_Z23GetScriptForDestinationRKNSt3__17variantIJ14CNoDestination17PubKeyDestination6PKHash10ScriptHash19WitnessV0ScriptHash16WitnessV0KeyHash16WitnessV1Taproot11PayToAnchor14WitnessUnknownEEE:
  167|  4.02k|{
  168|  4.02k|    return std::visit(CScriptVisitor(), dest);
  169|  4.02k|}
addresstype.cpp:_ZNK12_GLOBAL__N_114CScriptVisitorclERK16WitnessV0KeyHash:
  132|  4.02k|    {
  133|  4.02k|        return CScript() << OP_0 << ToByteVector(id);
  134|  4.02k|    }

_ZN16WitnessV1TaprootC2ERK11XOnlyPubKey:
   91|  6.09k|    explicit WitnessV1Taproot(const XOnlyPubKey& xpk) : XOnlyPubKey(xpk) {}
_ZN16WitnessV0KeyHashC2ERK7uint160:
   82|  4.02k|    explicit WitnessV0KeyHash(const uint160& hash) : BaseHash(hash) {}

_ZN4Coin11UnserializeI10SpanReaderEEvRT_:
   83|  12.1k|    void Unserialize(Stream &s) {
   84|  12.1k|        uint32_t code = 0;
   85|  12.1k|        ::Unserialize(s, VARINT(code));
  ------------------
  |  |  494|  12.1k|#define VARINT(obj) Using<VarIntFormatter<VarIntMode::DEFAULT>>(obj)
  ------------------
   86|  12.1k|        nHeight = code >> 1;
   87|  12.1k|        fCoinBase = code & 1;
   88|  12.1k|        ::Unserialize(s, Using<TxOutCompression>(out));
   89|  12.1k|    }
_ZNK4Coin7IsSpentEv:
   94|   100k|    bool IsSpent() const {
   95|   100k|        return out.IsNull();
   96|   100k|    }
_ZN4CoinC2Ev:
   68|  18.6k|    Coin() : fCoinBase(false), nHeight(0) { }

_ZN11ArgsManagerD2Ev:
  130|      2|ArgsManager::~ArgsManager() = default;

_Z17internal_bswap_32j:
   54|   143M|{
   55|   143M|#ifdef bitcoin_builtin_bswap32
   56|   143M|    return bitcoin_builtin_bswap32(x);
  ------------------
  |  |   24|   143M|#      define bitcoin_builtin_bswap32(x) __builtin_bswap32(x)
  ------------------
   57|       |#else
   58|       |    return (((x & 0xff000000U) >> 24) | ((x & 0x00ff0000U) >>  8) |
   59|       |            ((x & 0x0000ff00U) <<  8) | ((x & 0x000000ffU) << 24));
   60|       |#endif
   61|   143M|}
_Z17internal_bswap_64m:
   64|   478k|{
   65|   478k|#ifdef bitcoin_builtin_bswap64
   66|   478k|    return bitcoin_builtin_bswap64(x);
  ------------------
  |  |   27|   478k|#      define bitcoin_builtin_bswap64(x) __builtin_bswap64(x)
  ------------------
   67|       |#else
   68|       |     return (((x & 0xff00000000000000ull) >> 56)
   69|       |          | ((x & 0x00ff000000000000ull) >> 40)
   70|       |          | ((x & 0x0000ff0000000000ull) >> 24)
   71|       |          | ((x & 0x000000ff00000000ull) >> 8)
   72|       |          | ((x & 0x00000000ff000000ull) << 8)
   73|       |          | ((x & 0x0000000000ff0000ull) << 24)
   74|       |          | ((x & 0x000000000000ff00ull) << 40)
   75|       |          | ((x & 0x00000000000000ffull) << 56));
   76|       |#endif
   77|   478k|}

_Z16htole16_internalt:
   19|  2.39k|{
   20|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_16(host_16bits);
   21|  2.39k|        else return host_16bits;
   22|  2.39k|}
_Z16le16toh_internalt:
   29|   119k|{
   30|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_16(little_endian_16bits);
   31|   119k|        else return little_endian_16bits;
   32|   119k|}
_Z16be32toh_internalj:
   44|   139M|{
   45|   139M|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_32(big_endian_32bits);
   46|       |        else return big_endian_32bits;
   47|   139M|}
_Z16htobe32_internalj:
   34|  3.78M|{
   35|  3.78M|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_32(host_32bits);
   36|       |        else return host_32bits;
   37|  3.78M|}
_Z16htole64_internalm:
   59|   595k|{
   60|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_64(host_64bits);
   61|   595k|        else return host_64bits;
   62|   595k|}
_Z16htobe64_internalm:
   54|   478k|{
   55|   478k|    if constexpr (std::endian::native == std::endian::little) return internal_bswap_64(host_64bits);
   56|       |        else return host_64bits;
   57|   478k|}
_Z16le64toh_internalm:
   69|   594k|{
   70|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_64(little_endian_64bits);
   71|   594k|        else return little_endian_64bits;
   72|   594k|}
_Z16htole32_internalj:
   39|  16.4M|{
   40|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_32(host_32bits);
   41|  16.4M|        else return host_32bits;
   42|  16.4M|}
_Z16le32toh_internalj:
   49|  7.69M|{
   50|       |    if constexpr (std::endian::native == std::endian::big) return internal_bswap_32(little_endian_32bits);
   51|  7.69M|        else return little_endian_32bits;
   52|  7.69M|}

_Z20GetSpecialScriptSizej:
   87|  6.16k|{
   88|  6.16k|    if (nSize == 0 || nSize == 1)
  ------------------
  |  Branch (88:9): [True: 1.45k, False: 4.70k]
  |  Branch (88:23): [True: 1.11k, False: 3.58k]
  ------------------
   89|  2.57k|        return 20;
   90|  3.58k|    if (nSize == 2 || nSize == 3 || nSize == 4 || nSize == 5)
  ------------------
  |  Branch (90:9): [True: 360, False: 3.22k]
  |  Branch (90:23): [True: 284, False: 2.94k]
  |  Branch (90:37): [True: 1.49k, False: 1.45k]
  |  Branch (90:51): [True: 1.45k, False: 0]
  ------------------
   91|  3.58k|        return 32;
   92|      0|    return 0;
   93|  3.58k|}
_Z16DecompressScriptR7CScriptjRK9prevectorILj33EhjiE:
   96|  6.10k|{
   97|  6.10k|    switch(nSize) {
  ------------------
  |  Branch (97:12): [True: 6.10k, False: 0]
  ------------------
   98|  1.43k|    case 0x00:
  ------------------
  |  Branch (98:5): [True: 1.43k, False: 4.66k]
  ------------------
   99|  1.43k|        script.resize(25);
  100|  1.43k|        script[0] = OP_DUP;
  101|  1.43k|        script[1] = OP_HASH160;
  102|  1.43k|        script[2] = 20;
  103|  1.43k|        memcpy(&script[3], in.data(), 20);
  104|  1.43k|        script[23] = OP_EQUALVERIFY;
  105|  1.43k|        script[24] = OP_CHECKSIG;
  106|  1.43k|        return true;
  107|  1.11k|    case 0x01:
  ------------------
  |  Branch (107:5): [True: 1.11k, False: 4.99k]
  ------------------
  108|  1.11k|        script.resize(23);
  109|  1.11k|        script[0] = OP_HASH160;
  110|  1.11k|        script[1] = 20;
  111|  1.11k|        memcpy(&script[2], in.data(), 20);
  112|  1.11k|        script[22] = OP_EQUAL;
  113|  1.11k|        return true;
  114|    353|    case 0x02:
  ------------------
  |  Branch (114:5): [True: 353, False: 5.74k]
  ------------------
  115|    632|    case 0x03:
  ------------------
  |  Branch (115:5): [True: 279, False: 5.82k]
  ------------------
  116|    632|        script.resize(35);
  117|    632|        script[0] = 33;
  118|    632|        script[1] = nSize;
  119|    632|        memcpy(&script[2], in.data(), 32);
  120|    632|        script[34] = OP_CHECKSIG;
  121|    632|        return true;
  122|  1.48k|    case 0x04:
  ------------------
  |  Branch (122:5): [True: 1.48k, False: 4.61k]
  ------------------
  123|  2.92k|    case 0x05:
  ------------------
  |  Branch (123:5): [True: 1.44k, False: 4.66k]
  ------------------
  124|  2.92k|        unsigned char vch[33] = {};
  125|  2.92k|        vch[0] = nSize - 2;
  126|  2.92k|        memcpy(&vch[1], in.data(), 32);
  127|  2.92k|        CPubKey pubkey{vch};
  128|  2.92k|        if (!pubkey.Decompress())
  ------------------
  |  Branch (128:13): [True: 1.29k, False: 1.63k]
  ------------------
  129|  1.29k|            return false;
  130|  2.92k|        assert(pubkey.size() == 65);
  ------------------
  |  Branch (130:9): [True: 1.63k, False: 0]
  ------------------
  131|  1.63k|        script.resize(67);
  132|  1.63k|        script[0] = 65;
  133|  1.63k|        memcpy(&script[1], pubkey.begin(), 65);
  134|  1.63k|        script[66] = OP_CHECKSIG;
  135|  1.63k|        return true;
  136|  6.10k|    }
  137|      0|    return false;
  138|  6.10k|}
_Z16DecompressAmountm:
  169|  11.9k|{
  170|       |    // x = 0  OR  x = 1+10*(9*n + d - 1) + e  OR  x = 1+10*(n - 1) + 9
  171|  11.9k|    if (x == 0)
  ------------------
  |  Branch (171:9): [True: 2.79k, False: 9.16k]
  ------------------
  172|  2.79k|        return 0;
  173|  9.16k|    x--;
  174|       |    // x = 10*(9*n + d - 1) + e
  175|  9.16k|    int e = x % 10;
  176|  9.16k|    x /= 10;
  177|  9.16k|    uint64_t n = 0;
  178|  9.16k|    if (e < 9) {
  ------------------
  |  Branch (178:9): [True: 8.65k, False: 516]
  ------------------
  179|       |        // x = 9*n + d - 1
  180|  8.65k|        int d = (x % 9) + 1;
  181|  8.65k|        x /= 9;
  182|       |        // x = n
  183|  8.65k|        n = x*10 + d;
  184|  8.65k|    } else {
  185|    516|        n = x+1;
  186|    516|    }
  187|  48.7k|    while (e) {
  ------------------
  |  Branch (187:12): [True: 39.5k, False: 9.16k]
  ------------------
  188|  39.5k|        n *= 10;
  189|  39.5k|        e--;
  190|  39.5k|    }
  191|  9.16k|    return n;
  192|  11.9k|}

_ZN16TxOutCompression16SerializationOpsI10SpanReader6CTxOut17ActionUnserializeEEvRT0_RT_T1_:
  115|  12.0k|    FORMATTER_METHODS(CTxOut, obj) { READWRITE(Using<AmountCompression>(obj.nValue), Using<ScriptCompression>(obj.scriptPubKey)); }
  ------------------
  |  |  148|  12.0k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN17AmountCompression5UnserI10SpanReaderlEEvRT_RT0_:
  105|  12.0k|    {
  106|  12.0k|        uint64_t v;
  107|  12.0k|        s >> VARINT(v);
  ------------------
  |  |  494|  12.0k|#define VARINT(obj) Using<VarIntFormatter<VarIntMode::DEFAULT>>(obj)
  ------------------
  108|  12.0k|        val = DecompressAmount(v);
  109|  12.0k|    }
_ZN17ScriptCompression5UnserI10SpanReaderEEvRT_R7CScript:
   77|  11.9k|    void Unser(Stream &s, CScript& script) {
   78|  11.9k|        unsigned int nSize = 0;
   79|  11.9k|        s >> VARINT(nSize);
  ------------------
  |  |  494|  11.9k|#define VARINT(obj) Using<VarIntFormatter<VarIntMode::DEFAULT>>(obj)
  ------------------
   80|  11.9k|        if (nSize < nSpecialScripts) {
  ------------------
  |  Branch (80:13): [True: 6.16k, False: 5.79k]
  ------------------
   81|  6.16k|            CompressedScript vch(GetSpecialScriptSize(nSize), 0x00);
   82|  6.16k|            s >> std::span{vch};
   83|  6.16k|            DecompressScript(script, nSize, vch);
   84|  6.16k|            return;
   85|  6.16k|        }
   86|  5.79k|        nSize -= nSpecialScripts;
   87|  5.79k|        if (nSize > MAX_SCRIPT_SIZE) {
  ------------------
  |  Branch (87:13): [True: 104, False: 5.69k]
  ------------------
   88|       |            // Overly long script, replace with a short invalid one
   89|    104|            script << OP_RETURN;
   90|    104|            s.ignore(nSize);
   91|  5.69k|        } else {
   92|  5.69k|            script.resize(nSize);
   93|  5.69k|            s >> std::span{script};
   94|  5.69k|        }
   95|  5.79k|    }

_Z10MoneyRangeRKl:
   27|  6.73k|inline bool MoneyRange(const CAmount& nValue) { return (nValue >= 0 && nValue <= MAX_MONEY); }
  ------------------
  |  Branch (27:57): [True: 6.49k, False: 234]
  |  Branch (27:72): [True: 6.26k, False: 230]
  ------------------

_ZN15ChaCha20AlignedD2Ev:
   42|      4|{
   43|      4|    memory_cleanse(input, sizeof(input));
   44|      4|}
_ZN8ChaCha20D2Ev:
  332|      4|{
  333|      4|    memory_cleanse(m_buffer.data(), m_buffer.size());
  334|      4|}

_Z9WriteLE16ITk8ByteTypehEvPT_t:
   44|    208|{
   45|    208|    uint16_t v = htole16_internal(x);
   46|    208|    memcpy(ptr, &v, 2);
   47|    208|}
_Z8ReadLE16ITk8ByteTypehEtPKT_:
   20|   119k|{
   21|   119k|    uint16_t x;
   22|   119k|    memcpy(&x, ptr, 2);
   23|   119k|    return le16toh_internal(x);
   24|   119k|}
_Z8ReadLE32ITk8ByteTypehEjPKT_:
   28|  5.08M|{
   29|  5.08M|    uint32_t x;
   30|  5.08M|    memcpy(&x, ptr, 4);
   31|  5.08M|    return le32toh_internal(x);
   32|  5.08M|}
_Z9WriteLE32ITk8ByteTypehEvPT_j:
   51|  1.61M|{
   52|  1.61M|    uint32_t v = htole32_internal(x);
   53|  1.61M|    memcpy(ptr, &v, 4);
   54|  1.61M|}
_Z8ReadBE32ITk8ByteTypehEjPKT_:
   73|   139M|{
   74|   139M|    uint32_t x;
   75|   139M|    memcpy(&x, ptr, 4);
   76|   139M|    return be32toh_internal(x);
   77|   139M|}
_Z9WriteBE32ITk8ByteTypehEvPT_j:
   96|  3.78M|{
   97|  3.78M|    uint32_t v = htobe32_internal(x);
   98|  3.78M|    memcpy(ptr, &v, 4);
   99|  3.78M|}
_Z9WriteLE64ITk8ByteTypehEvPT_m:
   58|   308k|{
   59|   308k|    uint64_t v = htole64_internal(x);
   60|   308k|    memcpy(ptr, &v, 8);
   61|   308k|}
_Z9WriteBE64ITk8ByteTypehEvPT_m:
  103|   478k|{
  104|   478k|    uint64_t v = htobe64_internal(x);
  105|   478k|    memcpy(ptr, &v, 8);
  106|   478k|}

_ZN10CRIPEMD160C2Ev:
  243|   308k|{
  244|   308k|    ripemd160::Initialize(s);
  245|   308k|}
_ZN10CRIPEMD1605WriteEPKhm:
  248|   926k|{
  249|   926k|    const unsigned char* end = data + len;
  250|   926k|    size_t bufsize = bytes % 64;
  251|   926k|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (251:9): [True: 615k, False: 311k]
  |  Branch (251:20): [True: 309k, False: 306k]
  ------------------
  252|       |        // Fill the buffer, and process it.
  253|   309k|        memcpy(buf + bufsize, data, 64 - bufsize);
  254|   309k|        bytes += 64 - bufsize;
  255|   309k|        data += 64 - bufsize;
  256|   309k|        ripemd160::Transform(s, buf);
  257|   309k|        bufsize = 0;
  258|   309k|    }
  259|   932k|    while (end - data >= 64) {
  ------------------
  |  Branch (259:12): [True: 5.08k, False: 926k]
  ------------------
  260|       |        // Process full chunks directly from the source.
  261|  5.08k|        ripemd160::Transform(s, data);
  262|  5.08k|        bytes += 64;
  263|  5.08k|        data += 64;
  264|  5.08k|    }
  265|   926k|    if (end > data) {
  ------------------
  |  Branch (265:9): [True: 615k, False: 311k]
  ------------------
  266|       |        // Fill the buffer with what remains.
  267|   615k|        memcpy(buf + bufsize, data, end - data);
  268|   615k|        bytes += end - data;
  269|   615k|    }
  270|   926k|    return *this;
  271|   926k|}
_ZN10CRIPEMD1608FinalizeEPh:
  274|   308k|{
  275|   308k|    static const unsigned char pad[64] = {0x80};
  276|   308k|    unsigned char sizedesc[8];
  277|   308k|    WriteLE64(sizedesc, bytes << 3);
  278|   308k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  279|   308k|    Write(sizedesc, 8);
  280|   308k|    WriteLE32(hash, s[0]);
  281|   308k|    WriteLE32(hash + 4, s[1]);
  282|   308k|    WriteLE32(hash + 8, s[2]);
  283|   308k|    WriteLE32(hash + 12, s[3]);
  284|   308k|    WriteLE32(hash + 16, s[4]);
  285|   308k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd16010InitializeEPj:
   25|   308k|{
   26|   308k|    s[0] = 0x67452301ul;
   27|   308k|    s[1] = 0xEFCDAB89ul;
   28|   308k|    s[2] = 0x98BADCFEul;
   29|   308k|    s[3] = 0x10325476ul;
   30|   308k|    s[4] = 0xC3D2E1F0ul;
   31|   308k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1609TransformEPjPKh:
   55|   314k|{
   56|   314k|    uint32_t a1 = s[0], b1 = s[1], c1 = s[2], d1 = s[3], e1 = s[4];
   57|   314k|    uint32_t a2 = a1, b2 = b1, c2 = c1, d2 = d1, e2 = e1;
   58|   314k|    uint32_t w0 = ReadLE32(chunk + 0), w1 = ReadLE32(chunk + 4), w2 = ReadLE32(chunk + 8), w3 = ReadLE32(chunk + 12);
   59|   314k|    uint32_t w4 = ReadLE32(chunk + 16), w5 = ReadLE32(chunk + 20), w6 = ReadLE32(chunk + 24), w7 = ReadLE32(chunk + 28);
   60|   314k|    uint32_t w8 = ReadLE32(chunk + 32), w9 = ReadLE32(chunk + 36), w10 = ReadLE32(chunk + 40), w11 = ReadLE32(chunk + 44);
   61|   314k|    uint32_t w12 = ReadLE32(chunk + 48), w13 = ReadLE32(chunk + 52), w14 = ReadLE32(chunk + 56), w15 = ReadLE32(chunk + 60);
   62|       |
   63|   314k|    R11(a1, b1, c1, d1, e1, w0, 11);
   64|   314k|    R12(a2, b2, c2, d2, e2, w5, 8);
   65|   314k|    R11(e1, a1, b1, c1, d1, w1, 14);
   66|   314k|    R12(e2, a2, b2, c2, d2, w14, 9);
   67|   314k|    R11(d1, e1, a1, b1, c1, w2, 15);
   68|   314k|    R12(d2, e2, a2, b2, c2, w7, 9);
   69|   314k|    R11(c1, d1, e1, a1, b1, w3, 12);
   70|   314k|    R12(c2, d2, e2, a2, b2, w0, 11);
   71|   314k|    R11(b1, c1, d1, e1, a1, w4, 5);
   72|   314k|    R12(b2, c2, d2, e2, a2, w9, 13);
   73|   314k|    R11(a1, b1, c1, d1, e1, w5, 8);
   74|   314k|    R12(a2, b2, c2, d2, e2, w2, 15);
   75|   314k|    R11(e1, a1, b1, c1, d1, w6, 7);
   76|   314k|    R12(e2, a2, b2, c2, d2, w11, 15);
   77|   314k|    R11(d1, e1, a1, b1, c1, w7, 9);
   78|   314k|    R12(d2, e2, a2, b2, c2, w4, 5);
   79|   314k|    R11(c1, d1, e1, a1, b1, w8, 11);
   80|   314k|    R12(c2, d2, e2, a2, b2, w13, 7);
   81|   314k|    R11(b1, c1, d1, e1, a1, w9, 13);
   82|   314k|    R12(b2, c2, d2, e2, a2, w6, 7);
   83|   314k|    R11(a1, b1, c1, d1, e1, w10, 14);
   84|   314k|    R12(a2, b2, c2, d2, e2, w15, 8);
   85|   314k|    R11(e1, a1, b1, c1, d1, w11, 15);
   86|   314k|    R12(e2, a2, b2, c2, d2, w8, 11);
   87|   314k|    R11(d1, e1, a1, b1, c1, w12, 6);
   88|   314k|    R12(d2, e2, a2, b2, c2, w1, 14);
   89|   314k|    R11(c1, d1, e1, a1, b1, w13, 7);
   90|   314k|    R12(c2, d2, e2, a2, b2, w10, 14);
   91|   314k|    R11(b1, c1, d1, e1, a1, w14, 9);
   92|   314k|    R12(b2, c2, d2, e2, a2, w3, 12);
   93|   314k|    R11(a1, b1, c1, d1, e1, w15, 8);
   94|   314k|    R12(a2, b2, c2, d2, e2, w12, 6);
   95|       |
   96|   314k|    R21(e1, a1, b1, c1, d1, w7, 7);
   97|   314k|    R22(e2, a2, b2, c2, d2, w6, 9);
   98|   314k|    R21(d1, e1, a1, b1, c1, w4, 6);
   99|   314k|    R22(d2, e2, a2, b2, c2, w11, 13);
  100|   314k|    R21(c1, d1, e1, a1, b1, w13, 8);
  101|   314k|    R22(c2, d2, e2, a2, b2, w3, 15);
  102|   314k|    R21(b1, c1, d1, e1, a1, w1, 13);
  103|   314k|    R22(b2, c2, d2, e2, a2, w7, 7);
  104|   314k|    R21(a1, b1, c1, d1, e1, w10, 11);
  105|   314k|    R22(a2, b2, c2, d2, e2, w0, 12);
  106|   314k|    R21(e1, a1, b1, c1, d1, w6, 9);
  107|   314k|    R22(e2, a2, b2, c2, d2, w13, 8);
  108|   314k|    R21(d1, e1, a1, b1, c1, w15, 7);
  109|   314k|    R22(d2, e2, a2, b2, c2, w5, 9);
  110|   314k|    R21(c1, d1, e1, a1, b1, w3, 15);
  111|   314k|    R22(c2, d2, e2, a2, b2, w10, 11);
  112|   314k|    R21(b1, c1, d1, e1, a1, w12, 7);
  113|   314k|    R22(b2, c2, d2, e2, a2, w14, 7);
  114|   314k|    R21(a1, b1, c1, d1, e1, w0, 12);
  115|   314k|    R22(a2, b2, c2, d2, e2, w15, 7);
  116|   314k|    R21(e1, a1, b1, c1, d1, w9, 15);
  117|   314k|    R22(e2, a2, b2, c2, d2, w8, 12);
  118|   314k|    R21(d1, e1, a1, b1, c1, w5, 9);
  119|   314k|    R22(d2, e2, a2, b2, c2, w12, 7);
  120|   314k|    R21(c1, d1, e1, a1, b1, w2, 11);
  121|   314k|    R22(c2, d2, e2, a2, b2, w4, 6);
  122|   314k|    R21(b1, c1, d1, e1, a1, w14, 7);
  123|   314k|    R22(b2, c2, d2, e2, a2, w9, 15);
  124|   314k|    R21(a1, b1, c1, d1, e1, w11, 13);
  125|   314k|    R22(a2, b2, c2, d2, e2, w1, 13);
  126|   314k|    R21(e1, a1, b1, c1, d1, w8, 12);
  127|   314k|    R22(e2, a2, b2, c2, d2, w2, 11);
  128|       |
  129|   314k|    R31(d1, e1, a1, b1, c1, w3, 11);
  130|   314k|    R32(d2, e2, a2, b2, c2, w15, 9);
  131|   314k|    R31(c1, d1, e1, a1, b1, w10, 13);
  132|   314k|    R32(c2, d2, e2, a2, b2, w5, 7);
  133|   314k|    R31(b1, c1, d1, e1, a1, w14, 6);
  134|   314k|    R32(b2, c2, d2, e2, a2, w1, 15);
  135|   314k|    R31(a1, b1, c1, d1, e1, w4, 7);
  136|   314k|    R32(a2, b2, c2, d2, e2, w3, 11);
  137|   314k|    R31(e1, a1, b1, c1, d1, w9, 14);
  138|   314k|    R32(e2, a2, b2, c2, d2, w7, 8);
  139|   314k|    R31(d1, e1, a1, b1, c1, w15, 9);
  140|   314k|    R32(d2, e2, a2, b2, c2, w14, 6);
  141|   314k|    R31(c1, d1, e1, a1, b1, w8, 13);
  142|   314k|    R32(c2, d2, e2, a2, b2, w6, 6);
  143|   314k|    R31(b1, c1, d1, e1, a1, w1, 15);
  144|   314k|    R32(b2, c2, d2, e2, a2, w9, 14);
  145|   314k|    R31(a1, b1, c1, d1, e1, w2, 14);
  146|   314k|    R32(a2, b2, c2, d2, e2, w11, 12);
  147|   314k|    R31(e1, a1, b1, c1, d1, w7, 8);
  148|   314k|    R32(e2, a2, b2, c2, d2, w8, 13);
  149|   314k|    R31(d1, e1, a1, b1, c1, w0, 13);
  150|   314k|    R32(d2, e2, a2, b2, c2, w12, 5);
  151|   314k|    R31(c1, d1, e1, a1, b1, w6, 6);
  152|   314k|    R32(c2, d2, e2, a2, b2, w2, 14);
  153|   314k|    R31(b1, c1, d1, e1, a1, w13, 5);
  154|   314k|    R32(b2, c2, d2, e2, a2, w10, 13);
  155|   314k|    R31(a1, b1, c1, d1, e1, w11, 12);
  156|   314k|    R32(a2, b2, c2, d2, e2, w0, 13);
  157|   314k|    R31(e1, a1, b1, c1, d1, w5, 7);
  158|   314k|    R32(e2, a2, b2, c2, d2, w4, 7);
  159|   314k|    R31(d1, e1, a1, b1, c1, w12, 5);
  160|   314k|    R32(d2, e2, a2, b2, c2, w13, 5);
  161|       |
  162|   314k|    R41(c1, d1, e1, a1, b1, w1, 11);
  163|   314k|    R42(c2, d2, e2, a2, b2, w8, 15);
  164|   314k|    R41(b1, c1, d1, e1, a1, w9, 12);
  165|   314k|    R42(b2, c2, d2, e2, a2, w6, 5);
  166|   314k|    R41(a1, b1, c1, d1, e1, w11, 14);
  167|   314k|    R42(a2, b2, c2, d2, e2, w4, 8);
  168|   314k|    R41(e1, a1, b1, c1, d1, w10, 15);
  169|   314k|    R42(e2, a2, b2, c2, d2, w1, 11);
  170|   314k|    R41(d1, e1, a1, b1, c1, w0, 14);
  171|   314k|    R42(d2, e2, a2, b2, c2, w3, 14);
  172|   314k|    R41(c1, d1, e1, a1, b1, w8, 15);
  173|   314k|    R42(c2, d2, e2, a2, b2, w11, 14);
  174|   314k|    R41(b1, c1, d1, e1, a1, w12, 9);
  175|   314k|    R42(b2, c2, d2, e2, a2, w15, 6);
  176|   314k|    R41(a1, b1, c1, d1, e1, w4, 8);
  177|   314k|    R42(a2, b2, c2, d2, e2, w0, 14);
  178|   314k|    R41(e1, a1, b1, c1, d1, w13, 9);
  179|   314k|    R42(e2, a2, b2, c2, d2, w5, 6);
  180|   314k|    R41(d1, e1, a1, b1, c1, w3, 14);
  181|   314k|    R42(d2, e2, a2, b2, c2, w12, 9);
  182|   314k|    R41(c1, d1, e1, a1, b1, w7, 5);
  183|   314k|    R42(c2, d2, e2, a2, b2, w2, 12);
  184|   314k|    R41(b1, c1, d1, e1, a1, w15, 6);
  185|   314k|    R42(b2, c2, d2, e2, a2, w13, 9);
  186|   314k|    R41(a1, b1, c1, d1, e1, w14, 8);
  187|   314k|    R42(a2, b2, c2, d2, e2, w9, 12);
  188|   314k|    R41(e1, a1, b1, c1, d1, w5, 6);
  189|   314k|    R42(e2, a2, b2, c2, d2, w7, 5);
  190|   314k|    R41(d1, e1, a1, b1, c1, w6, 5);
  191|   314k|    R42(d2, e2, a2, b2, c2, w10, 15);
  192|   314k|    R41(c1, d1, e1, a1, b1, w2, 12);
  193|   314k|    R42(c2, d2, e2, a2, b2, w14, 8);
  194|       |
  195|   314k|    R51(b1, c1, d1, e1, a1, w4, 9);
  196|   314k|    R52(b2, c2, d2, e2, a2, w12, 8);
  197|   314k|    R51(a1, b1, c1, d1, e1, w0, 15);
  198|   314k|    R52(a2, b2, c2, d2, e2, w15, 5);
  199|   314k|    R51(e1, a1, b1, c1, d1, w5, 5);
  200|   314k|    R52(e2, a2, b2, c2, d2, w10, 12);
  201|   314k|    R51(d1, e1, a1, b1, c1, w9, 11);
  202|   314k|    R52(d2, e2, a2, b2, c2, w4, 9);
  203|   314k|    R51(c1, d1, e1, a1, b1, w7, 6);
  204|   314k|    R52(c2, d2, e2, a2, b2, w1, 12);
  205|   314k|    R51(b1, c1, d1, e1, a1, w12, 8);
  206|   314k|    R52(b2, c2, d2, e2, a2, w5, 5);
  207|   314k|    R51(a1, b1, c1, d1, e1, w2, 13);
  208|   314k|    R52(a2, b2, c2, d2, e2, w8, 14);
  209|   314k|    R51(e1, a1, b1, c1, d1, w10, 12);
  210|   314k|    R52(e2, a2, b2, c2, d2, w7, 6);
  211|   314k|    R51(d1, e1, a1, b1, c1, w14, 5);
  212|   314k|    R52(d2, e2, a2, b2, c2, w6, 8);
  213|   314k|    R51(c1, d1, e1, a1, b1, w1, 12);
  214|   314k|    R52(c2, d2, e2, a2, b2, w2, 13);
  215|   314k|    R51(b1, c1, d1, e1, a1, w3, 13);
  216|   314k|    R52(b2, c2, d2, e2, a2, w13, 6);
  217|   314k|    R51(a1, b1, c1, d1, e1, w8, 14);
  218|   314k|    R52(a2, b2, c2, d2, e2, w14, 5);
  219|   314k|    R51(e1, a1, b1, c1, d1, w11, 11);
  220|   314k|    R52(e2, a2, b2, c2, d2, w0, 15);
  221|   314k|    R51(d1, e1, a1, b1, c1, w6, 8);
  222|   314k|    R52(d2, e2, a2, b2, c2, w3, 13);
  223|   314k|    R51(c1, d1, e1, a1, b1, w15, 5);
  224|   314k|    R52(c2, d2, e2, a2, b2, w9, 11);
  225|   314k|    R51(b1, c1, d1, e1, a1, w13, 6);
  226|   314k|    R52(b2, c2, d2, e2, a2, w11, 11);
  227|       |
  228|   314k|    uint32_t t = s[0];
  229|   314k|    s[0] = s[1] + c1 + d2;
  230|   314k|    s[1] = s[2] + d1 + e2;
  231|   314k|    s[2] = s[3] + e1 + a2;
  232|   314k|    s[3] = s[4] + a1 + b2;
  233|   314k|    s[4] = t + b1 + c2;
  234|   314k|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R11ERjjS1_jjji:
   41|  5.02M|void inline R11(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f1(b, c, d), x, 0, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1605RoundERjjS1_jjjjji:
   36|  50.2M|{
   37|  50.2M|    a = rol(a + f + x + k, r) + e;
   38|  50.2M|    c = rol(c, 10);
   39|  50.2M|}
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603rolEji:
   33|   100M|uint32_t inline rol(uint32_t x, int i) { return (x << i) | (x >> (32 - i)); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f1Ejjj:
   17|  10.0M|uint32_t inline f1(uint32_t x, uint32_t y, uint32_t z) { return x ^ y ^ z; }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R12ERjjS1_jjji:
   47|  5.02M|void inline R12(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f5(b, c, d), x, 0x50A28BE6ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f5Ejjj:
   21|  10.0M|uint32_t inline f5(uint32_t x, uint32_t y, uint32_t z) { return x ^ (y | ~z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R21ERjjS1_jjji:
   42|  5.02M|void inline R21(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f2(b, c, d), x, 0x5A827999ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f2Ejjj:
   18|  10.0M|uint32_t inline f2(uint32_t x, uint32_t y, uint32_t z) { return (x & y) | (~x & z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R22ERjjS1_jjji:
   48|  5.02M|void inline R22(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f4(b, c, d), x, 0x5C4DD124ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f4Ejjj:
   20|  10.0M|uint32_t inline f4(uint32_t x, uint32_t y, uint32_t z) { return (x & z) | (y & ~z); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R31ERjjS1_jjji:
   43|  5.02M|void inline R31(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f3(b, c, d), x, 0x6ED9EBA1ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1602f3Ejjj:
   19|  10.0M|uint32_t inline f3(uint32_t x, uint32_t y, uint32_t z) { return (x | ~y) ^ z; }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R32ERjjS1_jjji:
   49|  5.02M|void inline R32(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f3(b, c, d), x, 0x6D703EF3ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R41ERjjS1_jjji:
   44|  5.02M|void inline R41(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f4(b, c, d), x, 0x8F1BBCDCul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R42ERjjS1_jjji:
   50|  5.02M|void inline R42(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f2(b, c, d), x, 0x7A6D76E9ul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R51ERjjS1_jjji:
   45|  5.02M|void inline R51(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f5(b, c, d), x, 0xA953FD4Eul, r); }
ripemd160.cpp:_ZN12_GLOBAL__N_19ripemd1603R52ERjjS1_jjji:
   51|  5.02M|void inline R52(uint32_t& a, uint32_t b, uint32_t& c, uint32_t d, uint32_t e, uint32_t x, int r) { Round(a, b, c, d, e, f1(b, c, d), x, 0, r); }

_ZN5CSHA1C2Ev:
  150|  14.3k|{
  151|  14.3k|    sha1::Initialize(s);
  152|  14.3k|}
_ZN5CSHA15WriteEPKhm:
  155|  42.9k|{
  156|  42.9k|    const unsigned char* end = data + len;
  157|  42.9k|    size_t bufsize = bytes % 64;
  158|  42.9k|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (158:9): [True: 28.3k, False: 14.6k]
  |  Branch (158:20): [True: 14.3k, False: 13.9k]
  ------------------
  159|       |        // Fill the buffer, and process it.
  160|  14.3k|        memcpy(buf + bufsize, data, 64 - bufsize);
  161|  14.3k|        bytes += 64 - bufsize;
  162|  14.3k|        data += 64 - bufsize;
  163|  14.3k|        sha1::Transform(s, buf);
  164|  14.3k|        bufsize = 0;
  165|  14.3k|    }
  166|  43.5k|    while (end - data >= 64) {
  ------------------
  |  Branch (166:12): [True: 613, False: 42.9k]
  ------------------
  167|       |        // Process full chunks directly from the source.
  168|    613|        sha1::Transform(s, data);
  169|    613|        bytes += 64;
  170|    613|        data += 64;
  171|    613|    }
  172|  42.9k|    if (end > data) {
  ------------------
  |  Branch (172:9): [True: 28.3k, False: 14.6k]
  ------------------
  173|       |        // Fill the buffer with what remains.
  174|  28.3k|        memcpy(buf + bufsize, data, end - data);
  175|  28.3k|        bytes += end - data;
  176|  28.3k|    }
  177|  42.9k|    return *this;
  178|  42.9k|}
_ZN5CSHA18FinalizeEPh:
  181|  14.3k|{
  182|  14.3k|    static const unsigned char pad[64] = {0x80};
  183|  14.3k|    unsigned char sizedesc[8];
  184|  14.3k|    WriteBE64(sizedesc, bytes << 3);
  185|  14.3k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  186|  14.3k|    Write(sizedesc, 8);
  187|  14.3k|    WriteBE32(hash, s[0]);
  188|  14.3k|    WriteBE32(hash + 4, s[1]);
  189|  14.3k|    WriteBE32(hash + 8, s[2]);
  190|  14.3k|    WriteBE32(hash + 12, s[3]);
  191|  14.3k|    WriteBE32(hash + 16, s[4]);
  192|  14.3k|}
sha1.cpp:_ZN12_GLOBAL__N_14sha110InitializeEPj:
   32|  14.3k|{
   33|  14.3k|    s[0] = 0x67452301ul;
   34|  14.3k|    s[1] = 0xEFCDAB89ul;
   35|  14.3k|    s[2] = 0x98BADCFEul;
   36|  14.3k|    s[3] = 0x10325476ul;
   37|  14.3k|    s[4] = 0xC3D2E1F0ul;
   38|  14.3k|}
sha1.cpp:_ZN12_GLOBAL__N_14sha19TransformEPjPKh:
   47|  14.9k|{
   48|  14.9k|    uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4];
   49|  14.9k|    uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
   50|       |
   51|  14.9k|    Round(a, b, c, d, e, f1(b, c, d), k1, w0 = ReadBE32(chunk + 0));
   52|  14.9k|    Round(e, a, b, c, d, f1(a, b, c), k1, w1 = ReadBE32(chunk + 4));
   53|  14.9k|    Round(d, e, a, b, c, f1(e, a, b), k1, w2 = ReadBE32(chunk + 8));
   54|  14.9k|    Round(c, d, e, a, b, f1(d, e, a), k1, w3 = ReadBE32(chunk + 12));
   55|  14.9k|    Round(b, c, d, e, a, f1(c, d, e), k1, w4 = ReadBE32(chunk + 16));
   56|  14.9k|    Round(a, b, c, d, e, f1(b, c, d), k1, w5 = ReadBE32(chunk + 20));
   57|  14.9k|    Round(e, a, b, c, d, f1(a, b, c), k1, w6 = ReadBE32(chunk + 24));
   58|  14.9k|    Round(d, e, a, b, c, f1(e, a, b), k1, w7 = ReadBE32(chunk + 28));
   59|  14.9k|    Round(c, d, e, a, b, f1(d, e, a), k1, w8 = ReadBE32(chunk + 32));
   60|  14.9k|    Round(b, c, d, e, a, f1(c, d, e), k1, w9 = ReadBE32(chunk + 36));
   61|  14.9k|    Round(a, b, c, d, e, f1(b, c, d), k1, w10 = ReadBE32(chunk + 40));
   62|  14.9k|    Round(e, a, b, c, d, f1(a, b, c), k1, w11 = ReadBE32(chunk + 44));
   63|  14.9k|    Round(d, e, a, b, c, f1(e, a, b), k1, w12 = ReadBE32(chunk + 48));
   64|  14.9k|    Round(c, d, e, a, b, f1(d, e, a), k1, w13 = ReadBE32(chunk + 52));
   65|  14.9k|    Round(b, c, d, e, a, f1(c, d, e), k1, w14 = ReadBE32(chunk + 56));
   66|  14.9k|    Round(a, b, c, d, e, f1(b, c, d), k1, w15 = ReadBE32(chunk + 60));
   67|       |
   68|  14.9k|    Round(e, a, b, c, d, f1(a, b, c), k1, w0 = left(w0 ^ w13 ^ w8 ^ w2));
   69|  14.9k|    Round(d, e, a, b, c, f1(e, a, b), k1, w1 = left(w1 ^ w14 ^ w9 ^ w3));
   70|  14.9k|    Round(c, d, e, a, b, f1(d, e, a), k1, w2 = left(w2 ^ w15 ^ w10 ^ w4));
   71|  14.9k|    Round(b, c, d, e, a, f1(c, d, e), k1, w3 = left(w3 ^ w0 ^ w11 ^ w5));
   72|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k2, w4 = left(w4 ^ w1 ^ w12 ^ w6));
   73|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k2, w5 = left(w5 ^ w2 ^ w13 ^ w7));
   74|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k2, w6 = left(w6 ^ w3 ^ w14 ^ w8));
   75|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k2, w7 = left(w7 ^ w4 ^ w15 ^ w9));
   76|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k2, w8 = left(w8 ^ w5 ^ w0 ^ w10));
   77|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k2, w9 = left(w9 ^ w6 ^ w1 ^ w11));
   78|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k2, w10 = left(w10 ^ w7 ^ w2 ^ w12));
   79|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k2, w11 = left(w11 ^ w8 ^ w3 ^ w13));
   80|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k2, w12 = left(w12 ^ w9 ^ w4 ^ w14));
   81|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k2, w13 = left(w13 ^ w10 ^ w5 ^ w15));
   82|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k2, w14 = left(w14 ^ w11 ^ w6 ^ w0));
   83|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k2, w15 = left(w15 ^ w12 ^ w7 ^ w1));
   84|       |
   85|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k2, w0 = left(w0 ^ w13 ^ w8 ^ w2));
   86|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k2, w1 = left(w1 ^ w14 ^ w9 ^ w3));
   87|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k2, w2 = left(w2 ^ w15 ^ w10 ^ w4));
   88|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k2, w3 = left(w3 ^ w0 ^ w11 ^ w5));
   89|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k2, w4 = left(w4 ^ w1 ^ w12 ^ w6));
   90|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k2, w5 = left(w5 ^ w2 ^ w13 ^ w7));
   91|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k2, w6 = left(w6 ^ w3 ^ w14 ^ w8));
   92|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k2, w7 = left(w7 ^ w4 ^ w15 ^ w9));
   93|  14.9k|    Round(a, b, c, d, e, f3(b, c, d), k3, w8 = left(w8 ^ w5 ^ w0 ^ w10));
   94|  14.9k|    Round(e, a, b, c, d, f3(a, b, c), k3, w9 = left(w9 ^ w6 ^ w1 ^ w11));
   95|  14.9k|    Round(d, e, a, b, c, f3(e, a, b), k3, w10 = left(w10 ^ w7 ^ w2 ^ w12));
   96|  14.9k|    Round(c, d, e, a, b, f3(d, e, a), k3, w11 = left(w11 ^ w8 ^ w3 ^ w13));
   97|  14.9k|    Round(b, c, d, e, a, f3(c, d, e), k3, w12 = left(w12 ^ w9 ^ w4 ^ w14));
   98|  14.9k|    Round(a, b, c, d, e, f3(b, c, d), k3, w13 = left(w13 ^ w10 ^ w5 ^ w15));
   99|  14.9k|    Round(e, a, b, c, d, f3(a, b, c), k3, w14 = left(w14 ^ w11 ^ w6 ^ w0));
  100|  14.9k|    Round(d, e, a, b, c, f3(e, a, b), k3, w15 = left(w15 ^ w12 ^ w7 ^ w1));
  101|       |
  102|  14.9k|    Round(c, d, e, a, b, f3(d, e, a), k3, w0 = left(w0 ^ w13 ^ w8 ^ w2));
  103|  14.9k|    Round(b, c, d, e, a, f3(c, d, e), k3, w1 = left(w1 ^ w14 ^ w9 ^ w3));
  104|  14.9k|    Round(a, b, c, d, e, f3(b, c, d), k3, w2 = left(w2 ^ w15 ^ w10 ^ w4));
  105|  14.9k|    Round(e, a, b, c, d, f3(a, b, c), k3, w3 = left(w3 ^ w0 ^ w11 ^ w5));
  106|  14.9k|    Round(d, e, a, b, c, f3(e, a, b), k3, w4 = left(w4 ^ w1 ^ w12 ^ w6));
  107|  14.9k|    Round(c, d, e, a, b, f3(d, e, a), k3, w5 = left(w5 ^ w2 ^ w13 ^ w7));
  108|  14.9k|    Round(b, c, d, e, a, f3(c, d, e), k3, w6 = left(w6 ^ w3 ^ w14 ^ w8));
  109|  14.9k|    Round(a, b, c, d, e, f3(b, c, d), k3, w7 = left(w7 ^ w4 ^ w15 ^ w9));
  110|  14.9k|    Round(e, a, b, c, d, f3(a, b, c), k3, w8 = left(w8 ^ w5 ^ w0 ^ w10));
  111|  14.9k|    Round(d, e, a, b, c, f3(e, a, b), k3, w9 = left(w9 ^ w6 ^ w1 ^ w11));
  112|  14.9k|    Round(c, d, e, a, b, f3(d, e, a), k3, w10 = left(w10 ^ w7 ^ w2 ^ w12));
  113|  14.9k|    Round(b, c, d, e, a, f3(c, d, e), k3, w11 = left(w11 ^ w8 ^ w3 ^ w13));
  114|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k4, w12 = left(w12 ^ w9 ^ w4 ^ w14));
  115|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k4, w13 = left(w13 ^ w10 ^ w5 ^ w15));
  116|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k4, w14 = left(w14 ^ w11 ^ w6 ^ w0));
  117|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k4, w15 = left(w15 ^ w12 ^ w7 ^ w1));
  118|       |
  119|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k4, w0 = left(w0 ^ w13 ^ w8 ^ w2));
  120|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k4, w1 = left(w1 ^ w14 ^ w9 ^ w3));
  121|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k4, w2 = left(w2 ^ w15 ^ w10 ^ w4));
  122|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k4, w3 = left(w3 ^ w0 ^ w11 ^ w5));
  123|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k4, w4 = left(w4 ^ w1 ^ w12 ^ w6));
  124|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k4, w5 = left(w5 ^ w2 ^ w13 ^ w7));
  125|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k4, w6 = left(w6 ^ w3 ^ w14 ^ w8));
  126|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k4, w7 = left(w7 ^ w4 ^ w15 ^ w9));
  127|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k4, w8 = left(w8 ^ w5 ^ w0 ^ w10));
  128|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k4, w9 = left(w9 ^ w6 ^ w1 ^ w11));
  129|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k4, w10 = left(w10 ^ w7 ^ w2 ^ w12));
  130|  14.9k|    Round(a, b, c, d, e, f2(b, c, d), k4, w11 = left(w11 ^ w8 ^ w3 ^ w13));
  131|  14.9k|    Round(e, a, b, c, d, f2(a, b, c), k4, w12 = left(w12 ^ w9 ^ w4 ^ w14));
  132|  14.9k|    Round(d, e, a, b, c, f2(e, a, b), k4, left(w13 ^ w10 ^ w5 ^ w15));
  133|  14.9k|    Round(c, d, e, a, b, f2(d, e, a), k4, left(w14 ^ w11 ^ w6 ^ w0));
  134|  14.9k|    Round(b, c, d, e, a, f2(c, d, e), k4, left(w15 ^ w12 ^ w7 ^ w1));
  135|       |
  136|  14.9k|    s[0] += a;
  137|  14.9k|    s[1] += b;
  138|  14.9k|    s[2] += c;
  139|  14.9k|    s[3] += d;
  140|  14.9k|    s[4] += e;
  141|  14.9k|}
sha1.cpp:_ZN12_GLOBAL__N_14sha15RoundEjRjjjS1_jjj:
   19|  1.19M|{
   20|  1.19M|    e += ((a << 5) | (a >> 27)) + f + k + w;
   21|  1.19M|    b = (b << 30) | (b >> 2);
   22|  1.19M|}
sha1.cpp:_ZN12_GLOBAL__N_14sha12f1Ejjj:
   24|   299k|uint32_t inline f1(uint32_t b, uint32_t c, uint32_t d) { return d ^ (b & (c ^ d)); }
sha1.cpp:_ZN12_GLOBAL__N_14sha14leftEj:
   28|   958k|uint32_t inline left(uint32_t x) { return (x << 1) | (x >> 31); }
sha1.cpp:_ZN12_GLOBAL__N_14sha12f2Ejjj:
   25|   598k|uint32_t inline f2(uint32_t b, uint32_t c, uint32_t d) { return b ^ c ^ d; }
sha1.cpp:_ZN12_GLOBAL__N_14sha12f3Ejjj:
   26|   299k|uint32_t inline f3(uint32_t b, uint32_t c, uint32_t d) { return (b & c) | (d & (b | c)); }

