46): [True: 1.91k, False: 945]
  ------------------
   93|  1.91k|            SignatureData signature_data_1 = DataFromTransaction(*mutable_transaction, n_in, *tx_out);
   94|  1.91k|            CTxIn input;
   95|  1.91k|            UpdateInput(input, signature_data_1);
   96|  1.91k|            const CScript script = ConsumeScript(fuzzed_data_provider);
   97|  1.91k|            SignatureData signature_data_2{script};
   98|  1.91k|            signature_data_1.MergeSignatureData(signature_data_2);
   99|  1.91k|        }
  100|  11.9k|        if (mutable_transaction) {
  ------------------
  |  Branch (100:13): [True: 8.06k, False: 3.90k]
  ------------------
  101|  8.06k|            CTransaction tx_from{*mutable_transaction};
  102|  8.06k|            CMutableTransaction tx_to;
  103|  8.06k|            const std::optional<CMutableTransaction> opt_tx_to = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider, TX_WITH_WITNESS);
  104|  8.06k|            if (opt_tx_to) {
  ------------------
  |  Branch (104:17): [True: 5.40k, False: 2.66k]
  ------------------
  105|  5.40k|                tx_to = *opt_tx_to;
  106|  5.40k|            }
  107|  8.06k|            CMutableTransaction script_tx_to = tx_to;
  108|  8.06k|            CMutableTransaction sign_transaction_tx_to = tx_to;
  109|  8.06k|            if (n_in < tx_to.vin.size() && tx_to.vin[n_in].prevout.n < tx_from.vout.size()) {
  ------------------
  |  Branch (109:17): [True: 1.47k, False: 6.59k]
  |  Branch (109:44): [True: 16, False: 1.45k]
  ------------------
  110|     16|                SignatureData empty;
  111|     16|                (void)SignSignature(provider, tx_from, tx_to, n_in, fuzzed_data_provider.ConsumeIntegral<int>(), empty);
  112|     16|            }
  113|  8.06k|            if (n_in < script_tx_to.vin.size()) {
  ------------------
  |  Branch (113:17): [True: 1.47k, False: 6.59k]
  ------------------
  114|  1.47k|                SignatureData empty;
  115|  1.47k|                auto from_pub_key = ConsumeScript(fuzzed_data_provider);
  116|  1.47k|                auto amount = ConsumeMoney(fuzzed_data_provider);
  117|  1.47k|                auto n_hash_type = fuzzed_data_provider.ConsumeIntegral<int>();
  118|  1.47k|                (void)SignSignature(provider, from_pub_key, script_tx_to, n_in, amount, n_hash_type, empty);
  119|  1.47k|                MutableTransactionSignatureCreator signature_creator{tx_to, n_in, ConsumeMoney(fuzzed_data_provider), fuzzed_data_provider.ConsumeIntegral<int>()};
  120|  1.47k|                std::vector<unsigned char> vch_sig;
  121|  1.47k|                CKeyID address;
  122|  1.47k|                if (fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (122:21): [True: 1.31k, False: 157]
  ------------------
  123|  1.31k|                    if (k.IsValid()) {
  ------------------
  |  Branch (123:25): [True: 1.31k, False: 1]
  ------------------
  124|  1.31k|                        address = k.GetPubKey().GetID();
  125|  1.31k|                    }
  126|  1.31k|                } else {
  127|    157|                    address = CKeyID{ConsumeUInt160(fuzzed_data_provider)};
  128|    157|                }
  129|  1.47k|                auto script_code = ConsumeScript(fuzzed_data_provider);
  130|  1.47k|                auto sigversion = fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0});
  131|  1.47k|                (void)signature_creator.CreateSig(provider, vch_sig, address, script_code, sigversion);
  132|  1.47k|            }
  133|  8.06k|            std::map<COutPoint, Coin> coins{ConsumeCoins(fuzzed_data_provider)};
  134|  8.06k|            std::map<int, bilingual_str> input_errors;
  135|  8.06k|            (void)SignTransaction(sign_transaction_tx_to, &provider, coins, fuzzed_data_provider.ConsumeIntegral<int>(), input_errors);
  136|  8.06k|        }
  137|  11.9k|    }
  138|       |
  139|  11.9k|    {
  140|  11.9k|        SignatureData signature_data_1;
  141|  11.9k|        (void)ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_1);
  142|  11.9k|        SignatureData signature_data_2;
  143|  11.9k|        (void)ProduceSignature(provider, DUMMY_MAXIMUM_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_2);
  144|  11.9k|    }
  145|  11.9k|}

_Z20ConstructPubKeyBytesR18FuzzedDataProvider4SpanIKhEb:
   17|  36.4k|{
   18|  36.4k|    uint8_t pk_type;
   19|  36.4k|    if (compressed) {
  ------------------
  |  Branch (19:9): [True: 29.7k, False: 6.72k]
  ------------------
   20|  29.7k|        pk_type = fuzzed_data_provider.PickValueInArray({0x02, 0x03});
   21|  29.7k|    } else {
   22|  6.72k|        pk_type = fuzzed_data_provider.PickValueInArray({0x04, 0x06, 0x07});
   23|  6.72k|    }
   24|  36.4k|    std::vector<uint8_t> pk_data{byte_data.begin(), byte_data.begin() + (compressed ? CPubKey::COMPRESSED_SIZE : CPubKey::SIZE)};
  ------------------
  |  Branch (24:74): [True: 29.7k, False: 6.72k]
  ------------------
   25|  36.4k|    pk_data[0] = pk_type;
   26|  36.4k|    return pk_data;
   27|  36.4k|}
_Z12ConsumeMoneyR18FuzzedDataProviderRKNSt3__18optionalIlEE:
   30|  2.95k|{
   31|  2.95k|    return fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, max.value_or(MAX_MONEY));
   32|  2.95k|}
_Z13ConsumeScriptR18FuzzedDataProviderb:
   94|  52.7k|{
   95|  52.7k|    CScript r_script{};
   96|  52.7k|    {
   97|       |        // Keep a buffer of bytes to allow the fuzz engine to produce smaller
   98|       |        // inputs to generate CScripts with repeated data.
   99|  52.7k|        static constexpr unsigned MAX_BUFFER_SZ{128};
  100|  52.7k|        std::vector<uint8_t> buffer(MAX_BUFFER_SZ, uint8_t{'a'});
  101|  11.6M|        while (fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (101:16): [True: 11.5M, False: 52.7k]
  ------------------
  102|  11.5M|            CallOneOf(
  103|  11.5M|                fuzzed_data_provider,
  104|  11.5M|                [&] {
  105|       |                    // Insert byte vector directly to allow malformed or unparsable scripts
  106|  11.5M|                    r_script.insert(r_script.end(), buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ));
  107|  11.5M|                },
  108|  11.5M|                [&] {
  109|       |                    // Push a byte vector from the buffer
  110|  11.5M|                    r_script << std::vector<uint8_t>{buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ)};
  111|  11.5M|                },
  112|  11.5M|                [&] {
  113|       |                    // Push multisig
  114|       |                    // There is a special case for this to aid the fuzz engine
  115|       |                    // navigate the highly structured multisig format.
  116|  11.5M|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  117|  11.5M|                    int num_data{fuzzed_data_provider.ConsumeIntegralInRange(1, 22)};
  118|  11.5M|                    while (num_data--) {
  119|  11.5M|                        auto pubkey_bytes{ConstructPubKeyBytes(fuzzed_data_provider, buffer, fuzzed_data_provider.ConsumeBool())};
  120|  11.5M|                        if (fuzzed_data_provider.ConsumeBool()) {
  121|  11.5M|                            pubkey_bytes.back() = num_data; // Make each pubkey different
  122|  11.5M|                        }
  123|  11.5M|                        r_script << pubkey_bytes;
  124|  11.5M|                    }
  125|  11.5M|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  126|  11.5M|                },
  127|  11.5M|                [&] {
  128|       |                    // Mutate the buffer
  129|  11.5M|                    const auto vec{ConsumeRandomLengthByteVector(fuzzed_data_provider, /*max_length=*/MAX_BUFFER_SZ)};
  130|  11.5M|                    std::copy(vec.begin(), vec.end(), buffer.begin());
  131|  11.5M|                },
  132|  11.5M|                [&] {
  133|       |                    // Push an integral
  134|  11.5M|                    r_script << fuzzed_data_provider.ConsumeIntegral<int64_t>();
  135|  11.5M|                },
  136|  11.5M|                [&] {
  137|       |                    // Push an opcode
  138|  11.5M|                    r_script << ConsumeOpcodeType(fuzzed_data_provider);
  139|  11.5M|                },
  140|  11.5M|                [&] {