_ZN7CSHA256C2Ev:
  695|   363k|{
  696|   363k|    sha256::Initialize(s);
  697|   363k|}
_ZN7CSHA2565WriteEPKhm:
  700|  31.1M|{
  701|  31.1M|    const unsigned char* end = data + len;
  702|  31.1M|    size_t bufsize = bytes % 64;
  703|  31.1M|    if (bufsize && bufsize + len >= 64) {
  ------------------
  |  Branch (703:9): [True: 30.1M, False: 960k]
  |  Branch (703:20): [True: 5.27M, False: 24.8M]
  ------------------
  704|       |        // Fill the buffer, and process it.
  705|  5.27M|        memcpy(buf + bufsize, data, 64 - bufsize);
  706|  5.27M|        bytes += 64 - bufsize;
  707|  5.27M|        data += 64 - bufsize;
  708|  5.27M|        Transform(s, buf, 1);
  709|  5.27M|        bufsize = 0;
  710|  5.27M|    }
  711|  31.1M|    if (end - data >= 64) {
  ------------------
  |  Branch (711:9): [True: 114k, False: 30.9M]
  ------------------
  712|   114k|        size_t blocks = (end - data) / 64;
  713|   114k|        Transform(s, data, blocks);
  714|   114k|        data += 64 * blocks;
  715|   114k|        bytes += 64 * blocks;
  716|   114k|    }
  717|  31.1M|    if (end > data) {
  ------------------
  |  Branch (717:9): [True: 30.1M, False: 960k]
  ------------------
  718|       |        // Fill the buffer with what remains.
  719|  30.1M|        memcpy(buf + bufsize, data, end - data);
  720|  30.1M|        bytes += end - data;
  721|  30.1M|    }
  722|  31.1M|    return *this;
  723|  31.1M|}
_ZN7CSHA2568FinalizeEPh:
  726|   464k|{
  727|   464k|    static const unsigned char pad[64] = {0x80};
  728|   464k|    unsigned char sizedesc[8];
  729|   464k|    WriteBE64(sizedesc, bytes << 3);
  730|   464k|    Write(pad, 1 + ((119 - (bytes % 64)) % 64));
  731|   464k|    Write(sizedesc, 8);
  732|   464k|    WriteBE32(hash, s[0]);
  733|   464k|    WriteBE32(hash + 4, s[1]);
  734|   464k|    WriteBE32(hash + 8, s[2]);
  735|   464k|    WriteBE32(hash + 12, s[3]);
  736|   464k|    WriteBE32(hash + 16, s[4]);
  737|   464k|    WriteBE32(hash + 20, s[5]);
  738|   464k|    WriteBE32(hash + 24, s[6]);
  739|   464k|    WriteBE32(hash + 28, s[7]);
  740|   464k|}
_ZN7CSHA2565ResetEv:
  743|  97.5k|{
  744|  97.5k|    bytes = 0;
  745|  97.5k|    sha256::Initialize(s);
  746|  97.5k|    return *this;
  747|  97.5k|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2569TransformEPjPKhm:
  100|  5.39M|{
  101|  14.0M|    while (blocks--) {
  ------------------
  |  Branch (101:12): [True: 8.69M, False: 5.39M]
  ------------------
  102|  8.69M|        uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
  103|  8.69M|        uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
  104|       |
  105|  8.69M|        Round(a, b, c, d, e, f, g, h, 0x428a2f98 + (w0 = ReadBE32(chunk + 0)));
  106|  8.69M|        Round(h, a, b, c, d, e, f, g, 0x71374491 + (w1 = ReadBE32(chunk + 4)));
  107|  8.69M|        Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf + (w2 = ReadBE32(chunk + 8)));
  108|  8.69M|        Round(f, g, h, a, b, c, d, e, 0xe9b5dba5 + (w3 = ReadBE32(chunk + 12)));
  109|  8.69M|        Round(e, f, g, h, a, b, c, d, 0x3956c25b + (w4 = ReadBE32(chunk + 16)));
  110|  8.69M|        Round(d, e, f, g, h, a, b, c, 0x59f111f1 + (w5 = ReadBE32(chunk + 20)));
  111|  8.69M|        Round(c, d, e, f, g, h, a, b, 0x923f82a4 + (w6 = ReadBE32(chunk + 24)));
  112|  8.69M|        Round(b, c, d, e, f, g, h, a, 0xab1c5ed5 + (w7 = ReadBE32(chunk + 28)));
  113|  8.69M|        Round(a, b, c, d, e, f, g, h, 0xd807aa98 + (w8 = ReadBE32(chunk + 32)));
  114|  8.69M|        Round(h, a, b, c, d, e, f, g, 0x12835b01 + (w9 = ReadBE32(chunk + 36)));
  115|  8.69M|        Round(g, h, a, b, c, d, e, f, 0x243185be + (w10 = ReadBE32(chunk + 40)));
  116|  8.69M|        Round(f, g, h, a, b, c, d, e, 0x550c7dc3 + (w11 = ReadBE32(chunk + 44)));
  117|  8.69M|        Round(e, f, g, h, a, b, c, d, 0x72be5d74 + (w12 = ReadBE32(chunk + 48)));
  118|  8.69M|        Round(d, e, f, g, h, a, b, c, 0x80deb1fe + (w13 = ReadBE32(chunk + 52)));
  119|  8.69M|        Round(c, d, e, f, g, h, a, b, 0x9bdc06a7 + (w14 = ReadBE32(chunk + 56)));
  120|  8.69M|        Round(b, c, d, e, f, g, h, a, 0xc19bf174 + (w15 = ReadBE32(chunk + 60)));
  121|       |
  122|  8.69M|        Round(a, b, c, d, e, f, g, h, 0xe49b69c1 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  123|  8.69M|        Round(h, a, b, c, d, e, f, g, 0xefbe4786 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  124|  8.69M|        Round(g, h, a, b, c, d, e, f, 0x0fc19dc6 + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  125|  8.69M|        Round(f, g, h, a, b, c, d, e, 0x240ca1cc + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  126|  8.69M|        Round(e, f, g, h, a, b, c, d, 0x2de92c6f + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  127|  8.69M|        Round(d, e, f, g, h, a, b, c, 0x4a7484aa + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  128|  8.69M|        Round(c, d, e, f, g, h, a, b, 0x5cb0a9dc + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  129|  8.69M|        Round(b, c, d, e, f, g, h, a, 0x76f988da + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  130|  8.69M|        Round(a, b, c, d, e, f, g, h, 0x983e5152 + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  131|  8.69M|        Round(h, a, b, c, d, e, f, g, 0xa831c66d + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  132|  8.69M|        Round(g, h, a, b, c, d, e, f, 0xb00327c8 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  133|  8.69M|        Round(f, g, h, a, b, c, d, e, 0xbf597fc7 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  134|  8.69M|        Round(e, f, g, h, a, b, c, d, 0xc6e00bf3 + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  135|  8.69M|        Round(d, e, f, g, h, a, b, c, 0xd5a79147 + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  136|  8.69M|        Round(c, d, e, f, g, h, a, b, 0x06ca6351 + (w14 += sigma1(w12) + w7 + sigma0(w15)));
  137|  8.69M|        Round(b, c, d, e, f, g, h, a, 0x14292967 + (w15 += sigma1(w13) + w8 + sigma0(w0)));
  138|       |
  139|  8.69M|        Round(a, b, c, d, e, f, g, h, 0x27b70a85 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  140|  8.69M|        Round(h, a, b, c, d, e, f, g, 0x2e1b2138 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  141|  8.69M|        Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  142|  8.69M|        Round(f, g, h, a, b, c, d, e, 0x53380d13 + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  143|  8.69M|        Round(e, f, g, h, a, b, c, d, 0x650a7354 + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  144|  8.69M|        Round(d, e, f, g, h, a, b, c, 0x766a0abb + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  145|  8.69M|        Round(c, d, e, f, g, h, a, b, 0x81c2c92e + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  146|  8.69M|        Round(b, c, d, e, f, g, h, a, 0x92722c85 + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  147|  8.69M|        Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1 + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  148|  8.69M|        Round(h, a, b, c, d, e, f, g, 0xa81a664b + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  149|  8.69M|        Round(g, h, a, b, c, d, e, f, 0xc24b8b70 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  150|  8.69M|        Round(f, g, h, a, b, c, d, e, 0xc76c51a3 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  151|  8.69M|        Round(e, f, g, h, a, b, c, d, 0xd192e819 + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  152|  8.69M|        Round(d, e, f, g, h, a, b, c, 0xd6990624 + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  153|  8.69M|        Round(c, d, e, f, g, h, a, b, 0xf40e3585 + (w14 += sigma1(w12) + w7 + sigma0(w15)));
  154|  8.69M|        Round(b, c, d, e, f, g, h, a, 0x106aa070 + (w15 += sigma1(w13) + w8 + sigma0(w0)));
  155|       |
  156|  8.69M|        Round(a, b, c, d, e, f, g, h, 0x19a4c116 + (w0 += sigma1(w14) + w9 + sigma0(w1)));
  157|  8.69M|        Round(h, a, b, c, d, e, f, g, 0x1e376c08 + (w1 += sigma1(w15) + w10 + sigma0(w2)));
  158|  8.69M|        Round(g, h, a, b, c, d, e, f, 0x2748774c + (w2 += sigma1(w0) + w11 + sigma0(w3)));
  159|  8.69M|        Round(f, g, h, a, b, c, d, e, 0x34b0bcb5 + (w3 += sigma1(w1) + w12 + sigma0(w4)));
  160|  8.69M|        Round(e, f, g, h, a, b, c, d, 0x391c0cb3 + (w4 += sigma1(w2) + w13 + sigma0(w5)));
  161|  8.69M|        Round(d, e, f, g, h, a, b, c, 0x4ed8aa4a + (w5 += sigma1(w3) + w14 + sigma0(w6)));
  162|  8.69M|        Round(c, d, e, f, g, h, a, b, 0x5b9cca4f + (w6 += sigma1(w4) + w15 + sigma0(w7)));
  163|  8.69M|        Round(b, c, d, e, f, g, h, a, 0x682e6ff3 + (w7 += sigma1(w5) + w0 + sigma0(w8)));
  164|  8.69M|        Round(a, b, c, d, e, f, g, h, 0x748f82ee + (w8 += sigma1(w6) + w1 + sigma0(w9)));
  165|  8.69M|        Round(h, a, b, c, d, e, f, g, 0x78a5636f + (w9 += sigma1(w7) + w2 + sigma0(w10)));
  166|  8.69M|        Round(g, h, a, b, c, d, e, f, 0x84c87814 + (w10 += sigma1(w8) + w3 + sigma0(w11)));
  167|  8.69M|        Round(f, g, h, a, b, c, d, e, 0x8cc70208 + (w11 += sigma1(w9) + w4 + sigma0(w12)));
  168|  8.69M|        Round(e, f, g, h, a, b, c, d, 0x90befffa + (w12 += sigma1(w10) + w5 + sigma0(w13)));
  169|  8.69M|        Round(d, e, f, g, h, a, b, c, 0xa4506ceb + (w13 += sigma1(w11) + w6 + sigma0(w14)));
  170|  8.69M|        Round(c, d, e, f, g, h, a, b, 0xbef9a3f7 + (w14 + sigma1(w12) + w7 + sigma0(w15)));
  171|  8.69M|        Round(b, c, d, e, f, g, h, a, 0xc67178f2 + (w15 + sigma1(w13) + w8 + sigma0(w0)));
  172|       |
  173|  8.69M|        s[0] += a;
  174|  8.69M|        s[1] += b;
  175|  8.69M|        s[2] += c;
  176|  8.69M|        s[3] += d;
  177|  8.69M|        s[4] += e;
  178|  8.69M|        s[5] += f;
  179|  8.69M|        s[6] += g;
  180|  8.69M|        s[7] += h;
  181|  8.69M|        chunk += 64;
  182|  8.69M|    }
  183|  5.39M|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2565RoundEjjjRjjjjS1_j:
   78|   556M|{
   79|   556M|    uint32_t t1 = h + Sigma1(e) + Ch(e, f, g) + k;
   80|   556M|    uint32_t t2 = Sigma0(a) + Maj(a, b, c);
   81|   556M|    d += t1;
   82|   556M|    h = t1 + t2;
   83|   556M|}
sha256.cpp:_ZN12_GLOBAL__N_16sha2566Sigma1Ej:
   72|   556M|uint32_t inline Sigma1(uint32_t x) { return (x >> 6 | x << 26) ^ (x >> 11 | x << 21) ^ (x >> 25 | x << 7); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2562ChEjjj:
   69|   556M|uint32_t inline Ch(uint32_t x, uint32_t y, uint32_t z) { return z ^ (x & (y ^ z)); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566Sigma0Ej:
   71|   556M|uint32_t inline Sigma0(uint32_t x) { return (x >> 2 | x << 30) ^ (x >> 13 | x << 19) ^ (x >> 22 | x << 10); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2563MajEjjj:
   70|   556M|uint32_t inline Maj(uint32_t x, uint32_t y, uint32_t z) { return (x & y) | (z & (x | y)); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566sigma1Ej:
   74|   417M|uint32_t inline sigma1(uint32_t x) { return (x >> 17 | x << 15) ^ (x >> 19 | x << 13) ^ (x >> 10); }
sha256.cpp:_ZN12_GLOBAL__N_16sha2566sigma0Ej:
   73|   417M|uint32_t inline sigma0(uint32_t x) { return (x >> 7 | x << 25) ^ (x >> 18 | x << 14) ^ (x >> 3); }
sha256.cpp:_ZN12_GLOBAL__N_16sha25610InitializeEPj:
   87|   460k|{
   88|   460k|    s[0] = 0x6a09e667ul;
   89|   460k|    s[1] = 0xbb67ae85ul;
   90|   460k|    s[2] = 0x3c6ef372ul;
   91|   460k|    s[3] = 0xa54ff53aul;
   92|   460k|    s[4] = 0x510e527ful;
   93|   460k|    s[5] = 0x9b05688cul;
   94|   460k|    s[6] = 0x1f83d9abul;
   95|   460k|    s[7] = 0x5be0cd19ul;
   96|   460k|}

_Z13SHA256Uint256RK7uint256:
   79|  23.5k|{
   80|  23.5k|    uint256 result;
   81|  23.5k|    CSHA256().Write(input.begin(), 32).Finalize(result.begin());
   82|  23.5k|    return result;
   83|  23.5k|}

_Z9RIPEMD160NSt3__14spanIKhLm18446744073709551615EEE:
  231|  6.06k|{
  232|  6.06k|    uint160 result;
  233|  6.06k|    CRIPEMD160().Write(data.data(), data.size()).Finalize(result.begin());
  234|  6.06k|    return result;
  235|  6.06k|}
_ZN9ChainCodeD2Ev:
   28|      2|    ~ChainCode() { memory_cleanse(data(), size()); }
_ZN10HashWriterlsI13ParamsWrapperI20TransactionSerParamsK12CTransactionEEERS_RKT_:
  150|  16.5k|    {
  151|  16.5k|        ::Serialize(*this, obj);
  152|  16.5k|        return *this;
  153|  16.5k|    }
_Z7Hash160INSt3__14spanIKhLm18446744073709551615EEEE7uint160RKT_:
  101|   106k|{
  102|   106k|    uint160 result;
  103|   106k|    CHash160().Write(MakeUCharSpan(in1)).Finalize(result);
  104|   106k|    return result;
  105|   106k|}
_ZN8CHash2565WriteENSt3__14spanIKhLm18446744073709551615EEE:
   45|  3.89k|    CHash256& Write(std::span<const unsigned char> input) {
   46|  3.89k|        sha.Write(input.data(), input.size());
   47|  3.89k|        return *this;
   48|  3.89k|    }
_ZN8CHash2568FinalizeENSt3__14spanIhLm18446744073709551615EEE:
   38|  3.89k|    void Finalize(std::span<unsigned char> output) {
   39|  3.89k|        assert(output.size() == OUTPUT_SIZE);
  ------------------
  |  Branch (39:9): [True: 3.89k, False: 0]
  ------------------
   40|  3.89k|        unsigned char buf[CSHA256::OUTPUT_SIZE];
   41|  3.89k|        sha.Finalize(buf);
   42|  3.89k|        sha.Reset().Write(buf, CSHA256::OUTPUT_SIZE).Finalize(output.data());
   43|  3.89k|    }
_ZN10HashWriterlsIlEERS_RKT_:
  150|  22.5k|    {
  151|  22.5k|        ::Serialize(*this, obj);
  152|  22.5k|        return *this;
  153|  22.5k|    }
_ZN10HashWriterlsI7CScriptEERS_RKT_:
  150|  22.5k|    {
  151|  22.5k|        ::Serialize(*this, obj);
  152|  22.5k|        return *this;
  153|  22.5k|    }
_ZN10HashWriterlsINSt3__16vectorIhNS1_9allocatorIhEEEEEERS_RKT_:
  150|    267|    {
  151|    267|        ::Serialize(*this, obj);
  152|    267|        return *this;
  153|    267|    }
_ZN10HashWriterlsI9COutPointEERS_RKT_:
  150|   154k|    {
  151|   154k|        ::Serialize(*this, obj);
  152|   154k|        return *this;
  153|   154k|    }
_ZN10HashWriterlsINSt3__14spanIKhLm32EEEEERS_RKT_:
  150|  6.96M|    {
  151|  6.96M|        ::Serialize(*this, obj);
  152|  6.96M|        return *this;
  153|  6.96M|    }
_ZN10HashWriterlsIjEERS_RKT_:
  150|   185k|    {
  151|   185k|        ::Serialize(*this, obj);
  152|   185k|        return *this;
  153|   185k|    }
_ZN10HashWriterlsI6CTxOutEERS_RKT_:
  150|  12.8k|    {
  151|  12.8k|        ::Serialize(*this, obj);
  152|  12.8k|        return *this;
  153|  12.8k|    }
_ZN10HashWriterlsIiEERS_RKT_:
  150|  76.0k|    {
  151|  76.0k|        ::Serialize(*this, obj);
  152|  76.0k|        return *this;
  153|  76.0k|    }
_ZN10HashWriter7GetHashEv:
  123|  93.6k|    uint256 GetHash() {
  124|  93.6k|        uint256 result;
  125|  93.6k|        ctx.Finalize(result.begin());
  126|  93.6k|        ctx.Reset().Write(result.begin(), CSHA256::OUTPUT_SIZE).Finalize(result.begin());
  127|  93.6k|        return result;
  128|  93.6k|    }
_ZN10HashWriterlsI7uint256EERS_RKT_:
  150|  47.5k|    {
  151|  47.5k|        ::Serialize(*this, obj);
  152|  47.5k|        return *this;
  153|  47.5k|    }
interpreter.cpp:_ZN10HashWriterlsIN12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionEEEERS_RKT_:
  150|  17.7k|    {
  151|  17.7k|        ::Serialize(*this, obj);
  152|  17.7k|        return *this;
  153|  17.7k|    }
interpreter.cpp:_ZN10HashWriterlsIN12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionEEEERS_RKT_:
  150|  43.1k|    {
  151|  43.1k|        ::Serialize(*this, obj);
  152|  43.1k|        return *this;
  153|  43.1k|    }
_ZN10HashWriterlsIhEERS_RKT_:
  150|  2.37k|    {
  151|  2.37k|        ::Serialize(*this, obj);
  152|  2.37k|        return *this;
  153|  2.37k|    }
_ZN10HashWriterlsI17CompactSizeWriterEERS_RKT_:
  150|  1.35k|    {
  151|  1.35k|        ::Serialize(*this, obj);
  152|  1.35k|        return *this;
  153|  1.35k|    }
_Z7Hash160I7CScriptE7uint160RKT_:
  101|  23.0k|{
  102|  23.0k|    uint160 result;
  103|  23.0k|    CHash160().Write(MakeUCharSpan(in1)).Finalize(result);
  104|  23.0k|    return result;
  105|  23.0k|}
_ZN8CHash1605WriteENSt3__14spanIKhLm18446744073709551615EEE:
   70|   206k|    CHash160& Write(std::span<const unsigned char> input) {
   71|   206k|        sha.Write(input.data(), input.size());
   72|   206k|        return *this;
   73|   206k|    }
_ZN8CHash1608FinalizeENSt3__14spanIhLm18446744073709551615EEE:
   63|   206k|    void Finalize(std::span<unsigned char> output) {
   64|   206k|        assert(output.size() == OUTPUT_SIZE);
  ------------------
  |  Branch (64:9): [True: 206k, False: 0]
  ------------------
   65|   206k|        unsigned char buf[CSHA256::OUTPUT_SIZE];
   66|   206k|        sha.Finalize(buf);
   67|   206k|        CRIPEMD160().Write(buf, CSHA256::OUTPUT_SIZE).Finalize(output.data());
   68|   206k|    }
_ZN10HashWriter5writeENSt3__14spanIKSt4byteLm18446744073709551615EEE:
  115|  29.8M|    {
  116|  29.8M|        ctx.Write(UCharCast(src.data()), src.size());
  117|  29.8M|    }
_ZN10HashWriter9GetSHA256Ev:
  134|  30.6k|    uint256 GetSHA256() {
  135|  30.6k|        uint256 result;
  136|  30.6k|        ctx.Finalize(result.begin());
  137|  30.6k|        return result;
  138|  30.6k|    }
_ZN10HashWriterlsINSt3__14spanIKhLm18446744073709551615EEEEERS_RKT_:
  150|  4.84k|    {
  151|  4.84k|        ::Serialize(*this, obj);
  152|  4.84k|        return *this;
  153|  4.84k|    }

_ZN4CKey5CheckEPKh:
  159|  12.0k|bool CKey::Check(const unsigned char *vch) {
  160|  12.0k|    return secp256k1_ec_seckey_verify(secp256k1_context_static, vch);
  161|  12.0k|}
_ZNK4CKey9GetPubKeyEv:
  184|  42.6k|CPubKey CKey::GetPubKey() const {
  185|  42.6k|    assert(keydata);
  ------------------
  |  Branch (185:5): [True: 42.6k, False: 0]
  ------------------
  186|  42.6k|    secp256k1_pubkey pubkey;
  187|  42.6k|    size_t clen = CPubKey::SIZE;
  188|  42.6k|    CPubKey result;
  189|  42.6k|    int ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pubkey, UCharCast(begin()));
  190|  42.6k|    assert(ret);
  ------------------
  |  Branch (190:5): [True: 42.6k, False: 0]
  ------------------
  191|  42.6k|    secp256k1_ec_pubkey_serialize(secp256k1_context_static, (unsigned char*)result.begin(), &clen, &pubkey, fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  216|  30.3k|#define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  30.3k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  |  |               #define SECP256K1_EC_COMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION | SECP256K1_FLAGS_BIT_COMPRESSION)
  |  |  ------------------
  |  |  |  |  202|  30.3k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  |  |  ------------------
  ------------------
                  secp256k1_ec_pubkey_serialize(secp256k1_context_static, (unsigned char*)result.begin(), &clen, &pubkey, fCompressed ? SECP256K1_EC_COMPRESSED : SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  217|  54.8k|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  12.2k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  |  Branch (191:109): [True: 30.3k, False: 12.2k]
  ------------------
  192|  42.6k|    assert(result.size() == clen);
  ------------------
  |  Branch (192:5): [True: 42.6k, False: 0]
  ------------------
  193|  42.6k|    assert(result.IsValid());
  ------------------
  |  Branch (193:5): [True: 42.6k, False: 0]
  ------------------
  194|  42.6k|    return result;
  195|  42.6k|}
_Z10SigHasLowRPK25secp256k1_ecdsa_signature:
  199|  67.0k|{
  200|  67.0k|    unsigned char compact_sig[64];
  201|  67.0k|    secp256k1_ecdsa_signature_serialize_compact(secp256k1_context_static, compact_sig, sig);
  202|       |
  203|       |    // In DER serialization, all values are interpreted as big-endian, signed integers. The highest bit in the integer indicates
  204|       |    // its signed-ness; 0 is positive, 1 is negative. When the value is interpreted as a negative integer, it must be converted
  205|       |    // to a positive value by prepending a 0x00 byte so that the highest bit is 0. We can avoid this prepending by ensuring that
  206|       |    // our highest bit is always 0, and thus we must check that the first byte is less than 0x80.
  207|  67.0k|    return compact_sig[0] < 0x80;
  208|  67.0k|}
_ZNK4CKey4SignERK7uint256RNSt3__16vectorIhNS3_9allocatorIhEEEEbj:
  210|  31.9k|bool CKey::Sign(const uint256 &hash, std::vector<unsigned char>& vchSig, bool grind, uint32_t test_case) const {
  211|  31.9k|    if (!keydata)
  ------------------
  |  Branch (211:9): [True: 0, False: 31.9k]
  ------------------
  212|      0|        return false;
  213|  31.9k|    vchSig.resize(CPubKey::SIGNATURE_SIZE);
  214|  31.9k|    size_t nSigLen = CPubKey::SIGNATURE_SIZE;
  215|  31.9k|    unsigned char extra_entropy[32] = {0};
  216|  31.9k|    WriteLE32(extra_entropy, test_case);
  217|  31.9k|    secp256k1_ecdsa_signature sig;
  218|  31.9k|    uint32_t counter = 0;
  219|  31.9k|    int ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, (!grind && test_case) ? extra_entropy : nullptr);
  ------------------
  |  Branch (219:135): [True: 0, False: 31.9k]
  |  Branch (219:145): [True: 0, False: 0]
  ------------------
  220|       |
  221|       |    // Grind for low R
  222|  67.0k|    while (ret && !SigHasLowR(&sig) && grind) {
  ------------------
  |  Branch (222:12): [True: 67.0k, False: 0]
  |  Branch (222:19): [True: 35.0k, False: 31.9k]
  |  Branch (222:40): [True: 35.0k, False: 0]
  ------------------
  223|  35.0k|        WriteLE32(extra_entropy, ++counter);
  224|  35.0k|        ret = secp256k1_ecdsa_sign(secp256k1_context_sign, &sig, hash.begin(), UCharCast(begin()), secp256k1_nonce_function_rfc6979, extra_entropy);
  225|  35.0k|    }
  226|  31.9k|    assert(ret);
  ------------------
  |  Branch (226:5): [True: 31.9k, False: 0]
  ------------------
  227|  31.9k|    secp256k1_ecdsa_signature_serialize_der(secp256k1_context_static, vchSig.data(), &nSigLen, &sig);
  228|  31.9k|    vchSig.resize(nSigLen);
  229|       |    // Additional verification step to prevent using a potentially corrupted signature
  230|  31.9k|    secp256k1_pubkey pk;
  231|  31.9k|    ret = secp256k1_ec_pubkey_create(secp256k1_context_sign, &pk, UCharCast(begin()));
  232|  31.9k|    assert(ret);
  ------------------
  |  Branch (232:5): [True: 31.9k, False: 0]
  ------------------
  233|  31.9k|    ret = secp256k1_ecdsa_verify(secp256k1_context_static, &sig, hash.begin(), &pk);
  234|  31.9k|    assert(ret);
  ------------------
  |  Branch (234:5): [True: 31.9k, False: 0]
  ------------------
  235|  31.9k|    return true;
  236|  31.9k|}
_ZN11ECC_ContextD2Ev:
  501|      2|{
  502|      2|    ECC_Stop();
  503|      2|}
key.cpp:_ZL8ECC_Stopv:
  486|      2|static void ECC_Stop() {
  487|      2|    secp256k1_context *ctx = secp256k1_context_sign;
  488|      2|    secp256k1_context_sign = nullptr;
  489|       |
  490|      2|    if (ctx) {
  ------------------
  |  Branch (490:9): [True: 2, False: 0]
  ------------------
  491|      2|        secp256k1_context_destroy(ctx);
  492|      2|    }
  493|      2|}

_ZNK4CKey12IsCompressedEv:
  131|  6.99k|    bool IsCompressed() const { return fCompressed; }
_ZN4CKey3SetINSt3__111__wrap_iterIPhEEEEvT_S5_b:
  109|  12.0k|    {
  110|  12.0k|        if (size_t(pend - pbegin) != std::tuple_size_v<KeyType>) {
  ------------------
  |  Branch (110:13): [True: 0, False: 12.0k]
  ------------------
  111|      0|            ClearKeyData();
  112|  12.0k|        } else if (Check(UCharCast(&pbegin[0]))) {
  ------------------
  |  Branch (112:20): [True: 9.90k, False: 2.17k]
  ------------------
  113|  9.90k|            MakeKeyData();
  114|  9.90k|            memcpy(keydata->data(), (unsigned char*)&pbegin[0], keydata->size());
  115|  9.90k|            fCompressed = fCompressedIn;
  116|  9.90k|        } else {
  117|  2.17k|            ClearKeyData();
  118|  2.17k|        }
  119|  12.0k|    }
_ZNK4CKey5beginEv:
  124|   141k|    const std::byte* begin() const { return data(); }
_ZNK4CKey4dataEv:
  123|   141k|    const std::byte* data() const { return keydata ? reinterpret_cast<const std::byte*>(keydata->data()) : nullptr; }
  ------------------
  |  Branch (123:44): [True: 141k, False: 0]
  ------------------
_ZN4CKeyC2Ev:
   79|   103k|    CKey() noexcept = default;
_ZN4CKeyaSERKS_:
   84|  74.2k|    {
   85|  74.2k|        if (this != &other) {
  ------------------
  |  Branch (85:13): [True: 74.2k, False: 0]
  ------------------
   86|  74.2k|            if (other.keydata) {
  ------------------
  |  Branch (86:17): [True: 74.2k, False: 0]
  ------------------
   87|  74.2k|                MakeKeyData();
   88|  74.2k|                *keydata = *other.keydata;
   89|  74.2k|            } else {
   90|      0|                ClearKeyData();
   91|      0|            }
   92|  74.2k|            fCompressed = other.fCompressed;
   93|  74.2k|        }
   94|  74.2k|        return *this;
   95|  74.2k|    }
_ZN4CKey11MakeKeyDataEv:
   69|  84.1k|    {
   70|  84.1k|        if (!keydata) keydata = make_secure_unique<KeyType>();
  ------------------
  |  Branch (70:13): [True: 84.1k, False: 0]
  ------------------
   71|  84.1k|    }
_ZN4CKey12ClearKeyDataEv:
   74|  2.17k|    {
   75|  2.17k|        keydata.reset();
   76|  2.17k|    }
_ZNK4CKey7IsValidEv:
  128|  13.1k|    bool IsValid() const { return !!keydata; }

_ZN11CNetCleanupD2Ev:
 3676|      2|    {
 3677|       |#ifdef WIN32
 3678|       |        // Shutdown Windows Sockets
 3679|       |        WSACleanup();
 3680|       |#endif
 3681|      2|    }

_ZNK9prevectorILj33EhjiE4dataEv:
  468|  6.10k|    const value_type* data() const {
  469|  6.10k|        return item_ptr(0);
  470|  6.10k|    }
_ZNK9prevectorILj33EhjiE8item_ptrEi:
  160|  6.10k|    const T* item_ptr(difference_type pos) const { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (160:59): [True: 6.10k, False: 0]
  ------------------
_ZNK9prevectorILj33EhjiE10direct_ptrEi:
  123|  6.10k|    const T* direct_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.direct) + pos; }
_ZN9prevectorILj36EhjiE6insertITkNSt3__114input_iteratorENS2_11__wrap_iterIPhEEEEvNS0_8iteratorET_S7_:
  335|  5.54M|    void insert(iterator pos, InputIterator first, InputIterator last) {
  336|  5.54M|        size_type p = pos - begin();
  337|  5.54M|        difference_type count = last - first;
  338|  5.54M|        size_type new_size = size() + count;
  339|  5.54M|        if (capacity() < new_size) {
  ------------------
  |  Branch (339:13): [True: 4.42k, False: 5.53M]
  ------------------
  340|  4.42k|            change_capacity(new_size + (new_size >> 1));
  341|  4.42k|        }
  342|  5.54M|        T* ptr = item_ptr(p);
  343|  5.54M|        T* dst = ptr + count;
  344|  5.54M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  345|  5.54M|        _size += count;
  346|  5.54M|        fill(ptr, first, last);
  347|  5.54M|    }
_ZNK9prevectorILj36EhjiE4backEv:
  412|  77.5k|    const T& back() const {
  413|  77.5k|        return *item_ptr(size() - 1);
  414|  77.5k|    }
_ZNK9prevectorILj16EhjiE9is_directEv:
  126|     16|    bool is_direct() const { return _size <= N; }
_ZN9prevectorILj16EhjiED2Ev:
  422|     16|    ~prevector() {
  423|     16|        if (!is_direct()) {
  ------------------
  |  Branch (423:13): [True: 0, False: 16]
  ------------------
  424|      0|            free(_union.indirect_contents.indirect);
  425|      0|            _union.indirect_contents.indirect = nullptr;
  426|      0|        }
  427|     16|    }
_ZN9prevectorILj36EhjiEC2EOS0_:
  224|   441k|        : _union(std::move(other._union)), _size(other._size)
  225|   441k|    {
  226|   441k|        other._size = 0;
  227|   441k|    }
_ZN9prevectorILj36EhjiE9push_backERKh:
  392|  15.7k|    void push_back(const T& value) {
  393|  15.7k|        emplace_back(value);
  394|  15.7k|    }
_ZN9prevectorILj36EhjiE12emplace_backIJRKhEEEvDpOT_:
  383|  15.7k|    void emplace_back(Args&&... args) {
  384|  15.7k|        size_type new_size = size() + 1;
  385|  15.7k|        if (capacity() < new_size) {
  ------------------
  |  Branch (385:13): [True: 84, False: 15.6k]
  ------------------
  386|     84|            change_capacity(new_size + (new_size >> 1));
  387|     84|        }
  388|  15.7k|        new(item_ptr(size())) T(std::forward<Args>(args)...);
  389|  15.7k|        _size++;
  390|  15.7k|    }
_ZN9prevectorILj36EhjiE20resize_uninitializedEj:
  349|  36.4k|    inline void resize_uninitialized(size_type new_size) {
  350|       |        // resize_uninitialized changes the size of the prevector but does not initialize it.
  351|       |        // If size < new_size, the added elements must be initialized explicitly.
  352|  36.4k|        if (capacity() < new_size) {
  ------------------
  |  Branch (352:13): [True: 18.3k, False: 18.0k]
  ------------------
  353|  18.3k|            change_capacity(new_size);
  354|  18.3k|            _size += new_size - size();
  355|  18.3k|            return;
  356|  18.3k|        }
  357|  18.0k|        if (new_size < size()) {
  ------------------
  |  Branch (357:13): [True: 0, False: 18.0k]
  ------------------
  358|      0|            erase(item_ptr(new_size), end());
  359|  18.0k|        } else {
  360|  18.0k|            _size += new_size - size();
  361|  18.0k|        }
  362|  18.0k|    }
_ZN9prevectorILj33EhjiEC2EjRKh:
  202|  6.16k|    explicit prevector(size_type n, const T& val) {
  203|  6.16k|        change_capacity(n);
  204|  6.16k|        _size += n;
  205|  6.16k|        fill(item_ptr(0), n, val);
  206|  6.16k|    }
_ZN9prevectorILj33EhjiE15change_capacityEj:
  128|  6.16k|    void change_capacity(size_type new_capacity) {
  129|  6.16k|        if (new_capacity <= N) {
  ------------------
  |  Branch (129:13): [True: 6.16k, False: 0]
  ------------------
  130|  6.16k|            if (!is_direct()) {
  ------------------
  |  Branch (130:17): [True: 0, False: 6.16k]
  ------------------
  131|      0|                T* indirect = indirect_ptr(0);
  132|      0|                T* src = indirect;
  133|      0|                T* dst = direct_ptr(0);
  134|      0|                memcpy(dst, src, size() * sizeof(T));
  135|      0|                free(indirect);
  136|      0|                _size -= N + 1;
  137|      0|            }
  138|  6.16k|        } else {
  139|      0|            if (!is_direct()) {
  ------------------
  |  Branch (139:17): [True: 0, False: 0]
  ------------------
  140|       |                /* FIXME: Because malloc/realloc here won't call new_handler if allocation fails, assert
  141|       |                    success. These should instead use an allocator or new/delete so that handlers
  142|       |                    are called as necessary, but performance would be slightly degraded by doing so. */
  143|      0|                _union.indirect_contents.indirect = static_cast<char*>(realloc(_union.indirect_contents.indirect, ((size_t)sizeof(T)) * new_capacity));
  144|      0|                assert(_union.indirect_contents.indirect);
  ------------------
  |  Branch (144:17): [True: 0, False: 0]
  ------------------
  145|      0|                _union.indirect_contents.capacity = new_capacity;
  146|      0|            } else {
  147|      0|                char* new_indirect = static_cast<char*>(malloc(((size_t)sizeof(T)) * new_capacity));
  148|      0|                assert(new_indirect);
  ------------------
  |  Branch (148:17): [True: 0, False: 0]
  ------------------
  149|      0|                T* src = direct_ptr(0);
  150|      0|                T* dst = reinterpret_cast<T*>(new_indirect);
  151|      0|                memcpy(dst, src, size() * sizeof(T));
  152|      0|                _union.indirect_contents.indirect = new_indirect;
  153|      0|                _union.indirect_contents.capacity = new_capacity;
  154|      0|                _size += N + 1;
  155|      0|            }
  156|      0|        }
  157|  6.16k|    }
_ZNK9prevectorILj33EhjiE9is_directEv:
  126|  36.9k|    bool is_direct() const { return _size <= N; }
_ZN9prevectorILj33EhjiE10direct_ptrEi:
  122|  12.3k|    T* direct_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.direct) + pos; }
_ZNK9prevectorILj33EhjiE4sizeEv:
  247|  6.16k|    size_type size() const {
  248|  6.16k|        return is_direct() ? _size : _size - N - 1;
  ------------------
  |  Branch (248:16): [True: 6.16k, False: 0]
  ------------------
  249|  6.16k|    }
_ZN9prevectorILj33EhjiE4fillEPhlRKh:
  162|  6.16k|    void fill(T* dst, ptrdiff_t count, const T& value = T{}) {
  163|  6.16k|        std::fill_n(dst, count, value);
  164|  6.16k|    }
_ZN9prevectorILj33EhjiE8item_ptrEi:
  159|  12.3k|    T* item_ptr(difference_type pos) { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (159:47): [True: 12.3k, False: 0]
  ------------------
_ZN9prevectorILj33EhjiE4dataEv:
  464|  6.16k|    value_type* data() {
  465|  6.16k|        return item_ptr(0);
  466|  6.16k|    }
_ZN9prevectorILj33EhjiED2Ev:
  422|  6.16k|    ~prevector() {
  423|  6.16k|        if (!is_direct()) {
  ------------------
  |  Branch (423:13): [True: 0, False: 6.16k]
  ------------------
  424|      0|            free(_union.indirect_contents.indirect);
  425|      0|            _union.indirect_contents.indirect = nullptr;
  426|      0|        }
  427|  6.16k|    }
_ZN9prevectorILj36EhjiE4dataEv:
  464|  10.8k|    value_type* data() {
  465|  10.8k|        return item_ptr(0);
  466|  10.8k|    }
_ZN9prevectorILj36EhjiEaSEOS0_:
  237|   136k|    prevector& operator=(prevector<N, T, Size, Diff>&& other) noexcept {
  238|   136k|        if (!is_direct()) {
  ------------------
  |  Branch (238:13): [True: 5.68k, False: 130k]
  ------------------
  239|  5.68k|            free(_union.indirect_contents.indirect);
  240|  5.68k|        }
  241|   136k|        _union = std::move(other._union);
  242|   136k|        _size = other._size;
  243|   136k|        other._size = 0;
  244|   136k|        return *this;
  245|   136k|    }
_ZNK9prevectorILj36EhjiE5emptyEv:
  251|  7.28M|    bool empty() const {
  252|  7.28M|        return size() == 0;
  253|  7.28M|    }
_ZNK9prevectorILj36EhjiE4dataEv:
  468|   191k|    const value_type* data() const {
  469|   191k|        return item_ptr(0);
  470|   191k|    }
_ZN9prevectorILj36EhjiE4fillITkNSt3__114input_iteratorENS0_14const_iteratorEEEvPhT_S5_:
  167|  2.47M|    void fill(T* dst, InputIterator first, InputIterator last) {
  168|  1.48G|        while (first != last) {
  ------------------
  |  Branch (168:16): [True: 1.48G, False: 2.47M]
  ------------------
  169|  1.48G|            new(static_cast<void*>(dst)) T(*first);
  170|  1.48G|            ++dst;
  171|  1.48G|            ++first;
  172|  1.48G|        }
  173|  2.47M|    }
_ZNK9prevectorILj36EhjiE14const_iteratoreqES1_:
  102|  1.48G|        bool operator==(const_iterator x) const { return ptr == x.ptr; }
_ZN9prevectorILj36EhjiE14const_iteratorppEv:
   92|  1.57G|        const_iterator& operator++() { ptr++; return *this; }
_ZNK9prevectorILj36EhjiEixEj:
  272|  1.16M|    const T& operator[](size_type pos) const {
  273|  1.16M|        return *item_ptr(pos);
  274|  1.16M|    }
_ZN9prevectorILj36EhjiE8item_ptrEi:
  159|  99.0M|    T* item_ptr(difference_type pos) { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (159:47): [True: 4.52M, False: 94.5M]
  ------------------
_ZNK9prevectorILj36EhjiE9is_directEv:
  126|   465M|    bool is_direct() const { return _size <= N; }
_ZN9prevectorILj36EhjiE10direct_ptrEi:
  122|  4.80M|    T* direct_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.direct) + pos; }
_ZN9prevectorILj36EhjiE12indirect_ptrEi:
  124|  94.5M|    T* indirect_ptr(difference_type pos) { return reinterpret_cast<T*>(_union.indirect_contents.indirect) + pos; }
_ZN9prevectorILj36EhjiE15change_capacityEj:
  128|  1.88M|    void change_capacity(size_type new_capacity) {
  129|  1.88M|        if (new_capacity <= N) {
  ------------------
  |  Branch (129:13): [True: 1.57M, False: 315k]
  ------------------
  130|  1.57M|            if (!is_direct()) {
  ------------------
  |  Branch (130:17): [True: 0, False: 1.57M]
  ------------------
  131|      0|                T* indirect = indirect_ptr(0);
  132|      0|                T* src = indirect;
  133|      0|                T* dst = direct_ptr(0);
  134|      0|                memcpy(dst, src, size() * sizeof(T));
  135|      0|                free(indirect);
  136|      0|                _size -= N + 1;
  137|      0|            }
  138|  1.57M|        } else {
  139|   315k|            if (!is_direct()) {
  ------------------
  |  Branch (139:17): [True: 37.9k, False: 277k]
  ------------------
  140|       |                /* FIXME: Because malloc/realloc here won't call new_handler if allocation fails, assert
  141|       |                    success. These should instead use an allocator or new/delete so that handlers
  142|       |                    are called as necessary, but performance would be slightly degraded by doing so. */
  143|  37.9k|                _union.indirect_contents.indirect = static_cast<char*>(realloc(_union.indirect_contents.indirect, ((size_t)sizeof(T)) * new_capacity));
  144|  37.9k|                assert(_union.indirect_contents.indirect);
  ------------------
  |  Branch (144:17): [True: 37.9k, False: 0]
  ------------------
  145|  37.9k|                _union.indirect_contents.capacity = new_capacity;
  146|   277k|            } else {
  147|   277k|                char* new_indirect = static_cast<char*>(malloc(((size_t)sizeof(T)) * new_capacity));
  148|   277k|                assert(new_indirect);
  ------------------
  |  Branch (148:17): [True: 277k, False: 0]
  ------------------
  149|   277k|                T* src = direct_ptr(0);
  150|   277k|                T* dst = reinterpret_cast<T*>(new_indirect);
  151|   277k|                memcpy(dst, src, size() * sizeof(T));
  152|   277k|                _union.indirect_contents.indirect = new_indirect;
  153|   277k|                _union.indirect_contents.capacity = new_capacity;
  154|   277k|                _size += N + 1;
  155|   277k|            }
  156|   315k|        }
  157|  1.88M|    }
_ZNK9prevectorILj36EhjiE3endEv:
  258|  98.2M|    const_iterator end() const { return const_iterator(item_ptr(size())); }
_ZNK9prevectorILj36EhjiE8item_ptrEi:
  160|   103M|    const T* item_ptr(difference_type pos) const { return is_direct() ? direct_ptr(pos) : indirect_ptr(pos); }
  ------------------
  |  Branch (160:59): [True: 8.26M, False: 94.9M]
  ------------------
_ZNK9prevectorILj36EhjiE10direct_ptrEi:
  123|  8.26M|    const T* direct_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.direct) + pos; }
_ZNK9prevectorILj36EhjiE12indirect_ptrEi:
  125|  94.9M|    const T* indirect_ptr(difference_type pos) const { return reinterpret_cast<const T*>(_union.indirect_contents.indirect) + pos; }
_ZNK9prevectorILj36EhjiE4sizeEv:
  247|   217M|    size_type size() const {
  248|   217M|        return is_direct() ? _size : _size - N - 1;
  ------------------
  |  Branch (248:16): [True: 27.7M, False: 190M]
  ------------------
  249|   217M|    }
_ZNK9prevectorILj36EhjiE5beginEv:
  256|  3.54M|    const_iterator begin() const { return const_iterator(item_ptr(0)); }
_ZNK9prevectorILj36EhjiE14const_iteratordeEv:
   89|  1.85G|        const T& operator*() const { return *ptr; }
_ZN9prevectorILj36EhjiEaSERKS0_:
  229|   231k|    prevector& operator=(const prevector<N, T, Size, Diff>& other) {
  230|   231k|        if (&other == this) {
  ------------------
  |  Branch (230:13): [True: 0, False: 231k]
  ------------------
  231|      0|            return *this;
  232|      0|        }
  233|   231k|        assign(other.begin(), other.end());
  234|   231k|        return *this;
  235|   231k|    }
_ZN9prevectorILj36EhjiE6assignITkNSt3__114input_iteratorENS0_14const_iteratorEEEvT_S4_:
  186|   231k|    void assign(InputIterator first, InputIterator last) {
  187|   231k|        size_type n = last - first;
  188|   231k|        clear();
  189|   231k|        if (capacity() < n) {
  ------------------
  |  Branch (189:13): [True: 35.6k, False: 195k]
  ------------------
  190|  35.6k|            change_capacity(n);
  191|  35.6k|        }
  192|   231k|        _size += n;
  193|   231k|        fill(item_ptr(0), first, last);
  194|   231k|    }
_ZNK9prevectorILj36EhjiEeqERKS0_:
  429|  12.1k|    constexpr bool operator==(const prevector& other) const {
  430|  12.1k|        return std::ranges::equal(*this, other);
  431|  12.1k|    }
_ZNK9prevectorILj36EhjiE14const_iteratorssES1_:
  103|   107M|        auto operator<=>(const_iterator x) const { return ptr <=> x.ptr; }
_ZNK9prevectorILj36EhjiE14const_iteratorptEv:
   90|  29.8M|        const T* operator->() const { return ptr; }
_ZN9prevectorILj36EhjiEC2Ev:
  196|  8.74M|    prevector() = default;
_ZN9prevectorILj36EhjiE6insertENS0_8iteratorERKh:
  307|  17.1M|    iterator insert(iterator pos, const T& value) {
  308|  17.1M|        size_type p = pos - begin();
  309|  17.1M|        size_type new_size = size() + 1;
  310|  17.1M|        if (capacity() < new_size) {
  ------------------
  |  Branch (310:13): [True: 2.08k, False: 17.1M]
  ------------------
  311|  2.08k|            change_capacity(new_size + (new_size >> 1));
  312|  2.08k|        }
  313|  17.1M|        T* ptr = item_ptr(p);
  314|  17.1M|        T* dst = ptr + 1;
  315|  17.1M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  316|  17.1M|        _size++;
  317|  17.1M|        new(static_cast<void*>(ptr)) T(value);
  318|  17.1M|        return iterator(ptr);
  319|  17.1M|    }
_ZmiN9prevectorILj36EhjiE8iteratorES1_:
   68|  32.5M|        difference_type friend operator-(iterator a, iterator b) { return (&(*a) - &(*b)); }
_ZNK9prevectorILj36EhjiE8iteratordeEv:
   61|  65.3M|        T& operator*() const { return *ptr; }
_ZNK9prevectorILj36EhjiE8capacityEv:
  260|  32.7M|    size_t capacity() const {
  261|  32.7M|        if (is_direct()) {
  ------------------
  |  Branch (261:13): [True: 1.36M, False: 31.4M]
  ------------------
  262|  1.36M|            return N;
  263|  31.4M|        } else {
  264|  31.4M|            return _union.indirect_contents.capacity;
  265|  31.4M|        }
  266|  32.7M|    }
_ZN9prevectorILj36EhjiE8iteratorC2EPh:
   60|  82.4M|        iterator(T* ptr_) : ptr(ptr_) {}
_ZN9prevectorILj36EhjiE6insertITkNSt3__114input_iteratorEPKhEEvNS0_8iteratorET_S6_:
  335|    208|    void insert(iterator pos, InputIterator first, InputIterator last) {
  336|    208|        size_type p = pos - begin();
  337|    208|        difference_type count = last - first;
  338|    208|        size_type new_size = size() + count;
  339|    208|        if (capacity() < new_size) {
  ------------------
  |  Branch (339:13): [True: 0, False: 208]
  ------------------
  340|      0|            change_capacity(new_size + (new_size >> 1));
  341|      0|        }
  342|    208|        T* ptr = item_ptr(p);
  343|    208|        T* dst = ptr + count;
  344|    208|        memmove(dst, ptr, (size() - p) * sizeof(T));
  345|    208|        _size += count;
  346|    208|        fill(ptr, first, last);
  347|    208|    }
_ZN9prevectorILj36EhjiE4fillITkNSt3__114input_iteratorEPKhEEvPhT_S6_:
  167|    208|    void fill(T* dst, InputIterator first, InputIterator last) {
  168|    624|        while (first != last) {
  ------------------
  |  Branch (168:16): [True: 416, False: 208]
  ------------------
  169|    416|            new(static_cast<void*>(dst)) T(*first);
  170|    416|            ++dst;
  171|    416|            ++first;
  172|    416|        }
  173|    208|    }
_ZN9prevectorILj36EhjiE6insertITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEEvNS0_8iteratorET_S8_:
  335|  8.49M|    void insert(iterator pos, InputIterator first, InputIterator last) {
  336|  8.49M|        size_type p = pos - begin();
  337|  8.49M|        difference_type count = last - first;
  338|  8.49M|        size_type new_size = size() + count;
  339|  8.49M|        if (capacity() < new_size) {
  ------------------
  |  Branch (339:13): [True: 91.8k, False: 8.40M]
  ------------------
  340|  91.8k|            change_capacity(new_size + (new_size >> 1));
  341|  91.8k|        }
  342|  8.49M|        T* ptr = item_ptr(p);
  343|  8.49M|        T* dst = ptr + count;
  344|  8.49M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  345|  8.49M|        _size += count;
  346|  8.49M|        fill(ptr, first, last);
  347|  8.49M|    }
_ZN9prevectorILj36EhjiE4fillITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEEvPhT_S8_:
  167|  8.51M|    void fill(T* dst, InputIterator first, InputIterator last) {
  168|  1.03G|        while (first != last) {
  ------------------
  |  Branch (168:16): [True: 1.02G, False: 8.51M]
  ------------------
  169|  1.02G|            new(static_cast<void*>(dst)) T(*first);
  170|  1.02G|            ++dst;
  171|  1.02G|            ++first;
  172|  1.02G|        }
  173|  8.51M|    }
_ZN9prevectorILj36EhjiEC2ERKS0_:
  216|   866k|    prevector(const prevector<N, T, Size, Diff>& other) {
  217|   866k|        size_type n = other.size();
  218|   866k|        change_capacity(n);
  219|   866k|        _size += n;
  220|   866k|        fill(item_ptr(0), other.begin(),  other.end());
  221|   866k|    }
_ZNK9prevectorILj36EhjiE8iteratorptEv:
   62|  56.1k|        T* operator->() const { return ptr; }
_ZN9prevectorILj36EhjiE3endEv:
  257|  32.6M|    iterator end() { return iterator(item_ptr(size())); }
_ZN9prevectorILj36EhjiE5beginEv:
  255|  32.6M|    iterator begin() { return iterator(item_ptr(0)); }
_ZN9prevectorILj36EhjiE14const_iteratorC2ENS0_8iteratorE:
   88|   211k|        const_iterator(iterator x) : ptr(&(*x)) {}
_ZN9prevectorILj36EhjiE6insertITkNSt3__114input_iteratorENS0_14const_iteratorEEEvNS0_8iteratorET_S5_:
  335|  1.28M|    void insert(iterator pos, InputIterator first, InputIterator last) {
  336|  1.28M|        size_type p = pos - begin();
  337|  1.28M|        difference_type count = last - first;
  338|  1.28M|        size_type new_size = size() + count;
  339|  1.28M|        if (capacity() < new_size) {
  ------------------
  |  Branch (339:13): [True: 38.4k, False: 1.24M]
  ------------------
  340|  38.4k|            change_capacity(new_size + (new_size >> 1));
  341|  38.4k|        }
  342|  1.28M|        T* ptr = item_ptr(p);
  343|  1.28M|        T* dst = ptr + count;
  344|  1.28M|        memmove(dst, ptr, (size() - p) * sizeof(T));
  345|  1.28M|        _size += count;
  346|  1.28M|        fill(ptr, first, last);
  347|  1.28M|    }
_ZN9prevectorILj36EhjiEC2ITkNSt3__114input_iteratorENS0_14const_iteratorEEET_S4_:
  209|  95.2k|    prevector(InputIterator first, InputIterator last) {
  210|  95.2k|        size_type n = last - first;
  211|  95.2k|        change_capacity(n);
  212|  95.2k|        _size += n;
  213|  95.2k|        fill(item_ptr(0), first, last);
  214|  95.2k|    }
_ZN9prevectorILj36EhjiEixEj:
  268|  56.9k|    T& operator[](size_type pos) {
  269|  56.9k|        return *item_ptr(pos);
  270|  56.9k|    }
_ZN9prevectorILj36EhjiE5clearEv:
  303|  1.83M|    void clear() {
  304|  1.83M|        resize(0);
  305|  1.83M|    }
_ZN9prevectorILj36EhjiE6resizeEj:
  276|  1.84M|    void resize(size_type new_size) {
  277|  1.84M|        size_type cur_size = size();
  278|  1.84M|        if (cur_size == new_size) {
  ------------------
  |  Branch (278:13): [True: 1.81M, False: 26.0k]
  ------------------
  279|  1.81M|            return;
  280|  1.81M|        }
  281|  26.0k|        if (cur_size > new_size) {
  ------------------
  |  Branch (281:13): [True: 16.6k, False: 9.40k]
  ------------------
  282|  16.6k|            erase(item_ptr(new_size), end());
  283|  16.6k|            return;
  284|  16.6k|        }
  285|  9.40k|        if (new_size > capacity()) {
  ------------------
  |  Branch (285:13): [True: 2.83k, False: 6.57k]
  ------------------
  286|  2.83k|            change_capacity(new_size);
  287|  2.83k|        }
  288|  9.40k|        ptrdiff_t increase = new_size - cur_size;
  289|  9.40k|        fill(item_ptr(cur_size), increase);
  290|  9.40k|        _size += increase;
  291|  9.40k|    }
_ZN9prevectorILj36EhjiE5eraseENS0_8iteratorES1_:
  368|  16.6k|    iterator erase(iterator first, iterator last) {
  369|       |        // Erase is not allowed to the change the object's capacity. That means
  370|       |        // that when starting with an indirectly allocated prevector with
  371|       |        // size and capacity > N, the result may be a still indirectly allocated
  372|       |        // prevector with size <= N and capacity > N. A shrink_to_fit() call is
  373|       |        // necessary to switch to the (more efficient) directly allocated
  374|       |        // representation (with capacity N and size <= N).
  375|  16.6k|        iterator p = first;
  376|  16.6k|        char* endp = (char*)&(*end());
  377|  16.6k|        _size -= last - p;
  378|  16.6k|        memmove(&(*first), &(*last), endp - ((char*)(&(*last))));
  379|  16.6k|        return first;
  380|  16.6k|    }
_ZN9prevectorILj36EhjiE4fillEPhlRKh:
  162|  9.40k|    void fill(T* dst, ptrdiff_t count, const T& value = T{}) {
  163|  9.40k|        std::fill_n(dst, count, value);
  164|  9.40k|    }
_ZN9prevectorILj36EhjiE13shrink_to_fitEv:
  299|   697k|    void shrink_to_fit() {
  300|   697k|        change_capacity(size());
  301|   697k|    }
_ZN9prevectorILj36EhjiEC2ITkNSt3__114input_iteratorENS2_11__wrap_iterIPKhEEEET_S7_:
  209|  19.3k|    prevector(InputIterator first, InputIterator last) {
  210|  19.3k|        size_type n = last - first;
  211|  19.3k|        change_capacity(n);
  212|  19.3k|        _size += n;
  213|  19.3k|        fill(item_ptr(0), first, last);
  214|  19.3k|    }
_ZN9prevectorILj36EhjiED2Ev:
  422|  10.1M|    ~prevector() {
  423|  10.1M|        if (!is_direct()) {
  ------------------
  |  Branch (423:13): [True: 271k, False: 9.90M]
  ------------------
  424|   271k|            free(_union.indirect_contents.indirect);
  425|   271k|            _union.indirect_contents.indirect = nullptr;
  426|   271k|        }
  427|  10.1M|    }
_ZN9prevectorILj36EhjiE14const_iteratorC2EPKh:
   87|   119M|        const_iterator(const T* ptr_) : ptr(ptr_) {}
_ZN9prevectorILj36EhjiEC2ITkNSt3__114input_iteratorENS2_11__wrap_iterIPhEEEET_S6_:
  209|  13.9k|    prevector(InputIterator first, InputIterator last) {
  210|  13.9k|        size_type n = last - first;
  211|  13.9k|        change_capacity(n);
  212|  13.9k|        _size += n;
  213|  13.9k|        fill(item_ptr(0), first, last);
  214|  13.9k|    }
_ZN9prevectorILj36EhjiE4fillITkNSt3__114input_iteratorENS2_11__wrap_iterIPhEEEEvS4_T_S6_:
  167|  5.55M|    void fill(T* dst, InputIterator first, InputIterator last) {
  168|   656M|        while (first != last) {
  ------------------
  |  Branch (168:16): [True: 651M, False: 5.55M]
  ------------------
  169|   651M|            new(static_cast<void*>(dst)) T(*first);
  170|   651M|            ++dst;
  171|   651M|            ++first;
  172|   651M|        }
  173|  5.55M|    }
_ZNK9prevectorILj36EhjiE14const_iteratorplEj:
   97|  17.8M|        const_iterator operator+(size_type n) const { return const_iterator(ptr + n); }
_ZmiN9prevectorILj36EhjiE14const_iteratorES1_:
   96|   139M|        difference_type friend operator-(const_iterator a, const_iterator b) { return (&(*a) - &(*b)); }
_ZN9prevectorILj36EhjiE14const_iteratorppEi:
   94|  91.5M|        const_iterator operator++(int) { const_iterator copy(*this); ++(*this); return copy; }
_ZNK9prevectorILj36EhjiE14const_iteratorixEj:
   91|   239k|        const T& operator[](size_type pos) const { return ptr[pos]; }
_ZN9prevectorILj36EhjiE14const_iteratorpLEj:
   99|  18.2M|        const_iterator& operator+=(size_type n) { ptr += n; return *this; }