  141|       |                    // Push a scriptnum
  142|  11.5M|                    r_script << ConsumeScriptNum(fuzzed_data_provider);
  143|  11.5M|                });
  144|  11.5M|        }
  145|  52.7k|    }
  146|  52.7k|    if (maybe_p2wsh && fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (146:9): [True: 0, False: 52.7k]
  |  Branch (146:24): [True: 0, False: 0]
  ------------------
  147|      0|        uint256 script_hash;
  148|      0|        CSHA256().Write(r_script.data(), r_script.size()).Finalize(script_hash.begin());
  149|      0|        r_script.clear();
  150|      0|        r_script << OP_0 << ToByteVector(script_hash);
  151|      0|    }
  152|  52.7k|    return r_script;
  153|  52.7k|}
_Z12ConsumeCoinsR18FuzzedDataProvider:
  167|  8.06k|{
  168|  8.06k|    std::map<COutPoint, Coin> coins;
  169|  11.6k|    LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
  ------------------
  |  |   23|  18.4k|    for (unsigned _count{limit}; (condition) && _count; --_count)
  |  |  ------------------
  |  |  |  Branch (23:34): [True: 11.6k, False: 6.82k]
  |  |  |  Branch (23:49): [True: 11.6k, False: 0]
  |  |  ------------------
  ------------------
  170|  11.6k|        const std::optional<COutPoint> outpoint{ConsumeDeserializable<COutPoint>(fuzzed_data_provider)};
  171|  11.6k|        if (!outpoint) {
  ------------------
  |  Branch (171:13): [True: 778, False: 10.8k]
  ------------------
  172|    778|            break;
  173|    778|        }
  174|  10.8k|        const std::optional<Coin> coin{ConsumeDeserializable<Coin>(fuzzed_data_provider)};
  175|  10.8k|        if (!coin) {
  ------------------
  |  Branch (175:13): [True: 461, False: 10.3k]
  ------------------
  176|    461|            break;
  177|    461|        }
  178|  10.3k|        coins[*outpoint] = *coin;
  179|  10.3k|    }
  180|       |
  181|  8.06k|    return coins;
  182|  8.06k|}
_Z17ConsumePrivateKeyR18FuzzedDataProviderNSt3__18optionalIbEE:
  231|  11.9k|{
  232|  11.9k|    auto key_data = fuzzed_data_provider.ConsumeBytes<uint8_t>(32);
  233|  11.9k|    key_data.resize(32);
  234|  11.9k|    CKey key;
  235|  11.9k|    bool compressed_value = compressed ? *compressed : fuzzed_data_provider.ConsumeBool();
  ------------------
  |  Branch (235:29): [True: 0, False: 11.9k]
  ------------------
  236|  11.9k|    key.Set(key_data.begin(), key_data.end(), compressed_value);
  237|  11.9k|    return key;
  238|  11.9k|}
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_0clEv:
  104|  5.64M|                [&] {
  105|       |                    // Insert byte vector directly to allow malformed or unparsable scripts
  106|  5.64M|                    r_script.insert(r_script.end(), buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ));
  107|  5.64M|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_1clEv:
  108|  5.83M|                [&] {
  109|       |                    // Push a byte vector from the buffer
  110|  5.83M|                    r_script << std::vector<uint8_t>{buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ)};
  111|  5.83M|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_2clEv:
  112|  5.61k|                [&] {
  113|       |                    // Push multisig
  114|       |                    // There is a special case for this to aid the fuzz engine
  115|       |                    // navigate the highly structured multisig format.
  116|  5.61k|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  117|  5.61k|                    int num_data{fuzzed_data_provider.ConsumeIntegralInRange(1, 22)};
  118|  42.0k|                    while (num_data--) {
  ------------------
  |  Branch (118:28): [True: 36.4k, False: 5.61k]
  ------------------
  119|  36.4k|                        auto pubkey_bytes{ConstructPubKeyBytes(fuzzed_data_provider, buffer, fuzzed_data_provider.ConsumeBool())};
  120|  36.4k|                        if (fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (120:29): [True: 29.7k, False: 6.65k]
  ------------------
  121|  29.7k|                            pubkey_bytes.back() = num_data; // Make each pubkey different
  122|  29.7k|                        }
  123|  36.4k|                        r_script << pubkey_bytes;
  124|  36.4k|                    }
  125|  5.61k|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  126|  5.61k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_3clEv:
  127|  14.1k|                [&] {
  128|       |                    // Mutate the buffer
  129|  14.1k|                    const auto vec{ConsumeRandomLengthByteVector(fuzzed_data_provider, /*max_length=*/MAX_BUFFER_SZ)};
  130|  14.1k|                    std::copy(vec.begin(), vec.end(), buffer.begin());
  131|  14.1k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_4clEv:
  132|  30.0k|                [&] {
  133|       |                    // Push an integral
  134|  30.0k|                    r_script << fuzzed_data_provider.ConsumeIntegral<int64_t>();
  135|  30.0k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_5clEv:
  136|  25.8k|                [&] {
  137|       |                    // Push an opcode
  138|  25.8k|                    r_script << ConsumeOpcodeType(fuzzed_data_provider);
  139|  25.8k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_6clEv:
  140|  3.01k|                [&] {
  141|       |                    // Push a scriptnum
  142|  3.01k|                    r_script << ConsumeScriptNum(fuzzed_data_provider);
  143|  3.01k|                });

_Z17ConsumeDataStreamR18FuzzedDataProviderRKNSt3__18optionalImEE:
   74|  11.9k|{
   75|  11.9k|    return DataStream{ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length)};
   76|  11.9k|}
_Z17ConsumeOpcodeTypeR18FuzzedDataProvider:
  141|  25.8k|{
  142|  25.8k|    return static_cast<opcodetype>(fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, MAX_OPCODE));
  143|  25.8k|}
_Z16ConsumeScriptNumR18FuzzedDataProvider:
  158|  3.01k|{
  159|  3.01k|    return CScriptNum{fuzzed_data_provider.ConsumeIntegral<int64_t>()};
  160|  3.01k|}
_Z14ConsumeUInt160R18FuzzedDataProvider:
  163|    157|{
  164|    157|    const std::vector<uint8_t> v160 = fuzzed_data_provider.ConsumeBytes<uint8_t>(160 / 8);
  165|    157|    if (v160.size() != 160 / 8) {
  ------------------
  |  Branch (165:9): [True: 96, False: 61]
  ------------------
  166|     96|        return {};
  167|     96|    }
  168|     61|    return uint160{v160};
  169|    157|}
_Z29ConsumeRandomLengthByteVectorIhENSt3__16vectorIT_NS0_9allocatorIS2_EEEER18FuzzedDataProviderRKNS0_8optionalImEE:
   58|   129k|{
   59|   129k|    static_assert(sizeof(B) == 1);
   60|   129k|    const std::string s = max_length ?
  ------------------
  |  Branch (60:27): [True: 26.1k, False: 103k]
  ------------------
   61|  26.1k|                              fuzzed_data_provider.ConsumeRandomLengthString(*max_length) :
   62|   129k|                              fuzzed_data_provider.ConsumeRandomLengthString();
   63|   129k|    std::vector<B> ret(s.size());
   64|   129k|    std::copy(s.begin(), s.end(), reinterpret_cast<char*>(ret.data()));
   65|   129k|    return ret;
   66|   129k|}
_Z21ConsumeDeserializableI9COutPointENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  120|  11.6k|{
  121|  11.6k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  122|  11.6k|    DataStream ds{buffer};
  123|  11.6k|    T obj;
  124|  11.6k|    try {
  125|  11.6k|        ds >> obj;
  126|  11.6k|    } catch (const std::ios_base::failure&) {
  127|    778|        return std::nullopt;
  128|    778|    }
  129|  10.8k|    return obj;
  130|  11.6k|}
_Z21ConsumeDeserializableI19CMutableTransaction20TransactionSerParamsENSt3__18optionalIT_EER18FuzzedDataProviderRKT0_RKNS3_ImEE:
  106|  20.0k|{
  107|  20.0k|    const std::vector<uint8_t> buffer{ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length)};
  108|  20.0k|    DataStream ds{buffer};
  109|  20.0k|    T obj;
  110|  20.0k|    try {
  111|  20.0k|        ds >> params(obj);
  112|  20.0k|    } catch (const std::ios_base::failure&) {
  113|  6.57k|        return std::nullopt;
  114|  6.57k|    }
  115|  13.4k|    return obj;
  116|  20.0k|}
_Z21ConsumeDeserializableI4CoinENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  120|  10.8k|{