_ZN6CTxOutC2ERKl7CScript:
   56|  10.5k|{
   57|  10.5k|    nValue = nValueIn;
   58|  10.5k|    scriptPubKey = scriptPubKeyIn;
   59|  10.5k|}
_ZN19CMutableTransactionC2Ev:
   66|  27.5k|CMutableTransaction::CMutableTransaction() : version{CTransaction::CURRENT_VERSION}, nLockTime{0} {}
_ZNK12CTransaction17ComputeHasWitnessEv:
   75|  15.4k|{
   76|  15.4k|    return std::any_of(vin.begin(), vin.end(), [](const auto& input) {
   77|  15.4k|        return !input.scriptWitness.IsNull();
   78|  15.4k|    });
   79|  15.4k|}
_ZNK12CTransaction11ComputeHashEv:
   82|  15.4k|{
   83|  15.4k|    return Txid::FromUint256((HashWriter{} << TX_NO_WITNESS(*this)).GetHash());
   84|  15.4k|}
_ZNK12CTransaction18ComputeWitnessHashEv:
   87|  15.4k|{
   88|  15.4k|    if (!HasWitness()) {
  ------------------
  |  Branch (88:9): [True: 14.3k, False: 1.06k]
  ------------------
   89|  14.3k|        return Wtxid::FromUint256(hash.ToUint256());
   90|  14.3k|    }
   91|       |
   92|  1.06k|    return Wtxid::FromUint256((HashWriter{} << TX_WITH_WITNESS(*this)).GetHash());
   93|  15.4k|}
_ZN12CTransactionC2ERK19CMutableTransaction:
   95|  15.4k|CTransaction::CTransaction(const CMutableTransaction& tx) : vin(tx.vin), vout(tx.vout), version{tx.version}, nLockTime{tx.nLockTime}, m_has_witness{ComputeHasWitness()}, hash{ComputeHash()}, m_witness_hash{ComputeWitnessHash()} {}
transaction.cpp:_ZZNK12CTransaction17ComputeHasWitnessEvENK3$_0clI5CTxInEEDaRKT_:
   76|   122k|    return std::any_of(vin.begin(), vin.end(), [](const auto& input) {
   77|   122k|        return !input.scriptWitness.IsNull();
   78|   122k|    });

_ZN9COutPoint16SerializationOpsI10SpanReaderS_17ActionUnserializeEEvRT0_RT_T1_:
   39|  12.7k|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  148|  12.7k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI10SpanReaderS_17ActionUnserializeEEvRT0_RT_T1_:
  152|  12.0k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  148|  12.0k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN19CMutableTransaction11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  373|  19.8k|    inline void Unserialize(Stream& s) {
  374|  19.8k|        UnserializeTransaction(*this, s, s.template GetParams<TransactionSerParams>());
  375|  19.8k|    }
_Z22UnserializeTransactionI12ParamsStreamIR10SpanReader20TransactionSerParamsE19CMutableTransactionEvRT0_RT_RKS3_:
  202|  19.8k|{
  203|  19.8k|    const bool fAllowWitness = params.allow_witness;
  204|       |
  205|  19.8k|    s >> tx.version;
  206|  19.8k|    unsigned char flags = 0;
  207|  19.8k|    tx.vin.clear();
  208|  19.8k|    tx.vout.clear();
  209|       |    /* Try to read the vin. In case the dummy is there, this will be read as an empty vector. */
  210|  19.8k|    s >> tx.vin;
  211|  19.8k|    if (tx.vin.size() == 0 && fAllowWitness) {
  ------------------
  |  Branch (211:9): [True: 6.79k, False: 13.0k]
  |  Branch (211:31): [True: 6.79k, False: 0]
  ------------------
  212|       |        /* We read a dummy or an empty vin. */
  213|  6.79k|        s >> flags;
  214|  6.79k|        if (flags != 0) {
  ------------------
  |  Branch (214:13): [True: 1.32k, False: 5.47k]
  ------------------
  215|  1.32k|            s >> tx.vin;
  216|  1.32k|            s >> tx.vout;
  217|  1.32k|        }
  218|  13.0k|    } else {
  219|       |        /* We read a non-empty vin. Assume a normal vout follows. */
  220|  13.0k|        s >> tx.vout;
  221|  13.0k|    }
  222|  19.8k|    if ((flags & 1) && fAllowWitness) {
  ------------------
  |  Branch (222:9): [True: 1.18k, False: 18.6k]
  |  Branch (222:24): [True: 1.18k, False: 0]
  ------------------
  223|       |        /* The witness flag is present, and we support witnesses. */
  224|  1.18k|        flags ^= 1;
  225|  24.9k|        for (size_t i = 0; i < tx.vin.size(); i++) {
  ------------------
  |  Branch (225:28): [True: 23.7k, False: 1.18k]
  ------------------
  226|  23.7k|            s >> tx.vin[i].scriptWitness.stack;
  227|  23.7k|        }
  228|  1.18k|        if (!tx.HasWitness()) {
  ------------------
  |  Branch (228:13): [True: 21, False: 1.16k]
  ------------------
  229|       |            /* It's illegal to encode witnesses when all witness stacks are empty. */
  230|     21|            throw std::ios_base::failure("Superfluous witness record");
  231|     21|        }
  232|  1.18k|    }
  233|  19.7k|    if (flags) {
  ------------------
  |  Branch (233:9): [True: 9, False: 19.7k]
  ------------------
  234|       |        /* Unknown flag in the serialization */
  235|      9|        throw std::ios_base::failure("Unknown transaction optional data");
  236|      9|    }
  237|  19.7k|    s >> tx.nLockTime;
  238|  19.7k|}
_ZN5CTxIn16SerializationOpsI12ParamsStreamIR10SpanReader20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
  124|   309k|    SERIALIZE_METHODS(CTxIn, obj) { READWRITE(obj.prevout, obj.scriptSig, obj.nSequence); }
  ------------------
  |  |  148|   309k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN9COutPoint16SerializationOpsI12ParamsStreamIR10SpanReader20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
   39|   309k|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  148|   309k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI12ParamsStreamIR10SpanReader20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
  152|   590k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  148|   590k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZNK6CTxOut6IsNullEv:
  161|   100k|    {
  162|   100k|        return (nValue == -1);
  163|   100k|    }
_ZN5CTxInC2Ev:
  117|   311k|    {
  118|   311k|        nSequence = SEQUENCE_FINAL;
  119|   311k|    }
_ZltRK9COutPointS1_:
   45|   288k|    {
   46|   288k|        return std::tie(a.hash, a.n) < std::tie(b.hash, b.n);
   47|   288k|    }
_ZN9COutPointC2Ev:
   36|   324k|    COutPoint(): n(NULL_INDEX) { }
_ZNK12CTransaction10HasWitnessEv:
  353|  16.5k|    bool HasWitness() const { return m_has_witness; }
_ZNK19CMutableTransaction10HasWitnessEv:
  393|  1.09k|    {
  394|  3.54k|        for (size_t i = 0; i < vin.size(); i++) {
  ------------------
  |  Branch (394:28): [True: 3.52k, False: 21]
  ------------------
  395|  3.52k|            if (!vin[i].scriptWitness.IsNull()) {
  ------------------
  |  Branch (395:17): [True: 1.07k, False: 2.44k]
  ------------------
  396|  1.07k|                return true;
  397|  1.07k|            }
  398|  3.52k|        }
  399|     21|        return false;
  400|  1.09k|    }
_ZN5CTxIn16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
  124|   165k|    SERIALIZE_METHODS(CTxIn, obj) { READWRITE(obj.prevout, obj.scriptSig, obj.nSequence); }
  ------------------
  |  |  148|   165k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN9COutPoint16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
   39|   165k|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  148|   165k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
  152|  61.5k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  148|  61.5k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZNK12CTransaction9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  313|  16.5k|    inline void Serialize(Stream& s) const {
  314|  16.5k|        SerializeTransaction(*this, s, s.template GetParams<TransactionSerParams>());
  315|  16.5k|    }
_Z20SerializeTransactionI12ParamsStreamIR10HashWriter20TransactionSerParamsE12CTransactionEvRKT0_RT_RKS3_:
  242|  16.5k|{
  243|  16.5k|    const bool fAllowWitness = params.allow_witness;
  244|       |
  245|  16.5k|    s << tx.version;
  246|  16.5k|    unsigned char flags = 0;
  247|       |    // Consistency check
  248|  16.5k|    if (fAllowWitness) {
  ------------------
  |  Branch (248:9): [True: 1.06k, False: 15.4k]
  ------------------
  249|       |        /* Check whether witnesses need to be serialized. */
  250|  1.06k|        if (tx.HasWitness()) {
  ------------------
  |  Branch (250:13): [True: 1.06k, False: 0]
  ------------------
  251|  1.06k|            flags |= 1;
  252|  1.06k|        }
  253|  1.06k|    }
  254|  16.5k|    if (flags) {
  ------------------
  |  Branch (254:9): [True: 1.06k, False: 15.4k]
  ------------------
  255|       |        /* Use extended format in case witnesses are to be serialized. */
  256|  1.06k|        std::vector<CTxIn> vinDummy;
  257|  1.06k|        s << vinDummy;
  258|  1.06k|        s << flags;
  259|  1.06k|    }
  260|  16.5k|    s << tx.vin;
  261|  16.5k|    s << tx.vout;
  262|  16.5k|    if (flags & 1) {
  ------------------
  |  Branch (262:9): [True: 1.06k, False: 15.4k]
  ------------------
  263|  24.1k|        for (size_t i = 0; i < tx.vin.size(); i++) {
  ------------------
  |  Branch (263:28): [True: 23.0k, False: 1.06k]
  ------------------
  264|  23.0k|            s << tx.vin[i].scriptWitness.stack;
  265|  23.0k|        }
  266|  1.06k|    }
  267|  16.5k|    s << tx.nLockTime;
  268|  16.5k|}
_ZN6CTxOutC2Ev:
  146|   697k|    {
  147|   697k|        SetNull();
  148|   697k|    }
_ZN6CTxOut7SetNullEv:
  155|   697k|    {
  156|   697k|        nValue = -1;
  157|   697k|        scriptPubKey.clear();
  158|   697k|    }
_ZN9COutPoint16SerializationOpsI10HashWriterKS_15ActionSerializeEEvRT0_RT_T1_:
   39|  6.91M|    SERIALIZE_METHODS(COutPoint, obj) { READWRITE(obj.hash, obj.n); }
  ------------------
  |  |  148|  6.91M|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN6CTxOut16SerializationOpsI10HashWriterKS_15ActionSerializeEEvRT0_RT_T1_:
  152|   202k|    SERIALIZE_METHODS(CTxOut, obj) { READWRITE(obj.nValue, obj.scriptPubKey); }
  ------------------
  |  |  148|   202k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------

_ZN22transaction_identifierILb0EE11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
   56|   309k|    template <typename Stream> void Unserialize(Stream& s) { m_wrapped.Unserialize(s); }
_ZN22transaction_identifierILb0EE11UnserializeI10SpanReaderEEvRT_:
   56|  12.7k|    template <typename Stream> void Unserialize(Stream& s) { m_wrapped.Unserialize(s); }
_ZNK22transaction_identifierILb0EEssERKS0_:
   35|   362k|    constexpr auto operator<=>(const transaction_identifier&) const = default;
_ZN22transaction_identifierILb0EEC2Ev:
   31|   324k|    transaction_identifier() : m_wrapped{} {}
_ZNK22transaction_identifierILb0EE9ToUint256Ev:
   37|  14.3k|    const uint256& ToUint256() const LIFETIMEBOUND { return m_wrapped; }
_ZN22transaction_identifierILb0EE11FromUint256ERK7uint256:
   38|  15.4k|    static transaction_identifier FromUint256(const uint256& id) { return {id}; }
_ZN22transaction_identifierILb0EEC2ERK7uint256:
   28|  15.4k|    transaction_identifier(const uint256& wrapped) : m_wrapped{wrapped} {}
_ZNK22transaction_identifierILb0EE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
   55|   165k|    template <typename Stream> void Serialize(Stream& s) const { m_wrapped.Serialize(s); }
_ZN22transaction_identifierILb1EE11FromUint256ERK7uint256:
   38|  15.4k|    static transaction_identifier FromUint256(const uint256& id) { return {id}; }
_ZN22transaction_identifierILb1EEC2ERK7uint256:
   28|  15.4k|    transaction_identifier(const uint256& wrapped) : m_wrapped{wrapped} {}
_ZNK22transaction_identifierILb0EE9SerializeI10HashWriterEEvRT_:
   55|  6.91M|    template <typename Stream> void Serialize(Stream& s) const { m_wrapped.Serialize(s); }

_Z21DeserializeHDKeypathsI10DataStreamEvRT_RKNSt3__16vectorIhNS3_9allocatorIhEEEERNS3_3mapI7CPubKey13KeyOriginInfoNS3_4lessISB_EENS5_INS3_4pairIKSB_SC_EEEEEE:
  168|  24.1k|{
  169|       |    // Make sure that the key is the size of pubkey + 1
  170|  24.1k|    if (key.size() != CPubKey::SIZE + 1 && key.size() != CPubKey::COMPRESSED_SIZE + 1) {
  ------------------
  |  Branch (170:9): [True: 23.7k, False: 378]
  |  Branch (170:44): [True: 22.8k, False: 976]
  ------------------
  171|  22.8k|        throw std::ios_base::failure("Size of key was not the expected size for the type BIP32 keypath");
  172|  22.8k|    }
  173|       |    // Read in the pubkey from key
  174|  1.35k|    CPubKey pubkey(key.begin() + 1, key.end());
  175|  1.35k|    if (!pubkey.IsFullyValid()) {
  ------------------
  |  Branch (175:9): [True: 608, False: 746]
  ------------------
  176|    608|       throw std::ios_base::failure("Invalid pubkey");
  177|    608|    }
  178|       |
  179|    746|    KeyOriginInfo keypath;
  180|    746|    DeserializeHDKeypath(s, keypath);
  181|       |
  182|       |    // Add to map
  183|    746|    hd_keypaths.emplace(pubkey, std::move(keypath));
  184|    746|}
_Z20DeserializeHDKeypathI10DataStreamEvRT_R13KeyOriginInfo:
  161|    746|{
  162|    746|    hd_keypath = DeserializeKeyOrigin(s, ReadCompactSize(s));
  163|    746|}
_Z20DeserializeKeyOriginI10DataStreamE13KeyOriginInfoRT_m:
  142|    192|{
  143|       |    // Read in key path
  144|    192|    if (length % 4 || length == 0) {
  ------------------
  |  Branch (144:9): [True: 24, False: 168]
  |  Branch (144:23): [True: 1, False: 167]
  ------------------
  145|     25|        throw std::ios_base::failure("Invalid length for HD key path");
  146|     25|    }
  147|       |
  148|    167|    KeyOriginInfo hd_keypath;
  149|    167|    s >> hd_keypath.fingerprint;
  150|  1.71M|    for (unsigned int i = 4; i < length; i += sizeof(uint32_t)) {
  ------------------
  |  Branch (150:30): [True: 1.71M, False: 167]
  ------------------
  151|  1.71M|        uint32_t index;
  152|  1.71M|        s >> index;
  153|  1.71M|        hd_keypath.path.push_back(index);
  154|  1.71M|    }
  155|    167|    return hd_keypath;
  156|    192|}
_Z18SerializeHDKeypathI10DataStreamEvRT_13KeyOriginInfo:
  199|  7.48k|{
  200|  7.48k|    WriteCompactSize(s, (hd_keypath.path.size() + 1) * sizeof(uint32_t));
  201|  7.48k|    SerializeKeyOrigin(s, hd_keypath);
  202|  7.48k|}
_Z18SerializeKeyOriginI10DataStreamEvRT_13KeyOriginInfo:
  189|  7.48k|{
  190|  7.48k|    s << hd_keypath.fingerprint;
  191|   387k|    for (const auto& path : hd_keypath.path) {
  ------------------
  |  Branch (191:27): [True: 387k, False: 7.48k]
  ------------------
  192|   387k|        s << path;
  193|   387k|    }
  194|  7.48k|}
_Z17SerializeToVectorI10DataStreamJ17CompactSizeWriterNSt3__14spanIKhLm18446744073709551615EEEEEvRT_DpRKT0_:
  119|  7.48k|{
  120|  7.48k|    SizeComputer sizecomp;
  121|  7.48k|    SerializeMany(sizecomp, args...);
  122|  7.48k|    WriteCompactSize(s, sizecomp.size());
  123|  7.48k|    SerializeMany(s, args...);
  124|  7.48k|}
_Z19SerializeHDKeypathsI10DataStreamEvRT_RKNSt3__13mapI7CPubKey13KeyOriginInfoNS3_4lessIS5_EENS3_9allocatorINS3_4pairIKS5_S6_EEEEEE17CompactSizeWriter:
  207|  24.1k|{
  208|  24.1k|    for (const auto& keypath_pair : hd_keypaths) {
  ------------------
  |  Branch (208:35): [True: 7.80k, False: 23.8k]
  ------------------
  209|  7.80k|        if (!keypath_pair.first.IsValid()) {
  ------------------
  |  Branch (209:13): [True: 317, False: 7.48k]
  ------------------
  210|    317|            throw std::ios_base::failure("Invalid CPubKey being serialized");
  211|    317|        }
  212|  7.48k|        SerializeToVector(s, type, std::span{keypath_pair.first});
  213|  7.48k|        SerializeHDKeypath(s, keypath_pair.second);
  214|  7.48k|    }
  215|  24.1k|}

_Z29ecdsa_signature_parse_der_laxP25secp256k1_ecdsa_signaturePKhm:
   45|   106k|int ecdsa_signature_parse_der_lax(secp256k1_ecdsa_signature* sig, const unsigned char *input, size_t inputlen) {
   46|   106k|    size_t rpos, rlen, spos, slen;
   47|   106k|    size_t pos = 0;
   48|   106k|    size_t lenbyte;
   49|   106k|    unsigned char tmpsig[64] = {0};
   50|   106k|    int overflow = 0;
   51|       |
   52|       |    /* Hack to initialize sig with a correctly-parsed but invalid signature. */
   53|   106k|    secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
   54|       |
   55|       |    /* Sequence tag byte */
   56|   106k|    if (pos == inputlen || input[pos] != 0x30) {
  ------------------
  |  Branch (56:9): [True: 0, False: 106k]
  |  Branch (56:28): [True: 0, False: 106k]
  ------------------
   57|      0|        return 0;
   58|      0|    }
   59|   106k|    pos++;
   60|       |
   61|       |    /* Sequence length bytes */
   62|   106k|    if (pos == inputlen) {
  ------------------
  |  Branch (62:9): [True: 0, False: 106k]
  ------------------
   63|      0|        return 0;
   64|      0|    }
   65|   106k|    lenbyte = input[pos++];
   66|   106k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (66:9): [True: 0, False: 106k]
  ------------------
   67|      0|        lenbyte -= 0x80;
   68|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (68:13): [True: 0, False: 0]
  ------------------
   69|      0|            return 0;
   70|      0|        }
   71|      0|        pos += lenbyte;
   72|      0|    }
   73|       |
   74|       |    /* Integer tag byte for R */
   75|   106k|    if (pos == inputlen || input[pos] != 0x02) {
  ------------------
  |  Branch (75:9): [True: 0, False: 106k]
  |  Branch (75:28): [True: 0, False: 106k]
  ------------------
   76|      0|        return 0;
   77|      0|    }
   78|   106k|    pos++;
   79|       |
   80|       |    /* Integer length for R */
   81|   106k|    if (pos == inputlen) {
  ------------------
  |  Branch (81:9): [True: 0, False: 106k]
  ------------------
   82|      0|        return 0;
   83|      0|    }
   84|   106k|    lenbyte = input[pos++];
   85|   106k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (85:9): [True: 0, False: 106k]
  ------------------
   86|      0|        lenbyte -= 0x80;
   87|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (87:13): [True: 0, False: 0]
  ------------------
   88|      0|            return 0;
   89|      0|        }
   90|      0|        while (lenbyte > 0 && input[pos] == 0) {
  ------------------
  |  Branch (90:16): [True: 0, False: 0]
  |  Branch (90:31): [True: 0, False: 0]
  ------------------
   91|      0|            pos++;
   92|      0|            lenbyte--;
   93|      0|        }
   94|      0|        static_assert(sizeof(size_t) >= 4, "size_t too small");
   95|      0|        if (lenbyte >= 4) {
  ------------------
  |  Branch (95:13): [True: 0, False: 0]
  ------------------
   96|      0|            return 0;
   97|      0|        }
   98|      0|        rlen = 0;
   99|      0|        while (lenbyte > 0) {
  ------------------
  |  Branch (99:16): [True: 0, False: 0]
  ------------------
  100|      0|            rlen = (rlen << 8) + input[pos];
  101|      0|            pos++;
  102|      0|            lenbyte--;
  103|      0|        }
  104|   106k|    } else {
  105|   106k|        rlen = lenbyte;
  106|   106k|    }
  107|   106k|    if (rlen > inputlen - pos) {
  ------------------
  |  Branch (107:9): [True: 0, False: 106k]
  ------------------
  108|      0|        return 0;
  109|      0|    }
  110|   106k|    rpos = pos;
  111|   106k|    pos += rlen;
  112|       |
  113|       |    /* Integer tag byte for S */
  114|   106k|    if (pos == inputlen || input[pos] != 0x02) {
  ------------------
  |  Branch (114:9): [True: 0, False: 106k]
  |  Branch (114:28): [True: 0, False: 106k]
  ------------------
  115|      0|        return 0;
  116|      0|    }
  117|   106k|    pos++;
  118|       |
  119|       |    /* Integer length for S */
  120|   106k|    if (pos == inputlen) {
  ------------------
  |  Branch (120:9): [True: 0, False: 106k]
  ------------------
  121|      0|        return 0;
  122|      0|    }
  123|   106k|    lenbyte = input[pos++];
  124|   106k|    if (lenbyte & 0x80) {
  ------------------
  |  Branch (124:9): [True: 0, False: 106k]
  ------------------
  125|      0|        lenbyte -= 0x80;
  126|      0|        if (lenbyte > inputlen - pos) {
  ------------------
  |  Branch (126:13): [True: 0, False: 0]
  ------------------
  127|      0|            return 0;
  128|      0|        }
  129|      0|        while (lenbyte > 0 && input[pos] == 0) {
  ------------------
  |  Branch (129:16): [True: 0, False: 0]
  |  Branch (129:31): [True: 0, False: 0]
  ------------------
  130|      0|            pos++;
  131|      0|            lenbyte--;
  132|      0|        }
  133|      0|        static_assert(sizeof(size_t) >= 4, "size_t too small");
  134|      0|        if (lenbyte >= 4) {
  ------------------
  |  Branch (134:13): [True: 0, False: 0]
  ------------------
  135|      0|            return 0;
  136|      0|        }
  137|      0|        slen = 0;
  138|      0|        while (lenbyte > 0) {
  ------------------
  |  Branch (138:16): [True: 0, False: 0]
  ------------------
  139|      0|            slen = (slen << 8) + input[pos];
  140|      0|            pos++;
  141|      0|            lenbyte--;
  142|      0|        }
  143|   106k|    } else {
  144|   106k|        slen = lenbyte;
  145|   106k|    }
  146|   106k|    if (slen > inputlen - pos) {
  ------------------
  |  Branch (146:9): [True: 0, False: 106k]
  ------------------
  147|      0|        return 0;
  148|      0|    }
  149|   106k|    spos = pos;
  150|       |
  151|       |    /* Ignore leading zeroes in R */
  152|   107k|    while (rlen > 0 && input[rpos] == 0) {
  ------------------
  |  Branch (152:12): [True: 107k, False: 0]
  |  Branch (152:24): [True: 772, False: 106k]
  ------------------
  153|    772|        rlen--;
  154|    772|        rpos++;
  155|    772|    }
  156|       |    /* Copy R value */
  157|   106k|    if (rlen > 32) {
  ------------------
  |  Branch (157:9): [True: 342, False: 106k]
  ------------------
  158|    342|        overflow = 1;
  159|   106k|    } else {
  160|   106k|        memcpy(tmpsig + 32 - rlen, input + rpos, rlen);
  161|   106k|    }
  162|       |
  163|       |    /* Ignore leading zeroes in S */
  164|   107k|    while (slen > 0 && input[spos] == 0) {
  ------------------
  |  Branch (164:12): [True: 107k, False: 0]
  |  Branch (164:24): [True: 878, False: 106k]
  ------------------
  165|    878|        slen--;
  166|    878|        spos++;
  167|    878|    }
  168|       |    /* Copy S value */
  169|   106k|    if (slen > 32) {
  ------------------
  |  Branch (169:9): [True: 0, False: 106k]
  ------------------
  170|      0|        overflow = 1;
  171|   106k|    } else {
  172|   106k|        memcpy(tmpsig + 64 - slen, input + spos, slen);
  173|   106k|    }
  174|       |
  175|   106k|    if (!overflow) {
  ------------------
  |  Branch (175:9): [True: 106k, False: 342]
  ------------------
  176|   106k|        overflow = !secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
  177|   106k|    }
  178|   106k|    if (overflow) {
  ------------------
  |  Branch (178:9): [True: 342, False: 106k]
  ------------------
  179|       |        /* Overwrite the result again with a correctly-parsed but invalid
  180|       |           signature if parsing failed. */
  181|    342|        memset(tmpsig, 0, 64);
  182|    342|        secp256k1_ecdsa_signature_parse_compact(secp256k1_context_static, sig, tmpsig);
  183|    342|    }
  184|   106k|    return 1;
  185|   106k|}
_ZNK11XOnlyPubKey11GetCPubKeysEv:
  201|  24.3k|{
  202|  24.3k|    std::vector<CPubKey> out;
  203|  24.3k|    unsigned char b[33] = {0x02};
  204|  24.3k|    std::copy(m_keydata.begin(), m_keydata.end(), b + 1);
  205|  24.3k|    CPubKey fullpubkey;
  206|  24.3k|    fullpubkey.Set(b, b + 33);
  207|  24.3k|    out.push_back(fullpubkey);
  208|  24.3k|    b[0] = 0x03;
  209|  24.3k|    fullpubkey.Set(b, b + 33);
  210|  24.3k|    out.push_back(fullpubkey);
  211|  24.3k|    return out;
  212|  24.3k|}
_ZNK11XOnlyPubKey9GetKeyIDsEv:
  215|  24.3k|{
  216|  24.3k|    std::vector<CKeyID> out;
  217|  48.6k|    for (const CPubKey& pk : GetCPubKeys()) {
  ------------------
  |  Branch (217:28): [True: 48.6k, False: 24.3k]
  ------------------
  218|  48.6k|        out.push_back(pk.GetID());
  219|  48.6k|    }
  220|  24.3k|    return out;
  221|  24.3k|}
_ZNK11XOnlyPubKey13VerifySchnorrERK7uint256NSt3__14spanIKhLm18446744073709551615EEE:
  237|    315|{
  238|    315|    assert(sigbytes.size() == 64);
  ------------------
  |  Branch (238:5): [True: 315, False: 0]
  ------------------
  239|    315|    secp256k1_xonly_pubkey pubkey;
  240|    315|    if (!secp256k1_xonly_pubkey_parse(secp256k1_context_static, &pubkey, m_keydata.data())) return false;
  ------------------
  |  Branch (240:9): [True: 34, False: 281]
  ------------------
  241|    281|    return secp256k1_schnorrsig_verify(secp256k1_context_static, sigbytes.data(), msg.begin(), 32, &pubkey);
  242|    315|}
_ZNK11XOnlyPubKey19ComputeTapTweakHashEPK7uint256:
  247|    387|{
  248|    387|    if (merkle_root == nullptr) {
  ------------------
  |  Branch (248:9): [True: 0, False: 387]
  ------------------
  249|       |        // We have no scripts. The actual tweak does not matter, but follow BIP341 here to
  250|       |        // allow for reproducible tweaking.
  251|      0|        return (HashWriter{HASHER_TAPTWEAK} << m_keydata).GetSHA256();
  252|    387|    } else {
  253|    387|        return (HashWriter{HASHER_TAPTWEAK} << m_keydata << *merkle_root).GetSHA256();
  254|    387|    }
  255|    387|}
_ZNK11XOnlyPubKey13CheckTapTweakERKS_RK7uint256b:
  258|  1.35k|{
  259|  1.35k|    secp256k1_xonly_pubkey internal_key;
  260|  1.35k|    if (!secp256k1_xonly_pubkey_parse(secp256k1_context_static, &internal_key, internal.data())) return false;
  ------------------
  |  Branch (260:9): [True: 972, False: 387]
  ------------------
  261|    387|    uint256 tweak = internal.ComputeTapTweakHash(&merkle_root);
  262|    387|    return secp256k1_xonly_pubkey_tweak_add_check(secp256k1_context_static, m_keydata.begin(), parity, &internal_key, tweak.begin());
  263|  1.35k|}
_ZNK7CPubKey6VerifyERK7uint256RKNSt3__16vectorIhNS3_9allocatorIhEEEE:
  283|  44.7k|bool CPubKey::Verify(const uint256 &hash, const std::vector<unsigned char>& vchSig) const {
  284|  44.7k|    if (!IsValid())
  ------------------
  |  Branch (284:9): [True: 0, False: 44.7k]
  ------------------
  285|      0|        return false;
  286|  44.7k|    secp256k1_pubkey pubkey;
  287|  44.7k|    secp256k1_ecdsa_signature sig;
  288|  44.7k|    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size())) {
  ------------------
  |  Branch (288:9): [True: 16, False: 44.7k]
  ------------------
  289|     16|        return false;
  290|     16|    }
  291|  44.7k|    if (!ecdsa_signature_parse_der_lax(&sig, vchSig.data(), vchSig.size())) {
  ------------------
  |  Branch (291:9): [True: 0, False: 44.7k]
  ------------------
  292|      0|        return false;
  293|      0|    }
  294|       |    /* libsecp256k1's ECDSA verification requires lower-S signatures, which have
  295|       |     * not historically been enforced in Bitcoin, so normalize them first. */
  296|  44.7k|    secp256k1_ecdsa_signature_normalize(secp256k1_context_static, &sig, &sig);
  297|  44.7k|    return secp256k1_ecdsa_verify(secp256k1_context_static, &sig, hash.begin(), &pubkey);
  298|  44.7k|}
_ZNK7CPubKey12IsFullyValidEv:
  320|  1.35k|bool CPubKey::IsFullyValid() const {
  321|  1.35k|    if (!IsValid())
  ------------------
  |  Branch (321:9): [True: 42, False: 1.31k]
  ------------------
  322|     42|        return false;
  323|  1.31k|    secp256k1_pubkey pubkey;
  324|  1.31k|    return secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size());
  325|  1.35k|}
_ZN7CPubKey10DecompressEv:
  327|  2.92k|bool CPubKey::Decompress() {
  328|  2.92k|    if (!IsValid())
  ------------------
  |  Branch (328:9): [True: 0, False: 2.92k]
  ------------------
  329|      0|        return false;
  330|  2.92k|    secp256k1_pubkey pubkey;
  331|  2.92k|    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, vch, size())) {
  ------------------
  |  Branch (331:9): [True: 1.29k, False: 1.63k]
  ------------------
  332|  1.29k|        return false;
  333|  1.29k|    }
  334|  1.63k|    unsigned char pub[SIZE];
  335|  1.63k|    size_t publen = SIZE;
  336|  1.63k|    secp256k1_ec_pubkey_serialize(secp256k1_context_static, pub, &publen, &pubkey, SECP256K1_EC_UNCOMPRESSED);
  ------------------
  |  |  217|  1.63k|#define SECP256K1_EC_UNCOMPRESSED (SECP256K1_FLAGS_TYPE_COMPRESSION)
  |  |  ------------------
  |  |  |  |  197|  1.63k|#define SECP256K1_FLAGS_TYPE_COMPRESSION (1 << 1)
  |  |  ------------------
  ------------------
  337|  1.63k|    Set(pub, pub + publen);
  338|  1.63k|    return true;
  339|  2.92k|}
_ZN7CPubKey9CheckLowSERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
  423|  62.2k|/* static */ bool CPubKey::CheckLowS(const std::vector<unsigned char>& vchSig) {
  424|  62.2k|    secp256k1_ecdsa_signature sig;
  425|  62.2k|    if (!ecdsa_signature_parse_der_lax(&sig, vchSig.data(), vchSig.size())) {
  ------------------
  |  Branch (425:9): [True: 0, False: 62.2k]
  ------------------
  426|      0|        return false;
  427|      0|    }
  428|  62.2k|    return (!secp256k1_ecdsa_signature_normalize(secp256k1_context_static, nullptr, &sig));
  429|  62.2k|}

_ZN7CPubKey11UnserializeI10SpanReaderEEvRT_:
  151|  19.5k|    {
  152|  19.5k|        const unsigned int len(::ReadCompactSize(s));
  153|  19.5k|        if (len <= SIZE) {
  ------------------
  |  Branch (153:13): [True: 15.9k, False: 3.64k]
  ------------------
  154|  15.9k|            s >> std::span{vch, len};
  155|  15.9k|            if (len != size()) {
  ------------------
  |  Branch (155:17): [True: 3.07k, False: 12.8k]
  ------------------
  156|  3.07k|                Invalidate();
  157|  3.07k|            }
  158|  15.9k|        } else {
  159|       |            // invalid pubkey, skip available data
  160|  3.64k|            s.ignore(len);
  161|  3.64k|            Invalidate();
  162|  3.64k|        }
  163|  19.5k|    }
_ZN7CPubKeyC2INSt3__111__wrap_iterIPKhEEEET_S6_:
  107|  1.35k|    {
  108|  1.35k|        Set(pbegin, pend);
  109|  1.35k|    }
_ZN7CPubKey9ValidSizeERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
   83|  13.5k|    bool static ValidSize(const std::vector<unsigned char> &vch) {
   84|  13.5k|      return vch.size() > 0 && GetLen(vch[0]) == vch.size();
  ------------------
  |  Branch (84:14): [True: 11.3k, False: 2.21k]
  |  Branch (84:32): [True: 7.87k, False: 3.48k]
  ------------------
   85|  13.5k|    }
_ZN7CPubKeyC2INSt3__111__wrap_iterIPhEEEET_S5_:
  107|      3|    {
  108|      3|        Set(pbegin, pend);
  109|      3|    }
_ZN7CPubKey3SetINSt3__111__wrap_iterIPhEEEEvT_S5_:
   96|      3|    {
   97|      3|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (97:19): [True: 0, False: 3]
  ------------------
   98|      3|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (98:13): [True: 0, False: 3]
  |  Branch (98:20): [True: 0, False: 0]
  ------------------
   99|      0|            memcpy(vch, (unsigned char*)&pbegin[0], len);
  100|      3|        else
  101|      3|            Invalidate();
  102|      3|    }
_ZN6CKeyIDC2Ev:
   28|  1.20k|    CKeyID() : uint160() {}
_ZltRK7CPubKeyS1_:
  131|   100k|    {
  132|   100k|        return a.vch[0] < b.vch[0] ||
  ------------------
  |  Branch (132:16): [True: 18.3k, False: 82.3k]
  ------------------
  133|  82.3k|               (a.vch[0] == b.vch[0] && memcmp(a.vch, b.vch, a.size()) < 0);
  ------------------
  |  Branch (133:17): [True: 68.9k, False: 13.4k]
  |  Branch (133:41): [True: 34.3k, False: 34.5k]
  ------------------
  134|   100k|    }
_ZNK7CPubKey3endEv:
  121|  30.9k|    const unsigned char* end() const { return vch + size(); }
_ZNK7CPubKey12IsCompressedEv:
  207|  9.90k|    {
  208|  9.90k|        return size() == COMPRESSED_SIZE;
  209|  9.90k|    }
_ZNK7CPubKey4dataEv:
  119|  7.48k|    const unsigned char* data() const { return vch; }
_ZN7CPubKey6GetLenEh:
   67|   595k|    {
   68|   595k|        if (chHeader == 2 || chHeader == 3)
  ------------------
  |  Branch (68:13): [True: 172k, False: 423k]
  |  Branch (68:30): [True: 292k, False: 131k]
  ------------------
   69|   464k|            return COMPRESSED_SIZE;
   70|   131k|        if (chHeader == 4 || chHeader == 6 || chHeader == 7)
  ------------------
  |  Branch (70:13): [True: 76.9k, False: 54.7k]
  |  Branch (70:30): [True: 24.5k, False: 30.2k]
  |  Branch (70:47): [True: 10.1k, False: 20.0k]
  ------------------
   71|   111k|            return SIZE;
   72|  20.0k|        return 0;
   73|   131k|    }
_ZN7CPubKey10InvalidateEv:
   77|   126k|    {
   78|   126k|        vch[0] = 0xFF;
   79|   126k|    }
_ZN7CPubKeyC2ENSt3__14spanIKhLm18446744073709551615EEE:
  113|  54.8k|    {
  114|  54.8k|        Set(_vch.begin(), _vch.end());
  115|  54.8k|    }
_ZNK7CPubKey4sizeEv:
  118|   478k|    unsigned int size() const { return GetLen(vch[0]); }
_ZNK7CPubKey7IsValidEv:
  192|   146k|    {
  193|   146k|        return size() > 0;
  194|   146k|    }
_ZN7CPubKey3SetINSt3__111__wrap_iterIPKhEEEEvT_S6_:
   96|  56.1k|    {
   97|  56.1k|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (97:19): [True: 0, False: 56.1k]
  ------------------
   98|  56.1k|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (98:13): [True: 56.1k, False: 34]
  |  Branch (98:20): [True: 56.1k, False: 8]
  ------------------
   99|  56.1k|            memcpy(vch, (unsigned char*)&pbegin[0], len);
  100|     42|        else
  101|     42|            Invalidate();
  102|  56.1k|    }
_ZN7CPubKeyC2Ev:
   89|   121k|    {
   90|   121k|        Invalidate();
   91|   121k|    }
_ZNK7CPubKey5GetIDEv:
  167|   106k|    {
  168|   106k|        return CKeyID(Hash160(std::span{vch}.first(size())));
  169|   106k|    }
_ZN6CKeyIDC2ERK7uint160:
   29|   141k|    explicit CKeyID(const uint160& in) : uint160(in) {}
_ZNK11XOnlyPubKey4dataEv:
  300|  1.35k|    const unsigned char* data() const { return m_keydata.begin(); }
_ZN11XOnlyPubKeyC2Ev:
  244|   162k|    XOnlyPubKey() = default;
_ZNK7CPubKey5beginEv:
  120|  75.2k|    const unsigned char* begin() const { return vch; }
_ZN7CPubKey3SetIPhEEvT_S2_:
   96|  50.2k|    {
   97|  50.2k|        int len = pend == pbegin ? 0 : GetLen(pbegin[0]);
  ------------------
  |  Branch (97:19): [True: 0, False: 50.2k]
  ------------------
   98|  50.2k|        if (len && len == (pend - pbegin))
  ------------------
  |  Branch (98:13): [True: 50.2k, False: 0]
  |  Branch (98:20): [True: 50.2k, False: 0]
  ------------------
   99|  50.2k|            memcpy(vch, (unsigned char*)&pbegin[0], len);
  100|      0|        else
  101|      0|            Invalidate();
  102|  50.2k|    }
_ZN11XOnlyPubKeyC2ENSt3__14spanIKhLm18446744073709551615EEE:
  259|  9.60k|    constexpr explicit XOnlyPubKey(std::span<const unsigned char> bytes) : m_keydata{bytes} {}

random.cpp:_ZN12_GLOBAL__N_18RNGStateD2Ev:
  367|      2|    ~RNGState() = default;