  121|  10.8k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  122|  10.8k|    DataStream ds{buffer};
  123|  10.8k|    T obj;
  124|  10.8k|    try {
  125|  10.8k|        ds >> obj;
  126|  10.8k|    } catch (const std::ios_base::failure&) {
  127|    461|        return std::nullopt;
  128|    461|    }
  129|  10.3k|    return obj;
  130|  10.8k|}
_Z21ConsumeDeserializableI7CPubKeyENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  120|  19.8k|{
  121|  19.8k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  122|  19.8k|    DataStream ds{buffer};
  123|  19.8k|    T obj;
  124|  19.8k|    try {
  125|  19.8k|        ds >> obj;
  126|  19.8k|    } catch (const std::ios_base::failure&) {
  127|  2.99k|        return std::nullopt;
  128|  2.99k|    }
  129|  16.8k|    return obj;
  130|  19.8k|}
_Z21ConsumeDeserializableI13KeyOriginInfoENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  120|  16.8k|{
  121|  16.8k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  122|  16.8k|    DataStream ds{buffer};
  123|  16.8k|    T obj;
  124|  16.8k|    try {
  125|  16.8k|        ds >> obj;
  126|  16.8k|    } catch (const std::ios_base::failure&) {
  127|    940|        return std::nullopt;
  128|    940|    }
  129|  15.9k|    return obj;
  130|  16.8k|}
_Z21ConsumeDeserializableI6CTxOutENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  120|  11.9k|{
  121|  11.9k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  122|  11.9k|    DataStream ds{buffer};
  123|  11.9k|    T obj;
  124|  11.9k|    try {
  125|  11.9k|        ds >> obj;
  126|  11.9k|    } catch (const std::ios_base::failure&) {
  127|  9.05k|        return std::nullopt;
  128|  9.05k|    }
  129|  2.91k|    return obj;
  130|  11.9k|}
util.cpp:_Z9CallOneOfIJZ13ConsumeScriptR18FuzzedDataProviderbE3$_0Z13ConsumeScriptS1_bE3$_1Z13ConsumeScriptS1_bE3$_2Z13ConsumeScriptS1_bE3$_3Z13ConsumeScriptS1_bE3$_4Z13ConsumeScriptS1_bE3$_5Z13ConsumeScriptS1_bE3$_6EEmS1_DpT_:
   36|  11.5M|{
   37|  11.5M|    constexpr size_t call_size{sizeof...(callables)};
   38|  11.5M|    static_assert(call_size >= 1);
   39|  11.5M|    const size_t call_index{fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, call_size - 1)};
   40|       |
   41|  11.5M|    size_t i{0};
   42|  80.9M|    ((i++ == call_index ? callables() : void()), ...);
  ------------------
  |  Branch (42:7): [True: 5.64M, False: 5.91M]
  |  Branch (42:7): [True: 5.83M, False: 5.72M]
  |  Branch (42:7): [True: 5.61k, False: 11.5M]
  |  Branch (42:7): [True: 14.1k, False: 11.5M]
  |  Branch (42:7): [True: 30.0k, False: 11.5M]
  |  Branch (42:7): [True: 25.8k, False: 11.5M]
  |  Branch (42:7): [True: 3.01k, False: 11.5M]
  ------------------
   43|  11.5M|    return call_size;
   44|  11.5M|}

_ZN12CheckGlobalsC2Ev:
   56|  11.9k|CheckGlobals::CheckGlobals() : m_impl(std::make_unique<CheckGlobalsImpl>()) {}
_ZN12CheckGlobalsD2Ev:
   57|  11.9k|CheckGlobals::~CheckGlobals() = default;
_ZN16CheckGlobalsImplC2Ev:
   17|  11.9k|    {
   18|  11.9k|        g_used_g_prng = false;
   19|  11.9k|        g_seeded_g_prng_zero = false;
   20|  11.9k|        g_used_system_time = false;
   21|  11.9k|        SetMockTime(0s);
   22|  11.9k|    }
_ZN16CheckGlobalsImplD2Ev:
   24|  11.9k|    {
   25|  11.9k|        if (g_used_g_prng && !g_seeded_g_prng_zero) {
  ------------------
  |  Branch (25:13): [True: 0, False: 11.9k]
  |  Branch (25:30): [True: 0, False: 0]
  ------------------
   26|      0|            std::cerr << "\n\n"
   27|      0|                         "The current fuzz target used the global random state.\n\n"
   28|       |
   29|      0|                         "This is acceptable, but requires the fuzz target to call \n"
   30|      0|                         "SeedRandomStateForTest(SeedRand::ZEROS) in the first line \n"
   31|      0|                         "of the FUZZ_TARGET function.\n\n"
   32|       |
   33|      0|                         "An alternative solution would be to avoid any use of globals.\n\n"
   34|       |
   35|      0|                         "Without a solution, fuzz instability and non-determinism can lead \n"
   36|      0|                         "to non-reproducible bugs or inefficient fuzzing.\n\n"
   37|      0|                      << std::endl;
   38|      0|            std::abort(); // Abort, because AFL may try to recover from a std::exit
   39|      0|        }
   40|       |
   41|  11.9k|        if (g_used_system_time) {
  ------------------
  |  Branch (41:13): [True: 0, False: 11.9k]
  ------------------
   42|      0|            std::cerr << "\n\n"
   43|      0|                         "The current fuzz target accessed system time.\n\n"
   44|       |
   45|      0|                         "This is acceptable, but requires the fuzz target to call \n"
   46|      0|                         "SetMockTime() at the beginning of processing the fuzz input.\n\n"
   47|       |
   48|      0|                         "Without setting mock time, time-dependent behavior can lead \n"
   49|      0|                         "to non-reproducible bugs or inefficient fuzzing.\n\n"
   50|      0|                      << std::endl;
   51|      0|            std::abort();
   52|      0|        }
   53|  11.9k|    }

_Z13SignSignatureRK15SigningProviderRK7CScriptR19CMutableTransactionjRKliR13SignatureData:
   95|  1.49k|{
   96|  1.49k|    assert(nIn < txTo.vin.size());
   97|       |
   98|  1.49k|    MutableTransactionSignatureCreator creator(txTo, nIn, amount, nHashType);
   99|       |
  100|  1.49k|    bool ret = ProduceSignature(provider, creator, fromPubKey, sig_data);
  101|  1.49k|    UpdateInput(txTo.vin.at(nIn), sig_data);
  102|  1.49k|    return ret;
  103|  1.49k|}
_Z13SignSignatureRK15SigningProviderRK12CTransactionR19CMutableTransactionjiR13SignatureData:
  106|     16|{
  107|     16|    assert(nIn < txTo.vin.size());
  108|     16|    const CTxIn& txin = txTo.vin[nIn];
  109|     16|    assert(txin.prevout.n < txFrom.vout.size());
  110|     16|    const CTxOut& txout = txFrom.vout[txin.prevout.n];
  111|       |
  112|     16|    return SignSignature(provider, txout.scriptPubKey, txTo, nIn, txout.nValue, nHashType, sig_data);
  113|     16|}

_ZN7uint160C2E4SpanIKhE:
  193|  46.9k|    constexpr explicit uint160(Span<const unsigned char> vch) : base_blob<160>(vch) {}
_ZN7uint256C2E4SpanIKhE:
  208|  13.2k|    constexpr explicit uint256(Span<const unsigned char> vch) : base_blob<256>(vch) {}
_ZN9base_blobILj256EE5beginEv:
  115|   361k|    constexpr unsigned char* begin() { return m_data.data(); }
_ZN9base_blobILj160EE5beginEv:
  115|  5.83k|    constexpr unsigned char* begin() { return m_data.data(); }
_ZNK9base_blobILj256EE5beginEv:
  118|   193k|    constexpr const unsigned char* begin() const { return m_data.data(); }
_ZN9base_blobILj256EE4sizeEv:
  121|  2.82k|    static constexpr unsigned int size() { return WIDTH; }
_ZNK9base_blobILj256EE3endEv:
  119|  18.0k|    constexpr const unsigned char* end() const { return m_data.data() + WIDTH; }
_ZNK9base_blobILj256EE7CompareERKS0_:
   64|   521k|    constexpr int Compare(const base_blob& other) const { return std::memcmp(m_data.data(), other.m_data.data(), WIDTH); }
_ZNK9base_blobILj256EE4dataEv:
  112|    447|    constexpr const unsigned char* data() const { return m_data.data(); }
_ZN9base_blobILj160EE4sizeEv:
  121|   116k|    static constexpr unsigned int size() { return WIDTH; }
_ZN9base_blobILj160EE4dataEv:
  113|   116k|    constexpr unsigned char* data() { return m_data.data(); }
_ZN9base_blobILj256EE4dataEv:
  113|  1.54k|    constexpr unsigned char* data() { return m_data.data(); }
_ZN7uint256C2Ev:
  205|  2.03M|    constexpr uint256() = default;
_ZN9base_blobILj256EEC2Ev:
   35|  2.03M|    constexpr base_blob() : m_data() {}
_ZN9base_blobILj256EEC2E4SpanIKhE:
   41|  13.2k|    {
   42|  13.2k|        assert(vch.size() == WIDTH);
   43|  13.2k|        std::copy(vch.begin(), vch.end(), m_data.begin());
   44|  13.2k|    }
_ZNK9base_blobILj160EE7CompareERKS0_:
   64|   230k|    constexpr int Compare(const base_blob& other) const { return std::memcmp(m_data.data(), other.m_data.data(), WIDTH); }
_ZltRK9base_blobILj160EES2_:
   68|   213k|    friend constexpr bool operator<(const base_blob& a, const base_blob& b) { return a.Compare(b) < 0; }