_Z10CastToBoolRKNSt3__16vectorIhNS_9allocatorIhEEEE:
   47|  94.4k|{
   48|   274k|    for (unsigned int i = 0; i < vch.size(); i++)
  ------------------
  |  Branch (48:30): [True: 251k, False: 23.6k]
  ------------------
   49|   251k|    {
   50|   251k|        if (vch[i] != 0)
  ------------------
  |  Branch (50:13): [True: 70.8k, False: 180k]
  ------------------
   51|  70.8k|        {
   52|       |            // Can be negative zero
   53|  70.8k|            if (i == vch.size()-1 && vch[i] == 0x80)
  ------------------
  |  Branch (53:17): [True: 21.6k, False: 49.2k]
  |  Branch (53:38): [True: 871, False: 20.7k]
  ------------------
   54|    871|                return false;
   55|  69.9k|            return true;
   56|  70.8k|        }
   57|   251k|    }
   58|  23.6k|    return false;
   59|  94.4k|}
_Z22CheckSignatureEncodingRKNSt3__16vectorIhNS_9allocatorIhEEEE19script_verify_flagsP13ScriptError_t:
  211|  69.8k|bool CheckSignatureEncoding(const std::vector<unsigned char> &vchSig, script_verify_flags flags, ScriptError* serror) {
  212|       |    // Empty signature. Not strictly DER encoded, but allowed to provide a
  213|       |    // compact way to provide an invalid signature for use with CHECK(MULTI)SIG
  214|  69.8k|    if (vchSig.size() == 0) {
  ------------------
  |  Branch (214:9): [True: 4.83k, False: 65.0k]
  ------------------
  215|  4.83k|        return true;
  216|  4.83k|    }
  217|  65.0k|    if ((flags & (SCRIPT_VERIFY_DERSIG | SCRIPT_VERIFY_LOW_S | SCRIPT_VERIFY_STRICTENC)) != 0 && !IsValidSignatureEncoding(vchSig)) {
  ------------------
  |  Branch (217:9): [True: 65.0k, False: 0]
  |  Branch (217:9): [True: 2.79k, False: 62.2k]
  |  Branch (217:98): [True: 2.79k, False: 62.2k]
  ------------------
  218|  2.79k|        return set_error(serror, SCRIPT_ERR_SIG_DER);
  219|  62.2k|    } else if ((flags & SCRIPT_VERIFY_LOW_S) != 0 && !IsLowDERSignature(vchSig, serror)) {
  ------------------
  |  Branch (219:16): [True: 62.2k, False: 4]
  |  Branch (219:16): [True: 0, False: 62.2k]
  |  Branch (219:54): [True: 0, False: 62.2k]
  ------------------
  220|       |        // serror is set
  221|      0|        return false;
  222|  62.2k|    } else if ((flags & SCRIPT_VERIFY_STRICTENC) != 0 && !IsDefinedHashtypeSignature(vchSig)) {
  ------------------
  |  Branch (222:16): [True: 62.2k, False: 0]
  |  Branch (222:16): [True: 16.2k, False: 45.9k]
  |  Branch (222:58): [True: 16.2k, False: 45.9k]
  ------------------
  223|  16.2k|        return set_error(serror, SCRIPT_ERR_SIG_HASHTYPE);
  224|  16.2k|    }
  225|  45.9k|    return true;
  226|  65.0k|}
_Z13FindAndDeleteR7CScriptRKS_:
  240|  70.5k|{
  241|  70.5k|    int nFound = 0;
  242|  70.5k|    if (b.empty())
  ------------------
  |  Branch (242:9): [True: 0, False: 70.5k]
  ------------------
  243|      0|        return nFound;
  244|  70.5k|    CScript result;
  245|  70.5k|    CScript::const_iterator pc = script.begin(), pc2 = script.begin(), end = script.end();
  246|  70.5k|    opcodetype opcode;
  247|  70.5k|    do
  248|  1.27M|    {
  249|  1.27M|        result.insert(result.end(), pc2, pc);
  250|  1.29M|        while (static_cast<size_t>(end - pc) >= b.size() && std::equal(b.begin(), b.end(), pc))
  ------------------
  |  Branch (250:16): [True: 911k, False: 387k]
  |  Branch (250:61): [True: 21.1k, False: 890k]
  ------------------
  251|  21.1k|        {
  252|  21.1k|            pc = pc + b.size();
  253|  21.1k|            ++nFound;
  254|  21.1k|        }
  255|  1.27M|        pc2 = pc;
  256|  1.27M|    }
  257|  1.27M|    while (script.GetOp(pc, opcode));
  ------------------
  |  Branch (257:12): [True: 1.20M, False: 70.5k]
  ------------------
  258|       |
  259|  70.5k|    if (nFound > 0) {
  ------------------
  |  Branch (259:9): [True: 2.52k, False: 67.9k]
  ------------------
  260|  2.52k|        result.insert(result.end(), pc2, end);
  261|  2.52k|        script = std::move(result);
  262|  2.52k|    }
  263|       |
  264|  70.5k|    return nFound;
  265|  70.5k|}
_Z10EvalScriptRNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEERK7CScript19script_verify_flagsRK20BaseSignatureChecker10SigVersionR19ScriptExecutionDataP13ScriptError_t:
  418|   535k|{
  419|   535k|    static const CScriptNum bnZero(0);
  420|   535k|    static const CScriptNum bnOne(1);
  421|       |    // static const CScriptNum bnFalse(0);
  422|       |    // static const CScriptNum bnTrue(1);
  423|   535k|    static const valtype vchFalse(0);
  424|       |    // static const valtype vchZero(0);
  425|   535k|    static const valtype vchTrue(1, 1);
  426|       |
  427|       |    // sigversion cannot be TAPROOT here, as it admits no script execution.
  428|   535k|    assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0 || sigversion == SigVersion::TAPSCRIPT);
  ------------------
  |  Branch (428:5): [True: 521k, False: 14.3k]
  |  Branch (428:5): [True: 14.3k, False: 0]
  |  Branch (428:5): [True: 0, False: 0]
  |  Branch (428:5): [True: 535k, False: 0]
  ------------------
  429|       |
  430|   535k|    CScript::const_iterator pc = script.begin();
  431|   535k|    CScript::const_iterator pend = script.end();
  432|   535k|    CScript::const_iterator pbegincodehash = script.begin();
  433|   535k|    opcodetype opcode;
  434|   535k|    valtype vchPushValue;
  435|   535k|    ConditionStack vfExec;
  436|   535k|    std::vector<valtype> altstack;
  437|   535k|    set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
  438|   535k|    if ((sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) && script.size() > MAX_SCRIPT_SIZE) {
  ------------------
  |  Branch (438:10): [True: 521k, False: 14.3k]
  |  Branch (438:44): [True: 14.3k, False: 0]
  |  Branch (438:85): [True: 94, False: 535k]
  ------------------
  439|     94|        return set_error(serror, SCRIPT_ERR_SCRIPT_SIZE);
  440|     94|    }
  441|   535k|    int nOpCount = 0;
  442|   535k|    bool fRequireMinimal = (flags & SCRIPT_VERIFY_MINIMALDATA) != 0;
  443|   535k|    uint32_t opcode_pos = 0;
  444|   535k|    execdata.m_codeseparator_pos = 0xFFFFFFFFUL;
  445|   535k|    execdata.m_codeseparator_pos_init = true;
  446|       |
  447|   535k|    try
  448|   535k|    {
  449|  11.5M|        for (; pc < pend; ++opcode_pos) {
  ------------------
  |  Branch (449:16): [True: 11.1M, False: 357k]
  ------------------
  450|  11.1M|            bool fExec = vfExec.all_true();
  451|       |
  452|       |            //
  453|       |            // Read instruction
  454|       |            //
  455|  11.1M|            if (!script.GetOp(pc, opcode, vchPushValue))
  ------------------
  |  Branch (455:17): [True: 15.7k, False: 11.1M]
  ------------------
  456|  15.7k|                return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
  457|  11.1M|            if (vchPushValue.size() > MAX_SCRIPT_ELEMENT_SIZE)
  ------------------
  |  Branch (457:17): [True: 455, False: 11.1M]
  ------------------
  458|    455|                return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
  459|       |
  460|  11.1M|            if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (460:17): [True: 11.0M, False: 71.0k]
  |  Branch (460:51): [True: 71.0k, False: 0]
  ------------------
  461|       |                // Note how OP_RESERVED does not count towards the opcode limit.
  462|  11.1M|                if (opcode > OP_16 && ++nOpCount > MAX_OPS_PER_SCRIPT) {
  ------------------
  |  Branch (462:21): [True: 1.76M, False: 9.37M]
  |  Branch (462:39): [True: 531, False: 1.76M]
  ------------------
  463|    531|                    return set_error(serror, SCRIPT_ERR_OP_COUNT);
  464|    531|                }
  465|  11.1M|            }
  466|       |
  467|  11.1M|            if (opcode == OP_CAT ||
  ------------------
  |  Branch (467:17): [True: 226, False: 11.1M]
  ------------------
  468|  11.1M|                opcode == OP_SUBSTR ||
  ------------------
  |  Branch (468:17): [True: 303, False: 11.1M]
  ------------------
  469|  11.1M|                opcode == OP_LEFT ||
  ------------------
  |  Branch (469:17): [True: 245, False: 11.1M]
  ------------------
  470|  11.1M|                opcode == OP_RIGHT ||
  ------------------
  |  Branch (470:17): [True: 359, False: 11.1M]
  ------------------
  471|  11.1M|                opcode == OP_INVERT ||
  ------------------
  |  Branch (471:17): [True: 238, False: 11.1M]
  ------------------
  472|  11.1M|                opcode == OP_AND ||
  ------------------
  |  Branch (472:17): [True: 279, False: 11.1M]
  ------------------
  473|  11.1M|                opcode == OP_OR ||
  ------------------
  |  Branch (473:17): [True: 681, False: 11.1M]
  ------------------
  474|  11.1M|                opcode == OP_XOR ||
  ------------------
  |  Branch (474:17): [True: 204, False: 11.1M]
  ------------------
  475|  11.1M|                opcode == OP_2MUL ||
  ------------------
  |  Branch (475:17): [True: 246, False: 11.1M]
  ------------------
  476|  11.1M|                opcode == OP_2DIV ||
  ------------------
  |  Branch (476:17): [True: 216, False: 11.1M]
  ------------------
  477|  11.1M|                opcode == OP_MUL ||
  ------------------
  |  Branch (477:17): [True: 268, False: 11.1M]
  ------------------
  478|  11.1M|                opcode == OP_DIV ||
  ------------------
  |  Branch (478:17): [True: 210, False: 11.1M]
  ------------------
  479|  11.1M|                opcode == OP_MOD ||
  ------------------
  |  Branch (479:17): [True: 385, False: 11.1M]
  ------------------
  480|  11.1M|                opcode == OP_LSHIFT ||
  ------------------
  |  Branch (480:17): [True: 239, False: 11.1M]
  ------------------
  481|  11.1M|                opcode == OP_RSHIFT)
  ------------------
  |  Branch (481:17): [True: 330, False: 11.1M]
  ------------------
  482|  4.42k|                return set_error(serror, SCRIPT_ERR_DISABLED_OPCODE); // Disabled opcodes (CVE-2010-5137).
  483|       |
  484|       |            // With SCRIPT_VERIFY_CONST_SCRIPTCODE, OP_CODESEPARATOR in non-segwit script is rejected even in an unexecuted branch
  485|  11.1M|            if (opcode == OP_CODESEPARATOR && sigversion == SigVersion::BASE && (flags & SCRIPT_VERIFY_CONST_SCRIPTCODE))
  ------------------
  |  Branch (485:17): [True: 1.46k, False: 11.1M]
  |  Branch (485:17): [True: 787, False: 11.1M]
  |  Branch (485:47): [True: 1.33k, False: 134]
  |  Branch (485:81): [True: 787, False: 544]
  ------------------
  486|    787|                return set_error(serror, SCRIPT_ERR_OP_CODESEPARATOR);
  487|       |
  488|  11.1M|            if (fExec && 0 <= opcode && opcode <= OP_PUSHDATA4) {
  ------------------
  |  Branch (488:17): [True: 4.81M, False: 6.32M]
  |  Branch (488:26): [True: 4.81M, False: 0]
  |  Branch (488:41): [True: 2.89M, False: 1.91M]
  ------------------
  489|  2.89M|                if (fRequireMinimal && !CheckMinimalPush(vchPushValue, opcode)) {
  ------------------
  |  Branch (489:21): [True: 2.86M, False: 31.7k]
  |  Branch (489:40): [True: 1.20k, False: 2.86M]
  ------------------
  490|  1.20k|                    return set_error(serror, SCRIPT_ERR_MINIMALDATA);
  491|  1.20k|                }
  492|  2.89M|                stack.push_back(vchPushValue);
  493|  8.23M|            } else if (fExec || (OP_IF <= opcode && opcode <= OP_ENDIF))
  ------------------
  |  Branch (493:24): [True: 1.91M, False: 6.32M]
  |  Branch (493:34): [True: 297k, False: 6.02M]
  |  Branch (493:53): [True: 96.7k, False: 200k]
  ------------------
  494|  2.01M|            switch (opcode)
  495|  2.01M|            {
  496|       |                //
  497|       |                // Push value
  498|       |                //
  499|  1.51k|                case OP_1NEGATE:
  ------------------
  |  Branch (499:17): [True: 1.51k, False: 2.01M]
  ------------------
  500|  28.2k|                case OP_1:
  ------------------
  |  Branch (500:17): [True: 26.7k, False: 1.98M]
  ------------------
  501|  85.5k|                case OP_2:
  ------------------
  |  Branch (501:17): [True: 57.3k, False: 1.95M]
  ------------------
  502|   113k|                case OP_3:
  ------------------
  |  Branch (502:17): [True: 27.4k, False: 1.98M]
  ------------------
  503|   126k|                case OP_4:
  ------------------
  |  Branch (503:17): [True: 13.0k, False: 2.00M]
  ------------------
  504|   294k|                case OP_5:
  ------------------
  |  Branch (504:17): [True: 168k, False: 1.84M]
  ------------------
  505|   304k|                case OP_6:
  ------------------
  |  Branch (505:17): [True: 9.69k, False: 2.00M]
  ------------------
  506|   322k|                case OP_7:
  ------------------
  |  Branch (506:17): [True: 17.7k, False: 1.99M]
  ------------------
  507|   362k|                case OP_8:
  ------------------
  |  Branch (507:17): [True: 39.9k, False: 1.97M]
  ------------------
  508|   369k|                case OP_9:
  ------------------
  |  Branch (508:17): [True: 7.31k, False: 2.00M]
  ------------------
  509|   372k|                case OP_10:
  ------------------
  |  Branch (509:17): [True: 2.80k, False: 2.01M]
  ------------------
  510|   386k|                case OP_11:
  ------------------
  |  Branch (510:17): [True: 14.2k, False: 1.99M]
  ------------------
  511|   387k|                case OP_12:
  ------------------
  |  Branch (511:17): [True: 1.16k, False: 2.01M]
  ------------------
  512|   407k|                case OP_13:
  ------------------
  |  Branch (512:17): [True: 19.6k, False: 1.99M]
  ------------------
  513|   448k|                case OP_14:
  ------------------
  |  Branch (513:17): [True: 40.9k, False: 1.97M]
  ------------------
  514|   451k|                case OP_15:
  ------------------
  |  Branch (514:17): [True: 3.18k, False: 2.01M]
  ------------------
  515|   453k|                case OP_16:
  ------------------
  |  Branch (515:17): [True: 2.10k, False: 2.01M]
  ------------------
  516|   453k|                {
  517|       |                    // ( -- value)
  518|   453k|                    CScriptNum bn((int)opcode - (int)(OP_1 - 1));
  519|   453k|                    stack.push_back(bn.getvch());
  520|       |                    // The result of these opcodes should always be the minimal way to push the data
  521|       |                    // they push, so no need for a CheckMinimalPush here.
  522|   453k|                }
  523|   453k|                break;
  524|       |
  525|       |
  526|       |                //
  527|       |                // Control
  528|       |                //
  529|   603k|                case OP_NOP:
  ------------------
  |  Branch (529:17): [True: 603k, False: 1.40M]
  ------------------
  530|   603k|                    break;
  531|       |
  532|  19.3k|                case OP_CHECKLOCKTIMEVERIFY:
  ------------------
  |  Branch (532:17): [True: 19.3k, False: 1.99M]
  ------------------
  533|  19.3k|                {
  534|  19.3k|                    if (!(flags & SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY)) {
  ------------------
  |  Branch (534:25): [True: 451, False: 18.9k]
  ------------------
  535|       |                        // not enabled; treat as a NOP2
  536|    451|                        break;
  537|    451|                    }
  538|       |
  539|  18.9k|                    if (stack.size() < 1)
  ------------------
  |  Branch (539:25): [True: 423, False: 18.5k]
  ------------------
  540|    423|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  541|       |
  542|       |                    // Note that elsewhere numeric opcodes are limited to
  543|       |                    // operands in the range -2**31+1 to 2**31-1, however it is
  544|       |                    // legal for opcodes to produce results exceeding that
  545|       |                    // range. This limitation is implemented by CScriptNum's
  546|       |                    // default 4-byte limit.
  547|       |                    //
  548|       |                    // If we kept to that limit we'd have a year 2038 problem,
  549|       |                    // even though the nLockTime field in transactions
  550|       |                    // themselves is uint32 which only becomes meaningless
  551|       |                    // after the year 2106.
  552|       |                    //
  553|       |                    // Thus as a special case we tell CScriptNum to accept up
  554|       |                    // to 5-byte bignums, which are good until 2**39-1, well
  555|       |                    // beyond the 2**32-1 limit of the nLockTime field itself.
  556|  18.5k|                    const CScriptNum nLockTime(stacktop(-1), fRequireMinimal, 5);
  ------------------
  |  |   65|  18.5k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  557|       |
  558|       |                    // In the rare event that the argument may be < 0 due to
  559|       |                    // some arithmetic being done first, you can always use
  560|       |                    // 0 MAX CHECKLOCKTIMEVERIFY.
  561|  18.5k|                    if (nLockTime < 0)
  ------------------
  |  Branch (561:25): [True: 582, False: 17.9k]
  ------------------
  562|    582|                        return set_error(serror, SCRIPT_ERR_NEGATIVE_LOCKTIME);
  563|       |
  564|       |                    // Actually compare the specified lock time with the transaction.
  565|  17.9k|                    if (!checker.CheckLockTime(nLockTime))
  ------------------
  |  Branch (565:25): [True: 2.72k, False: 15.2k]
  ------------------
  566|  2.72k|                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
  567|       |
  568|  15.2k|                    break;
  569|  17.9k|                }
  570|       |
  571|  16.1k|                case OP_CHECKSEQUENCEVERIFY:
  ------------------
  |  Branch (571:17): [True: 16.1k, False: 1.99M]
  ------------------
  572|  16.1k|                {
  573|  16.1k|                    if (!(flags & SCRIPT_VERIFY_CHECKSEQUENCEVERIFY)) {
  ------------------
  |  Branch (573:25): [True: 740, False: 15.4k]
  ------------------
  574|       |                        // not enabled; treat as a NOP3
  575|    740|                        break;
  576|    740|                    }
  577|       |
  578|  15.4k|                    if (stack.size() < 1)
  ------------------
  |  Branch (578:25): [True: 401, False: 15.0k]
  ------------------
  579|    401|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  580|       |
  581|       |                    // nSequence, like nLockTime, is a 32-bit unsigned integer
  582|       |                    // field. See the comment in CHECKLOCKTIMEVERIFY regarding
  583|       |                    // 5-byte numeric operands.
  584|  15.0k|                    const CScriptNum nSequence(stacktop(-1), fRequireMinimal, 5);
  ------------------
  |  |   65|  15.0k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  585|       |
  586|       |                    // In the rare event that the argument may be < 0 due to
  587|       |                    // some arithmetic being done first, you can always use
  588|       |                    // 0 MAX CHECKSEQUENCEVERIFY.
  589|  15.0k|                    if (nSequence < 0)
  ------------------
  |  Branch (589:25): [True: 773, False: 14.2k]
  ------------------
  590|    773|                        return set_error(serror, SCRIPT_ERR_NEGATIVE_LOCKTIME);
  591|       |
  592|       |                    // To provide for future soft-fork extensibility, if the
  593|       |                    // operand has the disabled lock-time flag set,
  594|       |                    // CHECKSEQUENCEVERIFY behaves as a NOP.
  595|  14.2k|                    if ((nSequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG) != 0)
  ------------------
  |  Branch (595:25): [True: 766, False: 13.5k]
  ------------------
  596|    766|                        break;
  597|       |
  598|       |                    // Compare the specified sequence number with the input.
  599|  13.5k|                    if (!checker.CheckSequence(nSequence))
  ------------------
  |  Branch (599:25): [True: 3.86k, False: 9.65k]
  ------------------
  600|  3.86k|                        return set_error(serror, SCRIPT_ERR_UNSATISFIED_LOCKTIME);
  601|       |
  602|  9.65k|                    break;
  603|  13.5k|                }
  604|       |
  605|  9.65k|                case OP_NOP1: case OP_NOP4: case OP_NOP5:
  ------------------
  |  Branch (605:17): [True: 294, False: 2.01M]
  |  Branch (605:31): [True: 261, False: 2.01M]
  |  Branch (605:45): [True: 321, False: 2.01M]
  ------------------
  606|  27.4k|                case OP_NOP6: case OP_NOP7: case OP_NOP8: case OP_NOP9: case OP_NOP10:
  ------------------
  |  Branch (606:17): [True: 658, False: 2.01M]
  |  Branch (606:31): [True: 405, False: 2.01M]
  |  Branch (606:45): [True: 24.8k, False: 1.98M]
  |  Branch (606:59): [True: 374, False: 2.01M]
  |  Branch (606:73): [True: 289, False: 2.01M]
  ------------------
  607|  27.4k|                {
  608|  27.4k|                    if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS)
  ------------------
  |  Branch (608:25): [True: 984, False: 26.4k]
  ------------------
  609|    984|                        return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS);
  610|  27.4k|                }
  611|  26.4k|                break;
  612|       |
  613|  26.4k|                case OP_IF:
  ------------------
  |  Branch (613:17): [True: 9.74k, False: 2.00M]
  ------------------
  614|   118k|                case OP_NOTIF:
  ------------------
  |  Branch (614:17): [True: 108k, False: 1.90M]
  ------------------
  615|   118k|                {
  616|       |                    // <expression> if [statements] [else [statements]] endif
  617|   118k|                    bool fValue = false;
  618|   118k|                    if (fExec)
  ------------------
  |  Branch (618:25): [True: 26.3k, False: 91.9k]
  ------------------
  619|  26.3k|                    {
  620|  26.3k|                        if (stack.size() < 1)
  ------------------
  |  Branch (620:29): [True: 597, False: 25.7k]
  ------------------
  621|    597|                            return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  622|  25.7k|                        valtype& vch = stacktop(-1);
  ------------------
  |  |   65|  25.7k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  623|       |                        // Tapscript requires minimal IF/NOTIF inputs as a consensus rule.
  624|  25.7k|                        if (sigversion == SigVersion::TAPSCRIPT) {
  ------------------
  |  Branch (624:29): [True: 0, False: 25.7k]
  ------------------
  625|       |                            // The input argument to the OP_IF and OP_NOTIF opcodes must be either
  626|       |                            // exactly 0 (the empty vector) or exactly 1 (the one-byte vector with value 1).
  627|      0|                            if (vch.size() > 1 || (vch.size() == 1 && vch[0] != 1)) {
  ------------------
  |  Branch (627:33): [True: 0, False: 0]
  |  Branch (627:52): [True: 0, False: 0]
  |  Branch (627:71): [True: 0, False: 0]
  ------------------
  628|      0|                                return set_error(serror, SCRIPT_ERR_TAPSCRIPT_MINIMALIF);
  629|      0|                            }
  630|      0|                        }
  631|       |                        // Under witness v0 rules it is only a policy rule, enabled through SCRIPT_VERIFY_MINIMALIF.
  632|  25.7k|                        if (sigversion == SigVersion::WITNESS_V0 && (flags & SCRIPT_VERIFY_MINIMALIF)) {
  ------------------
  |  Branch (632:29): [True: 34, False: 25.6k]
  |  Branch (632:29): [True: 34, False: 25.6k]
  |  Branch (632:69): [True: 34, False: 0]
  ------------------
  633|     34|                            if (vch.size() > 1)
  ------------------
  |  Branch (633:33): [True: 4, False: 30]
  ------------------
  634|      4|                                return set_error(serror, SCRIPT_ERR_MINIMALIF);
  635|     30|                            if (vch.size() == 1 && vch[0] != 1)
  ------------------
  |  Branch (635:33): [True: 27, False: 3]
  |  Branch (635:52): [True: 24, False: 3]
  ------------------
  636|     24|                                return set_error(serror, SCRIPT_ERR_MINIMALIF);
  637|     30|                        }
  638|  25.6k|                        fValue = CastToBool(vch);
  639|  25.6k|                        if (opcode == OP_NOTIF)
  ------------------
  |  Branch (639:29): [True: 22.4k, False: 3.23k]
  ------------------
  640|  22.4k|                            fValue = !fValue;
  641|  25.6k|                        popstack(stack);
  642|  25.6k|                    }
  643|   117k|                    vfExec.push_back(fValue);
  644|   117k|                }
  645|      0|                break;
  646|       |
  647|  2.54k|                case OP_ELSE:
  ------------------
  |  Branch (647:17): [True: 2.54k, False: 2.01M]
  ------------------
  648|  2.54k|                {
  649|  2.54k|                    if (vfExec.empty())
  ------------------
  |  Branch (649:25): [True: 471, False: 2.07k]
  ------------------
  650|    471|                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
  651|  2.07k|                    vfExec.toggle_top();
  652|  2.07k|                }
  653|      0|                break;
  654|       |
  655|  6.77k|                case OP_ENDIF:
  ------------------
  |  Branch (655:17): [True: 6.77k, False: 2.00M]
  ------------------
  656|  6.77k|                {
  657|  6.77k|                    if (vfExec.empty())
  ------------------
  |  Branch (657:25): [True: 801, False: 5.97k]
  ------------------
  658|    801|                        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
  659|  5.97k|                    vfExec.pop_back();
  660|  5.97k|                }
  661|      0|                break;
  662|       |
  663|  1.78k|                case OP_VERIFY:
  ------------------
  |  Branch (663:17): [True: 1.78k, False: 2.01M]
  ------------------
  664|  1.78k|                {
  665|       |                    // (true -- ) or
  666|       |                    // (false -- false) and return
  667|  1.78k|                    if (stack.size() < 1)
  ------------------
  |  Branch (667:25): [True: 492, False: 1.29k]
  ------------------
  668|    492|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  669|  1.29k|                    bool fValue = CastToBool(stacktop(-1));
  ------------------
  |  |   65|  1.29k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  670|  1.29k|                    if (fValue)
  ------------------
  |  Branch (670:25): [True: 737, False: 557]
  ------------------
  671|    737|                        popstack(stack);
  672|    557|                    else
  673|    557|                        return set_error(serror, SCRIPT_ERR_VERIFY);
  674|  1.29k|                }
  675|    737|                break;
  676|       |
  677|  1.80k|                case OP_RETURN:
  ------------------
  |  Branch (677:17): [True: 1.80k, False: 2.01M]
  ------------------
  678|  1.80k|                {
  679|  1.80k|                    return set_error(serror, SCRIPT_ERR_OP_RETURN);
  680|  1.29k|                }
  681|      0|                break;
  682|       |
  683|       |
  684|       |                //
  685|       |                // Stack ops
  686|       |                //
  687|  16.2k|                case OP_TOALTSTACK:
  ------------------
  |  Branch (687:17): [True: 16.2k, False: 1.99M]
  ------------------
  688|  16.2k|                {
  689|  16.2k|                    if (stack.size() < 1)
  ------------------
  |  Branch (689:25): [True: 707, False: 15.5k]
  ------------------
  690|    707|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  691|  15.5k|                    altstack.push_back(stacktop(-1));
  ------------------
  |  |   65|  15.5k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  692|  15.5k|                    popstack(stack);
  693|  15.5k|                }
  694|      0|                break;
  695|       |
  696|  2.41k|                case OP_FROMALTSTACK:
  ------------------
  |  Branch (696:17): [True: 2.41k, False: 2.01M]
  ------------------
  697|  2.41k|                {
  698|  2.41k|                    if (altstack.size() < 1)
  ------------------
  |  Branch (698:25): [True: 454, False: 1.96k]
  ------------------
  699|    454|                        return set_error(serror, SCRIPT_ERR_INVALID_ALTSTACK_OPERATION);
  700|  1.96k|                    stack.push_back(altstacktop(-1));
  ------------------
  |  |   66|  1.96k|#define altstacktop(i) (altstack.at(size_t(int64_t(altstack.size()) + int64_t{i})))
  ------------------
  701|  1.96k|                    popstack(altstack);
  702|  1.96k|                }
  703|      0|                break;
  704|       |
  705|    877|                case OP_2DROP:
  ------------------
  |  Branch (705:17): [True: 877, False: 2.01M]
  ------------------
  706|    877|                {
  707|       |                    // (x1 x2 -- )
  708|    877|                    if (stack.size() < 2)
  ------------------
  |  Branch (708:25): [True: 403, False: 474]
  ------------------
  709|    403|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  710|    474|                    popstack(stack);
  711|    474|                    popstack(stack);
  712|    474|                }
  713|      0|                break;
  714|       |
  715|  4.62k|                case OP_2DUP:
  ------------------
  |  Branch (715:17): [True: 4.62k, False: 2.00M]
  ------------------
  716|  4.62k|                {
  717|       |                    // (x1 x2 -- x1 x2 x1 x2)
  718|  4.62k|                    if (stack.size() < 2)
  ------------------
  |  Branch (718:25): [True: 396, False: 4.23k]
  ------------------
  719|    396|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  720|  4.23k|                    valtype vch1 = stacktop(-2);
  ------------------
  |  |   65|  4.23k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  721|  4.23k|                    valtype vch2 = stacktop(-1);
  ------------------
  |  |   65|  4.23k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  722|  4.23k|                    stack.push_back(vch1);
  723|  4.23k|                    stack.push_back(vch2);
  724|  4.23k|                }
  725|      0|                break;
  726|       |
  727|  6.34k|                case OP_3DUP:
  ------------------
  |  Branch (727:17): [True: 6.34k, False: 2.00M]
  ------------------
  728|  6.34k|                {
  729|       |                    // (x1 x2 x3 -- x1 x2 x3 x1 x2 x3)
  730|  6.34k|                    if (stack.size() < 3)
  ------------------
  |  Branch (730:25): [True: 405, False: 5.93k]
  ------------------
  731|    405|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  732|  5.93k|                    valtype vch1 = stacktop(-3);
  ------------------
  |  |   65|  5.93k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  733|  5.93k|                    valtype vch2 = stacktop(-2);
  ------------------
  |  |   65|  5.93k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  734|  5.93k|                    valtype vch3 = stacktop(-1);
  ------------------
  |  |   65|  5.93k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  735|  5.93k|                    stack.push_back(vch1);
  736|  5.93k|                    stack.push_back(vch2);
  737|  5.93k|                    stack.push_back(vch3);
  738|  5.93k|                }
  739|      0|                break;
  740|       |
  741|  6.71k|                case OP_2OVER:
  ------------------
  |  Branch (741:17): [True: 6.71k, False: 2.00M]
  ------------------
  742|  6.71k|                {
  743|       |                    // (x1 x2 x3 x4 -- x1 x2 x3 x4 x1 x2)
  744|  6.71k|                    if (stack.size() < 4)
  ------------------
  |  Branch (744:25): [True: 483, False: 6.23k]
  ------------------
  745|    483|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  746|  6.23k|                    valtype vch1 = stacktop(-4);
  ------------------
  |  |   65|  6.23k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  747|  6.23k|                    valtype vch2 = stacktop(-3);
  ------------------
  |  |   65|  6.23k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  748|  6.23k|                    stack.push_back(vch1);
  749|  6.23k|                    stack.push_back(vch2);
  750|  6.23k|                }
  751|      0|                break;
  752|       |
  753|  48.1k|                case OP_2ROT:
  ------------------
  |  Branch (753:17): [True: 48.1k, False: 1.96M]
  ------------------
  754|  48.1k|                {
  755|       |                    // (x1 x2 x3 x4 x5 x6 -- x3 x4 x5 x6 x1 x2)
  756|  48.1k|                    if (stack.size() < 6)
  ------------------
  |  Branch (756:25): [True: 538, False: 47.5k]
  ------------------
  757|    538|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  758|  47.5k|                    valtype vch1 = stacktop(-6);
  ------------------
  |  |   65|  47.5k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  759|  47.5k|                    valtype vch2 = stacktop(-5);
  ------------------
  |  |   65|  47.5k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  760|  47.5k|                    stack.erase(stack.end()-6, stack.end()-4);
  761|  47.5k|                    stack.push_back(vch1);
  762|  47.5k|                    stack.push_back(vch2);
  763|  47.5k|                }
  764|      0|                break;
  765|       |
  766|  12.1k|                case OP_2SWAP:
  ------------------
  |  Branch (766:17): [True: 12.1k, False: 2.00M]
  ------------------
  767|  12.1k|                {
  768|       |                    // (x1 x2 x3 x4 -- x3 x4 x1 x2)
  769|  12.1k|                    if (stack.size() < 4)
  ------------------
  |  Branch (769:25): [True: 405, False: 11.7k]
  ------------------
  770|    405|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  771|  11.7k|                    swap(stacktop(-4), stacktop(-2));
  ------------------
  |  |   65|  11.7k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-4), stacktop(-2));
  ------------------
  |  |   65|  11.7k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  772|  11.7k|                    swap(stacktop(-3), stacktop(-1));
  ------------------
  |  |   65|  11.7k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-3), stacktop(-1));
  ------------------
  |  |   65|  11.7k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  773|  11.7k|                }
  774|      0|                break;
  775|       |
  776|  4.64k|                case OP_IFDUP:
  ------------------
  |  Branch (776:17): [True: 4.64k, False: 2.00M]
  ------------------
  777|  4.64k|                {
  778|       |                    // (x - 0 | x x)
  779|  4.64k|                    if (stack.size() < 1)
  ------------------
  |  Branch (779:25): [True: 406, False: 4.23k]
  ------------------
  780|    406|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  781|  4.23k|                    valtype vch = stacktop(-1);
  ------------------
  |  |   65|  4.23k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  782|  4.23k|                    if (CastToBool(vch))
  ------------------
  |  Branch (782:25): [True: 2.44k, False: 1.79k]
  ------------------
  783|  2.44k|                        stack.push_back(vch);
  784|  4.23k|                }
  785|      0|                break;
  786|       |
  787|  12.8k|                case OP_DEPTH:
  ------------------
  |  Branch (787:17): [True: 12.8k, False: 2.00M]
  ------------------
  788|  12.8k|                {
  789|       |                    // -- stacksize
  790|  12.8k|                    CScriptNum bn(stack.size());
  791|  12.8k|                    stack.push_back(bn.getvch());
  792|  12.8k|                }
  793|  12.8k|                break;
  794|       |
  795|  2.05k|                case OP_DROP:
  ------------------
  |  Branch (795:17): [True: 2.05k, False: 2.01M]
  ------------------
  796|  2.05k|                {
  797|       |                    // (x -- )
  798|  2.05k|                    if (stack.size() < 1)
  ------------------
  |  Branch (798:25): [True: 800, False: 1.25k]
  ------------------
  799|    800|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  800|  1.25k|                    popstack(stack);
  801|  1.25k|                }
  802|      0|                break;
  803|       |
  804|  92.5k|                case OP_DUP:
  ------------------
  |  Branch (804:17): [True: 92.5k, False: 1.92M]
  ------------------
  805|  92.5k|                {
  806|       |                    // (x -- x x)
  807|  92.5k|                    if (stack.size() < 1)
  ------------------
  |  Branch (807:25): [True: 28.8k, False: 63.6k]
  ------------------
  808|  28.8k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  809|  63.6k|                    valtype vch = stacktop(-1);
  ------------------
  |  |   65|  63.6k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  810|  63.6k|                    stack.push_back(vch);
  811|  63.6k|                }
  812|      0|                break;
  813|       |
  814|  7.79k|                case OP_NIP:
  ------------------
  |  Branch (814:17): [True: 7.79k, False: 2.00M]
  ------------------
  815|  7.79k|                {
  816|       |                    // (x1 x2 -- x2)
  817|  7.79k|                    if (stack.size() < 2)
  ------------------
  |  Branch (817:25): [True: 420, False: 7.37k]
  ------------------
  818|    420|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  819|  7.37k|                    stack.erase(stack.end() - 2);
  820|  7.37k|                }
  821|      0|                break;
  822|       |
  823|  6.37k|                case OP_OVER:
  ------------------
  |  Branch (823:17): [True: 6.37k, False: 2.00M]
  ------------------
  824|  6.37k|                {
  825|       |                    // (x1 x2 -- x1 x2 x1)
  826|  6.37k|                    if (stack.size() < 2)
  ------------------
  |  Branch (826:25): [True: 534, False: 5.83k]
  ------------------
  827|    534|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  828|  5.83k|                    valtype vch = stacktop(-2);
  ------------------
  |  |   65|  5.83k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  829|  5.83k|                    stack.push_back(vch);
  830|  5.83k|                }
  831|      0|                break;
  832|       |
  833|  1.00k|                case OP_PICK:
  ------------------
  |  Branch (833:17): [True: 1.00k, False: 2.01M]
  ------------------
  834|  4.36k|                case OP_ROLL:
  ------------------
  |  Branch (834:17): [True: 3.36k, False: 2.01M]
  ------------------
  835|  4.36k|                {
  836|       |                    // (xn ... x2 x1 x0 n - xn ... x2 x1 x0 xn)
  837|       |                    // (xn ... x2 x1 x0 n - ... x2 x1 x0 xn)
  838|  4.36k|                    if (stack.size() < 2)
  ------------------
  |  Branch (838:25): [True: 516, False: 3.85k]
  ------------------
  839|    516|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  840|  3.85k|                    int n = CScriptNum(stacktop(-1), fRequireMinimal).getint();
  ------------------
  |  |   65|  3.85k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  841|  3.85k|                    popstack(stack);
  842|  3.85k|                    if (n < 0 || n >= (int)stack.size())
  ------------------
  |  Branch (842:25): [True: 608, False: 3.24k]
  |  Branch (842:34): [True: 606, False: 2.63k]
  ------------------
  843|    997|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  844|  2.85k|                    valtype vch = stacktop(-n-1);
  ------------------
  |  |   65|  2.85k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  845|  2.85k|                    if (opcode == OP_ROLL)
  ------------------
  |  Branch (845:25): [True: 1.94k, False: 908]
  ------------------
  846|  1.94k|                        stack.erase(stack.end()-n-1);
  847|  2.85k|                    stack.push_back(vch);
  848|  2.85k|                }
  849|      0|                break;
  850|       |
  851|  2.53k|                case OP_ROT:
  ------------------
  |  Branch (851:17): [True: 2.53k, False: 2.01M]
  ------------------
  852|  2.53k|                {
  853|       |                    // (x1 x2 x3 -- x2 x3 x1)
  854|       |                    //  x2 x1 x3  after first swap
  855|       |                    //  x2 x3 x1  after second swap
  856|  2.53k|                    if (stack.size() < 3)
  ------------------
  |  Branch (856:25): [True: 398, False: 2.14k]
  ------------------
  857|    398|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  858|  2.14k|                    swap(stacktop(-3), stacktop(-2));
  ------------------
  |  |   65|  2.14k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-3), stacktop(-2));
  ------------------
  |  |   65|  2.14k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  859|  2.14k|                    swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   65|  2.14k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   65|  2.14k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  860|  2.14k|                }
  861|      0|                break;
  862|       |
  863|  2.55k|                case OP_SWAP:
  ------------------
  |  Branch (863:17): [True: 2.55k, False: 2.01M]
  ------------------
  864|  2.55k|                {
  865|       |                    // (x1 x2 -- x2 x1)
  866|  2.55k|                    if (stack.size() < 2)
  ------------------
  |  Branch (866:25): [True: 757, False: 1.79k]
  ------------------
  867|    757|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  868|  1.79k|                    swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   65|  1.79k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
                                  swap(stacktop(-2), stacktop(-1));
  ------------------
  |  |   65|  1.79k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  869|  1.79k|                }
  870|      0|                break;
  871|       |
  872|  12.3k|                case OP_TUCK:
  ------------------
  |  Branch (872:17): [True: 12.3k, False: 2.00M]
  ------------------
  873|  12.3k|                {
  874|       |                    // (x1 x2 -- x2 x1 x2)
  875|  12.3k|                    if (stack.size() < 2)
  ------------------
  |  Branch (875:25): [True: 407, False: 11.9k]
  ------------------
  876|    407|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  877|  11.9k|                    valtype vch = stacktop(-1);
  ------------------
  |  |   65|  11.9k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  878|  11.9k|                    stack.insert(stack.end()-2, vch);
  879|  11.9k|                }
  880|      0|                break;
  881|       |
  882|       |
  883|  2.93k|                case OP_SIZE:
  ------------------
  |  Branch (883:17): [True: 2.93k, False: 2.01M]
  ------------------
  884|  2.93k|                {
  885|       |                    // (in -- in size)
  886|  2.93k|                    if (stack.size() < 1)
  ------------------
  |  Branch (886:25): [True: 397, False: 2.54k]
  ------------------
  887|    397|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  888|  2.54k|                    CScriptNum bn(stacktop(-1).size());
  ------------------
  |  |   65|  2.54k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  889|  2.54k|                    stack.push_back(bn.getvch());
  890|  2.54k|                }
  891|      0|                break;
  892|       |
  893|       |
  894|       |                //
  895|       |                // Bitwise logic
  896|       |                //
  897|  32.7k|                case OP_EQUAL:
  ------------------
  |  Branch (897:17): [True: 32.7k, False: 1.98M]
  ------------------
  898|  94.8k|                case OP_EQUALVERIFY:
  ------------------
  |  Branch (898:17): [True: 62.0k, False: 1.95M]
  ------------------
  899|       |                //case OP_NOTEQUAL: // use OP_NUMNOTEQUAL
  900|  94.8k|                {
  901|       |                    // (x1 x2 - bool)
  902|  94.8k|                    if (stack.size() < 2)
  ------------------
  |  Branch (902:25): [True: 430, False: 94.4k]
  ------------------
  903|    430|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  904|  94.4k|                    valtype& vch1 = stacktop(-2);
  ------------------
  |  |   65|  94.4k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  905|  94.4k|                    valtype& vch2 = stacktop(-1);
  ------------------
  |  |   65|  94.4k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  906|  94.4k|                    bool fEqual = (vch1 == vch2);
  907|       |                    // OP_NOTEQUAL is disabled because it would be too easy to say
  908|       |                    // something like n != 1 and have some wiseguy pass in 1 with extra
  909|       |                    // zero bytes after it (numerically, 0x01 == 0x0001 == 0x000001)
  910|       |                    //if (opcode == OP_NOTEQUAL)
  911|       |                    //    fEqual = !fEqual;
  912|  94.4k|                    popstack(stack);
  913|  94.4k|                    popstack(stack);
  914|  94.4k|                    stack.push_back(fEqual ? vchTrue : vchFalse);
  ------------------
  |  Branch (914:37): [True: 84.9k, False: 9.50k]
  ------------------
  915|  94.4k|                    if (opcode == OP_EQUALVERIFY)
  ------------------
  |  Branch (915:25): [True: 61.9k, False: 32.4k]
  ------------------
  916|  61.9k|                    {
  917|  61.9k|                        if (fEqual)
  ------------------
  |  Branch (917:29): [True: 61.3k, False: 647]
  ------------------
  918|  61.3k|                            popstack(stack);
  919|    647|                        else
  920|    647|                            return set_error(serror, SCRIPT_ERR_EQUALVERIFY);
  921|  61.9k|                    }
  922|  94.4k|                }
  923|  93.7k|                break;
  924|       |
  925|       |
  926|       |                //
  927|       |                // Numeric
  928|       |                //
  929|  93.7k|                case OP_1ADD:
  ------------------
  |  Branch (929:17): [True: 4.61k, False: 2.00M]
  ------------------
  930|  12.0k|                case OP_1SUB:
  ------------------
  |  Branch (930:17): [True: 7.46k, False: 2.00M]
  ------------------
  931|  14.1k|                case OP_NEGATE:
  ------------------
  |  Branch (931:17): [True: 2.09k, False: 2.01M]
  ------------------
  932|  25.4k|                case OP_ABS:
  ------------------
  |  Branch (932:17): [True: 11.2k, False: 2.00M]
  ------------------
  933|  30.9k|                case OP_NOT:
  ------------------
  |  Branch (933:17): [True: 5.55k, False: 2.00M]
  ------------------
  934|  58.2k|                case OP_0NOTEQUAL:
  ------------------
  |  Branch (934:17): [True: 27.2k, False: 1.98M]
  ------------------
  935|  58.2k|                {
  936|       |                    // (in -- out)
  937|  58.2k|                    if (stack.size() < 1)
  ------------------
  |  Branch (937:25): [True: 405, False: 57.8k]
  ------------------
  938|    405|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  939|  57.8k|                    CScriptNum bn(stacktop(-1), fRequireMinimal);
  ------------------
  |  |   65|  57.8k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  940|  57.8k|                    switch (opcode)
  941|  57.8k|                    {
  942|  4.57k|                    case OP_1ADD:       bn += bnOne; break;
  ------------------
  |  Branch (942:21): [True: 4.57k, False: 53.2k]
  ------------------
  943|  7.30k|                    case OP_1SUB:       bn -= bnOne; break;
  ------------------
  |  Branch (943:21): [True: 7.30k, False: 50.5k]
  ------------------
  944|  1.82k|                    case OP_NEGATE:     bn = -bn; break;
  ------------------
  |  Branch (944:21): [True: 1.82k, False: 56.0k]
  ------------------
  945|  11.2k|                    case OP_ABS:        if (bn < bnZero) bn = -bn; break;
  ------------------
  |  Branch (945:21): [True: 11.2k, False: 46.6k]
  |  Branch (945:45): [True: 997, False: 10.2k]
  ------------------
  946|  5.47k|                    case OP_NOT:        bn = (bn == bnZero); break;
  ------------------
  |  Branch (946:21): [True: 5.47k, False: 52.3k]
  ------------------
  947|  27.2k|                    case OP_0NOTEQUAL:  bn = (bn != bnZero); break;
  ------------------
  |  Branch (947:21): [True: 27.2k, False: 30.6k]
  ------------------
  948|      0|                    default:            assert(!"invalid opcode"); break;
  ------------------
  |  Branch (948:21): [True: 0, False: 57.8k]
  |  Branch (948:41): [Folded, False: 0]
  ------------------
  949|  57.8k|                    }
  950|  57.6k|                    popstack(stack);
  951|  57.6k|                    stack.push_back(bn.getvch());
  952|  57.6k|                }
  953|      0|                break;
  954|       |
  955|    510|                case OP_ADD:
  ------------------
  |  Branch (955:17): [True: 510, False: 2.01M]
  ------------------
  956|  3.21k|                case OP_SUB:
  ------------------
  |  Branch (956:17): [True: 2.70k, False: 2.01M]
  ------------------
  957|  5.31k|                case OP_BOOLAND:
  ------------------
  |  Branch (957:17): [True: 2.10k, False: 2.01M]
  ------------------
  958|  6.94k|                case OP_BOOLOR:
  ------------------
  |  Branch (958:17): [True: 1.62k, False: 2.01M]
  ------------------
  959|  7.51k|                case OP_NUMEQUAL:
  ------------------
  |  Branch (959:17): [True: 575, False: 2.01M]
  ------------------
  960|  8.63k|                case OP_NUMEQUALVERIFY:
  ------------------
  |  Branch (960:17): [True: 1.11k, False: 2.01M]
  ------------------
  961|  12.0k|                case OP_NUMNOTEQUAL:
  ------------------
  |  Branch (961:17): [True: 3.45k, False: 2.00M]
  ------------------
  962|  13.7k|                case OP_LESSTHAN:
  ------------------
  |  Branch (962:17): [True: 1.71k, False: 2.01M]
  ------------------
  963|  15.5k|                case OP_GREATERTHAN:
  ------------------
  |  Branch (963:17): [True: 1.75k, False: 2.01M]
  ------------------
  964|  20.4k|                case OP_LESSTHANOREQUAL:
  ------------------
  |  Branch (964:17): [True: 4.89k, False: 2.00M]
  ------------------
  965|  24.5k|                case OP_GREATERTHANOREQUAL:
  ------------------
  |  Branch (965:17): [True: 4.06k, False: 2.00M]
  ------------------
  966|  29.9k|                case OP_MIN:
  ------------------
  |  Branch (966:17): [True: 5.49k, False: 2.00M]
  ------------------
  967|  32.5k|                case OP_MAX:
  ------------------
  |  Branch (967:17): [True: 2.56k, False: 2.01M]
  ------------------
  968|  32.5k|                {
  969|       |                    // (x1 x2 -- out)
  970|  32.5k|                    if (stack.size() < 2)
  ------------------
  |  Branch (970:25): [True: 668, False: 31.9k]
  ------------------
  971|    668|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  972|  31.9k|                    CScriptNum bn1(stacktop(-2), fRequireMinimal);
  ------------------
  |  |   65|  31.9k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  973|  31.9k|                    CScriptNum bn2(stacktop(-1), fRequireMinimal);
  ------------------
  |  |   65|  31.9k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  974|  31.9k|                    CScriptNum bn(0);
  975|  31.9k|                    switch (opcode)
  976|  31.9k|                    {
  977|    484|                    case OP_ADD:
  ------------------
  |  Branch (977:21): [True: 484, False: 31.4k]
  ------------------
  978|    484|                        bn = bn1 + bn2;
  979|    484|                        break;
  980|       |
  981|  2.65k|                    case OP_SUB:
  ------------------
  |  Branch (981:21): [True: 2.65k, False: 29.2k]
  ------------------
  982|  2.65k|                        bn = bn1 - bn2;
  983|  2.65k|                        break;
  984|       |
  985|  2.06k|                    case OP_BOOLAND:             bn = (bn1 != bnZero && bn2 != bnZero); break;
  ------------------
  |  Branch (985:21): [True: 2.06k, False: 29.8k]
  |  Branch (985:56): [True: 880, False: 1.18k]
  |  Branch (985:73): [True: 572, False: 308]
  ------------------
  986|  1.56k|                    case OP_BOOLOR:              bn = (bn1 != bnZero || bn2 != bnZero); break;
  ------------------
  |  Branch (986:21): [True: 1.56k, False: 30.3k]
  |  Branch (986:56): [True: 988, False: 580]
  |  Branch (986:73): [True: 280, False: 300]
  ------------------
  987|    567|                    case OP_NUMEQUAL:            bn = (bn1 == bn2); break;
  ------------------
  |  Branch (987:21): [True: 567, False: 31.3k]
  ------------------
  988|  1.09k|                    case OP_NUMEQUALVERIFY:      bn = (bn1 == bn2); break;
  ------------------
  |  Branch (988:21): [True: 1.09k, False: 30.8k]
  ------------------
  989|  3.43k|                    case OP_NUMNOTEQUAL:         bn = (bn1 != bn2); break;
  ------------------
  |  Branch (989:21): [True: 3.43k, False: 28.4k]
  ------------------
  990|  1.32k|                    case OP_LESSTHAN:            bn = (bn1 < bn2); break;
  ------------------
  |  Branch (990:21): [True: 1.32k, False: 30.5k]
  ------------------
  991|  1.70k|                    case OP_GREATERTHAN:         bn = (bn1 > bn2); break;
  ------------------
  |  Branch (991:21): [True: 1.70k, False: 30.1k]
  ------------------
  992|  4.70k|                    case OP_LESSTHANOREQUAL:     bn = (bn1 <= bn2); break;
  ------------------
  |  Branch (992:21): [True: 4.70k, False: 27.1k]
  ------------------
  993|  3.58k|                    case OP_GREATERTHANOREQUAL:  bn = (bn1 >= bn2); break;
  ------------------
  |  Branch (993:21): [True: 3.58k, False: 28.3k]
  ------------------
  994|  5.43k|                    case OP_MIN:                 bn = (bn1 < bn2 ? bn1 : bn2); break;
  ------------------
  |  Branch (994:21): [True: 5.43k, False: 26.4k]
  |  Branch (994:56): [True: 1.14k, False: 4.28k]
  ------------------
  995|  2.42k|                    case OP_MAX:                 bn = (bn1 > bn2 ? bn1 : bn2); break;
  ------------------
  |  Branch (995:21): [True: 2.42k, False: 29.4k]
  |  Branch (995:56): [True: 480, False: 1.94k]
  ------------------
  996|      0|                    default:                     assert(!"invalid opcode"); break;
  ------------------
  |  Branch (996:21): [True: 0, False: 31.9k]
  |  Branch (996:50): [Folded, False: 0]
  ------------------
  997|  31.9k|                    }
  998|  31.0k|                    popstack(stack);
  999|  31.0k|                    popstack(stack);
 1000|  31.0k|                    stack.push_back(bn.getvch());
 1001|       |
 1002|  31.0k|                    if (opcode == OP_NUMEQUALVERIFY)
  ------------------
  |  Branch (1002:25): [True: 1.09k, False: 29.9k]
  ------------------
 1003|  1.09k|                    {
 1004|  1.09k|                        if (CastToBool(stacktop(-1)))
  ------------------
  |  |   65|  1.09k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  |  Branch (1004:29): [True: 487, False: 607]
  ------------------
 1005|    487|                            popstack(stack);
 1006|    607|                        else
 1007|    607|                            return set_error(serror, SCRIPT_ERR_NUMEQUALVERIFY);
 1008|  1.09k|                    }
 1009|  31.0k|                }
 1010|  30.4k|                break;
 1011|       |
 1012|  30.4k|                case OP_WITHIN:
  ------------------
  |  Branch (1012:17): [True: 10.6k, False: 2.00M]
  ------------------
 1013|  10.6k|                {
 1014|       |                    // (x min max -- out)
 1015|  10.6k|                    if (stack.size() < 3)
  ------------------
  |  Branch (1015:25): [True: 427, False: 10.1k]
  ------------------
 1016|    427|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1017|  10.1k|                    CScriptNum bn1(stacktop(-3), fRequireMinimal);
  ------------------
  |  |   65|  10.1k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1018|  10.1k|                    CScriptNum bn2(stacktop(-2), fRequireMinimal);
  ------------------
  |  |   65|  10.1k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1019|  10.1k|                    CScriptNum bn3(stacktop(-1), fRequireMinimal);
  ------------------
  |  |   65|  10.1k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1020|  10.1k|                    bool fValue = (bn2 <= bn1 && bn1 < bn3);
  ------------------
  |  Branch (1020:36): [True: 7.44k, False: 2.75k]
  |  Branch (1020:50): [True: 1.52k, False: 5.91k]
  ------------------
 1021|  10.1k|                    popstack(stack);
 1022|  10.1k|                    popstack(stack);
 1023|  10.1k|                    popstack(stack);
 1024|  10.1k|                    stack.push_back(fValue ? vchTrue : vchFalse);
  ------------------
  |  Branch (1024:37): [True: 1.52k, False: 8.66k]
  ------------------
 1025|  10.1k|                }
 1026|      0|                break;
 1027|       |
 1028|       |
 1029|       |                //
 1030|       |                // Crypto
 1031|       |                //
 1032|  96.4k|                case OP_RIPEMD160:
  ------------------
  |  Branch (1032:17): [True: 96.4k, False: 1.91M]
  ------------------
 1033|   110k|                case OP_SHA1:
  ------------------
  |  Branch (1033:17): [True: 14.3k, False: 1.99M]
  ------------------
 1034|   114k|                case OP_SHA256:
  ------------------
  |  Branch (1034:17): [True: 3.47k, False: 2.00M]
  ------------------
 1035|   202k|                case OP_HASH160:
  ------------------
  |  Branch (1035:17): [True: 88.4k, False: 1.92M]
  ------------------
 1036|   206k|                case OP_HASH256:
  ------------------
  |  Branch (1036:17): [True: 3.90k, False: 2.00M]
  ------------------
 1037|   206k|                {
 1038|       |                    // (in -- hash)
 1039|   206k|                    if (stack.size() < 1)
  ------------------
  |  Branch (1039:25): [True: 11.2k, False: 195k]
  ------------------
 1040|  11.2k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1041|   195k|                    valtype& vch = stacktop(-1);
  ------------------
  |  |   65|   195k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1042|   195k|                    valtype vchHash((opcode == OP_RIPEMD160 || opcode == OP_SHA1 || opcode == OP_HASH160) ? 20 : 32);
  ------------------
  |  Branch (1042:38): [True: 96.4k, False: 98.8k]
  |  Branch (1042:64): [True: 14.3k, False: 84.5k]
  |  Branch (1042:85): [True: 77.1k, False: 7.37k]
  ------------------
 1043|   195k|                    if (opcode == OP_RIPEMD160)
  ------------------
  |  Branch (1043:25): [True: 96.4k, False: 98.8k]
  ------------------
 1044|  96.4k|                        CRIPEMD160().Write(vch.data(), vch.size()).Finalize(vchHash.data());
 1045|  98.8k|                    else if (opcode == OP_SHA1)
  ------------------
  |  Branch (1045:30): [True: 14.3k, False: 84.5k]
  ------------------
 1046|  14.3k|                        CSHA1().Write(vch.data(), vch.size()).Finalize(vchHash.data());
 1047|  84.5k|                    else if (opcode == OP_SHA256)
  ------------------
  |  Branch (1047:30): [True: 3.47k, False: 81.0k]
  ------------------
 1048|  3.47k|                        CSHA256().Write(vch.data(), vch.size()).Finalize(vchHash.data());
 1049|  81.0k|                    else if (opcode == OP_HASH160)
  ------------------
  |  Branch (1049:30): [True: 77.1k, False: 3.89k]
  ------------------
 1050|  77.1k|                        CHash160().Write(vch).Finalize(vchHash);
 1051|  3.89k|                    else if (opcode == OP_HASH256)
  ------------------
  |  Branch (1051:30): [True: 3.89k, False: 0]
  ------------------
 1052|  3.89k|                        CHash256().Write(vch).Finalize(vchHash);
 1053|   195k|                    popstack(stack);
 1054|   195k|                    stack.push_back(vchHash);
 1055|   195k|                }
 1056|      0|                break;
 1057|       |
 1058|    677|                case OP_CODESEPARATOR:
  ------------------
  |  Branch (1058:17): [True: 677, False: 2.01M]
  ------------------
 1059|    677|                {
 1060|       |                    // If SCRIPT_VERIFY_CONST_SCRIPTCODE flag is set, use of OP_CODESEPARATOR is rejected in pre-segwit
 1061|       |                    // script, even in an unexecuted branch (this is checked above the opcode case statement).
 1062|       |
 1063|       |                    // Hash starts after the code separator
 1064|    677|                    pbegincodehash = pc;
 1065|    677|                    execdata.m_codeseparator_pos = opcode_pos;
 1066|    677|                }
 1067|    677|                break;
 1068|       |
 1069|  67.7k|                case OP_CHECKSIG:
  ------------------
  |  Branch (1069:17): [True: 67.7k, False: 1.94M]
  ------------------
 1070|  71.5k|                case OP_CHECKSIGVERIFY:
  ------------------
  |  Branch (1070:17): [True: 3.74k, False: 2.00M]
  ------------------
 1071|  71.5k|                {
 1072|       |                    // (sig pubkey -- bool)
 1073|  71.5k|                    if (stack.size() < 2)
  ------------------
  |  Branch (1073:25): [True: 5.04k, False: 66.4k]
  ------------------
 1074|  5.04k|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1075|       |
 1076|  66.4k|                    valtype& vchSig    = stacktop(-2);
  ------------------
  |  |   65|  66.4k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1077|  66.4k|                    valtype& vchPubKey = stacktop(-1);
  ------------------
  |  |   65|  66.4k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1078|       |
 1079|  66.4k|                    bool fSuccess = true;
 1080|  66.4k|                    if (!EvalChecksig(vchSig, vchPubKey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, fSuccess)) return false;
  ------------------
  |  Branch (1080:25): [True: 64.8k, False: 1.59k]
  ------------------
 1081|  1.59k|                    popstack(stack);
 1082|  1.59k|                    popstack(stack);
 1083|  1.59k|                    stack.push_back(fSuccess ? vchTrue : vchFalse);
  ------------------
  |  Branch (1083:37): [True: 956, False: 634]
  ------------------
 1084|  1.59k|                    if (opcode == OP_CHECKSIGVERIFY)
  ------------------
  |  Branch (1084:25): [True: 552, False: 1.03k]
  ------------------
 1085|    552|                    {
 1086|    552|                        if (fSuccess)
  ------------------
  |  Branch (1086:29): [True: 0, False: 552]
  ------------------
 1087|      0|                            popstack(stack);
 1088|    552|                        else
 1089|    552|                            return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
 1090|    552|                    }
 1091|  1.59k|                }
 1092|  1.03k|                break;
 1093|       |
 1094|  1.03k|                case OP_CHECKSIGADD:
  ------------------
  |  Branch (1094:17): [True: 549, False: 2.01M]
  ------------------
 1095|    549|                {
 1096|       |                    // OP_CHECKSIGADD is only available in Tapscript
 1097|    549|                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
  ------------------
  |  Branch (1097:25): [True: 549, False: 0]
  |  Branch (1097:59): [True: 0, False: 0]
  ------------------
 1098|       |
 1099|       |                    // (sig num pubkey -- num)
 1100|      0|                    if (stack.size() < 3) return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
  ------------------
  |  Branch (1100:25): [True: 0, False: 0]
  ------------------
 1101|       |
 1102|      0|                    const valtype& sig = stacktop(-3);
  ------------------
  |  |   65|      0|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1103|      0|                    const CScriptNum num(stacktop(-2), fRequireMinimal);
  ------------------
  |  |   65|      0|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1104|      0|                    const valtype& pubkey = stacktop(-1);
  ------------------
  |  |   65|      0|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1105|       |
 1106|      0|                    bool success = true;
 1107|      0|                    if (!EvalChecksig(sig, pubkey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, success)) return false;
  ------------------
  |  Branch (1107:25): [True: 0, False: 0]
  ------------------
 1108|      0|                    popstack(stack);
 1109|      0|                    popstack(stack);
 1110|      0|                    popstack(stack);
 1111|      0|                    stack.push_back((num + (success ? 1 : 0)).getvch());
  ------------------
  |  Branch (1111:45): [True: 0, False: 0]
  ------------------
 1112|      0|                }
 1113|      0|                break;
 1114|       |
 1115|  29.3k|                case OP_CHECKMULTISIG:
  ------------------
  |  Branch (1115:17): [True: 29.3k, False: 1.98M]
  ------------------
 1116|  33.8k|                case OP_CHECKMULTISIGVERIFY:
  ------------------
  |  Branch (1116:17): [True: 4.44k, False: 2.00M]
  ------------------
 1117|  33.8k|                {
 1118|  33.8k|                    if (sigversion == SigVersion::TAPSCRIPT) return set_error(serror, SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG);
  ------------------
  |  Branch (1118:25): [True: 0, False: 33.8k]
  ------------------
 1119|       |
 1120|       |                    // ([sig ...] num_of_signatures [pubkey ...] num_of_pubkeys -- bool)
 1121|       |
 1122|  33.8k|                    int i = 1;
 1123|  33.8k|                    if ((int)stack.size() < i)
  ------------------
  |  Branch (1123:25): [True: 492, False: 33.3k]
  ------------------
 1124|    492|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1125|       |
 1126|  33.3k|                    int nKeysCount = CScriptNum(stacktop(-i), fRequireMinimal).getint();
  ------------------
  |  |   65|  33.3k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1127|  33.3k|                    if (nKeysCount < 0 || nKeysCount > MAX_PUBKEYS_PER_MULTISIG)
  ------------------
  |  Branch (1127:25): [True: 841, False: 32.5k]
  |  Branch (1127:43): [True: 651, False: 31.8k]
  ------------------
 1128|  1.24k|                        return set_error(serror, SCRIPT_ERR_PUBKEY_COUNT);
 1129|  32.1k|                    nOpCount += nKeysCount;
 1130|  32.1k|                    if (nOpCount > MAX_OPS_PER_SCRIPT)
  ------------------
  |  Branch (1130:25): [True: 486, False: 31.6k]
  ------------------
 1131|    486|                        return set_error(serror, SCRIPT_ERR_OP_COUNT);
 1132|  31.6k|                    int ikey = ++i;
 1133|       |                    // ikey2 is the position of last non-signature item in the stack. Top stack item = 1.
 1134|       |                    // With SCRIPT_VERIFY_NULLFAIL, this is used for cleanup if operation fails.
 1135|  31.6k|                    int ikey2 = nKeysCount + 2;
 1136|  31.6k|                    i += nKeysCount;
 1137|  31.6k|                    if ((int)stack.size() < i)
  ------------------
  |  Branch (1137:25): [True: 661, False: 30.9k]
  ------------------
 1138|    661|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1139|       |
 1140|  30.9k|                    int nSigsCount = CScriptNum(stacktop(-i), fRequireMinimal).getint();
  ------------------
  |  |   65|  30.9k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1141|  30.9k|                    if (nSigsCount < 0 || nSigsCount > nKeysCount)
  ------------------
  |  Branch (1141:25): [True: 951, False: 30.0k]
  |  Branch (1141:43): [True: 667, False: 29.3k]
  ------------------
 1142|  1.07k|                        return set_error(serror, SCRIPT_ERR_SIG_COUNT);
 1143|  29.8k|                    int isig = ++i;
 1144|  29.8k|                    i += nSigsCount;
 1145|  29.8k|                    if ((int)stack.size() < i)
  ------------------
  |  Branch (1145:25): [True: 546, False: 29.3k]
  ------------------
 1146|    546|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1147|       |
 1148|       |                    // Subset of script starting at the most recent codeseparator
 1149|  29.3k|                    CScript scriptCode(pbegincodehash, pend);
 1150|       |
 1151|       |                    // Drop the signature in pre-segwit scripts but not segwit scripts
 1152|  44.1k|                    for (int k = 0; k < nSigsCount; k++)
  ------------------
  |  Branch (1152:37): [True: 15.7k, False: 28.4k]
  ------------------
 1153|  15.7k|                    {
 1154|  15.7k|                        valtype& vchSig = stacktop(-isig-k);
  ------------------
  |  |   65|  15.7k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1155|  15.7k|                        if (sigversion == SigVersion::BASE) {
  ------------------
  |  Branch (1155:29): [True: 15.7k, False: 0]
  ------------------
 1156|  15.7k|                            int found = FindAndDelete(scriptCode, CScript() << vchSig);
 1157|  15.7k|                            if (found > 0 && (flags & SCRIPT_VERIFY_CONST_SCRIPTCODE))
  ------------------
  |  Branch (1157:33): [True: 983, False: 14.7k]
  |  Branch (1157:33): [True: 882, False: 14.8k]
  |  Branch (1157:46): [True: 882, False: 101]
  ------------------
 1158|    882|                                return set_error(serror, SCRIPT_ERR_SIG_FINDANDDELETE);
 1159|  15.7k|                        }
 1160|  15.7k|                    }
 1161|       |
 1162|  28.4k|                    bool fSuccess = true;
 1163|  30.9k|                    while (fSuccess && nSigsCount > 0)
  ------------------
  |  Branch (1163:28): [True: 29.1k, False: 1.76k]
  |  Branch (1163:40): [True: 4.85k, False: 24.2k]
  ------------------
 1164|  4.85k|                    {
 1165|  4.85k|                        valtype& vchSig    = stacktop(-isig);
  ------------------
  |  |   65|  4.85k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1166|  4.85k|                        valtype& vchPubKey = stacktop(-ikey);
  ------------------
  |  |   65|  4.85k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
 1167|       |
 1168|       |                        // Note how this makes the exact order of pubkey/signature evaluation
 1169|       |                        // distinguishable by CHECKMULTISIG NOT if the STRICTENC flag is set.
 1170|       |                        // See the script_(in)valid tests for details.
 1171|  4.85k|                        if (!CheckSignatureEncoding(vchSig, flags, serror) || !CheckPubKeyEncoding(vchPubKey, flags, sigversion, serror)) {
  ------------------
  |  Branch (1171:29): [True: 749, False: 4.10k]
  |  Branch (1171:79): [True: 1.66k, False: 2.44k]
  ------------------
 1172|       |                            // serror is set
 1173|  2.41k|                            return false;
 1174|  2.41k|                        }
 1175|       |
 1176|       |                        // Check signature
 1177|  2.44k|                        bool fOk = checker.CheckECDSASignature(vchSig, vchPubKey, scriptCode, sigversion);
 1178|       |
 1179|  2.44k|                        if (fOk) {
  ------------------
  |  Branch (1179:29): [True: 1.02k, False: 1.41k]
  ------------------
 1180|  1.02k|                            isig++;
 1181|  1.02k|                            nSigsCount--;
 1182|  1.02k|                        }
 1183|  2.44k|                        ikey++;
 1184|  2.44k|                        nKeysCount--;
 1185|       |
 1186|       |                        // If there are more signatures left than keys left,
 1187|       |                        // then too many signatures have failed. Exit early,
 1188|       |                        // without checking any further signatures.
 1189|  2.44k|                        if (nSigsCount > nKeysCount)
  ------------------
  |  Branch (1189:29): [True: 1.22k, False: 1.21k]
  ------------------
 1190|  1.22k|                            fSuccess = false;
 1191|  2.44k|                    }
 1192|       |
 1193|       |                    // Clean up stack of actual arguments
 1194|   109k|                    while (i-- > 1) {
  ------------------
  |  Branch (1194:28): [True: 84.6k, False: 25.1k]
  ------------------
 1195|       |                        // If the operation failed, we require that all signatures must be empty vector
 1196|  84.6k|                        if (!fSuccess && (flags & SCRIPT_VERIFY_NULLFAIL) && !ikey2 && stacktop(-1).size())
  ------------------
  |  |   65|  2.52k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  |  Branch (1196:29): [True: 10.0k, False: 74.5k]
  |  Branch (1196:29): [True: 923, False: 83.7k]
  |  Branch (1196:42): [True: 9.99k, False: 72]
  |  Branch (1196:78): [True: 2.52k, False: 7.46k]
  |  Branch (1196:88): [True: 923, False: 1.60k]
  ------------------
 1197|    923|                            return set_error(serror, SCRIPT_ERR_SIG_NULLFAIL);
 1198|  83.7k|                        if (ikey2 > 0)
  ------------------
  |  Branch (1198:29): [True: 81.4k, False: 2.23k]
  ------------------
 1199|  81.4k|                            ikey2--;
 1200|  83.7k|                        popstack(stack);
 1201|  83.7k|                    }
 1202|       |
 1203|       |                    // A bug causes CHECKMULTISIG to consume one extra argument
 1204|       |                    // whose contents were not checked in any way.
 1205|       |                    //
 1206|       |                    // Unfortunately this is a potential source of mutability,
 1207|       |                    // so optionally verify it is exactly equal to zero prior
 1208|       |                    // to removing it from the stack.
 1209|  25.1k|                    if (stack.size() < 1)
  ------------------
  |  Branch (1209:25): [True: 0, False: 25.1k]
  ------------------
 1210|      0|                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
 1211|  25.1k|                    if ((flags & SCRIPT_VERIFY_NULLDUMMY) && stacktop(-1).size())
  ------------------
  |  |   65|  23.9k|#define stacktop(i) (stack.at(size_t(int64_t(stack.size()) + int64_t{i})))
  ------------------
  |  Branch (1211:25): [True: 23.9k, False: 1.17k]
  |  Branch (1211:25): [True: 741, False: 24.3k]
  |  Branch (1211:62): [True: 741, False: 23.2k]
  ------------------
 1212|    741|                        return set_error(serror, SCRIPT_ERR_SIG_NULLDUMMY);
 1213|  24.3k|                    popstack(stack);
 1214|       |
 1215|  24.3k|                    stack.push_back(fSuccess ? vchTrue : vchFalse);
  ------------------
  |  Branch (1215:37): [True: 23.7k, False: 586]
  ------------------
 1216|       |
 1217|  24.3k|                    if (opcode == OP_CHECKMULTISIGVERIFY)
  ------------------
  |  Branch (1217:25): [True: 1.58k, False: 22.7k]
  ------------------
 1218|  1.58k|                    {
 1219|  1.58k|                        if (fSuccess)
  ------------------
  |  Branch (1219:29): [True: 1.54k, False: 39]
  ------------------
 1220|  1.54k|                            popstack(stack);
 1221|     39|                        else
 1222|     39|                            return set_error(serror, SCRIPT_ERR_CHECKMULTISIGVERIFY);
 1223|  1.58k|                    }
 1224|  24.3k|                }
 1225|  24.3k|                break;
 1226|       |
 1227|  24.3k|                default:
  ------------------
  |  Branch (1227:17): [True: 3.68k, False: 2.00M]
  ------------------
 1228|  3.68k|                    return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
 1229|  2.01M|            }
 1230|       |
 1231|       |            // Size limits
 1232|  10.9M|            if (stack.size() + altstack.size() > MAX_STACK_SIZE)
  ------------------
  |  Branch (1232:17): [True: 413, False: 10.9M]
  ------------------
 1233|    413|                return set_error(serror, SCRIPT_ERR_STACK_SIZE);
 1234|  10.9M|        }
 1235|   535k|    }
 1236|   535k|    catch (const scriptnum_error&)
 1237|   535k|    {
 1238|  2.85k|        return set_error(serror, SCRIPT_ERR_SCRIPTNUM);
 1239|  2.85k|    }
 1240|   535k|    catch (...)
 1241|   535k|    {
 1242|      0|        return set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
 1243|      0|    }
 1244|       |
 1245|   357k|    if (!vfExec.empty())
  ------------------
  |  Branch (1245:9): [True: 4.73k, False: 352k]
  ------------------
 1246|  4.73k|        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
 1247|       |
 1248|   352k|    return set_success(serror);
 1249|   357k|}
_Z10EvalScriptRNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEERK7CScript19script_verify_flagsRK20BaseSignatureChecker10SigVersionP13ScriptError_t:
 1252|   521k|{
 1253|   521k|    ScriptExecutionData execdata;
 1254|   521k|    return EvalScript(stack, script, flags, checker, sigversion, execdata, serror);
 1255|   521k|}
_ZN26PrecomputedTransactionData4InitI12CTransactionEEvRKT_ONSt3__16vectorI6CTxOutNS5_9allocatorIS7_EEEEb:
 1414|  7.72k|{
 1415|  7.72k|    assert(!m_spent_outputs_ready);
  ------------------
  |  Branch (1415:5): [True: 7.72k, False: 0]
  ------------------
 1416|       |
 1417|  7.72k|    m_spent_outputs = std::move(spent_outputs);
 1418|  7.72k|    if (!m_spent_outputs.empty()) {
  ------------------
  |  Branch (1418:9): [True: 1.51k, False: 6.20k]
  ------------------
 1419|  1.51k|        assert(m_spent_outputs.size() == txTo.vin.size());
  ------------------
  |  Branch (1419:9): [True: 1.51k, False: 0]
  ------------------
 1420|  1.51k|        m_spent_outputs_ready = true;
 1421|  1.51k|    }
 1422|       |
 1423|       |    // Determine which precomputation-impacting features this transaction uses.
 1424|  7.72k|    bool uses_bip143_segwit = force;
 1425|  7.72k|    bool uses_bip341_taproot = force;
 1426|  7.72k|    for (size_t inpos = 0; inpos < txTo.vin.size() && !(uses_bip143_segwit && uses_bip341_taproot); ++inpos) {
  ------------------
  |  Branch (1426:28): [True: 4.87k, False: 2.84k]
  |  Branch (1426:57): [True: 4.87k, False: 0]
  |  Branch (1426:79): [True: 4.87k, False: 0]
  ------------------
 1427|      0|        if (!txTo.vin[inpos].scriptWitness.IsNull()) {
  ------------------
  |  Branch (1427:13): [True: 0, False: 0]
  ------------------
 1428|      0|            if (m_spent_outputs_ready && m_spent_outputs[inpos].scriptPubKey.size() == 2 + WITNESS_V1_TAPROOT_SIZE &&
  ------------------
  |  Branch (1428:17): [True: 0, False: 0]
  |  Branch (1428:42): [True: 0, False: 0]
  ------------------
 1429|      0|                m_spent_outputs[inpos].scriptPubKey[0] == OP_1) {
  ------------------
  |  Branch (1429:17): [True: 0, False: 0]
  ------------------
 1430|       |                // Treat every witness-bearing spend with 34-byte scriptPubKey that starts with OP_1 as a Taproot
 1431|       |                // spend. This only works if spent_outputs was provided as well, but if it wasn't, actual validation
 1432|       |                // will fail anyway. Note that this branch may trigger for scriptPubKeys that aren't actually segwit
 1433|       |                // but in that case validation will fail as SCRIPT_ERR_WITNESS_UNEXPECTED anyway.
 1434|      0|                uses_bip341_taproot = true;
 1435|      0|            } else {
 1436|       |                // Treat every spend that's not known to native witness v1 as a Witness v0 spend. This branch may
 1437|       |                // also be taken for unknown witness versions, but it is harmless, and being precise would require
 1438|       |                // P2SH evaluation to find the redeemScript.
 1439|      0|                uses_bip143_segwit = true;
 1440|      0|            }
 1441|      0|        }
 1442|      0|        if (uses_bip341_taproot && uses_bip143_segwit) break; // No need to scan further if we already need all.
  ------------------
  |  Branch (1442:13): [True: 0, False: 0]
  |  Branch (1442:36): [True: 0, False: 0]
  ------------------
 1443|      0|    }
 1444|       |
 1445|  7.72k|    if (uses_bip143_segwit || uses_bip341_taproot) {
  ------------------
  |  Branch (1445:9): [True: 7.72k, False: 0]
  |  Branch (1445:31): [True: 0, False: 0]
  ------------------
 1446|       |        // Computations shared between both sighash schemes.
 1447|  7.72k|        m_prevouts_single_hash = GetPrevoutsSHA256(txTo);
 1448|  7.72k|        m_sequences_single_hash = GetSequencesSHA256(txTo);
 1449|  7.72k|        m_outputs_single_hash = GetOutputsSHA256(txTo);
 1450|  7.72k|    }
 1451|  7.72k|    if (uses_bip143_segwit) {
  ------------------
  |  Branch (1451:9): [True: 7.72k, False: 0]
  ------------------
 1452|  7.72k|        hashPrevouts = SHA256Uint256(m_prevouts_single_hash);
 1453|  7.72k|        hashSequence = SHA256Uint256(m_sequences_single_hash);
 1454|  7.72k|        hashOutputs = SHA256Uint256(m_outputs_single_hash);
 1455|  7.72k|        m_bip143_segwit_ready = true;
 1456|  7.72k|    }
 1457|  7.72k|    if (uses_bip341_taproot && m_spent_outputs_ready) {
  ------------------
  |  Branch (1457:9): [True: 7.72k, False: 0]
  |  Branch (1457:32): [True: 1.51k, False: 6.20k]
  ------------------
 1458|  1.51k|        m_spent_amounts_single_hash = GetSpentAmountsSHA256(m_spent_outputs);
 1459|  1.51k|        m_spent_scripts_single_hash = GetSpentScriptsSHA256(m_spent_outputs);
 1460|  1.51k|        m_bip341_taproot_ready = true;
 1461|  1.51k|    }
 1462|  7.72k|}
_ZNK12SigHashCache10CacheIndexEi:
 1583|  88.7k|{
 1584|       |    // Note that we do not distinguish between BASE and WITNESS_V0 to determine the cache index,
 1585|       |    // because no input can simultaneously use both.
 1586|  88.7k|    return 3 * !!(hash_type & SIGHASH_ANYONECANPAY) +
 1587|  88.7k|           2 * ((hash_type & 0x1f) == SIGHASH_SINGLE) +
 1588|  88.7k|           1 * ((hash_type & 0x1f) == SIGHASH_NONE);
 1589|  88.7k|}
_ZNK12SigHashCache4LoadEiRK7CScriptR10HashWriter:
 1592|  44.3k|{
 1593|  44.3k|    auto& entry = m_cache_entries[CacheIndex(hash_type)];
 1594|  44.3k|    if (entry.has_value()) {
  ------------------
  |  Branch (1594:9): [True: 0, False: 44.3k]
  ------------------
 1595|      0|        if (script_code == entry->first) {
  ------------------
  |  Branch (1595:13): [True: 0, False: 0]
  ------------------
 1596|      0|            writer = HashWriter(entry->second);
 1597|      0|            return true;
 1598|      0|        }
 1599|      0|    }
 1600|  44.3k|    return false;
 1601|  44.3k|}
_ZN12SigHashCache5StoreEiRK7CScriptRK10HashWriter:
 1604|  44.3k|{
 1605|  44.3k|    auto& entry = m_cache_entries[CacheIndex(hash_type)];
 1606|  44.3k|    entry.emplace(script_code, writer);
 1607|  44.3k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE20VerifyECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEERK7CPubKeyRK7uint256:
 1691|  21.8k|{
 1692|  21.8k|    return pubkey.Verify(sighash, vchSig);
 1693|  21.8k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE22VerifySchnorrSignatureENSt3__14spanIKhLm18446744073709551615EEERK11XOnlyPubKeyRK7uint256:
 1697|    315|{
 1698|    315|    return pubkey.VerifySchnorr(sighash, sig);
 1699|    315|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE19CheckECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEES8_RK7CScript10SigVersion:
 1703|  22.8k|{
 1704|  22.8k|    CPubKey pubkey(vchPubKey);
 1705|  22.8k|    if (!pubkey.IsValid())
  ------------------
  |  Branch (1705:9): [True: 0, False: 22.8k]
  ------------------
 1706|      0|        return false;
 1707|       |
 1708|       |    // Hash type is one byte tacked on to the end of the signature
 1709|  22.8k|    std::vector<unsigned char> vchSig(vchSigIn);
 1710|  22.8k|    if (vchSig.empty())
  ------------------
  |  Branch (1710:9): [True: 993, False: 21.8k]
  ------------------
 1711|    993|        return false;
 1712|  21.8k|    int nHashType = vchSig.back();
 1713|  21.8k|    vchSig.pop_back();
 1714|       |
 1715|       |    // Witness sighashes need the amount.
 1716|  21.8k|    if (sigversion == SigVersion::WITNESS_V0 && amount < 0) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1716:9): [True: 4.15k, False: 17.7k]
  |  Branch (1716:49): [True: 0, False: 4.15k]
  ------------------
 1717|       |
 1718|  21.8k|    uint256 sighash = SignatureHash(scriptCode, *txTo, nIn, nHashType, amount, sigversion, this->txdata, &m_sighash_cache);
 1719|       |
 1720|  21.8k|    if (!VerifyECDSASignature(vchSig, pubkey, sighash))
  ------------------
  |  Branch (1720:9): [True: 21.8k, False: 0]
  ------------------
 1721|  21.8k|        return false;
 1722|       |
 1723|      0|    return true;
 1724|  21.8k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE21CheckSchnorrSignatureENSt3__14spanIKhLm18446744073709551615EEES5_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
 1728|  1.22k|{
 1729|  1.22k|    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
  ------------------
  |  Branch (1729:5): [True: 1.22k, False: 0]
  |  Branch (1729:5): [True: 0, False: 0]
  |  Branch (1729:5): [True: 1.22k, False: 0]
  ------------------
 1730|       |    // Schnorr signatures have 32-byte public keys. The caller is responsible for enforcing this.
 1731|  1.22k|    assert(pubkey_in.size() == 32);
  ------------------
  |  Branch (1731:5): [True: 1.22k, False: 0]
  ------------------
 1732|       |    // Note that in Tapscript evaluation, empty signatures are treated specially (invalid signature that does not
 1733|       |    // abort script execution). This is implemented in EvalChecksigTapscript, which won't invoke
 1734|       |    // CheckSchnorrSignature in that case. In other contexts, they are invalid like every other signature with
 1735|       |    // size different from 64 or 65.
 1736|  1.22k|    if (sig.size() != 64 && sig.size() != 65) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_SIZE);
  ------------------
  |  Branch (1736:9): [True: 1.06k, False: 155]
  |  Branch (1736:29): [True: 823, False: 243]
  ------------------
 1737|       |
 1738|    398|    XOnlyPubKey pubkey{pubkey_in};
 1739|       |
 1740|    398|    uint8_t hashtype = SIGHASH_DEFAULT;
 1741|    398|    if (sig.size() == 65) {
  ------------------
  |  Branch (1741:9): [True: 243, False: 155]
  ------------------
 1742|    243|        hashtype = SpanPopBack(sig);
 1743|    243|        if (hashtype == SIGHASH_DEFAULT) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
  ------------------
  |  Branch (1743:13): [True: 13, False: 230]
  ------------------
 1744|    243|    }
 1745|    385|    uint256 sighash;
 1746|    385|    if (!this->txdata) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1746:9): [True: 0, False: 385]
  ------------------
 1747|    385|    if (!SignatureHashSchnorr(sighash, execdata, *txTo, nIn, hashtype, sigversion, *this->txdata, m_mdb)) {
  ------------------
  |  Branch (1747:9): [True: 70, False: 315]
  ------------------
 1748|     70|        return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
 1749|     70|    }
 1750|    315|    if (!VerifySchnorrSignature(sig, pubkey, sighash)) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG);
  ------------------
  |  Branch (1750:9): [True: 315, False: 0]
  ------------------
 1751|      0|    return true;
 1752|    315|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE13CheckLockTimeERK10CScriptNum:
 1756|  8.80k|{
 1757|       |    // There are two kinds of nLockTime: lock-by-blockheight
 1758|       |    // and lock-by-blocktime, distinguished by whether
 1759|       |    // nLockTime < LOCKTIME_THRESHOLD.
 1760|       |    //
 1761|       |    // We want to compare apples to apples, so fail the script
 1762|       |    // unless the type of nLockTime being tested is the same as
 1763|       |    // the nLockTime in the transaction.
 1764|  8.80k|    if (!(
  ------------------
  |  Branch (1764:9): [True: 583, False: 8.22k]
  ------------------
 1765|  8.80k|        (txTo->nLockTime <  LOCKTIME_THRESHOLD && nLockTime <  LOCKTIME_THRESHOLD) ||
  ------------------
  |  Branch (1765:10): [True: 7.91k, False: 898]