_ZN9base_blobILj256EE11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
  133|   152k|    {
  134|   152k|        s.read(MakeWritableByteSpan(m_data));
  135|   152k|    }
_ZN9base_blobILj256EE11UnserializeI10DataStreamEEvRT_:
  133|  11.6k|    {
  134|  11.6k|        s.read(MakeWritableByteSpan(m_data));
  135|  11.6k|    }
_ZN7uint160C2Ev:
  192|   268k|    constexpr uint160() = default;
_ZN9base_blobILj160EEC2Ev:
   35|   268k|    constexpr base_blob() : m_data() {}
_ZN9base_blobILj160EEC2E4SpanIKhE:
   41|  46.9k|    {
   42|  46.9k|        assert(vch.size() == WIDTH);
   43|  46.9k|        std::copy(vch.begin(), vch.end(), m_data.begin());
   44|  46.9k|    }
_ZeqRK9base_blobILj160EES2_:
   66|  17.0k|    friend constexpr bool operator==(const base_blob& a, const base_blob& b) { return a.Compare(b) == 0; }
_ZNK9base_blobILj160EE5beginEv:
  118|  4.00k|    constexpr const unsigned char* begin() const { return m_data.data(); }
_ZNK9base_blobILj160EE3endEv:
  119|  4.00k|    constexpr const unsigned char* end() const { return m_data.data() + WIDTH; }
_ZNK9base_blobILj256EE9SerializeI10HashWriterEEvRT_:
  127|  5.94M|    {
  128|  5.94M|        s << Span(m_data);
  129|  5.94M|    }
_ZNK9base_blobILj256EE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  127|   174k|    {
  128|   174k|        s << Span(m_data);
  129|   174k|    }

_Z22inline_assertion_checkILb1EbEOT0_S1_PKciS3_S3_:
   52|  11.9k|{
   53|  11.9k|    if (IS_ASSERT || std::is_constant_evaluated() || G_FUZZING
  ------------------
  |  Branch (53:9): [Folded - Ignored]
  |  Branch (53:22): [Folded - Ignored]
  |  Branch (53:54): [Folded - Ignored]
  ------------------
   54|       |#ifdef ABORT_ON_FAILED_ASSUME
   55|       |        || true
   56|       |#endif
   57|  11.9k|    ) {
   58|  11.9k|        if (!val) {
  ------------------
  |  Branch (58:13): [True: 0, False: 11.9k]
  ------------------
   59|      0|            assertion_fail(file, line, func, assertion);
   60|      0|        }
   61|  11.9k|    }
   62|  11.9k|    return std::forward<T>(val);
   63|  11.9k|}
_Z22inline_assertion_checkILb1ERPKNSt3__18functionIFvNS0_4spanIKhLm18446744073709551615EEEEEEEOT0_SB_PKciSD_SD_:
   52|  11.9k|{
   53|  11.9k|    if (IS_ASSERT || std::is_constant_evaluated() || G_FUZZING
  ------------------
  |  Branch (53:9): [Folded - Ignored]
  |  Branch (53:22): [Folded - Ignored]
  |  Branch (53:54): [Folded - Ignored]
  ------------------
   54|       |#ifdef ABORT_ON_FAILED_ASSUME
   55|       |        || true
   56|       |#endif
   57|  11.9k|    ) {
   58|  11.9k|        if (!val) {
  ------------------
  |  Branch (58:13): [True: 0, False: 11.9k]
  ------------------
   59|      0|            assertion_fail(file, line, func, assertion);
   60|      0|        }
   61|  11.9k|    }
   62|  11.9k|    return std::forward<T>(val);
   63|  11.9k|}

_ZN8BaseHashI7uint160EC2ERKS0_:
   16|  43.4k|    explicit BaseHash(const HashType& in) : m_hash(in) {}
_ZNK8BaseHashI7uint160EeqERKS1_:
   49|  17.0k|    {
   50|  17.0k|        return m_hash == other.m_hash;
   51|  17.0k|    }
_ZNK8BaseHashI7uint160EltERKS1_:
   59|  22.2k|    {
   60|  22.2k|        return m_hash < other.m_hash;
   61|  22.2k|    }
_ZNK8BaseHashI7uint160E5beginEv:
   24|  4.00k|    {
   25|  4.00k|        return m_hash.begin();
   26|  4.00k|    }
_ZNK8BaseHashI7uint160E3endEv:
   34|  4.00k|    {
   35|  4.00k|        return m_hash.end();
   36|  4.00k|    }

_Z16AdditionOverflowImEbT_S0_:
   16|  1.69M|{
   17|  1.69M|    static_assert(std::is_integral<T>::value, "Integral required.");
   18|       |    if constexpr (std::numeric_limits<T>::is_signed) {
   19|       |        return (i > 0 && j > std::numeric_limits<T>::max() - i) ||
   20|       |               (i < 0 && j < std::numeric_limits<T>::min() - i);
   21|       |    }
   22|  1.69M|    return std::numeric_limits<T>::max() - i < j;
   23|  1.69M|}
_Z10CheckedAddImENSt3__18optionalIT_EES2_S2_:
   27|  1.69M|{
   28|  1.69M|    if (AdditionOverflow(i, j)) {
  ------------------
  |  Branch (28:9): [True: 0, False: 1.69M]
  ------------------
   29|      0|        return std::nullopt;
   30|      0|    }