  |  Branch (1765:51): [True: 7.66k, False: 244]
  ------------------
 1766|  1.14k|        (txTo->nLockTime >= LOCKTIME_THRESHOLD && nLockTime >= LOCKTIME_THRESHOLD)
  ------------------
  |  Branch (1766:10): [True: 898, False: 244]
  |  Branch (1766:51): [True: 559, False: 339]
  ------------------
 1767|  8.80k|    ))
 1768|    583|        return false;
 1769|       |
 1770|       |    // Now that we know we're comparing apples-to-apples, the
 1771|       |    // comparison is a simple numeric one.
 1772|  8.22k|    if (nLockTime > (int64_t)txTo->nLockTime)
  ------------------
  |  Branch (1772:9): [True: 750, False: 7.47k]
  ------------------
 1773|    750|        return false;
 1774|       |
 1775|       |    // Finally the nLockTime feature can be disabled in IsFinalTx()
 1776|       |    // and thus CHECKLOCKTIMEVERIFY bypassed if every txin has
 1777|       |    // been finalized by setting nSequence to maxint. The
 1778|       |    // transaction would be allowed into the blockchain, making
 1779|       |    // the opcode ineffective.
 1780|       |    //
 1781|       |    // Testing if this vin is not final is sufficient to
 1782|       |    // prevent this condition. Alternatively we could test all
 1783|       |    // inputs, but testing just this input minimizes the data
 1784|       |    // required to prove correct CHECKLOCKTIMEVERIFY execution.
 1785|  7.47k|    if (CTxIn::SEQUENCE_FINAL == txTo->vin[nIn].nSequence)
  ------------------
  |  Branch (1785:9): [True: 11, False: 7.46k]
  ------------------
 1786|     11|        return false;
 1787|       |
 1788|  7.46k|    return true;
 1789|  7.47k|}
_ZNK34GenericTransactionSignatureCheckerI12CTransactionE13CheckSequenceERK10CScriptNum:
 1793|  6.70k|{
 1794|       |    // Relative lock times are supported by comparing the passed
 1795|       |    // in operand to the sequence number of the input.
 1796|  6.70k|    const int64_t txToSequence = (int64_t)txTo->vin[nIn].nSequence;
 1797|       |
 1798|       |    // Fail if the transaction's version number is not set high
 1799|       |    // enough to trigger BIP 68 rules.
 1800|  6.70k|    if (txTo->version < 2)
  ------------------
  |  Branch (1800:9): [True: 304, False: 6.39k]
  ------------------
 1801|    304|        return false;
 1802|       |
 1803|       |    // Sequence numbers with their most significant bit set are not
 1804|       |    // consensus constrained. Testing that the transaction's sequence
 1805|       |    // number do not have this bit set prevents using this property
 1806|       |    // to get around a CHECKSEQUENCEVERIFY check.
 1807|  6.39k|    if (txToSequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG)
  ------------------
  |  Branch (1807:9): [True: 269, False: 6.12k]
  ------------------
 1808|    269|        return false;
 1809|       |
 1810|       |    // Mask off any bits that do not have consensus-enforced meaning
 1811|       |    // before doing the integer comparisons
 1812|  6.12k|    const uint32_t nLockTimeMask = CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG | CTxIn::SEQUENCE_LOCKTIME_MASK;
 1813|  6.12k|    const int64_t txToSequenceMasked = txToSequence & nLockTimeMask;
 1814|  6.12k|    const CScriptNum nSequenceMasked = nSequence & nLockTimeMask;
 1815|       |
 1816|       |    // There are two kinds of nSequence: lock-by-blockheight
 1817|       |    // and lock-by-blocktime, distinguished by whether
 1818|       |    // nSequenceMasked < CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG.
 1819|       |    //
 1820|       |    // We want to compare apples to apples, so fail the script
 1821|       |    // unless the type of nSequenceMasked being tested is the same as
 1822|       |    // the nSequenceMasked in the transaction.
 1823|  6.12k|    if (!(
  ------------------
  |  Branch (1823:9): [True: 1.22k, False: 4.90k]
  ------------------
 1824|  6.12k|        (txToSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG) ||
  ------------------
  |  Branch (1824:10): [True: 5.08k, False: 1.04k]
  |  Branch (1824:70): [True: 4.59k, False: 495]
  ------------------
 1825|  1.53k|        (txToSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG)
  ------------------
  |  Branch (1825:10): [True: 1.04k, False: 495]
  |  Branch (1825:70): [True: 310, False: 731]
  ------------------
 1826|  6.12k|    )) {
 1827|  1.22k|        return false;
 1828|  1.22k|    }
 1829|       |
 1830|       |    // Now that we know we're comparing apples-to-apples, the
 1831|       |    // comparison is a simple numeric one.
 1832|  4.90k|    if (nSequenceMasked > txToSequenceMasked)
  ------------------
  |  Branch (1832:9): [True: 302, False: 4.59k]
  ------------------
 1833|    302|        return false;
 1834|       |
 1835|  4.59k|    return true;
 1836|  4.90k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE20VerifyECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEERK7CPubKeyRK7uint256:
 1691|  22.8k|{
 1692|  22.8k|    return pubkey.Verify(sighash, vchSig);
 1693|  22.8k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE19CheckECDSASignatureERKNSt3__16vectorIhNS2_9allocatorIhEEEES8_RK7CScript10SigVersion:
 1703|  23.8k|{
 1704|  23.8k|    CPubKey pubkey(vchPubKey);
 1705|  23.8k|    if (!pubkey.IsValid())
  ------------------
  |  Branch (1705:9): [True: 0, False: 23.8k]
  ------------------
 1706|      0|        return false;
 1707|       |
 1708|       |    // Hash type is one byte tacked on to the end of the signature
 1709|  23.8k|    std::vector<unsigned char> vchSig(vchSigIn);
 1710|  23.8k|    if (vchSig.empty())
  ------------------
  |  Branch (1710:9): [True: 1.02k, False: 22.8k]
  ------------------
 1711|  1.02k|        return false;
 1712|  22.8k|    int nHashType = vchSig.back();
 1713|  22.8k|    vchSig.pop_back();
 1714|       |
 1715|       |    // Witness sighashes need the amount.
 1716|  22.8k|    if (sigversion == SigVersion::WITNESS_V0 && amount < 0) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1716:9): [True: 4.66k, False: 18.1k]
  |  Branch (1716:49): [True: 0, False: 4.66k]
  ------------------
 1717|       |
 1718|  22.8k|    uint256 sighash = SignatureHash(scriptCode, *txTo, nIn, nHashType, amount, sigversion, this->txdata, &m_sighash_cache);
 1719|       |
 1720|  22.8k|    if (!VerifyECDSASignature(vchSig, pubkey, sighash))
  ------------------
  |  Branch (1720:9): [True: 21.9k, False: 943]
  ------------------
 1721|  21.9k|        return false;
 1722|       |
 1723|    943|    return true;
 1724|  22.8k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE21CheckSchnorrSignatureENSt3__14spanIKhLm18446744073709551615EEES5_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
 1728|  1.21k|{
 1729|  1.21k|    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
  ------------------
  |  Branch (1729:5): [True: 1.21k, False: 0]
  |  Branch (1729:5): [True: 0, False: 0]
  |  Branch (1729:5): [True: 1.21k, False: 0]
  ------------------
 1730|       |    // Schnorr signatures have 32-byte public keys. The caller is responsible for enforcing this.
 1731|  1.21k|    assert(pubkey_in.size() == 32);
  ------------------
  |  Branch (1731:5): [True: 1.21k, False: 0]
  ------------------
 1732|       |    // Note that in Tapscript evaluation, empty signatures are treated specially (invalid signature that does not
 1733|       |    // abort script execution). This is implemented in EvalChecksigTapscript, which won't invoke
 1734|       |    // CheckSchnorrSignature in that case. In other contexts, they are invalid like every other signature with
 1735|       |    // size different from 64 or 65.
 1736|  1.21k|    if (sig.size() != 64 && sig.size() != 65) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_SIZE);
  ------------------
  |  Branch (1736:9): [True: 1.06k, False: 155]
  |  Branch (1736:29): [True: 816, False: 244]
  ------------------
 1737|       |
 1738|    399|    XOnlyPubKey pubkey{pubkey_in};
 1739|       |
 1740|    399|    uint8_t hashtype = SIGHASH_DEFAULT;
 1741|    399|    if (sig.size() == 65) {
  ------------------
  |  Branch (1741:9): [True: 244, False: 155]
  ------------------
 1742|    244|        hashtype = SpanPopBack(sig);
 1743|    244|        if (hashtype == SIGHASH_DEFAULT) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
  ------------------
  |  Branch (1743:13): [True: 14, False: 230]
  ------------------
 1744|    244|    }
 1745|    385|    uint256 sighash;
 1746|    385|    if (!this->txdata) return HandleMissingData(m_mdb);
  ------------------
  |  Branch (1746:9): [True: 385, False: 0]
  ------------------
 1747|      0|    if (!SignatureHashSchnorr(sighash, execdata, *txTo, nIn, hashtype, sigversion, *this->txdata, m_mdb)) {
  ------------------
  |  Branch (1747:9): [True: 0, False: 0]
  ------------------
 1748|      0|        return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
 1749|      0|    }
 1750|      0|    if (!VerifySchnorrSignature(sig, pubkey, sighash)) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG);
  ------------------
  |  Branch (1750:9): [True: 0, False: 0]
  ------------------
 1751|      0|    return true;
 1752|      0|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE13CheckLockTimeERK10CScriptNum:
 1756|  8.93k|{
 1757|       |    // There are two kinds of nLockTime: lock-by-blockheight
 1758|       |    // and lock-by-blocktime, distinguished by whether
 1759|       |    // nLockTime < LOCKTIME_THRESHOLD.
 1760|       |    //
 1761|       |    // We want to compare apples to apples, so fail the script
 1762|       |    // unless the type of nLockTime being tested is the same as
 1763|       |    // the nLockTime in the transaction.
 1764|  8.93k|    if (!(
  ------------------
  |  Branch (1764:9): [True: 600, False: 8.33k]
  ------------------
 1765|  8.93k|        (txTo->nLockTime <  LOCKTIME_THRESHOLD && nLockTime <  LOCKTIME_THRESHOLD) ||
  ------------------
  |  Branch (1765:10): [True: 7.98k, False: 950]
  |  Branch (1765:51): [True: 7.73k, False: 247]
  ------------------
 1766|  1.19k|        (txTo->nLockTime >= LOCKTIME_THRESHOLD && nLockTime >= LOCKTIME_THRESHOLD)
  ------------------
  |  Branch (1766:10): [True: 950, False: 247]
  |  Branch (1766:51): [True: 597, False: 353]
  ------------------
 1767|  8.93k|    ))
 1768|    600|        return false;
 1769|       |
 1770|       |    // Now that we know we're comparing apples-to-apples, the
 1771|       |    // comparison is a simple numeric one.
 1772|  8.33k|    if (nLockTime > (int64_t)txTo->nLockTime)
  ------------------
  |  Branch (1772:9): [True: 770, False: 7.56k]
  ------------------
 1773|    770|        return false;
 1774|       |
 1775|       |    // Finally the nLockTime feature can be disabled in IsFinalTx()
 1776|       |    // and thus CHECKLOCKTIMEVERIFY bypassed if every txin has
 1777|       |    // been finalized by setting nSequence to maxint. The
 1778|       |    // transaction would be allowed into the blockchain, making
 1779|       |    // the opcode ineffective.
 1780|       |    //
 1781|       |    // Testing if this vin is not final is sufficient to
 1782|       |    // prevent this condition. Alternatively we could test all
 1783|       |    // inputs, but testing just this input minimizes the data
 1784|       |    // required to prove correct CHECKLOCKTIMEVERIFY execution.
 1785|  7.56k|    if (CTxIn::SEQUENCE_FINAL == txTo->vin[nIn].nSequence)
  ------------------
  |  Branch (1785:9): [True: 13, False: 7.54k]
  ------------------
 1786|     13|        return false;
 1787|       |
 1788|  7.54k|    return true;
 1789|  7.56k|}
_ZNK34GenericTransactionSignatureCheckerI19CMutableTransactionE13CheckSequenceERK10CScriptNum:
 1793|  6.60k|{
 1794|       |    // Relative lock times are supported by comparing the passed
 1795|       |    // in operand to the sequence number of the input.
 1796|  6.60k|    const int64_t txToSequence = (int64_t)txTo->vin[nIn].nSequence;
 1797|       |
 1798|       |    // Fail if the transaction's version number is not set high
 1799|       |    // enough to trigger BIP 68 rules.
 1800|  6.60k|    if (txTo->version < 2)
  ------------------
  |  Branch (1800:9): [True: 305, False: 6.29k]
  ------------------
 1801|    305|        return false;
 1802|       |
 1803|       |    // Sequence numbers with their most significant bit set are not
 1804|       |    // consensus constrained. Testing that the transaction's sequence
 1805|       |    // number do not have this bit set prevents using this property
 1806|       |    // to get around a CHECKSEQUENCEVERIFY check.
 1807|  6.29k|    if (txToSequence & CTxIn::SEQUENCE_LOCKTIME_DISABLE_FLAG)
  ------------------
  |  Branch (1807:9): [True: 74, False: 6.22k]
  ------------------
 1808|     74|        return false;
 1809|       |
 1810|       |    // Mask off any bits that do not have consensus-enforced meaning
 1811|       |    // before doing the integer comparisons
 1812|  6.22k|    const uint32_t nLockTimeMask = CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG | CTxIn::SEQUENCE_LOCKTIME_MASK;
 1813|  6.22k|    const int64_t txToSequenceMasked = txToSequence & nLockTimeMask;
 1814|  6.22k|    const CScriptNum nSequenceMasked = nSequence & nLockTimeMask;
 1815|       |
 1816|       |    // There are two kinds of nSequence: lock-by-blockheight
 1817|       |    // and lock-by-blocktime, distinguished by whether
 1818|       |    // nSequenceMasked < CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG.
 1819|       |    //
 1820|       |    // We want to compare apples to apples, so fail the script
 1821|       |    // unless the type of nSequenceMasked being tested is the same as
 1822|       |    // the nSequenceMasked in the transaction.
 1823|  6.22k|    if (!(
  ------------------
  |  Branch (1823:9): [True: 1.06k, False: 5.15k]
  ------------------
 1824|  6.22k|        (txToSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked <  CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG) ||
  ------------------
  |  Branch (1824:10): [True: 5.34k, False: 883]
  |  Branch (1824:70): [True: 4.84k, False: 494]
  ------------------
 1825|  1.37k|        (txToSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG && nSequenceMasked >= CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG)
  ------------------
  |  Branch (1825:10): [True: 883, False: 494]
  |  Branch (1825:70): [True: 309, False: 574]
  ------------------
 1826|  6.22k|    )) {
 1827|  1.06k|        return false;
 1828|  1.06k|    }
 1829|       |
 1830|       |    // Now that we know we're comparing apples-to-apples, the
 1831|       |    // comparison is a simple numeric one.
 1832|  5.15k|    if (nSequenceMasked > txToSequenceMasked)
  ------------------
  |  Branch (1832:9): [True: 313, False: 4.84k]
  ------------------
 1833|    313|        return false;
 1834|       |
 1835|  4.84k|    return true;
 1836|  5.15k|}
_Z18ComputeTapleafHashhNSt3__14spanIKhLm18446744073709551615EEE:
 1883|  1.35k|{
 1884|  1.35k|    return (HashWriter{HASHER_TAPLEAF} << leaf_version << CompactSizeWriter(script.size()) << script).GetSHA256();
 1885|  1.35k|}
_Z20ComputeTapbranchHashNSt3__14spanIKhLm18446744073709551615EEES2_:
 1888|  1.74k|{
 1889|  1.74k|    HashWriter ss_branch{HASHER_TAPBRANCH};
 1890|  1.74k|    if (std::lexicographical_compare(a.begin(), a.end(), b.begin(), b.end())) {
  ------------------
  |  Branch (1890:9): [True: 913, False: 829]
  ------------------
 1891|    913|        ss_branch << a << b;
 1892|    913|    } else {
 1893|    829|        ss_branch << b << a;
 1894|    829|    }
 1895|  1.74k|    return ss_branch.GetSHA256();
 1896|  1.74k|}
_Z24ComputeTaprootMerkleRootNSt3__14spanIKhLm18446744073709551615EEERK7uint256:
 1899|  1.35k|{
 1900|  1.35k|    assert(control.size() >= TAPROOT_CONTROL_BASE_SIZE);
  ------------------
  |  Branch (1900:5): [True: 1.35k, False: 0]
  ------------------
 1901|  1.35k|    assert(control.size() <= TAPROOT_CONTROL_MAX_SIZE);
  ------------------
  |  Branch (1901:5): [True: 1.35k, False: 0]
  ------------------
 1902|  1.35k|    assert((control.size() - TAPROOT_CONTROL_BASE_SIZE) % TAPROOT_CONTROL_NODE_SIZE == 0);
  ------------------
  |  Branch (1902:5): [True: 1.35k, False: 0]
  ------------------
 1903|       |
 1904|  1.35k|    const int path_len = (control.size() - TAPROOT_CONTROL_BASE_SIZE) / TAPROOT_CONTROL_NODE_SIZE;
 1905|  1.35k|    uint256 k = tapleaf_hash;
 1906|  3.10k|    for (int i = 0; i < path_len; ++i) {
  ------------------
  |  Branch (1906:21): [True: 1.74k, False: 1.35k]
  ------------------
 1907|  1.74k|        std::span node{std::span{control}.subspan(TAPROOT_CONTROL_BASE_SIZE + TAPROOT_CONTROL_NODE_SIZE * i, TAPROOT_CONTROL_NODE_SIZE)};
 1908|  1.74k|        k = ComputeTapbranchHash(k, node);
 1909|  1.74k|    }
 1910|  1.35k|    return k;
 1911|  1.35k|}
_Z12VerifyScriptRK7CScriptS1_PK14CScriptWitness19script_verify_flagsRK20BaseSignatureCheckerP13ScriptError_t:
 2013|   211k|{
 2014|   211k|    static const CScriptWitness emptyWitness;
 2015|   211k|    if (witness == nullptr) {
  ------------------
  |  Branch (2015:9): [True: 0, False: 211k]
  ------------------
 2016|      0|        witness = &emptyWitness;
 2017|      0|    }
 2018|   211k|    bool hadWitness = false;
 2019|       |
 2020|   211k|    set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
 2021|       |
 2022|   211k|    if ((flags & SCRIPT_VERIFY_SIGPUSHONLY) != 0 && !scriptSig.IsPushOnly()) {
  ------------------
  |  Branch (2022:9): [True: 0, False: 211k]
  |  Branch (2022:9): [True: 0, False: 211k]
  |  Branch (2022:53): [True: 0, False: 0]
  ------------------
 2023|      0|        return set_error(serror, SCRIPT_ERR_SIG_PUSHONLY);
 2024|      0|    }
 2025|       |
 2026|       |    // scriptSig and scriptPubKey must be evaluated sequentially on the same stack
 2027|       |    // rather than being simply concatenated (see CVE-2010-5141)
 2028|   211k|    std::vector<std::vector<unsigned char> > stack, stackCopy;
 2029|   211k|    if (!EvalScript(stack, scriptSig, flags, checker, SigVersion::BASE, serror))
  ------------------
  |  Branch (2029:9): [True: 8.91k, False: 202k]
  ------------------
 2030|       |        // serror is set
 2031|  8.91k|        return false;
 2032|   202k|    if (flags & SCRIPT_VERIFY_P2SH)
  ------------------
  |  Branch (2032:9): [True: 202k, False: 0]
  ------------------
 2033|   202k|        stackCopy = stack;
 2034|   202k|    if (!EvalScript(stack, scriptPubKey, flags, checker, SigVersion::BASE, serror))
  ------------------
  |  Branch (2034:9): [True: 152k, False: 50.4k]
  ------------------
 2035|       |        // serror is set
 2036|   152k|        return false;
 2037|  50.4k|    if (stack.empty())
  ------------------
  |  Branch (2037:9): [True: 1.35k, False: 49.1k]
  ------------------
 2038|  1.35k|        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 2039|  49.1k|    if (CastToBool(stack.back()) == false)
  ------------------
  |  Branch (2039:9): [True: 2.00k, False: 47.1k]
  ------------------
 2040|  2.00k|        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 2041|       |
 2042|       |    // Bare witness programs
 2043|  47.1k|    int witnessversion;
 2044|  47.1k|    std::vector<unsigned char> witnessprogram;
 2045|  47.1k|    if (flags & SCRIPT_VERIFY_WITNESS) {
  ------------------
  |  Branch (2045:9): [True: 47.1k, False: 0]
  ------------------
 2046|  47.1k|        if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
  ------------------
  |  Branch (2046:13): [True: 29.3k, False: 17.7k]
  ------------------
 2047|  29.3k|            hadWitness = true;
 2048|  29.3k|            if (scriptSig.size() != 0) {
  ------------------
  |  Branch (2048:17): [True: 600, False: 28.7k]
  ------------------
 2049|       |                // The scriptSig must be _exactly_ CScript(), otherwise we reintroduce malleability.
 2050|    600|                return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED);
 2051|    600|            }
 2052|  28.7k|            if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/false)) {
  ------------------
  |  Branch (2052:17): [True: 28.3k, False: 418]
  ------------------
 2053|  28.3k|                return false;
 2054|  28.3k|            }
 2055|       |            // Bypass the cleanstack check at the end. The actual stack is obviously not clean
 2056|       |            // for witness programs.
 2057|    418|            stack.resize(1);
 2058|    418|        }
 2059|  47.1k|    }
 2060|       |
 2061|       |    // Additional validation for spend-to-script-hash transactions:
 2062|  18.1k|    if ((flags & SCRIPT_VERIFY_P2SH) && scriptPubKey.IsPayToScriptHash())
  ------------------
  |  Branch (2062:9): [True: 18.1k, False: 0]
  |  Branch (2062:9): [True: 14.3k, False: 3.79k]
  |  Branch (2062:41): [True: 14.3k, False: 3.79k]
  ------------------
 2063|  14.3k|    {
 2064|       |        // scriptSig must be literals-only or validation fails
 2065|  14.3k|        if (!scriptSig.IsPushOnly())
  ------------------
  |  Branch (2065:13): [True: 278, False: 14.1k]
  ------------------
 2066|    278|            return set_error(serror, SCRIPT_ERR_SIG_PUSHONLY);
 2067|       |
 2068|       |        // Restore stack.
 2069|  14.1k|        swap(stack, stackCopy);
 2070|       |
 2071|       |        // stack cannot be empty here, because if it was the
 2072|       |        // P2SH  HASH <> EQUAL  scriptPubKey would be evaluated with
 2073|       |        // an empty stack and the EvalScript above would return false.
 2074|  14.1k|        assert(!stack.empty());
  ------------------
  |  Branch (2074:9): [True: 14.1k, False: 0]
  ------------------
 2075|       |
 2076|  14.1k|        const valtype& pubKeySerialized = stack.back();
 2077|  14.1k|        CScript pubKey2(pubKeySerialized.begin(), pubKeySerialized.end());
 2078|  14.1k|        popstack(stack);
 2079|       |
 2080|  14.1k|        if (!EvalScript(stack, pubKey2, flags, checker, SigVersion::BASE, serror))
  ------------------
  |  Branch (2080:13): [True: 667, False: 13.4k]
  ------------------
 2081|       |            // serror is set
 2082|    667|            return false;
 2083|  13.4k|        if (stack.empty())
  ------------------
  |  Branch (2083:13): [True: 1.14k, False: 12.3k]
  ------------------
 2084|  1.14k|            return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 2085|  12.3k|        if (!CastToBool(stack.back()))
  ------------------
  |  Branch (2085:13): [True: 112, False: 12.1k]
  ------------------
 2086|    112|            return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
 2087|       |
 2088|       |        // P2SH witness program
 2089|  12.1k|        if (flags & SCRIPT_VERIFY_WITNESS) {
  ------------------
  |  Branch (2089:13): [True: 12.1k, False: 0]
  ------------------
 2090|  12.1k|            if (pubKey2.IsWitnessProgram(witnessversion, witnessprogram)) {
  ------------------
  |  Branch (2090:17): [True: 12.1k, False: 35]
  ------------------
 2091|  12.1k|                hadWitness = true;
 2092|  12.1k|                if (scriptSig != CScript() << std::vector<unsigned char>(pubKey2.begin(), pubKey2.end())) {
  ------------------
  |  Branch (2092:21): [True: 6, False: 12.1k]
  ------------------
 2093|       |                    // The scriptSig must be _exactly_ a single push of the redeemScript. Otherwise we
 2094|       |                    // reintroduce malleability.
 2095|      6|                    return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED_P2SH);
 2096|      6|                }
 2097|  12.1k|                if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/true)) {
  ------------------
  |  Branch (2097:21): [True: 11.6k, False: 510]
  ------------------
 2098|  11.6k|                    return false;
 2099|  11.6k|                }
 2100|       |                // Bypass the cleanstack check at the end. The actual stack is obviously not clean
 2101|       |                // for witness programs.
 2102|    510|                stack.resize(1);
 2103|    510|            }
 2104|  12.1k|        }
 2105|  12.1k|    }
 2106|       |
 2107|       |    // The CLEANSTACK check is only performed after potential P2SH evaluation,
 2108|       |    // as the non-P2SH evaluation of a P2SH script will obviously not result in
 2109|       |    // a clean stack (the P2SH inputs remain). The same holds for witness evaluation.
 2110|  4.33k|    if ((flags & SCRIPT_VERIFY_CLEANSTACK) != 0) {
  ------------------
  |  Branch (2110:9): [True: 4.33k, False: 0]
  ------------------
 2111|       |        // Disallow CLEANSTACK without P2SH, as otherwise a switch CLEANSTACK->P2SH+CLEANSTACK
 2112|       |        // would be possible, which is not a softfork (and P2SH should be one).
 2113|  4.33k|        assert((flags & SCRIPT_VERIFY_P2SH) != 0);
  ------------------
  |  Branch (2113:9): [True: 4.33k, False: 0]
  ------------------
 2114|  4.33k|        assert((flags & SCRIPT_VERIFY_WITNESS) != 0);
  ------------------
  |  Branch (2114:9): [True: 4.33k, False: 0]
  ------------------
 2115|  4.33k|        if (stack.size() != 1) {
  ------------------
  |  Branch (2115:13): [True: 1.25k, False: 3.08k]
  ------------------
 2116|  1.25k|            return set_error(serror, SCRIPT_ERR_CLEANSTACK);
 2117|  1.25k|        }
 2118|  4.33k|    }
 2119|       |
 2120|  3.08k|    if (flags & SCRIPT_VERIFY_WITNESS) {
  ------------------
  |  Branch (2120:9): [True: 3.08k, False: 0]
  ------------------
 2121|       |        // We can't check for correct unexpected witness data if P2SH was off, so require
 2122|       |        // that WITNESS implies P2SH. Otherwise, going from WITNESS->P2SH+WITNESS would be
 2123|       |        // possible, which is not a softfork.
 2124|  3.08k|        assert((flags & SCRIPT_VERIFY_P2SH) != 0);
  ------------------
  |  Branch (2124:9): [True: 3.08k, False: 0]
  ------------------
 2125|  3.08k|        if (!hadWitness && !witness->IsNull()) {
  ------------------
  |  Branch (2125:13): [True: 2.15k, False: 928]
  |  Branch (2125:28): [True: 604, False: 1.55k]
  ------------------
 2126|    604|            return set_error(serror, SCRIPT_ERR_WITNESS_UNEXPECTED);
 2127|    604|        }
 2128|  3.08k|    }
 2129|       |
 2130|  2.48k|    return set_success(serror);
 2131|  3.08k|}
interpreter.cpp:_ZL24IsValidSignatureEncodingRKNSt3__16vectorIhNS_9allocatorIhEEEE:
  118|   127k|bool static IsValidSignatureEncoding(const std::vector<unsigned char> &sig) {
  119|       |    // Format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S] [sighash]
  120|       |    // * total-length: 1-byte length descriptor of everything that follows,
  121|       |    //   excluding the sighash byte.
  122|       |    // * R-length: 1-byte length descriptor of the R value that follows.
  123|       |    // * R: arbitrary-length big-endian encoded R value. It must use the shortest
  124|       |    //   possible encoding for a positive integer (which means no null bytes at
  125|       |    //   the start, except a single one when the next byte has its highest bit set).
  126|       |    // * S-length: 1-byte length descriptor of the S value that follows.
  127|       |    // * S: arbitrary-length big-endian encoded S value. The same rules apply.
  128|       |    // * sighash: 1-byte value indicating what data is hashed (not part of the DER
  129|       |    //   signature)
  130|       |
  131|       |    // Minimum and maximum size constraints.
  132|   127k|    if (sig.size() < 9) return false;
  ------------------
  |  Branch (132:9): [True: 974, False: 126k]
  ------------------
  133|   126k|    if (sig.size() > 73) return false;
  ------------------
  |  Branch (133:9): [True: 27, False: 126k]
  ------------------
  134|       |
  135|       |    // A signature is of type 0x30 (compound).
  136|   126k|    if (sig[0] != 0x30) return false;
  ------------------
  |  Branch (136:9): [True: 661, False: 125k]
  ------------------
  137|       |
  138|       |    // Make sure the length covers the entire signature.
  139|   125k|    if (sig[1] != sig.size() - 3) return false;
  ------------------
  |  Branch (139:9): [True: 480, False: 125k]
  ------------------
  140|       |
  141|       |    // Extract the length of the R element.
  142|   125k|    unsigned int lenR = sig[3];
  143|       |
  144|       |    // Make sure the length of the S element is still inside the signature.
  145|   125k|    if (5 + lenR >= sig.size()) return false;
  ------------------
  |  Branch (145:9): [True: 296, False: 124k]
  ------------------
  146|       |
  147|       |    // Extract the length of the S element.
  148|   124k|    unsigned int lenS = sig[5 + lenR];
  149|       |
  150|       |    // Verify that the length of the signature matches the sum of the length
  151|       |    // of the elements.
  152|   124k|    if ((size_t)(lenR + lenS + 7) != sig.size()) return false;
  ------------------
  |  Branch (152:9): [True: 90, False: 124k]
  ------------------
  153|       |
  154|       |    // Check whether the R element is an integer.
  155|   124k|    if (sig[2] != 0x02) return false;
  ------------------
  |  Branch (155:9): [True: 39, False: 124k]
  ------------------
  156|       |
  157|       |    // Zero-length integers are not allowed for R.
  158|   124k|    if (lenR == 0) return false;
  ------------------
  |  Branch (158:9): [True: 1, False: 124k]
  ------------------
  159|       |
  160|       |    // Negative numbers are not allowed for R.
  161|   124k|    if (sig[4] & 0x80) return false;
  ------------------
  |  Branch (161:9): [True: 19, False: 124k]
  ------------------
  162|       |
  163|       |    // Null bytes at the start of R are not allowed, unless R would
  164|       |    // otherwise be interpreted as a negative number.
  165|   124k|    if (lenR > 1 && (sig[4] == 0x00) && !(sig[5] & 0x80)) return false;
  ------------------
  |  Branch (165:9): [True: 124k, False: 3]
  |  Branch (165:21): [True: 1.04k, False: 123k]
  |  Branch (165:41): [True: 38, False: 1.00k]
  ------------------
  166|       |
  167|       |    // Check whether the S element is an integer.
  168|   124k|    if (sig[lenR + 4] != 0x02) return false;
  ------------------
  |  Branch (168:9): [True: 146, False: 124k]
  ------------------
  169|       |
  170|       |    // Zero-length integers are not allowed for S.
  171|   124k|    if (lenS == 0) return false;
  ------------------
  |  Branch (171:9): [True: 1, False: 124k]
  ------------------
  172|       |
  173|       |    // Negative numbers are not allowed for S.
  174|   124k|    if (sig[lenR + 6] & 0x80) return false;
  ------------------
  |  Branch (174:9): [True: 5, False: 124k]
  ------------------
  175|       |
  176|       |    // Null bytes at the start of S are not allowed, unless S would otherwise be
  177|       |    // interpreted as a negative number.
  178|   124k|    if (lenS > 1 && (sig[lenR + 6] == 0x00) && !(sig[lenR + 7] & 0x80)) return false;
  ------------------
  |  Branch (178:9): [True: 124k, False: 0]
  |  Branch (178:21): [True: 979, False: 123k]
  |  Branch (178:48): [True: 18, False: 961]
  ------------------
  179|       |
  180|   124k|    return true;
  181|   124k|}
interpreter.cpp:_ZN12_GLOBAL__N_19set_errorEP13ScriptError_tS0_:
   38|   964k|{
   39|   964k|    if (ret)
  ------------------
  |  Branch (39:9): [True: 366k, False: 597k]
  ------------------
   40|   366k|        *ret = serror;
   41|   964k|    return false;
   42|   964k|}
interpreter.cpp:_ZL17IsLowDERSignatureRKNSt3__16vectorIhNS_9allocatorIhEEEEP13ScriptError_t:
  183|  62.2k|bool static IsLowDERSignature(const valtype &vchSig, ScriptError* serror) {
  184|  62.2k|    if (!IsValidSignatureEncoding(vchSig)) {
  ------------------
  |  Branch (184:9): [True: 0, False: 62.2k]
  ------------------
  185|      0|        return set_error(serror, SCRIPT_ERR_SIG_DER);
  186|      0|    }
  187|       |    // https://bitcoin.stackexchange.com/a/12556:
  188|       |    //     Also note that inside transaction signatures, an extra hashtype byte
  189|       |    //     follows the actual signature data.
  190|  62.2k|    std::vector<unsigned char> vchSigCopy(vchSig.begin(), vchSig.begin() + vchSig.size() - 1);
  191|       |    // If the S value is above the order of the curve divided by two, its
  192|       |    // complement modulo the order could have been used instead, which is
  193|       |    // one byte shorter when encoded correctly.
  194|  62.2k|    if (!CPubKey::CheckLowS(vchSigCopy)) {
  ------------------
  |  Branch (194:9): [True: 0, False: 62.2k]
  ------------------
  195|      0|        return set_error(serror, SCRIPT_ERR_SIG_HIGH_S);
  196|      0|    }
  197|  62.2k|    return true;
  198|  62.2k|}
interpreter.cpp:_ZL26IsDefinedHashtypeSignatureRKNSt3__16vectorIhNS_9allocatorIhEEEE:
  200|  62.2k|bool static IsDefinedHashtypeSignature(const valtype &vchSig) {
  201|  62.2k|    if (vchSig.size() == 0) {
  ------------------
  |  Branch (201:9): [True: 0, False: 62.2k]
  ------------------
  202|      0|        return false;
  203|      0|    }
  204|  62.2k|    unsigned char nHashType = vchSig[vchSig.size() - 1] & (~(SIGHASH_ANYONECANPAY));
  205|  62.2k|    if (nHashType < SIGHASH_ALL || nHashType > SIGHASH_SINGLE)
  ------------------
  |  Branch (205:9): [True: 15.3k, False: 46.9k]
  |  Branch (205:36): [True: 963, False: 45.9k]
  ------------------
  206|  16.2k|        return false;
  207|       |
  208|  45.9k|    return true;
  209|  62.2k|}
interpreter.cpp:_ZNK12_GLOBAL__N_114ConditionStack8all_trueEv:
  295|  11.1M|    bool all_true() const { return m_first_false_pos == NO_FALSE; }
interpreter.cpp:_ZL8popstackRNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEE:
   68|   770k|{
   69|   770k|    if (stack.empty())
  ------------------
  |  Branch (69:9): [True: 0, False: 770k]
  ------------------
   70|      0|        throw std::runtime_error("popstack(): stack empty");
   71|   770k|    stack.pop_back();
   72|   770k|}
interpreter.cpp:_ZN12_GLOBAL__N_114ConditionStack9push_backEb:
  297|   117k|    {
  298|   117k|        if (m_first_false_pos == NO_FALSE && !f) {
  ------------------
  |  Branch (298:13): [True: 25.6k, False: 91.9k]
  |  Branch (298:46): [True: 5.39k, False: 20.3k]
  ------------------
  299|       |            // The stack consists of all true values, and a false is added.
  300|       |            // The first false value will appear at the current size.
  301|  5.39k|            m_first_false_pos = m_stack_size;
  302|  5.39k|        }
  303|   117k|        ++m_stack_size;
  304|   117k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_114ConditionStack5emptyEv:
  294|   366k|    bool empty() const { return m_stack_size == 0; }
interpreter.cpp:_ZN12_GLOBAL__N_114ConditionStack10toggle_topEv:
  315|  2.07k|    {
  316|  2.07k|        assert(m_stack_size > 0);
  ------------------
  |  Branch (316:9): [True: 2.07k, False: 0]
  ------------------
  317|  2.07k|        if (m_first_false_pos == NO_FALSE) {
  ------------------
  |  Branch (317:13): [True: 911, False: 1.16k]
  ------------------
  318|       |            // The current stack is all true values; the first false will be the top.
  319|    911|            m_first_false_pos = m_stack_size - 1;
  320|  1.16k|        } else if (m_first_false_pos == m_stack_size - 1) {
  ------------------
  |  Branch (320:20): [True: 775, False: 389]
  ------------------
  321|       |            // The top is the first false value; toggling it will make everything true.
  322|    775|            m_first_false_pos = NO_FALSE;
  323|    775|        } else {
  324|       |            // There is a false value, but not on top. No action is needed as toggling
  325|       |            // anything but the first false value is unobservable.
  326|    389|        }
  327|  2.07k|    }
interpreter.cpp:_ZN12_GLOBAL__N_114ConditionStack8pop_backEv:
  306|  5.97k|    {
  307|  5.97k|        assert(m_stack_size > 0);
  ------------------
  |  Branch (307:9): [True: 5.97k, False: 0]
  ------------------
  308|  5.97k|        --m_stack_size;
  309|  5.97k|        if (m_first_false_pos == m_stack_size) {
  ------------------
  |  Branch (309:13): [True: 669, False: 5.30k]
  ------------------
  310|       |            // When popping off the first false value, everything becomes true.
  311|    669|            m_first_false_pos = NO_FALSE;
  312|    669|        }
  313|  5.97k|    }
interpreter.cpp:_ZL12EvalChecksigRKNSt3__16vectorIhNS_9allocatorIhEEEES5_N9prevectorILj36EhjiE14const_iteratorES8_R19ScriptExecutionData19script_verify_flagsRK20BaseSignatureChecker10SigVersionP13ScriptError_tRb:
  403|  66.4k|{
  404|  66.4k|    switch (sigversion) {
  ------------------
  |  Branch (404:13): [True: 66.4k, False: 0]
  ------------------
  405|  54.7k|    case SigVersion::BASE:
  ------------------
  |  Branch (405:5): [True: 54.7k, False: 11.6k]
  ------------------
  406|  66.4k|    case SigVersion::WITNESS_V0:
  ------------------
  |  Branch (406:5): [True: 11.6k, False: 54.7k]
  ------------------
  407|  66.4k|        return EvalChecksigPreTapscript(sig, pubkey, pbegincodehash, pend, flags, checker, sigversion, serror, success);
  408|      0|    case SigVersion::TAPSCRIPT:
  ------------------
  |  Branch (408:5): [True: 0, False: 66.4k]
  ------------------
  409|      0|        return EvalChecksigTapscript(sig, pubkey, execdata, flags, checker, sigversion, serror, success);
  410|      0|    case SigVersion::TAPROOT:
  ------------------
  |  Branch (410:5): [True: 0, False: 66.4k]
  ------------------
  411|       |        // Key path spending in Taproot has no script, so this is unreachable.
  412|      0|        break;
  413|  66.4k|    }
  414|  66.4k|    assert(false);
  ------------------
  |  Branch (414:5): [Folded, False: 0]
  ------------------
  415|      0|}
interpreter.cpp:_ZL24EvalChecksigPreTapscriptRKNSt3__16vectorIhNS_9allocatorIhEEEES5_N9prevectorILj36EhjiE14const_iteratorES8_19script_verify_flagsRK20BaseSignatureChecker10SigVersionP13ScriptError_tRb:
  332|  66.4k|{
  333|  66.4k|    assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
  ------------------
  |  Branch (333:5): [True: 54.7k, False: 11.6k]
  |  Branch (333:5): [True: 11.6k, False: 0]
  |  Branch (333:5): [True: 66.4k, False: 0]
  ------------------
  334|       |
  335|       |    // Subset of script starting at the most recent codeseparator
  336|  66.4k|    CScript scriptCode(pbegincodehash, pend);
  337|       |
  338|       |    // Drop the signature in pre-segwit scripts but not segwit scripts
  339|  66.4k|    if (sigversion == SigVersion::BASE) {
  ------------------
  |  Branch (339:9): [True: 54.7k, False: 11.6k]
  ------------------
  340|  54.7k|        int found = FindAndDelete(scriptCode, CScript() << vchSig);
  341|  54.7k|        if (found > 0 && (flags & SCRIPT_VERIFY_CONST_SCRIPTCODE))
  ------------------
  |  Branch (341:13): [True: 1.54k, False: 53.2k]
  |  Branch (341:13): [True: 1.45k, False: 53.3k]
  |  Branch (341:26): [True: 1.45k, False: 94]
  ------------------
  342|  1.45k|            return set_error(serror, SCRIPT_ERR_SIG_FINDANDDELETE);
  343|  54.7k|    }
  344|       |
  345|  65.0k|    if (!CheckSignatureEncoding(vchSig, flags, serror) || !CheckPubKeyEncoding(vchPubKey, flags, sigversion, serror)) {
  ------------------
  |  Branch (345:9): [True: 18.3k, False: 46.6k]
  |  Branch (345:59): [True: 1.28k, False: 45.3k]
  ------------------
  346|       |        //serror is set
  347|  19.6k|        return false;
  348|  19.6k|    }
  349|  45.3k|    fSuccess = checker.CheckECDSASignature(vchSig, vchPubKey, scriptCode, sigversion);
  350|       |
  351|  45.3k|    if (!fSuccess && (flags & SCRIPT_VERIFY_NULLFAIL) && vchSig.size())
  ------------------
  |  Branch (351:9): [True: 44.4k, False: 956]
  |  Branch (351:9): [True: 43.8k, False: 1.59k]
  |  Branch (351:22): [True: 44.4k, False: 29]
  |  Branch (351:58): [True: 43.8k, False: 605]
  ------------------
  352|  43.8k|        return set_error(serror, SCRIPT_ERR_SIG_NULLFAIL);
  353|       |
  354|  1.59k|    return true;
  355|  45.3k|}
interpreter.cpp:_ZL19CheckPubKeyEncodingRKNSt3__16vectorIhNS_9allocatorIhEEEE19script_verify_flagsRK10SigVersionP13ScriptError_t:
  228|  50.7k|bool static CheckPubKeyEncoding(const valtype &vchPubKey, script_verify_flags flags, const SigVersion &sigversion, ScriptError* serror) {
  229|  50.7k|    if ((flags & SCRIPT_VERIFY_STRICTENC) != 0 && !IsCompressedOrUncompressedPubKey(vchPubKey)) {
  ------------------
  |  Branch (229:9): [True: 50.7k, False: 0]
  |  Branch (229:9): [True: 2.94k, False: 47.8k]
  |  Branch (229:51): [True: 2.94k, False: 47.8k]
  ------------------
  230|  2.94k|        return set_error(serror, SCRIPT_ERR_PUBKEYTYPE);
  231|  2.94k|    }
  232|       |    // Only compressed keys are accepted in segwit
  233|  47.8k|    if ((flags & SCRIPT_VERIFY_WITNESS_PUBKEYTYPE) != 0 && sigversion == SigVersion::WITNESS_V0 && !IsCompressedPubKey(vchPubKey)) {
  ------------------
  |  Branch (233:9): [True: 47.7k, False: 38]
  |  Branch (233:9): [True: 1, False: 47.8k]
  |  Branch (233:60): [True: 8.82k, False: 38.9k]
  |  Branch (233:100): [True: 1, False: 8.82k]
  ------------------
  234|      1|        return set_error(serror, SCRIPT_ERR_WITNESS_PUBKEYTYPE);
  235|      1|    }
  236|  47.8k|    return true;
  237|  47.8k|}
interpreter.cpp:_ZL32IsCompressedOrUncompressedPubKeyRKNSt3__16vectorIhNS_9allocatorIhEEEE:
   74|  50.7k|bool static IsCompressedOrUncompressedPubKey(const valtype &vchPubKey) {
   75|  50.7k|    if (vchPubKey.size() < CPubKey::COMPRESSED_SIZE) {
  ------------------
  |  Branch (75:9): [True: 752, False: 50.0k]
  ------------------
   76|       |        //  Non-canonical public key: too short
   77|    752|        return false;
   78|    752|    }
   79|  50.0k|    if (vchPubKey[0] == 0x04) {
  ------------------
  |  Branch (79:9): [True: 4.06k, False: 45.9k]
  ------------------
   80|  4.06k|        if (vchPubKey.size() != CPubKey::SIZE) {
  ------------------
  |  Branch (80:13): [True: 670, False: 3.39k]
  ------------------
   81|       |            //  Non-canonical public key: invalid length for uncompressed key
   82|    670|            return false;
   83|    670|        }
   84|  45.9k|    } else if (vchPubKey[0] == 0x02 || vchPubKey[0] == 0x03) {
  ------------------
  |  Branch (84:16): [True: 14.9k, False: 30.9k]
  |  Branch (84:40): [True: 30.2k, False: 697]
  ------------------
   85|  45.2k|        if (vchPubKey.size() != CPubKey::COMPRESSED_SIZE) {
  ------------------
  |  Branch (85:13): [True: 826, False: 44.4k]
  ------------------
   86|       |            //  Non-canonical public key: invalid length for compressed key
   87|    826|            return false;
   88|    826|        }
   89|  45.2k|    } else {
   90|       |        //  Non-canonical public key: neither compressed nor uncompressed
   91|    697|        return false;
   92|    697|    }
   93|  47.8k|    return true;
   94|  50.0k|}
interpreter.cpp:_ZL18IsCompressedPubKeyRKNSt3__16vectorIhNS_9allocatorIhEEEE:
   96|  8.82k|bool static IsCompressedPubKey(const valtype &vchPubKey) {
   97|  8.82k|    if (vchPubKey.size() != CPubKey::COMPRESSED_SIZE) {
  ------------------
  |  Branch (97:9): [True: 1, False: 8.82k]
  ------------------
   98|       |        //  Non-canonical public key: invalid length for compressed key
   99|      1|        return false;
  100|      1|    }
  101|  8.82k|    if (vchPubKey[0] != 0x02 && vchPubKey[0] != 0x03) {
  ------------------
  |  Branch (101:9): [True: 6.82k, False: 1.99k]
  |  Branch (101:33): [True: 0, False: 6.82k]
  ------------------
  102|       |        //  Non-canonical public key: invalid prefix for compressed key
  103|      0|        return false;
  104|      0|    }
  105|  8.82k|    return true;
  106|  8.82k|}
interpreter.cpp:_ZN12_GLOBAL__N_111set_successEP13ScriptError_t:
   31|   355k|{
   32|   355k|    if (ret)
  ------------------
  |  Branch (32:9): [True: 121k, False: 233k]
  ------------------
   33|   121k|        *ret = SCRIPT_ERR_OK;
   34|   355k|    return true;
   35|   355k|}
interpreter.cpp:_ZN12_GLOBAL__N_121GetSpentAmountsSHA256ERKNSt3__16vectorI6CTxOutNS0_9allocatorIS2_EEEE:
 1391|  1.51k|{
 1392|  1.51k|    HashWriter ss{};
 1393|  7.45k|    for (const auto& txout : outputs_spent) {
  ------------------
  |  Branch (1393:28): [True: 7.45k, False: 1.51k]
  ------------------
 1394|  7.45k|        ss << txout.nValue;
 1395|  7.45k|    }
 1396|  1.51k|    return ss.GetSHA256();
 1397|  1.51k|}
interpreter.cpp:_ZN12_GLOBAL__N_121GetSpentScriptsSHA256ERKNSt3__16vectorI6CTxOutNS0_9allocatorIS2_EEEE:
 1401|  1.51k|{
 1402|  1.51k|    HashWriter ss{};
 1403|  7.45k|    for (const auto& txout : outputs_spent) {
  ------------------
  |  Branch (1403:28): [True: 7.45k, False: 1.51k]
  ------------------
 1404|  7.45k|        ss << txout.scriptPubKey;
 1405|  7.45k|    }
 1406|  1.51k|    return ss.GetSHA256();
 1407|  1.51k|}
interpreter.cpp:_ZL17HandleMissingData19MissingDataBehavior:
 1481|    416|{
 1482|    416|    switch (mdb) {
  ------------------
  |  Branch (1482:13): [True: 416, False: 0]
  ------------------
 1483|      0|    case MissingDataBehavior::ASSERT_FAIL:
  ------------------
  |  Branch (1483:5): [True: 0, False: 416]
  ------------------
 1484|      0|        assert(!"Missing data");
  ------------------
  |  Branch (1484:9): [Folded, False: 0]
  ------------------
 1485|      0|        break;
 1486|    416|    case MissingDataBehavior::FAIL:
  ------------------
  |  Branch (1486:5): [True: 416, False: 0]
  ------------------
 1487|    416|        return false;
 1488|    416|    }
 1489|    416|    assert(!"Unknown MissingDataBehavior value");
  ------------------
  |  Branch (1489:5): [Folded, False: 0]
  ------------------
 1490|      0|}
interpreter.cpp:_ZL20VerifyWitnessProgramRK14CScriptWitnessiRKNSt3__16vectorIhNS2_9allocatorIhEEEE19script_verify_flagsRK20BaseSignatureCheckerP13ScriptError_tb:
 1928|  40.8k|{
 1929|  40.8k|    CScript exec_script; //!< Actually executed script (last stack item in P2WSH; implied P2PKH script in P2WPKH; leaf script in P2TR)
 1930|  40.8k|    std::span stack{witness.stack};
 1931|  40.8k|    ScriptExecutionData execdata;
 1932|       |
 1933|  40.8k|    if (witversion == 0) {
  ------------------
  |  Branch (1933:9): [True: 26.9k, False: 13.9k]
  ------------------
 1934|  26.9k|        if (program.size() == WITNESS_V0_SCRIPTHASH_SIZE) {
  ------------------
  |  Branch (1934:13): [True: 13.2k, False: 13.6k]
  ------------------
 1935|       |            // BIP141 P2WSH: 32-byte witness v0 program (which encodes SHA256(script))
 1936|  13.2k|            if (stack.size() == 0) {
  ------------------
  |  Branch (1936:17): [True: 8.03k, False: 5.25k]
  ------------------
 1937|  8.03k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY);
 1938|  8.03k|            }
 1939|  5.25k|            const valtype& script_bytes = SpanPopBack(stack);
 1940|  5.25k|            exec_script = CScript(script_bytes.begin(), script_bytes.end());
 1941|  5.25k|            uint256 hash_exec_script;
 1942|  5.25k|            CSHA256().Write(exec_script.data(), exec_script.size()).Finalize(hash_exec_script.begin());
 1943|  5.25k|            if (memcmp(hash_exec_script.begin(), program.data(), 32)) {
  ------------------
  |  Branch (1943:17): [True: 2.50k, False: 2.74k]
  ------------------
 1944|  2.50k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
 1945|  2.50k|            }
 1946|  2.74k|            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
 1947|  13.6k|        } else if (program.size() == WITNESS_V0_KEYHASH_SIZE) {
  ------------------
  |  Branch (1947:20): [True: 13.0k, False: 653]
  ------------------
 1948|       |            // BIP141 P2WPKH: 20-byte witness v0 program (which encodes Hash160(pubkey))
 1949|  13.0k|            if (stack.size() != 2) {
  ------------------
  |  Branch (1949:17): [True: 1.33k, False: 11.6k]
  ------------------
 1950|  1.33k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); // 2 items in witness
 1951|  1.33k|            }
 1952|  11.6k|            exec_script << OP_DUP << OP_HASH160 << program << OP_EQUALVERIFY << OP_CHECKSIG;
 1953|  11.6k|            return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::WITNESS_V0, checker, execdata, serror);
 1954|  13.0k|        } else {
 1955|    653|            return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH);
 1956|    653|        }
 1957|  26.9k|    } else if (witversion == 1 && program.size() == WITNESS_V1_TAPROOT_SIZE && !is_p2sh) {
  ------------------
  |  Branch (1957:16): [True: 13.2k, False: 683]
  |  Branch (1957:35): [True: 12.0k, False: 1.17k]
  |  Branch (1957:80): [True: 12.0k, False: 0]
  ------------------
 1958|       |        // BIP341 Taproot: 32-byte non-P2SH witness v1 program (which encodes a P2C-tweaked pubkey)
 1959|  12.0k|        if (!(flags & SCRIPT_VERIFY_TAPROOT)) return set_success(serror);
  ------------------
  |  Branch (1959:13): [True: 0, False: 12.0k]
  ------------------
 1960|  12.0k|        if (stack.size() == 0) return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY);
  ------------------
  |  Branch (1960:13): [True: 6.54k, False: 5.54k]
  ------------------
 1961|  5.54k|        if (stack.size() >= 2 && !stack.back().empty() && stack.back()[0] == ANNEX_TAG) {
  ------------------
  |  Branch (1961:13): [True: 3.09k, False: 2.44k]
  |  Branch (1961:34): [True: 2.82k, False: 271]
  |  Branch (1961:59): [True: 267, False: 2.56k]
  ------------------
 1962|       |            // Drop annex (this is non-standard; see IsWitnessStandard)
 1963|    267|            const valtype& annex = SpanPopBack(stack);
 1964|    267|            execdata.m_annex_hash = (HashWriter{} << annex).GetSHA256();
 1965|    267|            execdata.m_annex_present = true;
 1966|  5.28k|        } else {
 1967|  5.28k|            execdata.m_annex_present = false;
 1968|  5.28k|        }
 1969|  5.54k|        execdata.m_annex_init = true;
 1970|  5.54k|        if (stack.size() == 1) {
  ------------------
  |  Branch (1970:13): [True: 2.45k, False: 3.09k]
  ------------------
 1971|       |            // Key path spending (stack size is 1 after removing optional annex)
 1972|  2.45k|            if (!checker.CheckSchnorrSignature(stack.front(), program, SigVersion::TAPROOT, execdata, serror)) {
  ------------------
  |  Branch (1972:17): [True: 2.43k, False: 18]
  ------------------
 1973|  2.43k|                return false; // serror is set
 1974|  2.43k|            }
 1975|     18|            return set_success(serror);
 1976|  3.09k|        } else {
 1977|       |            // Script path spending (stack size is >1 after removing optional annex)
 1978|  3.09k|            const valtype& control = SpanPopBack(stack);
 1979|  3.09k|            const valtype& script = SpanPopBack(stack);
 1980|  3.09k|            if (control.size() < TAPROOT_CONTROL_BASE_SIZE || control.size() > TAPROOT_CONTROL_MAX_SIZE || ((control.size() - TAPROOT_CONTROL_BASE_SIZE) % TAPROOT_CONTROL_NODE_SIZE) != 0) {
  ------------------
  |  Branch (1980:17): [True: 1.28k, False: 1.80k]
  |  Branch (1980:63): [True: 42, False: 1.76k]
  |  Branch (1980:108): [True: 407, False: 1.35k]
  ------------------
 1981|  1.73k|                return set_error(serror, SCRIPT_ERR_TAPROOT_WRONG_CONTROL_SIZE);
 1982|  1.73k|            }
 1983|  1.35k|            execdata.m_tapleaf_hash = ComputeTapleafHash(control[0] & TAPROOT_LEAF_MASK, script);
 1984|  1.35k|            if (!VerifyTaprootCommitment(control, program, execdata.m_tapleaf_hash)) {
  ------------------
  |  Branch (1984:17): [True: 1.35k, False: 0]
  ------------------
 1985|  1.35k|                return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
 1986|  1.35k|            }
 1987|      0|            execdata.m_tapleaf_hash_init = true;
 1988|      0|            if ((control[0] & TAPROOT_LEAF_MASK) == TAPROOT_LEAF_TAPSCRIPT) {
  ------------------
  |  Branch (1988:17): [True: 0, False: 0]
  ------------------
 1989|       |                // Tapscript (leaf version 0xc0)
 1990|      0|                exec_script = CScript(script.begin(), script.end());
 1991|      0|                execdata.m_validation_weight_left = ::GetSerializeSize(witness.stack) + VALIDATION_WEIGHT_OFFSET;
 1992|      0|                execdata.m_validation_weight_left_init = true;
 1993|      0|                return ExecuteWitnessScript(stack, exec_script, flags, SigVersion::TAPSCRIPT, checker, execdata, serror);
 1994|      0|            }
 1995|      0|            if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION) {
  ------------------
  |  Branch (1995:17): [True: 0, False: 0]
  ------------------
 1996|      0|                return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION);
 1997|      0|            }
 1998|      0|            return set_success(serror);
 1999|      0|        }
 2000|  5.54k|    } else if (!is_p2sh && CScript::IsPayToAnchor(witversion, program)) {
  ------------------
  |  Branch (2000:16): [True: 1.84k, False: 10]
  |  Branch (2000:28): [True: 373, False: 1.47k]
  ------------------
 2001|    373|        return true;
 2002|  1.48k|    } else {
 2003|  1.48k|        if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM) {
  ------------------
  |  Branch (2003:13): [True: 1.48k, False: 0]
  ------------------
 2004|  1.48k|            return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM);
 2005|  1.48k|        }
 2006|       |        // Other version/size/p2sh combinations return true for future softfork compatibility
 2007|      0|        return true;
 2008|  1.48k|    }
 2009|       |    // There is intentionally no return statement here, to be able to use "control reaches end of non-void function" warnings to detect gaps in the logic above.
 2010|  40.8k|}
interpreter.cpp:_ZL20ExecuteWitnessScriptRKNSt3__14spanIKNS_6vectorIhNS_9allocatorIhEEEELm18446744073709551615EEERK7CScript19script_verify_flags10SigVersionRK20BaseSignatureCheckerR19ScriptExecutionDataP13ScriptError_t:
 1843|  14.4k|{
 1844|  14.4k|    std::vector<valtype> stack{stack_span.begin(), stack_span.end()};
 1845|       |
 1846|  14.4k|    if (sigversion == SigVersion::TAPSCRIPT) {
  ------------------
  |  Branch (1846:9): [True: 0, False: 14.4k]
  ------------------
 1847|       |        // OP_SUCCESSx processing overrides everything, including stack element size limits
 1848|      0|        CScript::const_iterator pc = exec_script.begin();
 1849|      0|        while (pc < exec_script.end()) {
  ------------------
  |  Branch (1849:16): [True: 0, False: 0]
  ------------------
 1850|      0|            opcodetype opcode;
 1851|      0|            if (!exec_script.GetOp(pc, opcode)) {
  ------------------
  |  Branch (1851:17): [True: 0, False: 0]
  ------------------
 1852|       |                // Note how this condition would not be reached if an unknown OP_SUCCESSx was found
 1853|      0|                return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
 1854|      0|            }
 1855|       |            // New opcodes will be listed here. May use a different sigversion to modify existing opcodes.
 1856|      0|            if (IsOpSuccess(opcode)) {
  ------------------
  |  Branch (1856:17): [True: 0, False: 0]
  ------------------
 1857|      0|                if (flags & SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS) {
  ------------------
  |  Branch (1857:21): [True: 0, False: 0]
  ------------------
 1858|      0|                    return set_error(serror, SCRIPT_ERR_DISCOURAGE_OP_SUCCESS);
 1859|      0|                }
 1860|      0|                return set_success(serror);
 1861|      0|            }
 1862|      0|        }
 1863|       |
 1864|       |        // Tapscript enforces initial stack size limits (altstack is empty here)
 1865|      0|        if (stack.size() > MAX_STACK_SIZE) return set_error(serror, SCRIPT_ERR_STACK_SIZE);
  ------------------
  |  Branch (1865:13): [True: 0, False: 0]
  ------------------
 1866|      0|    }
 1867|       |
 1868|       |    // Disallow stack item size > MAX_SCRIPT_ELEMENT_SIZE in witness stack
 1869|  52.3k|    for (const valtype& elem : stack) {
  ------------------
  |  Branch (1869:30): [True: 52.3k, False: 14.3k]
  ------------------
 1870|  52.3k|        if (elem.size() > MAX_SCRIPT_ELEMENT_SIZE) return set_error(serror, SCRIPT_ERR_PUSH_SIZE);
  ------------------
  |  Branch (1870:13): [True: 80, False: 52.2k]
  ------------------
 1871|  52.3k|    }
 1872|       |
 1873|       |    // Run the script interpreter.
 1874|  14.3k|    if (!EvalScript(stack, exec_script, flags, checker, sigversion, execdata, serror)) return false;
  ------------------
  |  Branch (1874:9): [True: 12.4k, False: 1.93k]
  ------------------
 1875|       |
 1876|       |    // Scripts inside witness implicitly require cleanstack behaviour
 1877|  1.93k|    if (stack.size() != 1) return set_error(serror, SCRIPT_ERR_CLEANSTACK);
  ------------------
  |  Branch (1877:9): [True: 1.19k, False: 733]
  ------------------
 1878|    733|    if (!CastToBool(stack.back())) return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
  ------------------
  |  Branch (1878:9): [True: 196, False: 537]
  ------------------
 1879|    537|    return true;
 1880|    733|}
interpreter.cpp:_ZL23VerifyTaprootCommitmentRKNSt3__16vectorIhNS_9allocatorIhEEEES5_RK7uint256:
 1914|  1.35k|{
 1915|  1.35k|    assert(control.size() >= TAPROOT_CONTROL_BASE_SIZE);
  ------------------
  |  Branch (1915:5): [True: 1.35k, False: 0]
  ------------------
 1916|  1.35k|    assert(program.size() >= uint256::size());
  ------------------
  |  Branch (1916:5): [True: 1.35k, False: 0]
  ------------------
 1917|       |    //! The internal pubkey (x-only, so no Y coordinate parity).
 1918|  1.35k|    const XOnlyPubKey p{std::span{control}.subspan(1, TAPROOT_CONTROL_BASE_SIZE - 1)};
 1919|       |    //! The output pubkey (taken from the scriptPubKey).
 1920|  1.35k|    const XOnlyPubKey q{program};
 1921|       |    // Compute the Merkle root from the leaf and the provided path.
 1922|  1.35k|    const uint256 merkle_root = ComputeTaprootMerkleRoot(control, tapleaf_hash);
 1923|       |    // Verify that the output pubkey matches the tweaked internal pubkey, after correcting for parity.
 1924|  1.35k|    return q.CheckTapTweak(p, merkle_root, control[0] & 1);
 1925|  1.35k|}
interpreter.cpp:_ZN12_GLOBAL__N_117GetPrevoutsSHA256I12CTransactionEE7uint256RKT_:
 1359|  7.72k|{
 1360|  7.72k|    HashWriter ss{};
 1361|   138k|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1361:27): [True: 138k, False: 7.72k]
  ------------------
 1362|   138k|        ss << txin.prevout;
 1363|   138k|    }
 1364|  7.72k|    return ss.GetSHA256();
 1365|  7.72k|}
interpreter.cpp:_ZN12_GLOBAL__N_118GetSequencesSHA256I12CTransactionEE7uint256RKT_:
 1370|  7.72k|{
 1371|  7.72k|    HashWriter ss{};
 1372|   138k|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1372:27): [True: 138k, False: 7.72k]
  ------------------
 1373|   138k|        ss << txin.nSequence;
 1374|   138k|    }
 1375|  7.72k|    return ss.GetSHA256();
 1376|  7.72k|}
interpreter.cpp:_ZN12_GLOBAL__N_116GetOutputsSHA256I12CTransactionEE7uint256RKT_:
 1381|  7.72k|{
 1382|  7.72k|    HashWriter ss{};
 1383|  10.8k|    for (const auto& txout : txTo.vout) {
  ------------------
  |  Branch (1383:28): [True: 10.8k, False: 7.72k]
  ------------------
 1384|  10.8k|        ss << txout;
 1385|  10.8k|    }
 1386|  7.72k|    return ss.GetSHA256();
 1387|  7.72k|}
interpreter.cpp:_ZN12_GLOBAL__N_117GetPrevoutsSHA256I19CMutableTransactionEE7uint256RKT_:
 1359|    109|{
 1360|    109|    HashWriter ss{};
 1361|  1.18k|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1361:27): [True: 1.18k, False: 109]
  ------------------
 1362|  1.18k|        ss << txin.prevout;
 1363|  1.18k|    }
 1364|    109|    return ss.GetSHA256();
 1365|    109|}
interpreter.cpp:_ZN12_GLOBAL__N_118GetSequencesSHA256I19CMutableTransactionEE7uint256RKT_:
 1370|     98|{
 1371|     98|    HashWriter ss{};
 1372|  1.05k|    for (const auto& txin : txTo.vin) {
  ------------------
  |  Branch (1372:27): [True: 1.05k, False: 98]
  ------------------
 1373|  1.05k|        ss << txin.nSequence;
 1374|  1.05k|    }
 1375|     98|    return ss.GetSHA256();
 1376|     98|}
interpreter.cpp:_ZN12_GLOBAL__N_116GetOutputsSHA256I19CMutableTransactionEE7uint256RKT_:
 1381|    164|{
 1382|    164|    HashWriter ss{};
 1383|    725|    for (const auto& txout : txTo.vout) {
  ------------------
  |  Branch (1383:28): [True: 725, False: 164]
  ------------------
 1384|    725|        ss << txout;
 1385|    725|    }
 1386|    164|    return ss.GetSHA256();
 1387|    164|}
_Z13SignatureHashI12CTransactionE7uint256RK7CScriptRKT_jiRKl10SigVersionPK26PrecomputedTransactionDataP12SigHashCache:
 1611|  21.8k|{
 1612|  21.8k|    assert(nIn < txTo.vin.size());
  ------------------
  |  Branch (1612:5): [True: 21.8k, False: 0]
  ------------------
 1613|       |
 1614|  21.8k|    if (sigversion != SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (1614:9): [True: 17.7k, False: 4.15k]
  ------------------
 1615|       |        // Check for invalid use of SIGHASH_SINGLE
 1616|  17.7k|        if ((nHashType & 0x1f) == SIGHASH_SINGLE) {
  ------------------
  |  Branch (1616:13): [True: 543, False: 17.2k]
  ------------------
 1617|    543|            if (nIn >= txTo.vout.size()) {
  ------------------
  |  Branch (1617:17): [True: 0, False: 543]
  ------------------
 1618|       |                //  nOut out of range
 1619|      0|                return uint256::ONE;
 1620|      0|            }
 1621|    543|        }
 1622|  17.7k|    }
 1623|       |
 1624|  21.8k|    HashWriter ss{};
 1625|       |
 1626|       |    // Try to compute using cached SHA256 midstate.
 1627|  21.8k|    if (sighash_cache && sighash_cache->Load(nHashType, scriptCode, ss)) {
  ------------------
  |  Branch (1627:9): [True: 21.8k, False: 0]
  |  Branch (1627:26): [True: 0, False: 21.8k]
  ------------------
 1628|       |        // Add sighash type and hash.
 1629|      0|        ss << nHashType;
 1630|      0|        return ss.GetHash();
 1631|      0|    }
 1632|       |
 1633|  21.8k|    if (sigversion == SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (1633:9): [True: 4.15k, False: 17.7k]
  ------------------
 1634|  4.15k|        uint256 hashPrevouts;
 1635|  4.15k|        uint256 hashSequence;
 1636|  4.15k|        uint256 hashOutputs;
 1637|  4.15k|        const bool cacheready = cache && cache->m_bip143_segwit_ready;
  ------------------
  |  Branch (1637:33): [True: 4.15k, False: 0]
  |  Branch (1637:42): [True: 4.15k, False: 0]
  ------------------
 1638|       |
 1639|  4.15k|        if (!(nHashType & SIGHASH_ANYONECANPAY)) {
  ------------------
  |  Branch (1639:13): [True: 3.36k, False: 793]
  ------------------
 1640|  3.36k|            hashPrevouts = cacheready ? cache->hashPrevouts : SHA256Uint256(GetPrevoutsSHA256(txTo));
  ------------------
  |  Branch (1640:28): [True: 3.36k, False: 0]
  ------------------
 1641|  3.36k|        }
 1642|       |
 1643|  4.15k|        if (!(nHashType & SIGHASH_ANYONECANPAY) && (nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1643:13): [True: 3.36k, False: 793]
  |  Branch (1643:52): [True: 1.60k, False: 1.76k]
  |  Branch (1643:92): [True: 1.06k, False: 537]
  ------------------
 1644|  1.06k|            hashSequence = cacheready ? cache->hashSequence : SHA256Uint256(GetSequencesSHA256(txTo));
  ------------------
  |  Branch (1644:28): [True: 1.06k, False: 0]
  ------------------
 1645|  1.06k|        }
 1646|       |
 1647|  4.15k|        if ((nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1647:13): [True: 2.03k, False: 2.12k]
  |  Branch (1647:53): [True: 1.22k, False: 808]
  ------------------
 1648|  1.22k|            hashOutputs = cacheready ? cache->hashOutputs : SHA256Uint256(GetOutputsSHA256(txTo));
  ------------------
  |  Branch (1648:27): [True: 1.22k, False: 0]
  ------------------
 1649|  2.92k|        } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nIn < txTo.vout.size()) {
  ------------------
  |  Branch (1649:20): [True: 2.12k, False: 808]
  |  Branch (1649:60): [True: 382, False: 1.73k]
  ------------------
 1650|    382|            HashWriter inner_ss{};
 1651|    382|            inner_ss << txTo.vout[nIn];
 1652|    382|            hashOutputs = inner_ss.GetHash();
 1653|    382|        }
 1654|       |
 1655|       |        // Version
 1656|  4.15k|        ss << txTo.version;
 1657|       |        // Input prevouts/nSequence (none/all, depending on flags)
 1658|  4.15k|        ss << hashPrevouts;
 1659|  4.15k|        ss << hashSequence;
 1660|       |        // The input being signed (replacing the scriptSig with scriptCode + amount)
 1661|       |        // The prevout may already be contained in hashPrevout, and the nSequence
 1662|       |        // may already be contain in hashSequence.
 1663|  4.15k|        ss << txTo.vin[nIn].prevout;
 1664|  4.15k|        ss << scriptCode;
 1665|  4.15k|        ss << amount;
 1666|  4.15k|        ss << txTo.vin[nIn].nSequence;
 1667|       |        // Outputs (none/one/all, depending on flags)
 1668|  4.15k|        ss << hashOutputs;
 1669|       |        // Locktime
 1670|  4.15k|        ss << txTo.nLockTime;
 1671|  17.7k|    } else {
 1672|       |        // Wrapper to serialize only the necessary parts of the transaction being signed
 1673|  17.7k|        CTransactionSignatureSerializer<T> txTmp(txTo, scriptCode, nIn, nHashType);
 1674|       |
 1675|       |        // Serialize
 1676|  17.7k|        ss << txTmp;
 1677|  17.7k|    }
 1678|       |
 1679|       |    // If a cache object was provided, store the midstate there.
 1680|  21.8k|    if (sighash_cache != nullptr) {
  ------------------
  |  Branch (1680:9): [True: 21.8k, False: 0]
  ------------------
 1681|  21.8k|        sighash_cache->Store(nHashType, scriptCode, ss);
 1682|  21.8k|    }
 1683|       |
 1684|       |    // Add sighash type and hash.
 1685|  21.8k|    ss << nHashType;
 1686|  21.8k|    return ss.GetHash();
 1687|  21.8k|}
interpreter.cpp:_ZN12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionEC2ERKS1_RK7CScriptji:
 1276|  17.7k|        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
 1277|  17.7k|        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
 1278|  17.7k|        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
 1279|  17.7k|        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE9SerializeI10HashWriterEEvRT_:
 1338|  17.7k|    void Serialize(S &s) const {
 1339|       |        // Serialize version
 1340|  17.7k|        ::Serialize(s, txTo.version);
 1341|       |        // Serialize vin
 1342|  17.7k|        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
  ------------------
  |  Branch (1342:32): [True: 550, False: 17.1k]
  ------------------
 1343|  17.7k|        ::WriteCompactSize(s, nInputs);
 1344|  2.05M|        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
  ------------------
  |  Branch (1344:39): [True: 2.03M, False: 17.7k]
  ------------------
 1345|  2.03M|             SerializeInput(s, nInput);
 1346|       |        // Serialize vout
 1347|  17.7k|        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
  ------------------
  |  Branch (1347:33): [True: 11.4k, False: 6.34k]
  |  Branch (1347:50): [True: 543, False: 5.79k]
  ------------------
 1348|  17.7k|        ::WriteCompactSize(s, nOutputs);
 1349|  78.4k|        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
  ------------------
  |  Branch (1349:40): [True: 60.7k, False: 17.7k]
  ------------------
 1350|  60.7k|             SerializeOutput(s, nOutput);
 1351|       |        // Serialize nLockTime
 1352|  17.7k|        ::Serialize(s, txTo.nLockTime);
 1353|  17.7k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE14SerializeInputI10HashWriterEEvRT_j:
 1306|  2.03M|    void SerializeInput(S &s, unsigned int nInput) const {
 1307|       |        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
 1308|  2.03M|        if (fAnyoneCanPay)
  ------------------
  |  Branch (1308:13): [True: 550, False: 2.03M]
  ------------------
 1309|    550|            nInput = nIn;
 1310|       |        // Serialize the prevout
 1311|  2.03M|        ::Serialize(s, txTo.vin[nInput].prevout);
 1312|       |        // Serialize the script
 1313|  2.03M|        if (nInput != nIn)
  ------------------
  |  Branch (1313:13): [True: 2.01M, False: 17.7k]
  ------------------
 1314|       |            // Blank out other inputs' signatures
 1315|  2.01M|            ::Serialize(s, CScript());
 1316|  17.7k|        else
 1317|  17.7k|            SerializeScriptCode(s);
 1318|       |        // Serialize the nSequence
 1319|  2.03M|        if (nInput != nIn && (fHashSingle || fHashNone))
  ------------------
  |  Branch (1319:13): [True: 2.01M, False: 17.7k]
  |  Branch (1319:31): [True: 55.5k, False: 1.96M]
  |  Branch (1319:46): [True: 1.48M, False: 479k]
  ------------------
 1320|       |            // let the others update at will
 1321|  1.54M|            ::Serialize(s, int32_t{0});
 1322|   497k|        else
 1323|   497k|            ::Serialize(s, txTo.vin[nInput].nSequence);
 1324|  2.03M|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE19SerializeScriptCodeI10HashWriterEEvRT_:
 1283|  17.7k|    void SerializeScriptCode(S &s) const {
 1284|  17.7k|        CScript::const_iterator it = scriptCode.begin();
 1285|  17.7k|        CScript::const_iterator itBegin = it;
 1286|  17.7k|        opcodetype opcode;
 1287|  17.7k|        unsigned int nCodeSeparators = 0;
 1288|   106k|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1288:16): [True: 88.6k, False: 17.7k]
  ------------------
 1289|  88.6k|            if (opcode == OP_CODESEPARATOR)
  ------------------
  |  Branch (1289:17): [True: 0, False: 88.6k]
  ------------------
 1290|      0|                nCodeSeparators++;
 1291|  88.6k|        }
 1292|  17.7k|        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
 1293|  17.7k|        it = itBegin;
 1294|   106k|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1294:16): [True: 88.6k, False: 17.7k]
  ------------------
 1295|  88.6k|            if (opcode == OP_CODESEPARATOR) {
  ------------------
  |  Branch (1295:17): [True: 0, False: 88.6k]
  ------------------
 1296|      0|                s.write(std::as_bytes(std::span{&itBegin[0], size_t(it - itBegin - 1)}));
 1297|      0|                itBegin = it;
 1298|      0|            }
 1299|  88.6k|        }
 1300|  17.7k|        if (itBegin != scriptCode.end())
  ------------------
  |  Branch (1300:13): [True: 17.7k, False: 0]
  ------------------
 1301|  17.7k|            s.write(std::as_bytes(std::span{&itBegin[0], size_t(it - itBegin)}));
 1302|  17.7k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionE15SerializeOutputI10HashWriterEEvRT_j:
 1328|  60.7k|    void SerializeOutput(S &s, unsigned int nOutput) const {
 1329|  60.7k|        if (fHashSingle && nOutput != nIn)
  ------------------
  |  Branch (1329:13): [True: 25.7k, False: 34.9k]
  |  Branch (1329:28): [True: 25.2k, False: 543]
  ------------------
 1330|       |            // Do not lock-in the txout payee at other indices as txin
 1331|  25.2k|            ::Serialize(s, CTxOut());
 1332|  35.4k|        else
 1333|  35.4k|            ::Serialize(s, txTo.vout[nOutput]);
 1334|  60.7k|    }
_Z20SignatureHashSchnorrI12CTransactionEbR7uint256R19ScriptExecutionDataRKT_jh10SigVersionRK26PrecomputedTransactionData19MissingDataBehavior:
 1494|    385|{
 1495|    385|    uint8_t ext_flag, key_version;
 1496|    385|    switch (sigversion) {
 1497|    385|    case SigVersion::TAPROOT:
  ------------------
  |  Branch (1497:5): [True: 385, False: 0]
  ------------------
 1498|    385|        ext_flag = 0;
 1499|       |        // key_version is not used and left uninitialized.
 1500|    385|        break;
 1501|      0|    case SigVersion::TAPSCRIPT:
  ------------------
  |  Branch (1501:5): [True: 0, False: 385]
  ------------------
 1502|      0|        ext_flag = 1;
 1503|       |        // key_version must be 0 for now, representing the current version of
 1504|       |        // 32-byte public keys in the tapscript signature opcode execution.
 1505|       |        // An upgradable public key version (with a size not 32-byte) may
 1506|       |        // request a different key_version with a new sigversion.
 1507|      0|        key_version = 0;
 1508|      0|        break;
 1509|      0|    default:
  ------------------
  |  Branch (1509:5): [True: 0, False: 385]
  ------------------
 1510|      0|        assert(false);
  ------------------
  |  Branch (1510:9): [Folded, False: 0]
  ------------------
 1511|    385|    }
 1512|    385|    assert(in_pos < tx_to.vin.size());
  ------------------
  |  Branch (1512:5): [True: 385, False: 0]
  ------------------
 1513|    385|    if (!(cache.m_bip341_taproot_ready && cache.m_spent_outputs_ready)) {
  ------------------
  |  Branch (1513:11): [True: 354, False: 31]
  |  Branch (1513:43): [True: 354, False: 0]
  ------------------
 1514|     31|        return HandleMissingData(mdb);
 1515|     31|    }
 1516|       |
 1517|    354|    HashWriter ss{HASHER_TAPSIGHASH};
 1518|       |
 1519|       |    // Epoch
 1520|    354|    static constexpr uint8_t EPOCH = 0;
 1521|    354|    ss << EPOCH;
 1522|       |
 1523|       |    // Hash type
 1524|    354|    const uint8_t output_type = (hash_type == SIGHASH_DEFAULT) ? SIGHASH_ALL : (hash_type & SIGHASH_OUTPUT_MASK); // Default (no sighash byte) is equivalent to SIGHASH_ALL
  ------------------
  |  Branch (1524:33): [True: 128, False: 226]
  ------------------
 1525|    354|    const uint8_t input_type = hash_type & SIGHASH_INPUT_MASK;
 1526|    354|    if (!(hash_type <= 0x03 || (hash_type >= 0x81 && hash_type <= 0x83))) return false;
  ------------------
  |  Branch (1526:11): [True: 322, False: 32]
  |  Branch (1526:33): [True: 20, False: 12]
  |  Branch (1526:54): [True: 8, False: 12]
  ------------------
 1527|    330|    ss << hash_type;
 1528|       |
 1529|       |    // Transaction level data
 1530|    330|    ss << tx_to.version;
 1531|    330|    ss << tx_to.nLockTime;
 1532|    330|    if (input_type != SIGHASH_ANYONECANPAY) {
  ------------------
  |  Branch (1532:9): [True: 322, False: 8]
  ------------------
 1533|    322|        ss << cache.m_prevouts_single_hash;
 1534|    322|        ss << cache.m_spent_amounts_single_hash;
 1535|    322|        ss << cache.m_spent_scripts_single_hash;
 1536|    322|        ss << cache.m_sequences_single_hash;
 1537|    322|    }
 1538|    330|    if (output_type == SIGHASH_ALL) {
  ------------------
  |  Branch (1538:9): [True: 218, False: 112]
  ------------------
 1539|    218|        ss << cache.m_outputs_single_hash;
 1540|    218|    }
 1541|       |
 1542|       |    // Data about the input/prevout being spent
 1543|    330|    assert(execdata.m_annex_init);
  ------------------
  |  Branch (1543:5): [True: 330, False: 0]
  ------------------
 1544|    330|    const bool have_annex = execdata.m_annex_present;
 1545|    330|    const uint8_t spend_type = (ext_flag << 1) + (have_annex ? 1 : 0); // The low bit indicates whether an annex is present.
  ------------------
  |  Branch (1545:51): [True: 2, False: 328]
  ------------------
 1546|    330|    ss << spend_type;
 1547|    330|    if (input_type == SIGHASH_ANYONECANPAY) {
  ------------------
  |  Branch (1547:9): [True: 8, False: 322]
  ------------------
 1548|      8|        ss << tx_to.vin[in_pos].prevout;
 1549|      8|        ss << cache.m_spent_outputs[in_pos];
 1550|      8|        ss << tx_to.vin[in_pos].nSequence;
 1551|    322|    } else {
 1552|    322|        ss << in_pos;
 1553|    322|    }
 1554|    330|    if (have_annex) {
  ------------------
  |  Branch (1554:9): [True: 2, False: 328]
  ------------------
 1555|      2|        ss << execdata.m_annex_hash;
 1556|      2|    }
 1557|       |
 1558|       |    // Data about the output (if only one).
 1559|    330|    if (output_type == SIGHASH_SINGLE) {
  ------------------
  |  Branch (1559:9): [True: 46, False: 284]
  ------------------
 1560|     46|        if (in_pos >= tx_to.vout.size()) return false;
  ------------------
  |  Branch (1560:13): [True: 15, False: 31]
  ------------------
 1561|     31|        if (!execdata.m_output_hash) {
  ------------------
  |  Branch (1561:13): [True: 31, False: 0]
  ------------------
 1562|     31|            HashWriter sha_single_output{};
 1563|     31|            sha_single_output << tx_to.vout[in_pos];
 1564|     31|            execdata.m_output_hash = sha_single_output.GetSHA256();
 1565|     31|        }
 1566|     31|        ss << execdata.m_output_hash.value();
 1567|     31|    }
 1568|       |
 1569|       |    // Additional data for BIP 342 signatures
 1570|    315|    if (sigversion == SigVersion::TAPSCRIPT) {
  ------------------
  |  Branch (1570:9): [True: 0, False: 315]
  ------------------
 1571|      0|        assert(execdata.m_tapleaf_hash_init);
  ------------------
  |  Branch (1571:9): [True: 0, False: 0]
  ------------------
 1572|      0|        ss << execdata.m_tapleaf_hash;
 1573|      0|        ss << key_version;
 1574|      0|        assert(execdata.m_codeseparator_pos_init);
  ------------------
  |  Branch (1574:9): [True: 0, False: 0]
  ------------------
 1575|      0|        ss << execdata.m_codeseparator_pos;
 1576|      0|    }
 1577|       |
 1578|    315|    hash_out = ss.GetSHA256();
 1579|    315|    return true;
 1580|    315|}
_Z13SignatureHashI19CMutableTransactionE7uint256RK7CScriptRKT_jiRKl10SigVersionPK26PrecomputedTransactionDataP12SigHashCache:
 1611|  54.8k|{
 1612|  54.8k|    assert(nIn < txTo.vin.size());
  ------------------
  |  Branch (1612:5): [True: 54.8k, False: 0]
  ------------------
 1613|       |
 1614|  54.8k|    if (sigversion != SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (1614:9): [True: 43.9k, False: 10.9k]
  ------------------
 1615|       |        // Check for invalid use of SIGHASH_SINGLE
 1616|  43.9k|        if ((nHashType & 0x1f) == SIGHASH_SINGLE) {
  ------------------
  |  Branch (1616:13): [True: 1.80k, False: 42.0k]
  ------------------
 1617|  1.80k|            if (nIn >= txTo.vout.size()) {
  ------------------
  |  Branch (1617:17): [True: 710, False: 1.09k]
  ------------------
 1618|       |                //  nOut out of range
 1619|    710|                return uint256::ONE;
 1620|    710|            }
 1621|  1.80k|        }
 1622|  43.9k|    }
 1623|       |
 1624|  54.1k|    HashWriter ss{};
 1625|       |
 1626|       |    // Try to compute using cached SHA256 midstate.
 1627|  54.1k|    if (sighash_cache && sighash_cache->Load(nHashType, scriptCode, ss)) {
  ------------------
  |  Branch (1627:9): [True: 22.4k, False: 31.6k]
  |  Branch (1627:26): [True: 0, False: 22.4k]
  ------------------
 1628|       |        // Add sighash type and hash.
 1629|      0|        ss << nHashType;
 1630|      0|        return ss.GetHash();
 1631|      0|    }
 1632|       |
 1633|  54.1k|    if (sigversion == SigVersion::WITNESS_V0) {
  ------------------
  |  Branch (1633:9): [True: 10.9k, False: 43.1k]
  ------------------
 1634|  10.9k|        uint256 hashPrevouts;
 1635|  10.9k|        uint256 hashSequence;
 1636|  10.9k|        uint256 hashOutputs;
 1637|  10.9k|        const bool cacheready = cache && cache->m_bip143_segwit_ready;
  ------------------
  |  Branch (1637:33): [True: 10.7k, False: 179]
  |  Branch (1637:42): [True: 10.7k, False: 0]
  ------------------
 1638|       |
 1639|  10.9k|        if (!(nHashType & SIGHASH_ANYONECANPAY)) {
  ------------------
  |  Branch (1639:13): [True: 9.25k, False: 1.67k]
  ------------------
 1640|  9.25k|            hashPrevouts = cacheready ? cache->hashPrevouts : SHA256Uint256(GetPrevoutsSHA256(txTo));
  ------------------
  |  Branch (1640:28): [True: 9.14k, False: 109]
  ------------------
 1641|  9.25k|        }
 1642|       |
 1643|  10.9k|        if (!(nHashType & SIGHASH_ANYONECANPAY) && (nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1643:13): [True: 9.25k, False: 1.67k]
  |  Branch (1643:52): [True: 5.72k, False: 3.53k]
  |  Branch (1643:92): [True: 4.63k, False: 1.08k]
  ------------------
 1644|  4.63k|            hashSequence = cacheready ? cache->hashSequence : SHA256Uint256(GetSequencesSHA256(txTo));
  ------------------
  |  Branch (1644:28): [True: 4.53k, False: 98]
  ------------------
 1645|  4.63k|        }
 1646|       |
 1647|  10.9k|        if ((nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
  ------------------
  |  Branch (1647:13): [True: 6.67k, False: 4.25k]
  |  Branch (1647:53): [True: 5.05k, False: 1.62k]
  ------------------
 1648|  5.05k|            hashOutputs = cacheready ? cache->hashOutputs : SHA256Uint256(GetOutputsSHA256(txTo));
  ------------------
  |  Branch (1648:27): [True: 4.88k, False: 164]
  ------------------
 1649|  5.88k|        } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nIn < txTo.vout.size()) {
  ------------------
  |  Branch (1649:20): [True: 4.25k, False: 1.62k]
  |  Branch (1649:60): [True: 768, False: 3.48k]
  ------------------
 1650|    768|            HashWriter inner_ss{};
 1651|    768|            inner_ss << txTo.vout[nIn];
 1652|    768|            hashOutputs = inner_ss.GetHash();
 1653|    768|        }
 1654|       |
 1655|       |        // Version
 1656|  10.9k|        ss << txTo.version;
 1657|       |        // Input prevouts/nSequence (none/all, depending on flags)
 1658|  10.9k|        ss << hashPrevouts;
 1659|  10.9k|        ss << hashSequence;
 1660|       |        // The input being signed (replacing the scriptSig with scriptCode + amount)
 1661|       |        // The prevout may already be contained in hashPrevout, and the nSequence
 1662|       |        // may already be contain in hashSequence.
 1663|  10.9k|        ss << txTo.vin[nIn].prevout;
 1664|  10.9k|        ss << scriptCode;
 1665|  10.9k|        ss << amount;
 1666|  10.9k|        ss << txTo.vin[nIn].nSequence;
 1667|       |        // Outputs (none/one/all, depending on flags)
 1668|  10.9k|        ss << hashOutputs;
 1669|       |        // Locktime
 1670|  10.9k|        ss << txTo.nLockTime;
 1671|  43.1k|    } else {
 1672|       |        // Wrapper to serialize only the necessary parts of the transaction being signed
 1673|  43.1k|        CTransactionSignatureSerializer<T> txTmp(txTo, scriptCode, nIn, nHashType);
 1674|       |
 1675|       |        // Serialize
 1676|  43.1k|        ss << txTmp;
 1677|  43.1k|    }
 1678|       |
 1679|       |    // If a cache object was provided, store the midstate there.
 1680|  54.1k|    if (sighash_cache != nullptr) {
  ------------------
  |  Branch (1680:9): [True: 22.4k, False: 31.6k]
  ------------------
 1681|  22.4k|        sighash_cache->Store(nHashType, scriptCode, ss);
 1682|  22.4k|    }
 1683|       |
 1684|       |    // Add sighash type and hash.
 1685|  54.1k|    ss << nHashType;
 1686|  54.1k|    return ss.GetHash();
 1687|  54.1k|}
interpreter.cpp:_ZN12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionEC2ERKS1_RK7CScriptji:
 1276|  43.1k|        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
 1277|  43.1k|        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
 1278|  43.1k|        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
 1279|  43.1k|        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE9SerializeI10HashWriterEEvRT_:
 1338|  43.1k|    void Serialize(S &s) const {
 1339|       |        // Serialize version
 1340|  43.1k|        ::Serialize(s, txTo.version);
 1341|       |        // Serialize vin
 1342|  43.1k|        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
  ------------------
  |  Branch (1342:32): [True: 1.32k, False: 41.8k]
  ------------------
 1343|  43.1k|        ::WriteCompactSize(s, nInputs);
 1344|  4.76M|        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
  ------------------
  |  Branch (1344:39): [True: 4.72M, False: 43.1k]
  ------------------
 1345|  4.72M|             SerializeInput(s, nInput);
 1346|       |        // Serialize vout
 1347|  43.1k|        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
  ------------------
  |  Branch (1347:33): [True: 23.1k, False: 20.0k]
  |  Branch (1347:50): [True: 1.09k, False: 18.9k]
  ------------------
 1348|  43.1k|        ::WriteCompactSize(s, nOutputs);
 1349|   171k|        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
  ------------------
  |  Branch (1349:40): [True: 128k, False: 43.1k]
  ------------------
 1350|   128k|             SerializeOutput(s, nOutput);
 1351|       |        // Serialize nLockTime
 1352|  43.1k|        ::Serialize(s, txTo.nLockTime);
 1353|  43.1k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE14SerializeInputI10HashWriterEEvRT_j:
 1306|  4.72M|    void SerializeInput(S &s, unsigned int nInput) const {
 1307|       |        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
 1308|  4.72M|        if (fAnyoneCanPay)
  ------------------
  |  Branch (1308:13): [True: 1.32k, False: 4.72M]
  ------------------
 1309|  1.32k|            nInput = nIn;
 1310|       |        // Serialize the prevout
 1311|  4.72M|        ::Serialize(s, txTo.vin[nInput].prevout);
 1312|       |        // Serialize the script
 1313|  4.72M|        if (nInput != nIn)
  ------------------
  |  Branch (1313:13): [True: 4.68M, False: 43.1k]
  ------------------
 1314|       |            // Blank out other inputs' signatures
 1315|  4.68M|            ::Serialize(s, CScript());
 1316|  43.1k|        else
 1317|  43.1k|            SerializeScriptCode(s);
 1318|       |        // Serialize the nSequence
 1319|  4.72M|        if (nInput != nIn && (fHashSingle || fHashNone))
  ------------------
  |  Branch (1319:13): [True: 4.68M, False: 43.1k]
  |  Branch (1319:31): [True: 111k, False: 4.57M]
  |  Branch (1319:46): [True: 2.99M, False: 1.57M]
  ------------------
 1320|       |            // let the others update at will
 1321|  3.10M|            ::Serialize(s, int32_t{0});
 1322|  1.62M|        else
 1323|  1.62M|            ::Serialize(s, txTo.vin[nInput].nSequence);
 1324|  4.72M|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE19SerializeScriptCodeI10HashWriterEEvRT_:
 1283|  43.1k|    void SerializeScriptCode(S &s) const {
 1284|  43.1k|        CScript::const_iterator it = scriptCode.begin();
 1285|  43.1k|        CScript::const_iterator itBegin = it;
 1286|  43.1k|        opcodetype opcode;
 1287|  43.1k|        unsigned int nCodeSeparators = 0;
 1288|  36.1M|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1288:16): [True: 36.0M, False: 43.1k]
  ------------------
 1289|  36.0M|            if (opcode == OP_CODESEPARATOR)
  ------------------
  |  Branch (1289:17): [True: 2.08k, False: 36.0M]
  ------------------
 1290|  2.08k|                nCodeSeparators++;
 1291|  36.0M|        }
 1292|  43.1k|        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
 1293|  43.1k|        it = itBegin;
 1294|  36.1M|        while (scriptCode.GetOp(it, opcode)) {
  ------------------
  |  Branch (1294:16): [True: 36.0M, False: 43.1k]
  ------------------
 1295|  36.0M|            if (opcode == OP_CODESEPARATOR) {
  ------------------
  |  Branch (1295:17): [True: 2.08k, False: 36.0M]
  ------------------
 1296|  2.08k|                s.write(std::as_bytes(std::span{&itBegin[0], size_t(it - itBegin - 1)}));
 1297|  2.08k|                itBegin = it;
 1298|  2.08k|            }
 1299|  36.0M|        }
 1300|  43.1k|        if (itBegin != scriptCode.end())
  ------------------
  |  Branch (1300:13): [True: 42.6k, False: 536]
  ------------------
 1301|  42.6k|            s.write(std::as_bytes(std::span{&itBegin[0], size_t(it - itBegin)}));
 1302|  43.1k|    }
interpreter.cpp:_ZNK12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionE15SerializeOutputI10HashWriterEEvRT_j:
 1328|   128k|    void SerializeOutput(S &s, unsigned int nOutput) const {
 1329|   128k|        if (fHashSingle && nOutput != nIn)
  ------------------
  |  Branch (1329:13): [True: 51.5k, False: 77.2k]
  |  Branch (1329:28): [True: 50.4k, False: 1.09k]
  ------------------
 1330|       |            // Do not lock-in the txout payee at other indices as txin
 1331|  50.4k|            ::Serialize(s, CTxOut());
 1332|  78.3k|        else
 1333|  78.3k|            ::Serialize(s, txTo.vout[nOutput]);
 1334|   128k|    }

_ZN25DeferringSignatureCheckerC2ERK20BaseSignatureChecker:
  346|  92.1k|    DeferringSignatureChecker(const BaseSignatureChecker& checker) : m_checker(checker) {}
_ZNK25DeferringSignatureChecker21CheckSchnorrSignatureENSt3__14spanIKhLm18446744073709551615EEES3_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
  354|  1.21k|    {
  355|  1.21k|        return m_checker.CheckSchnorrSignature(sig, pubkey, sigversion, execdata, serror);
  356|  1.21k|    }
_ZNK25DeferringSignatureChecker13CheckLockTimeERK10CScriptNum:
  359|  8.93k|    {
  360|  8.93k|        return m_checker.CheckLockTime(nLockTime);
  361|  8.93k|    }
_ZNK25DeferringSignatureChecker13CheckSequenceERK10CScriptNum:
  363|  6.60k|    {
  364|  6.60k|        return m_checker.CheckSequence(nSequence);
  365|  6.60k|    }
_ZN26PrecomputedTransactionDataC2Ev:
  185|  7.72k|    PrecomputedTransactionData() = default;
_ZNK20BaseSignatureChecker19CheckECDSASignatureERKNSt3__16vectorIhNS0_9allocatorIhEEEES6_RK7CScript10SigVersion:
  279|     38|    {
  280|     38|        return false;
  281|     38|    }
_ZN34GenericTransactionSignatureCheckerI12CTransactionEC2EPKS0_jRKlRK26PrecomputedTransactionData19MissingDataBehavior:
  330|  88.0k|    GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, const PrecomputedTransactionData& txdataIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(&txdataIn) {}
_ZN34GenericTransactionSignatureCheckerI19CMutableTransactionEC2EPKS0_jRKl19MissingDataBehavior:
  329|  94.5k|    GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(nullptr) {}
_ZN34GenericTransactionSignatureCheckerI19CMutableTransactionEC2EPKS0_jRKlRK26PrecomputedTransactionData19MissingDataBehavior:
  330|  87.7k|    GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, const PrecomputedTransactionData& txdataIn, MissingDataBehavior mdb) : txTo(txToIn), m_mdb(mdb), nIn(nInIn), amount(amountIn), txdata(&txdataIn) {}
_ZN20BaseSignatureCheckerD2Ev:
  298|   362k|    virtual ~BaseSignatureChecker() = default;