   31|  1.69M|    return i + j;
   32|  1.69M|}

_Z11SetMockTimeNSt3__16chrono8durationIxNS_5ratioILl1ELl1EEEEE:
   42|  11.9k|{
   43|  11.9k|    Assert(mock_time_in >= 0s);
  ------------------
  |  |   85|  11.9k|#define Assert(val) inline_assertion_check<true>(val, __FILE__, __LINE__, __func__, #val)
  ------------------
   44|  11.9k|    g_mock_time.store(mock_time_in, std::memory_order_relaxed);
   45|  11.9k|}

_ZNK22transaction_identifierILb0EE7CompareERKS0_:
   21|   521k|    constexpr int Compare(const transaction_identifier<has_witness>& other) const { return m_wrapped.Compare(other.m_wrapped); }
_ZNK22transaction_identifierILb0EEltIS0_EEbRKT_:
   37|   521k|    bool operator<(const Other& other) const { return Compare(other) < 0; }
_ZN22transaction_identifierILb0EEC2Ev:
   30|   165k|    transaction_identifier() : m_wrapped{} {}
_ZN22transaction_identifierILb0EE11UnserializeI12ParamsStreamIR10DataStream20TransactionSerParamsEEEvRT_:
   58|   152k|    template <typename Stream> void Unserialize(Stream& s) { m_wrapped.Unserialize(s); }
_ZN22transaction_identifierILb0EE11UnserializeI10DataStreamEEvRT_:
   58|  11.6k|    template <typename Stream> void Unserialize(Stream& s) { m_wrapped.Unserialize(s); }
_ZN22transaction_identifierILb0EE11FromUint256ERK7uint256:
   40|  16.1k|    static transaction_identifier FromUint256(const uint256& id) { return {id}; }
_ZN22transaction_identifierILb0EEC2ERK7uint256:
   16|  16.1k|    transaction_identifier(const uint256& wrapped) : m_wrapped{wrapped} {}
_ZN22transaction_identifierILb1EE11FromUint256ERK7uint256:
   40|  16.1k|    static transaction_identifier FromUint256(const uint256& id) { return {id}; }
_ZN22transaction_identifierILb1EEC2ERK7uint256:
   16|  16.1k|    transaction_identifier(const uint256& wrapped) : m_wrapped{wrapped} {}
_ZNK22transaction_identifierILb0EE9ToUint256Ev:
   39|  15.1k|    const uint256& ToUint256() const LIFETIMEBOUND { return m_wrapped; }
_ZNK22transaction_identifierILb0EE9SerializeI10HashWriterEEvRT_:
   57|  5.89M|    template <typename Stream> void Serialize(Stream& s) const { m_wrapped.Serialize(s); }
_ZNK22transaction_identifierILb0EE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
   57|   174k|    template <typename Stream> void Serialize(Stream& s) const { m_wrapped.Serialize(s); }

_ZNK4util17TranslatedLiteralcvNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEv:
   60|  55.6k|    operator std::string() const { return translate_fn && *translate_fn ? (*translate_fn)(original) : original; }
  ------------------
  |  Branch (60:43): [True: 55.6k, False: 0]
  |  Branch (60:59): [True: 0, False: 55.6k]
  ------------------
_ZNK4util17TranslatedLiteralcv13bilingual_strEv:
   61|  55.6k|    operator bilingual_str() const { return {original, std::string{*this}}; }
_Z12UntranslatedNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE:
   82|  87.8k|inline bilingual_str Untranslated(std::string original) { return {original, original}; }

_Z6VectorIJNSt3__110unique_ptrIKN10miniscript4NodeI7CPubKeyEENS0_14default_deleteIS6_EEEES9_EENS0_6vectorINS0_11common_typeIJDpT_EE4typeENS0_9allocatorISF_EEEEDpOSC_:
   24|     17|{
   25|     17|    std::vector<typename std::common_type<Args...>::type> ret;
   26|     17|    ret.reserve(sizeof...(args));
   27|       |    // The line below uses the trick from https://www.experts-exchange.com/articles/32502/None-recursive-variadic-templates-with-std-initializer-list.html
   28|     17|    (void)std::initializer_list<int>{(ret.emplace_back(std::forward<Args>(args)), 0)...};
   29|     17|    return ret;
   30|     17|}
_Z6VectorIJRNSt3__16vectorIhNS0_9allocatorIhEEEEEENS1_INS0_11common_typeIJDpT_EE4typeENS2_ISA_EEEEDpOS7_:
   24|     12|{
   25|     12|    std::vector<typename std::common_type<Args...>::type> ret;
   26|     12|    ret.reserve(sizeof...(args));
   27|       |    // The line below uses the trick from https://www.experts-exchange.com/articles/32502/None-recursive-variadic-templates-with-std-initializer-list.html
   28|     12|    (void)std::initializer_list<int>{(ret.emplace_back(std::forward<Args>(args)), 0)...};
   29|     12|    return ret;
   30|     12|}