_ZN13KeyOriginInfo16SerializationOpsI10SpanReaderS_17ActionUnserializeEEvRT0_RT_T1_:
   35|  16.9k|    SERIALIZE_METHODS(KeyOriginInfo, obj) { READWRITE(obj.fingerprint, obj.path); }
  ------------------
  |  |  148|  16.9k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------

_ZN10miniscript8internal12SanitizeTypeENS_4TypeE:
   19|  1.22k|Type SanitizeType(Type e) {
   20|  1.22k|    int num_types = (e << "K"_mst) + (e << "V"_mst) + (e << "B"_mst) + (e << "W"_mst);
   21|  1.22k|    if (num_types == 0) return ""_mst; // No valid type, don't care about the rest
  ------------------
  |  Branch (21:9): [True: 25, False: 1.19k]
  ------------------
   22|  1.19k|    CHECK_NONFATAL(num_types == 1); // K, V, B, W all conflict with each other
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   23|  1.19k|    CHECK_NONFATAL(!(e << "z"_mst) || !(e << "o"_mst)); // z conflicts with o
  ------------------
  |  |  113|  2.39k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 1.19k]
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  ------------------
  ------------------
   24|  1.19k|    CHECK_NONFATAL(!(e << "n"_mst) || !(e << "z"_mst)); // n conflicts with z
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   25|  1.19k|    CHECK_NONFATAL(!(e << "n"_mst) || !(e << "W"_mst)); // n conflicts with W
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   26|  1.19k|    CHECK_NONFATAL(!(e << "V"_mst) || !(e << "d"_mst)); // V conflicts with d
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   27|  1.19k|    CHECK_NONFATAL(!(e << "K"_mst) ||  (e << "u"_mst)); // K implies u
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   28|  1.19k|    CHECK_NONFATAL(!(e << "V"_mst) || !(e << "u"_mst)); // V conflicts with u
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   29|  1.19k|    CHECK_NONFATAL(!(e << "e"_mst) || !(e << "f"_mst)); // e conflicts with f
  ------------------
  |  |  113|  2.39k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 1.19k]
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  ------------------
  ------------------
   30|  1.19k|    CHECK_NONFATAL(!(e << "e"_mst) ||  (e << "d"_mst)); // e implies d
  ------------------
  |  |  113|  2.39k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 1.19k]
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  ------------------
  ------------------
   31|  1.19k|    CHECK_NONFATAL(!(e << "V"_mst) || !(e << "e"_mst)); // V conflicts with e
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   32|  1.19k|    CHECK_NONFATAL(!(e << "d"_mst) || !(e << "f"_mst)); // d conflicts with f
  ------------------
  |  |  113|  2.39k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 1.19k]
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  ------------------
  ------------------
   33|  1.19k|    CHECK_NONFATAL(!(e << "V"_mst) ||  (e << "f"_mst)); // V implies f
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   34|  1.19k|    CHECK_NONFATAL(!(e << "K"_mst) ||  (e << "s"_mst)); // K implies s
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   35|  1.19k|    CHECK_NONFATAL(!(e << "z"_mst) ||  (e << "m"_mst)); // z implies m
  ------------------
  |  |  113|  2.39k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 1.19k]
  |  |  |  Branch (113:28): [True: 1.19k, False: 0]
  |  |  ------------------
  ------------------
   36|  1.19k|    return e;
   37|  1.22k|}
_ZN10miniscript8internal11ComputeTypeENS_8FragmentENS_4TypeES2_S2_RKNSt3__16vectorIS2_NS3_9allocatorIS2_EEEEjmmmNS_17MiniscriptContextE:
   40|  1.22k|                 size_t data_size, size_t n_subs, size_t n_keys, MiniscriptContext ms_ctx) {
   41|       |    // Sanity check on data
   42|  1.22k|    if (fragment == Fragment::SHA256 || fragment == Fragment::HASH256) {
  ------------------
  |  Branch (42:9): [True: 0, False: 1.22k]
  |  Branch (42:41): [True: 0, False: 1.22k]
  ------------------
   43|      0|        CHECK_NONFATAL(data_size == 32);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   44|  1.22k|    } else if (fragment == Fragment::RIPEMD160 || fragment == Fragment::HASH160) {
  ------------------
  |  Branch (44:16): [True: 0, False: 1.22k]
  |  Branch (44:51): [True: 0, False: 1.22k]
  ------------------
   45|      0|        CHECK_NONFATAL(data_size == 20);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   46|  1.22k|    } else {
   47|  1.22k|        CHECK_NONFATAL(data_size == 0);
  ------------------
  |  |  113|  1.22k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   48|  1.22k|    }
   49|       |    // Sanity check on k
   50|  1.22k|    if (fragment == Fragment::OLDER || fragment == Fragment::AFTER) {
  ------------------
  |  Branch (50:9): [True: 0, False: 1.22k]
  |  Branch (50:40): [True: 0, False: 1.22k]
  ------------------
   51|      0|        CHECK_NONFATAL(k >= 1 && k < 0x80000000UL);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   52|  1.22k|    } else if (fragment == Fragment::MULTI || fragment == Fragment::MULTI_A) {
  ------------------
  |  Branch (52:16): [True: 0, False: 1.22k]
  |  Branch (52:47): [True: 0, False: 1.22k]
  ------------------
   53|      0|        CHECK_NONFATAL(k >= 1 && k <= n_keys);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   54|  1.22k|    } else if (fragment == Fragment::THRESH) {
  ------------------
  |  Branch (54:16): [True: 0, False: 1.22k]
  ------------------
   55|      0|        CHECK_NONFATAL(k >= 1 && k <= n_subs);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   56|  1.22k|    } else {
   57|  1.22k|        CHECK_NONFATAL(k == 0);
  ------------------
  |  |  113|  1.22k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   58|  1.22k|    }
   59|       |    // Sanity check on subs
   60|  1.22k|    if (fragment == Fragment::AND_V || fragment == Fragment::AND_B || fragment == Fragment::OR_B ||
  ------------------
  |  Branch (60:9): [True: 23, False: 1.20k]
  |  Branch (60:40): [True: 0, False: 1.20k]
  |  Branch (60:71): [True: 0, False: 1.20k]
  ------------------
   61|  1.20k|        fragment == Fragment::OR_C || fragment == Fragment::OR_I || fragment == Fragment::OR_D) {
  ------------------
  |  Branch (61:9): [True: 0, False: 1.20k]
  |  Branch (61:39): [True: 0, False: 1.20k]
  |  Branch (61:69): [True: 0, False: 1.20k]
  ------------------
   62|     23|        CHECK_NONFATAL(n_subs == 2);
  ------------------
  |  |  113|     23|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   63|  1.20k|    } else if (fragment == Fragment::ANDOR) {
  ------------------
  |  Branch (63:16): [True: 0, False: 1.20k]
  ------------------
   64|      0|        CHECK_NONFATAL(n_subs == 3);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   65|  1.20k|    } else if (fragment == Fragment::WRAP_A || fragment == Fragment::WRAP_S || fragment == Fragment::WRAP_C ||
  ------------------
  |  Branch (65:16): [True: 0, False: 1.20k]
  |  Branch (65:48): [True: 0, False: 1.20k]
  |  Branch (65:80): [True: 2, False: 1.19k]
  ------------------
   66|  1.19k|               fragment == Fragment::WRAP_D || fragment == Fragment::WRAP_V || fragment == Fragment::WRAP_J ||
  ------------------
  |  Branch (66:16): [True: 0, False: 1.19k]
  |  Branch (66:48): [True: 0, False: 1.19k]
  |  Branch (66:80): [True: 0, False: 1.19k]
  ------------------
   67|  1.19k|               fragment == Fragment::WRAP_N) {
  ------------------
  |  Branch (67:16): [True: 0, False: 1.19k]
  ------------------
   68|      2|        CHECK_NONFATAL(n_subs == 1);
  ------------------
  |  |  113|      2|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   69|  1.19k|    } else if (fragment != Fragment::THRESH) {
  ------------------
  |  Branch (69:16): [True: 1.19k, False: 0]
  ------------------
   70|  1.19k|        CHECK_NONFATAL(n_subs == 0);
  ------------------
  |  |  113|  1.19k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   71|  1.19k|    }
   72|       |    // Sanity check on keys
   73|  1.22k|    if (fragment == Fragment::PK_K || fragment == Fragment::PK_H) {
  ------------------
  |  Branch (73:9): [True: 0, False: 1.22k]
  |  Branch (73:39): [True: 0, False: 1.22k]
  ------------------
   74|      0|        CHECK_NONFATAL(n_keys == 1);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   75|  1.22k|    } else if (fragment == Fragment::MULTI) {
  ------------------
  |  Branch (75:16): [True: 0, False: 1.22k]
  ------------------
   76|      0|        CHECK_NONFATAL(n_keys >= 1 && n_keys <= MAX_PUBKEYS_PER_MULTISIG);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   77|      0|        CHECK_NONFATAL(!IsTapscript(ms_ctx));
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   78|  1.22k|    } else if (fragment == Fragment::MULTI_A) {
  ------------------
  |  Branch (78:16): [True: 0, False: 1.22k]
  ------------------
   79|      0|        CHECK_NONFATAL(n_keys >= 1 && n_keys <= MAX_PUBKEYS_PER_MULTI_A);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  |  |  ------------------
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  |  Branch (113:28): [True: 0, False: 0]
  |  |  ------------------
  ------------------
   80|      0|        CHECK_NONFATAL(IsTapscript(ms_ctx));
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   81|  1.22k|    } else {
   82|  1.22k|        CHECK_NONFATAL(n_keys == 0);
  ------------------
  |  |  113|  1.22k|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
   83|  1.22k|    }
   84|       |
   85|       |    // Below is the per-fragment logic for computing the expression types.
   86|       |    // It heavily relies on Type's << operator (where "X << a_mst" means
   87|       |    // "X has all properties listed in a").
   88|  1.22k|    switch (fragment) {
  ------------------
  |  Branch (88:13): [True: 1.22k, False: 0]
  ------------------
   89|      0|        case Fragment::PK_K: return "Konudemsxk"_mst;
  ------------------
  |  Branch (89:9): [True: 0, False: 1.22k]
  ------------------
   90|      0|        case Fragment::PK_H: return "Knudemsxk"_mst;
  ------------------
  |  Branch (90:9): [True: 0, False: 1.22k]
  ------------------
   91|      0|        case Fragment::OLDER: return
  ------------------
  |  Branch (91:9): [True: 0, False: 1.22k]
  ------------------
   92|      0|            "g"_mst.If(k & CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG) |
   93|      0|            "h"_mst.If(!(k & CTxIn::SEQUENCE_LOCKTIME_TYPE_FLAG)) |
   94|      0|            "Bzfmxk"_mst;
   95|      0|        case Fragment::AFTER: return
  ------------------
  |  Branch (95:9): [True: 0, False: 1.22k]
  ------------------
   96|      0|            "i"_mst.If(k >= LOCKTIME_THRESHOLD) |
   97|      0|            "j"_mst.If(k < LOCKTIME_THRESHOLD) |
   98|      0|            "Bzfmxk"_mst;
   99|      0|        case Fragment::SHA256: return "Bonudmk"_mst;
  ------------------
  |  Branch (99:9): [True: 0, False: 1.22k]
  ------------------
  100|      0|        case Fragment::RIPEMD160: return "Bonudmk"_mst;
  ------------------
  |  Branch (100:9): [True: 0, False: 1.22k]
  ------------------
  101|      0|        case Fragment::HASH256: return "Bonudmk"_mst;
  ------------------
  |  Branch (101:9): [True: 0, False: 1.22k]
  ------------------
  102|      0|        case Fragment::HASH160: return "Bonudmk"_mst;
  ------------------
  |  Branch (102:9): [True: 0, False: 1.22k]
  ------------------
  103|      0|        case Fragment::JUST_1: return "Bzufmxk"_mst;
  ------------------
  |  Branch (103:9): [True: 0, False: 1.22k]
  ------------------
  104|  1.19k|        case Fragment::JUST_0: return "Bzudemsxk"_mst;
  ------------------
  |  Branch (104:9): [True: 1.19k, False: 25]
  ------------------
  105|      0|        case Fragment::WRAP_A: return
  ------------------
  |  Branch (105:9): [True: 0, False: 1.22k]
  ------------------
  106|      0|            "W"_mst.If(x << "B"_mst) | // W=B_x
  107|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  108|      0|            (x & "udfems"_mst) | // u=u_x, d=d_x, f=f_x, e=e_x, m=m_x, s=s_x
  109|      0|            "x"_mst; // x
  110|      0|        case Fragment::WRAP_S: return
  ------------------
  |  Branch (110:9): [True: 0, False: 1.22k]
  ------------------
  111|      0|            "W"_mst.If(x << "Bo"_mst) | // W=B_x*o_x
  112|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  113|      0|            (x & "udfemsx"_mst); // u=u_x, d=d_x, f=f_x, e=e_x, m=m_x, s=s_x, x=x_x
  114|      2|        case Fragment::WRAP_C: return
  ------------------
  |  Branch (114:9): [True: 2, False: 1.22k]
  ------------------
  115|      2|            "B"_mst.If(x << "K"_mst) | // B=K_x
  116|      2|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  117|      2|            (x & "ondfem"_mst) | // o=o_x, n=n_x, d=d_x, f=f_x, e=e_x, m=m_x
  118|      2|            "us"_mst; // u, s
  119|      0|        case Fragment::WRAP_D: return
  ------------------
  |  Branch (119:9): [True: 0, False: 1.22k]
  ------------------
  120|      0|            "B"_mst.If(x << "Vz"_mst) | // B=V_x*z_x
  121|      0|            "o"_mst.If(x << "z"_mst) | // o=z_x
  122|      0|            "e"_mst.If(x << "f"_mst) | // e=f_x
  123|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  124|      0|            (x & "ms"_mst) | // m=m_x, s=s_x
  125|       |            // NOTE: 'd:' is 'u' under Tapscript but not P2WSH as MINIMALIF is only a policy rule there.
  126|      0|            "u"_mst.If(IsTapscript(ms_ctx)) |
  127|      0|            "ndx"_mst; // n, d, x
  128|      0|        case Fragment::WRAP_V: return
  ------------------
  |  Branch (128:9): [True: 0, False: 1.22k]
  ------------------
  129|      0|            "V"_mst.If(x << "B"_mst) | // V=B_x
  130|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  131|      0|            (x & "zonms"_mst) | // z=z_x, o=o_x, n=n_x, m=m_x, s=s_x
  132|      0|            "fx"_mst; // f, x
  133|      0|        case Fragment::WRAP_J: return
  ------------------
  |  Branch (133:9): [True: 0, False: 1.22k]
  ------------------
  134|      0|            "B"_mst.If(x << "Bn"_mst) | // B=B_x*n_x
  135|      0|            "e"_mst.If(x << "f"_mst) | // e=f_x
  136|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  137|      0|            (x & "oums"_mst) | // o=o_x, u=u_x, m=m_x, s=s_x
  138|      0|            "ndx"_mst; // n, d, x
  139|      0|        case Fragment::WRAP_N: return
  ------------------
  |  Branch (139:9): [True: 0, False: 1.22k]
  ------------------
  140|      0|            (x & "ghijk"_mst) | // g=g_x, h=h_x, i=i_x, j=j_x, k=k_x
  141|      0|            (x & "Bzondfems"_mst) | // B=B_x, z=z_x, o=o_x, n=n_x, d=d_x, f=f_x, e=e_x, m=m_x, s=s_x
  142|      0|            "ux"_mst; // u, x
  143|     23|        case Fragment::AND_V: return
  ------------------
  |  Branch (143:9): [True: 23, False: 1.20k]
  ------------------
  144|     23|            (y & "KVB"_mst).If(x << "V"_mst) | // B=V_x*B_y, V=V_x*V_y, K=V_x*K_y
  145|     23|            (x & "n"_mst) | (y & "n"_mst).If(x << "z"_mst) | // n=n_x+z_x*n_y
  146|     23|            ((x | y) & "o"_mst).If((x | y) << "z"_mst) | // o=o_x*z_y+z_x*o_y
  147|     23|            (x & y & "mz"_mst) | // m=m_x*m_y, z=z_x*z_y
  148|     23|            ((x | y) & "s"_mst) | // s=s_x+s_y
  149|     23|            "f"_mst.If((y << "f"_mst) || (x << "s"_mst)) | // f=f_y+s_x
  ------------------
  |  Branch (149:24): [True: 0, False: 23]
  |  Branch (149:42): [True: 23, False: 0]
  ------------------
  150|     23|            (y & "ux"_mst) | // u=u_y, x=x_y
  151|     23|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  152|     23|            "k"_mst.If(((x & y) << "k"_mst) &&
  ------------------
  |  Branch (152:24): [True: 23, False: 0]
  ------------------
  153|     23|                !(((x << "g"_mst) && (y << "h"_mst)) ||
  ------------------
  |  Branch (153:20): [True: 0, False: 23]
  |  Branch (153:38): [True: 0, False: 0]
  ------------------
  154|     23|                ((x << "h"_mst) && (y << "g"_mst)) ||
  ------------------
  |  Branch (154:18): [True: 0, False: 23]
  |  Branch (154:36): [True: 0, False: 0]
  ------------------
  155|     23|                ((x << "i"_mst) && (y << "j"_mst)) ||
  ------------------
  |  Branch (155:18): [True: 0, False: 23]
  |  Branch (155:36): [True: 0, False: 0]
  ------------------
  156|     23|                ((x << "j"_mst) && (y << "i"_mst)))); // k=k_x*k_y*!(g_x*h_y + h_x*g_y + i_x*j_y + j_x*i_y)
  ------------------
  |  Branch (156:18): [True: 0, False: 23]
  |  Branch (156:36): [True: 0, False: 0]
  ------------------
  157|      0|        case Fragment::AND_B: return
  ------------------
  |  Branch (157:9): [True: 0, False: 1.22k]
  ------------------
  158|      0|            (x & "B"_mst).If(y << "W"_mst) | // B=B_x*W_y
  159|      0|            ((x | y) & "o"_mst).If((x | y) << "z"_mst) | // o=o_x*z_y+z_x*o_y
  160|      0|            (x & "n"_mst) | (y & "n"_mst).If(x << "z"_mst) | // n=n_x+z_x*n_y
  161|      0|            (x & y & "e"_mst).If((x & y) << "s"_mst) | // e=e_x*e_y*s_x*s_y
  162|      0|            (x & y & "dzm"_mst) | // d=d_x*d_y, z=z_x*z_y, m=m_x*m_y
  163|      0|            "f"_mst.If(((x & y) << "f"_mst) || (x << "sf"_mst) || (y << "sf"_mst)) | // f=f_x*f_y + f_x*s_x + f_y*s_y
  ------------------
  |  Branch (163:24): [True: 0, False: 0]
  |  Branch (163:48): [True: 0, False: 0]
  |  Branch (163:67): [True: 0, False: 0]
  ------------------
  164|      0|            ((x | y) & "s"_mst) | // s=s_x+s_y
  165|      0|            "ux"_mst | // u, x
  166|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  167|      0|            "k"_mst.If(((x & y) << "k"_mst) &&
  ------------------
  |  Branch (167:24): [True: 0, False: 0]
  ------------------
  168|      0|                !(((x << "g"_mst) && (y << "h"_mst)) ||
  ------------------
  |  Branch (168:20): [True: 0, False: 0]
  |  Branch (168:38): [True: 0, False: 0]
  ------------------
  169|      0|                ((x << "h"_mst) && (y << "g"_mst)) ||
  ------------------
  |  Branch (169:18): [True: 0, False: 0]
  |  Branch (169:36): [True: 0, False: 0]
  ------------------
  170|      0|                ((x << "i"_mst) && (y << "j"_mst)) ||
  ------------------
  |  Branch (170:18): [True: 0, False: 0]
  |  Branch (170:36): [True: 0, False: 0]
  ------------------
  171|      0|                ((x << "j"_mst) && (y << "i"_mst)))); // k=k_x*k_y*!(g_x*h_y + h_x*g_y + i_x*j_y + j_x*i_y)
  ------------------
  |  Branch (171:18): [True: 0, False: 0]
  |  Branch (171:36): [True: 0, False: 0]
  ------------------
  172|      0|        case Fragment::OR_B: return
  ------------------
  |  Branch (172:9): [True: 0, False: 1.22k]
  ------------------
  173|      0|            "B"_mst.If(x << "Bd"_mst && y << "Wd"_mst) | // B=B_x*d_x*W_x*d_y
  ------------------
  |  Branch (173:24): [True: 0, False: 0]
  |  Branch (173:41): [True: 0, False: 0]
  ------------------
  174|      0|            ((x | y) & "o"_mst).If((x | y) << "z"_mst) | // o=o_x*z_y+z_x*o_y
  175|      0|            (x & y & "m"_mst).If((x | y) << "s"_mst && (x & y) << "e"_mst) | // m=m_x*m_y*e_x*e_y*(s_x+s_y)
  ------------------
  |  Branch (175:34): [True: 0, False: 0]
  |  Branch (175:56): [True: 0, False: 0]
  ------------------
  176|      0|            (x & y & "zse"_mst) | // z=z_x*z_y, s=s_x*s_y, e=e_x*e_y
  177|      0|            "dux"_mst | // d, u, x
  178|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  179|      0|            (x & y & "k"_mst); // k=k_x*k_y
  180|      0|        case Fragment::OR_D: return
  ------------------
  |  Branch (180:9): [True: 0, False: 1.22k]
  ------------------
  181|      0|            (y & "B"_mst).If(x << "Bdu"_mst) | // B=B_y*B_x*d_x*u_x
  182|      0|            (x & "o"_mst).If(y << "z"_mst) | // o=o_x*z_y
  183|      0|            (x & y & "m"_mst).If(x << "e"_mst && (x | y) << "s"_mst) | // m=m_x*m_y*e_x*(s_x+s_y)
  ------------------
  |  Branch (183:34): [True: 0, False: 0]
  |  Branch (183:50): [True: 0, False: 0]
  ------------------
  184|      0|            (x & y & "zs"_mst) | // z=z_x*z_y, s=s_x*s_y
  185|      0|            (y & "ufde"_mst) | // u=u_y, f=f_y, d=d_y, e=e_y
  186|      0|            "x"_mst | // x
  187|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  188|      0|            (x & y & "k"_mst); // k=k_x*k_y
  189|      0|        case Fragment::OR_C: return
  ------------------
  |  Branch (189:9): [True: 0, False: 1.22k]
  ------------------
  190|      0|            (y & "V"_mst).If(x << "Bdu"_mst) | // V=V_y*B_x*u_x*d_x
  191|      0|            (x & "o"_mst).If(y << "z"_mst) | // o=o_x*z_y
  192|      0|            (x & y & "m"_mst).If(x << "e"_mst && (x | y) << "s"_mst) | // m=m_x*m_y*e_x*(s_x+s_y)
  ------------------
  |  Branch (192:34): [True: 0, False: 0]
  |  Branch (192:50): [True: 0, False: 0]
  ------------------
  193|      0|            (x & y & "zs"_mst) | // z=z_x*z_y, s=s_x*s_y
  194|      0|            "fx"_mst | // f, x
  195|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  196|      0|            (x & y & "k"_mst); // k=k_x*k_y
  197|      0|        case Fragment::OR_I: return
  ------------------
  |  Branch (197:9): [True: 0, False: 1.22k]
  ------------------
  198|      0|            (x & y & "VBKufs"_mst) | // V=V_x*V_y, B=B_x*B_y, K=K_x*K_y, u=u_x*u_y, f=f_x*f_y, s=s_x*s_y
  199|      0|            "o"_mst.If((x & y) << "z"_mst) | // o=z_x*z_y
  200|      0|            ((x | y) & "e"_mst).If((x | y) << "f"_mst) | // e=e_x*f_y+f_x*e_y
  201|      0|            (x & y & "m"_mst).If((x | y) << "s"_mst) | // m=m_x*m_y*(s_x+s_y)
  202|      0|            ((x | y) & "d"_mst) | // d=d_x+d_y
  203|      0|            "x"_mst | // x
  204|      0|            ((x | y) & "ghij"_mst) | // g=g_x+g_y, h=h_x+h_y, i=i_x+i_y, j=j_x+j_y
  205|      0|            (x & y & "k"_mst); // k=k_x*k_y
  206|      0|        case Fragment::ANDOR: return
  ------------------
  |  Branch (206:9): [True: 0, False: 1.22k]
  ------------------
  207|      0|            (y & z & "BKV"_mst).If(x << "Bdu"_mst) | // B=B_x*d_x*u_x*B_y*B_z, K=B_x*d_x*u_x*K_y*K_z, V=B_x*d_x*u_x*V_y*V_z
  208|      0|            (x & y & z & "z"_mst) | // z=z_x*z_y*z_z
  209|      0|            ((x | (y & z)) & "o"_mst).If((x | (y & z)) << "z"_mst) | // o=o_x*z_y*z_z+z_x*o_y*o_z
  210|      0|            (y & z & "u"_mst) | // u=u_y*u_z
  211|      0|            (z & "f"_mst).If((x << "s"_mst) || (y << "f"_mst)) | // f=(s_x+f_y)*f_z
  ------------------
  |  Branch (211:30): [True: 0, False: 0]
  |  Branch (211:48): [True: 0, False: 0]
  ------------------
  212|      0|            (z & "d"_mst) | // d=d_z
  213|      0|            (z & "e"_mst).If(x << "s"_mst || y << "f"_mst) | // e=e_z*(s_x+f_y)
  ------------------
  |  Branch (213:30): [True: 0, False: 0]
  |  Branch (213:46): [True: 0, False: 0]
  ------------------
  214|      0|            (x & y & z & "m"_mst).If(x << "e"_mst && (x | y | z) << "s"_mst) | // m=m_x*m_y*m_z*e_x*(s_x+s_y+s_z)
  ------------------
  |  Branch (214:38): [True: 0, False: 0]
  |  Branch (214:54): [True: 0, False: 0]
  ------------------
  215|      0|            (z & (x | y) & "s"_mst) | // s=s_z*(s_x+s_y)
  216|      0|            "x"_mst | // x
  217|      0|            ((x | y | z) & "ghij"_mst) | // g=g_x+g_y+g_z, h=h_x+h_y+h_z, i=i_x+i_y+i_z, j=j_x+j_y_j_z
  218|      0|            "k"_mst.If(((x & y & z) << "k"_mst) &&
  ------------------
  |  Branch (218:24): [True: 0, False: 0]
  ------------------
  219|      0|                !(((x << "g"_mst) && (y << "h"_mst)) ||
  ------------------
  |  Branch (219:20): [True: 0, False: 0]
  |  Branch (219:38): [True: 0, False: 0]
  ------------------
  220|      0|                ((x << "h"_mst) && (y << "g"_mst)) ||
  ------------------
  |  Branch (220:18): [True: 0, False: 0]
  |  Branch (220:36): [True: 0, False: 0]
  ------------------
  221|      0|                ((x << "i"_mst) && (y << "j"_mst)) ||
  ------------------
  |  Branch (221:18): [True: 0, False: 0]
  |  Branch (221:36): [True: 0, False: 0]
  ------------------
  222|      0|                ((x << "j"_mst) && (y << "i"_mst)))); // k=k_x*k_y*k_z* !(g_x*h_y + h_x*g_y + i_x*j_y + j_x*i_y)
  ------------------
  |  Branch (222:18): [True: 0, False: 0]
  |  Branch (222:36): [True: 0, False: 0]
  ------------------
  223|      0|        case Fragment::MULTI: {
  ------------------
  |  Branch (223:9): [True: 0, False: 1.22k]
  ------------------
  224|      0|            return "Bnudemsk"_mst;
  225|      0|        }
  226|      0|        case Fragment::MULTI_A: {
  ------------------
  |  Branch (226:9): [True: 0, False: 1.22k]
  ------------------
  227|      0|            return "Budemsk"_mst;
  228|      0|        }
  229|      0|        case Fragment::THRESH: {
  ------------------
  |  Branch (229:9): [True: 0, False: 1.22k]
  ------------------
  230|      0|            bool all_e = true;
  231|      0|            bool all_m = true;
  232|      0|            uint32_t args = 0;
  233|      0|            uint32_t num_s = 0;
  234|      0|            Type acc_tl = "k"_mst;
  235|      0|            for (size_t i = 0; i < sub_types.size(); ++i) {
  ------------------
  |  Branch (235:32): [True: 0, False: 0]
  ------------------
  236|      0|                Type t = sub_types[i];
  237|      0|                if (!(t << (i ? "Wdu"_mst : "Bdu"_mst))) return ""_mst; // Require Bdu, Wdu, Wdu, ...
  ------------------
  |  Branch (237:21): [True: 0, False: 0]
  |  Branch (237:29): [True: 0, False: 0]
  ------------------
  238|      0|                if (!(t << "e"_mst)) all_e = false;
  ------------------
  |  Branch (238:21): [True: 0, False: 0]
  ------------------
  239|      0|                if (!(t << "m"_mst)) all_m = false;
  ------------------
  |  Branch (239:21): [True: 0, False: 0]
  ------------------
  240|      0|                if (t << "s"_mst) num_s += 1;
  ------------------
  |  Branch (240:21): [True: 0, False: 0]
  ------------------
  241|      0|                args += (t << "z"_mst) ? 0 : (t << "o"_mst) ? 1 : 2;
  ------------------
  |  Branch (241:25): [True: 0, False: 0]
  |  Branch (241:46): [True: 0, False: 0]
  ------------------
  242|      0|                acc_tl = ((acc_tl | t) & "ghij"_mst) |
  243|       |                    // Thresh contains a combination of timelocks if it has threshold > 1 and
  244|       |                    // it contains two different children that have different types of timelocks
  245|       |                    // Note how if any of the children don't have "k", the parent also does not have "k"
  246|      0|                    "k"_mst.If(((acc_tl & t) << "k"_mst) && ((k <= 1) ||
  ------------------
  |  Branch (246:32): [True: 0, False: 0]
  |  Branch (246:62): [True: 0, False: 0]
  ------------------
  247|      0|                        ((k > 1) && !(((acc_tl << "g"_mst) && (t << "h"_mst)) ||
  ------------------
  |  Branch (247:26): [True: 0, False: 0]
  |  Branch (247:40): [True: 0, False: 0]
  |  Branch (247:63): [True: 0, False: 0]
  ------------------
  248|      0|                        ((acc_tl << "h"_mst) && (t << "g"_mst)) ||
  ------------------
  |  Branch (248:26): [True: 0, False: 0]
  |  Branch (248:49): [True: 0, False: 0]
  ------------------
  249|      0|                        ((acc_tl << "i"_mst) && (t << "j"_mst)) ||
  ------------------
  |  Branch (249:26): [True: 0, False: 0]
  |  Branch (249:49): [True: 0, False: 0]
  ------------------
  250|      0|                        ((acc_tl << "j"_mst) && (t << "i"_mst))))));
  ------------------
  |  Branch (250:26): [True: 0, False: 0]
  |  Branch (250:49): [True: 0, False: 0]
  ------------------
  251|      0|            }
  252|      0|            return "Bdu"_mst |
  253|      0|                   "z"_mst.If(args == 0) | // z=all z
  254|      0|                   "o"_mst.If(args == 1) | // o=all z except one o
  255|      0|                   "e"_mst.If(all_e && num_s == n_subs) | // e=all e and all s
  ------------------
  |  Branch (255:31): [True: 0, False: 0]
  |  Branch (255:40): [True: 0, False: 0]
  ------------------
  256|      0|                   "m"_mst.If(all_e && all_m && num_s >= n_subs - k) | // m=all e, >=(n-k) s
  ------------------
  |  Branch (256:31): [True: 0, False: 0]
  |  Branch (256:40): [True: 0, False: 0]
  |  Branch (256:49): [True: 0, False: 0]
  ------------------
  257|      0|                   "s"_mst.If(num_s >= n_subs - k + 1) |  // s= >=(n-k+1) s
  258|      0|                   acc_tl; // timelock info
  259|      0|            }
  260|  1.22k|    }
  261|  1.22k|    assert(false);
  ------------------
  |  Branch (261:5): [Folded, False: 0]
  ------------------
  262|      0|}
_ZN10miniscript8internal16ComputeScriptLenENS_8FragmentENS_4TypeEmjmmNS_17MiniscriptContextE:
  265|  1.22k|                        size_t n_keys, MiniscriptContext ms_ctx) {
  266|  1.22k|    switch (fragment) {
  ------------------
  |  Branch (266:13): [True: 1.22k, False: 0]
  ------------------
  267|      0|        case Fragment::JUST_1:
  ------------------
  |  Branch (267:9): [True: 0, False: 1.22k]
  ------------------
  268|  1.19k|        case Fragment::JUST_0: return 1;
  ------------------
  |  Branch (268:9): [True: 1.19k, False: 25]
  ------------------
  269|      0|        case Fragment::PK_K: return IsTapscript(ms_ctx) ? 33 : 34;
  ------------------
  |  Branch (269:9): [True: 0, False: 1.22k]
  |  Branch (269:37): [True: 0, False: 0]
  ------------------
  270|      0|        case Fragment::PK_H: return 3 + 21;
  ------------------
  |  Branch (270:9): [True: 0, False: 1.22k]
  ------------------
  271|      0|        case Fragment::OLDER:
  ------------------
  |  Branch (271:9): [True: 0, False: 1.22k]
  ------------------
  272|      0|        case Fragment::AFTER: return 1 + BuildScript(k).size();
  ------------------
  |  Branch (272:9): [True: 0, False: 1.22k]
  ------------------
  273|      0|        case Fragment::HASH256:
  ------------------
  |  Branch (273:9): [True: 0, False: 1.22k]
  ------------------
  274|      0|        case Fragment::SHA256: return 4 + 2 + 33;
  ------------------
  |  Branch (274:9): [True: 0, False: 1.22k]
  ------------------
  275|      0|        case Fragment::HASH160:
  ------------------
  |  Branch (275:9): [True: 0, False: 1.22k]
  ------------------
  276|      0|        case Fragment::RIPEMD160: return 4 + 2 + 21;
  ------------------
  |  Branch (276:9): [True: 0, False: 1.22k]
  ------------------
  277|      0|        case Fragment::MULTI: return 1 + BuildScript(n_keys).size() + BuildScript(k).size() + 34 * n_keys;
  ------------------
  |  Branch (277:9): [True: 0, False: 1.22k]
  ------------------
  278|      0|        case Fragment::MULTI_A: return (1 + 32 + 1) * n_keys + BuildScript(k).size() + 1;
  ------------------
  |  Branch (278:9): [True: 0, False: 1.22k]
  ------------------
  279|     23|        case Fragment::AND_V: return subsize;
  ------------------
  |  Branch (279:9): [True: 23, False: 1.20k]
  ------------------
  280|      0|        case Fragment::WRAP_V: return subsize + (sub0typ << "x"_mst);
  ------------------
  |  Branch (280:9): [True: 0, False: 1.22k]
  ------------------
  281|      0|        case Fragment::WRAP_S:
  ------------------
  |  Branch (281:9): [True: 0, False: 1.22k]
  ------------------
  282|      2|        case Fragment::WRAP_C:
  ------------------
  |  Branch (282:9): [True: 2, False: 1.22k]
  ------------------
  283|      2|        case Fragment::WRAP_N:
  ------------------
  |  Branch (283:9): [True: 0, False: 1.22k]
  ------------------
  284|      2|        case Fragment::AND_B:
  ------------------
  |  Branch (284:9): [True: 0, False: 1.22k]
  ------------------
  285|      2|        case Fragment::OR_B: return subsize + 1;
  ------------------
  |  Branch (285:9): [True: 0, False: 1.22k]
  ------------------
  286|      0|        case Fragment::WRAP_A:
  ------------------
  |  Branch (286:9): [True: 0, False: 1.22k]
  ------------------
  287|      0|        case Fragment::OR_C: return subsize + 2;
  ------------------
  |  Branch (287:9): [True: 0, False: 1.22k]
  ------------------
  288|      0|        case Fragment::WRAP_D:
  ------------------
  |  Branch (288:9): [True: 0, False: 1.22k]
  ------------------
  289|      0|        case Fragment::OR_D:
  ------------------
  |  Branch (289:9): [True: 0, False: 1.22k]
  ------------------
  290|      0|        case Fragment::OR_I:
  ------------------
  |  Branch (290:9): [True: 0, False: 1.22k]
  ------------------
  291|      0|        case Fragment::ANDOR: return subsize + 3;
  ------------------
  |  Branch (291:9): [True: 0, False: 1.22k]
  ------------------
  292|      0|        case Fragment::WRAP_J: return subsize + 4;
  ------------------
  |  Branch (292:9): [True: 0, False: 1.22k]
  ------------------
  293|      0|        case Fragment::THRESH: return subsize + n_subs + BuildScript(k).size();
  ------------------
  |  Branch (293:9): [True: 0, False: 1.22k]
  ------------------
  294|  1.22k|    }
  295|  1.22k|    assert(false);
  ------------------
  |  Branch (295:5): [Folded, False: 0]
  ------------------
  296|      0|}
_ZN10miniscript8internal15DecomposeScriptERK7CScript:
  369|  1.65k|{
  370|  1.65k|    std::vector<Opcode> out;
  371|  1.65k|    CScript::const_iterator it = script.begin(), itend = script.end();
  372|  29.1k|    while (it != itend) {
  ------------------
  |  Branch (372:12): [True: 27.8k, False: 1.26k]
  ------------------
  373|  27.8k|        std::vector<unsigned char> push_data;
  374|  27.8k|        opcodetype opcode;
  375|  27.8k|        if (!script.GetOp(it, opcode, push_data)) {
  ------------------
  |  Branch (375:13): [True: 336, False: 27.5k]
  ------------------
  376|    336|            return {};
  377|  27.5k|        } else if (opcode >= OP_1 && opcode <= OP_16) {
  ------------------
  |  Branch (377:20): [True: 8.91k, False: 18.6k]
  |  Branch (377:38): [True: 5.24k, False: 3.67k]
  ------------------
  378|       |            // Deal with OP_n (GetOp does not turn them into pushes).
  379|  5.24k|            push_data.assign(1, CScript::DecodeOP_N(opcode));
  380|  22.3k|        } else if (opcode == OP_CHECKSIGVERIFY) {
  ------------------
  |  Branch (380:20): [True: 57, False: 22.2k]
  ------------------
  381|       |            // Decompose OP_CHECKSIGVERIFY into OP_CHECKSIG OP_VERIFY
  382|     57|            out.emplace_back(OP_CHECKSIG, std::vector<unsigned char>());
  383|     57|            opcode = OP_VERIFY;
  384|  22.2k|        } else if (opcode == OP_CHECKMULTISIGVERIFY) {
  ------------------
  |  Branch (384:20): [True: 68, False: 22.1k]
  ------------------
  385|       |            // Decompose OP_CHECKMULTISIGVERIFY into OP_CHECKMULTISIG OP_VERIFY
  386|     68|            out.emplace_back(OP_CHECKMULTISIG, std::vector<unsigned char>());
  387|     68|            opcode = OP_VERIFY;
  388|  22.1k|        } else if (opcode == OP_EQUALVERIFY) {
  ------------------
  |  Branch (388:20): [True: 21, False: 22.1k]
  ------------------
  389|       |            // Decompose OP_EQUALVERIFY into OP_EQUAL OP_VERIFY
  390|     21|            out.emplace_back(OP_EQUAL, std::vector<unsigned char>());
  391|     21|            opcode = OP_VERIFY;
  392|  22.1k|        } else if (opcode == OP_NUMEQUALVERIFY) {
  ------------------
  |  Branch (392:20): [True: 14, False: 22.1k]
  ------------------
  393|       |            // Decompose OP_NUMEQUALVERIFY into OP_NUMEQUAL OP_VERIFY
  394|     14|            out.emplace_back(OP_NUMEQUAL, std::vector<unsigned char>());
  395|     14|            opcode = OP_VERIFY;
  396|  22.1k|        } else if (IsPushdataOp(opcode)) {
  ------------------
  |  Branch (396:20): [True: 486, False: 21.6k]
  ------------------
  397|    486|            if (!CheckMinimalPush(push_data, opcode)) return {};
  ------------------
  |  Branch (397:17): [True: 54, False: 432]
  ------------------
  398|  21.6k|        } else if (it != itend && (opcode == OP_CHECKSIG || opcode == OP_CHECKMULTISIG || opcode == OP_EQUAL || opcode == OP_NUMEQUAL) && (*it == OP_VERIFY)) {
  ------------------
  |  Branch (398:20): [True: 21.3k, False: 344]
  |  Branch (398:36): [True: 53, False: 21.2k]
  |  Branch (398:61): [True: 3, False: 21.2k]
  |  Branch (398:91): [True: 1, False: 21.2k]
  |  Branch (398:113): [True: 331, False: 20.9k]
  |  Branch (398:139): [True: 0, False: 388]
  ------------------
  399|       |            // Rule out non minimal VERIFY sequences
  400|      0|            return {};
  401|      0|        }
  402|  27.4k|        out.emplace_back(opcode, std::move(push_data));
  403|  27.4k|    }
  404|  1.26k|    std::reverse(out.begin(), out.end());
  405|  1.26k|    return out;
  406|  1.65k|}

_ZNK10miniscript4Type2IfEb:
  157|    117|    constexpr Type If(bool x) const { return Type(x ? m_flags : 0); }
  ------------------
  |  Branch (157:51): [True: 92, False: 25]
  ------------------
_ZN10miniscript4TypeC2Ej:
  135|    656|    explicit constexpr Type(uint32_t flags) : m_flags(flags) {}
_ZNK10miniscript4TypeorES0_:
  142|    305|    constexpr Type operator|(Type x) const { return Type(m_flags | x.m_flags); }
_ZNK10miniscript4TypeanES0_:
  145|    234|    constexpr Type operator&(Type x) const { return Type(m_flags & x.m_flags); }
_ZNK10miniscript4TypeeqES0_:
  154|  3.57k|    constexpr bool operator==(Type x) const { return m_flags == x.m_flags; }
_ZN10miniscript8internal3OpsC2EjNS0_6MaxIntIjEES3_:
  397|  1.22k|    Ops(uint32_t in_count, MaxInt<uint32_t> in_sat, MaxInt<uint32_t> in_dsat) : count(in_count), sat(in_sat), dsat(in_dsat) {};
_ZN10miniscript8internal7SatInfoC2Ev:
  452|  1.24k|    constexpr SatInfo() noexcept : valid(false), netdiff(0), exec(0) {}
_ZN10miniscript8internal7SatInfoC2Eii:
  456|  1.20k|        valid{true}, netdiff{in_netdiff}, exec{in_exec} {}
_ZN10miniscript8internalplERKNS0_7SatInfoES3_:
  474|     27|    {
  475|       |        // Concatenation with an empty set yields an empty set.
  476|     27|        if (!a.valid || !b.valid) return {};
  ------------------
  |  Branch (476:13): [True: 25, False: 2]
  |  Branch (476:25): [True: 0, False: 2]
  ------------------
  477|       |        // Otherwise, the maximum stack size difference for the combined scripts is the sum of the
  478|       |        // netdiffs, and the maximum stack size difference anywhere is either b.exec (if the
  479|       |        // maximum occurred in b) or b.netdiff+a.exec (if the maximum occurred in a).
  480|      2|        return {a.netdiff + b.netdiff, std::max(b.exec, b.netdiff + a.exec)};
  481|     27|    }
_ZN10miniscript8internal7SatInfo4PushEv:
  486|  1.19k|    static constexpr SatInfo Push() noexcept { return {-1, 0}; }
_ZN10miniscript8internal7SatInfo11OP_CHECKSIGEv:
  502|      4|    static constexpr SatInfo OP_CHECKSIG() noexcept { return {1, 1}; }
_ZN10miniscript8internal9StackSizeC2ENS0_7SatInfoES2_:
  512|  1.22k|    constexpr StackSize(SatInfo in_sat, SatInfo in_dsat) noexcept : sat(in_sat), dsat(in_dsat) {};
_ZNK10miniscript8internal9StackSize3SatEv:
  515|     48|    const SatInfo& Sat() const { return sat; }
_ZNK10miniscript8internal9StackSize4DsatEv:
  516|      2|    const SatInfo& Dsat() const { return dsat; }
_ZN10miniscript8internal11WitnessSizeC2ENS0_6MaxIntIjEES3_:
  525|  1.22k|    WitnessSize(MaxInt<uint32_t> in_sat, MaxInt<uint32_t> in_dsat) : sat(in_sat), dsat(in_dsat) {};
_ZN10miniscript8internal13MaxScriptSizeENS_17MiniscriptContextE:
  285|  5.21k|{
  286|  5.21k|    if (IsTapscript(ms_ctx)) {
  ------------------
  |  Branch (286:9): [True: 0, False: 5.21k]
  ------------------
  287|       |        // Leaf scripts under Tapscript are not explicitly limited in size. They are only implicitly
  288|       |        // bounded by the maximum standard size of a spending transaction. Let the maximum script
  289|       |        // size conservatively be small enough such that even a maximum sized witness and a reasonably
  290|       |        // sized spending transaction can spend an output paying to this script without running into
  291|       |        // the maximum standard tx size limit.
  292|      0|        constexpr auto max_size{MAX_STANDARD_TX_WEIGHT - TX_BODY_LEEWAY_WEIGHT - MAX_TAPSCRIPT_SAT_SIZE};
  293|      0|        return max_size - GetSizeOfCompactSize(max_size);
  294|      0|    }
  295|  5.21k|    return MAX_STANDARD_P2WSH_SCRIPT_SIZE;
  296|  5.21k|}
_ZN10miniscript11IsTapscriptENS_17MiniscriptContextE:
  260|  7.66k|{
  261|  7.66k|    switch (ms_ctx) {
  ------------------
  |  Branch (261:13): [True: 7.66k, False: 0]
  ------------------
  262|  7.66k|        case MiniscriptContext::P2WSH: return false;
  ------------------
  |  Branch (262:9): [True: 7.66k, False: 0]
  ------------------
  263|      0|        case MiniscriptContext::TAPSCRIPT: return true;
  ------------------
  |  Branch (263:9): [True: 0, False: 7.66k]
  ------------------
  264|  7.66k|    }
  265|  7.66k|    assert(false);
  ------------------
  |  Branch (265:5): [Folded, False: 0]
  ------------------
  266|      0|}
_ZN10miniscript8internal6MaxIntIjEC2Ej:
  372|  2.39k|    MaxInt(I val) : valid(true), value(val) {}
_ZN10miniscript8internal6MaxIntIjEC2Ev:
  371|  2.49k|    MaxInt() : valid(false), value(0) {}
_ZN10miniscript8internalplERKNS0_6MaxIntIjEES4_:
  377|     46|    friend MaxInt<I> operator+(const MaxInt<I>& a, const MaxInt<I>& b) {
  378|     46|        if (!a.valid || !b.valid) return {};
  ------------------
  |  Branch (378:13): [True: 46, False: 0]
  |  Branch (378:25): [True: 0, False: 0]
  ------------------
  379|      0|        return a.value + b.value;
  380|     46|    }
_ZNK10miniscript4TypelsES0_:
  148|  27.9k|    constexpr bool operator<<(Type x) const { return (x.m_flags & ~m_flags) == 0; }
_ZN10miniscript8internal11InputResultC2IRKNS0_10InputStackES5_EEOT_OT0_:
  360|     79|    InputResult(A&& in_nsat, B&& in_sat) : nsat(std::forward<A>(in_nsat)), sat(std::forward<B>(in_sat)) {}
_ZN10miniscript4NodeI7CPubKeyED2Ev:
  553|  3.05k|    {
  554|       |        // Destroy the subexpressions iteratively after moving out their
  555|       |        // subexpressions to avoid a stack-overflow due to recursive calls to
  556|       |        // the subs' destructors.
  557|       |        // We move vectors in order to only update array-pointers inside them
  558|       |        // rather than moving individual Node instances which would involve
  559|       |        // moving/copying each Node field.
  560|  3.05k|        std::vector<std::vector<Node>> queue;
  561|  3.05k|        queue.push_back(std::move(subs));
  562|  3.05k|        do {
  563|  3.05k|            auto flattening{std::move(queue.back())};
  564|  3.05k|            queue.pop_back();
  565|  3.05k|            for (Node& n : flattening) {
  ------------------
  |  Branch (565:26): [True: 48, False: 3.05k]
  ------------------
  566|     48|                if (!n.subs.empty()) queue.push_back(std::move(n.subs));
  ------------------
  |  Branch (566:21): [True: 0, False: 48]
  ------------------
  567|     48|            }
  568|  3.05k|        } while (!queue.empty());
  ------------------
  |  Branch (568:18): [True: 0, False: 3.05k]
  ------------------
  569|  3.05k|    }
_ZN10miniscript10FromScriptI12WshSatisfierEENSt3__18optionalINS_4NodeINT_3KeyEEEEERK7CScriptRKS5_:
 2692|  1.66k|{
 2693|  1.66k|    using namespace internal;
 2694|       |    // A too large Script is necessarily invalid, don't bother parsing it.
 2695|  1.66k|    if (script.size() > MaxScriptSize(ctx.MsContext())) return {};
  ------------------
  |  Branch (2695:9): [True: 2, False: 1.65k]
  ------------------
 2696|  1.65k|    auto decomposed = DecomposeScript(script);
 2697|  1.65k|    if (!decomposed) return {};
  ------------------
  |  Branch (2697:9): [True: 390, False: 1.26k]
  ------------------
 2698|  1.26k|    auto it = decomposed->begin();
 2699|  1.26k|    auto ret = DecodeScript<typename Ctx::Key>(it, decomposed->end(), ctx);
 2700|  1.26k|    if (!ret) return {};
  ------------------
  |  Branch (2700:9): [True: 1.18k, False: 80]
  ------------------
 2701|     80|    if (it != decomposed->end()) return {};
  ------------------
  |  Branch (2701:9): [True: 1, False: 79]
  ------------------
 2702|     79|    return ret;
 2703|     80|}
_ZN10miniscript8internal12DecodeScriptI7CPubKey12WshSatisfierNSt3__111__wrap_iterIPNS4_4pairI10opcodetypeNS4_6vectorIhNS4_9allocatorIhEEEEEEEEEENS4_8optionalINS_4NodeIT_EEEERT1_SK_RKT0_:
 2297|  1.26k|{
 2298|       |    // The two integers are used to hold state for thresh()
 2299|  1.26k|    std::vector<std::tuple<DecodeContext, int64_t, int64_t>> to_parse;
 2300|  1.26k|    std::vector<Node<Key>> constructed;
 2301|       |
 2302|       |    // This is the top level, so we assume the type is B
 2303|       |    // (in particular, disallowing top level W expressions)
 2304|  1.26k|    to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2305|       |
 2306|  6.15k|    while (!to_parse.empty()) {
  ------------------
  |  Branch (2306:12): [True: 6.06k, False: 90]
  ------------------
 2307|       |        // Exit early if the Miniscript is not going to be valid.
 2308|  6.06k|        if (!constructed.empty() && !constructed.back().IsValid()) return {};
  ------------------
  |  Branch (2308:13): [True: 3.48k, False: 2.57k]
  |  Branch (2308:37): [True: 15, False: 3.47k]
  ------------------
 2309|       |
 2310|       |        // Get the current context we are decoding within
 2311|  6.04k|        auto [cur_context, n, k] = to_parse.back();
 2312|  6.04k|        to_parse.pop_back();
 2313|       |
 2314|  6.04k|        switch(cur_context) {
  ------------------
  |  Branch (2314:16): [True: 6.04k, False: 0]
  ------------------
 2315|  2.45k|        case DecodeContext::SINGLE_BKV_EXPR: {
  ------------------
  |  Branch (2315:9): [True: 2.45k, False: 3.59k]
  ------------------
 2316|  2.45k|            if (in >= last) return {};
  ------------------
  |  Branch (2316:17): [True: 866, False: 1.59k]
  ------------------
 2317|       |
 2318|       |            // Constants
 2319|  1.59k|            if (in[0].first == OP_1) {
  ------------------
  |  Branch (2319:17): [True: 0, False: 1.59k]
  ------------------
 2320|      0|                ++in;
 2321|      0|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::JUST_1);
 2322|      0|                break;
 2323|      0|            }
 2324|  1.59k|            if (in[0].first == OP_0) {
  ------------------
  |  Branch (2324:17): [True: 1.19k, False: 391]
  ------------------
 2325|  1.19k|                ++in;
 2326|  1.19k|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::JUST_0);
 2327|  1.19k|                break;
 2328|  1.19k|            }
 2329|       |            // Public keys
 2330|    391|            if (in[0].second.size() == 33 || in[0].second.size() == 32) {
  ------------------
  |  Branch (2330:17): [True: 1, False: 390]
  |  Branch (2330:46): [True: 2, False: 388]
  ------------------
 2331|      3|                auto key = ctx.FromPKBytes(in[0].second.begin(), in[0].second.end());
 2332|      3|                if (!key) return {};
  ------------------
  |  Branch (2332:21): [True: 3, False: 0]
  ------------------
 2333|      0|                ++in;
 2334|      0|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::PK_K, Vector(std::move(*key)));
 2335|      0|                break;
 2336|      3|            }
 2337|    388|            if (last - in >= 5 && in[0].first == OP_VERIFY && in[1].first == OP_EQUAL && in[3].first == OP_HASH160 && in[4].first == OP_DUP && in[2].second.size() == 20) {
  ------------------
  |  Branch (2337:17): [True: 359, False: 29]
  |  Branch (2337:35): [True: 30, False: 329]
  |  Branch (2337:63): [True: 0, False: 30]
  |  Branch (2337:90): [True: 0, False: 0]
  |  Branch (2337:119): [True: 0, False: 0]
  |  Branch (2337:144): [True: 0, False: 0]
  ------------------
 2338|      0|                auto key = ctx.FromPKHBytes(in[2].second.begin(), in[2].second.end());
 2339|      0|                if (!key) return {};
  ------------------
  |  Branch (2339:21): [True: 0, False: 0]
  ------------------
 2340|      0|                in += 5;
 2341|      0|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::PK_H, Vector(std::move(*key)));
 2342|      0|                break;
 2343|      0|            }
 2344|       |            // Time locks
 2345|    388|            std::optional<int64_t> num;
 2346|    388|            if (last - in >= 2 && in[0].first == OP_CHECKSEQUENCEVERIFY && (num = ParseScriptNumber(in[1]))) {
  ------------------
  |  Branch (2346:17): [True: 369, False: 19]
  |  Branch (2346:17): [True: 0, False: 388]
  |  Branch (2346:35): [True: 0, False: 369]
  |  Branch (2346:76): [True: 0, False: 0]
  ------------------
 2347|      0|                in += 2;
 2348|      0|                if (*num < 1 || *num > 0x7FFFFFFFL) return {};
  ------------------
  |  Branch (2348:21): [True: 0, False: 0]
  |  Branch (2348:33): [True: 0, False: 0]
  ------------------
 2349|      0|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::OLDER, *num);
 2350|      0|                break;
 2351|      0|            }
 2352|    388|            if (last - in >= 2 && in[0].first == OP_CHECKLOCKTIMEVERIFY && (num = ParseScriptNumber(in[1]))) {
  ------------------
  |  Branch (2352:17): [True: 369, False: 19]
  |  Branch (2352:17): [True: 0, False: 388]
  |  Branch (2352:35): [True: 0, False: 369]
  |  Branch (2352:76): [True: 0, False: 0]
  ------------------
 2353|      0|                in += 2;
 2354|      0|                if (num < 1 || num > 0x7FFFFFFFL) return {};
  ------------------
  |  Branch (2354:21): [True: 0, False: 0]
  |  Branch (2354:21): [True: 0, False: 0]
  |  Branch (2354:32): [True: 0, False: 0]
  ------------------
 2355|      0|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::AFTER, *num);
 2356|      0|                break;
 2357|      0|            }
 2358|       |            // Hashes
 2359|    388|            if (last - in >= 7 && in[0].first == OP_EQUAL && in[3].first == OP_VERIFY && in[4].first == OP_EQUAL && (num = ParseScriptNumber(in[5])) && num == 32 && in[6].first == OP_SIZE) {
  ------------------
  |  Branch (2359:17): [True: 358, False: 30]
  |  Branch (2359:17): [True: 0, False: 388]
  |  Branch (2359:35): [True: 0, False: 358]
  |  Branch (2359:62): [True: 0, False: 0]
  |  Branch (2359:90): [True: 0, False: 0]
  |  Branch (2359:117): [True: 0, False: 0]
  |  Branch (2359:153): [True: 0, False: 0]
  |  Branch (2359:166): [True: 0, False: 0]
  ------------------
 2360|      0|                if (in[2].first == OP_SHA256 && in[1].second.size() == 32) {
  ------------------
  |  Branch (2360:21): [True: 0, False: 0]
  |  Branch (2360:49): [True: 0, False: 0]
  ------------------
 2361|      0|                    constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::SHA256, in[1].second);
 2362|      0|                    in += 7;
 2363|      0|                    break;
 2364|      0|                } else if (in[2].first == OP_RIPEMD160 && in[1].second.size() == 20) {
  ------------------
  |  Branch (2364:28): [True: 0, False: 0]
  |  Branch (2364:59): [True: 0, False: 0]
  ------------------
 2365|      0|                    constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::RIPEMD160, in[1].second);
 2366|      0|                    in += 7;
 2367|      0|                    break;
 2368|      0|                } else if (in[2].first == OP_HASH256 && in[1].second.size() == 32) {
  ------------------
  |  Branch (2368:28): [True: 0, False: 0]
  |  Branch (2368:57): [True: 0, False: 0]
  ------------------
 2369|      0|                    constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::HASH256, in[1].second);
 2370|      0|                    in += 7;
 2371|      0|                    break;
 2372|      0|                } else if (in[2].first == OP_HASH160 && in[1].second.size() == 20) {
  ------------------
  |  Branch (2372:28): [True: 0, False: 0]
  |  Branch (2372:57): [True: 0, False: 0]
  ------------------
 2373|      0|                    constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::HASH160, in[1].second);
 2374|      0|                    in += 7;
 2375|      0|                    break;
 2376|      0|                }
 2377|      0|            }
 2378|       |            // Multi
 2379|    388|            if (last - in >= 3 && in[0].first == OP_CHECKMULTISIG) {
  ------------------
  |  Branch (2379:17): [True: 360, False: 28]
  |  Branch (2379:35): [True: 0, False: 360]
  ------------------
 2380|      0|                if (IsTapscript(ctx.MsContext())) return {};
  ------------------
  |  Branch (2380:21): [True: 0, False: 0]
  ------------------
 2381|      0|                std::vector<Key> keys;
 2382|      0|                const auto n = ParseScriptNumber(in[1]);
 2383|      0|                if (!n || last - in < 3 + *n) return {};
  ------------------
  |  Branch (2383:21): [True: 0, False: 0]
  |  Branch (2383:27): [True: 0, False: 0]
  ------------------
 2384|      0|                if (*n < 1 || *n > 20) return {};
  ------------------
  |  Branch (2384:21): [True: 0, False: 0]
  |  Branch (2384:31): [True: 0, False: 0]
  ------------------
 2385|      0|                for (int i = 0; i < *n; ++i) {
  ------------------
  |  Branch (2385:33): [True: 0, False: 0]
  ------------------
 2386|      0|                    if (in[2 + i].second.size() != 33) return {};
  ------------------
  |  Branch (2386:25): [True: 0, False: 0]
  ------------------
 2387|      0|                    auto key = ctx.FromPKBytes(in[2 + i].second.begin(), in[2 + i].second.end());
 2388|      0|                    if (!key) return {};
  ------------------
  |  Branch (2388:25): [True: 0, False: 0]
  ------------------
 2389|      0|                    keys.push_back(std::move(*key));
 2390|      0|                }
 2391|      0|                const auto k = ParseScriptNumber(in[2 + *n]);
 2392|      0|                if (!k || *k < 1 || *k > *n) return {};
  ------------------
  |  Branch (2392:21): [True: 0, False: 0]
  |  Branch (2392:27): [True: 0, False: 0]
  |  Branch (2392:37): [True: 0, False: 0]
  ------------------
 2393|      0|                in += 3 + *n;
 2394|      0|                std::reverse(keys.begin(), keys.end());
 2395|      0|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::MULTI, std::move(keys), *k);
 2396|      0|                break;
 2397|      0|            }
 2398|       |            // Tapscript's equivalent of multi
 2399|    388|            if (last - in >= 4 && in[0].first == OP_NUMEQUAL) {
  ------------------
  |  Branch (2399:17): [True: 359, False: 29]
  |  Branch (2399:35): [True: 0, False: 359]
  ------------------
 2400|      0|                if (!IsTapscript(ctx.MsContext())) return {};
  ------------------
  |  Branch (2400:21): [True: 0, False: 0]
  ------------------
 2401|       |                // The necessary threshold of signatures.
 2402|      0|                const auto k = ParseScriptNumber(in[1]);
 2403|      0|                if (!k) return {};
  ------------------
  |  Branch (2403:21): [True: 0, False: 0]
  ------------------
 2404|      0|                if (*k < 1 || *k > MAX_PUBKEYS_PER_MULTI_A) return {};
  ------------------
  |  Branch (2404:21): [True: 0, False: 0]
  |  Branch (2404:31): [True: 0, False: 0]
  ------------------
 2405|      0|                if (last - in < 2 + *k * 2) return {};
  ------------------
  |  Branch (2405:21): [True: 0, False: 0]
  ------------------
 2406|      0|                std::vector<Key> keys;
 2407|      0|                keys.reserve(*k);
 2408|       |                // Walk through the expected (pubkey, CHECKSIG[ADD]) pairs.
 2409|      0|                for (int pos = 2;; pos += 2) {
 2410|      0|                    if (last - in < pos + 2) return {};
  ------------------
  |  Branch (2410:25): [True: 0, False: 0]
  ------------------
 2411|       |                    // Make sure it's indeed an x-only pubkey and a CHECKSIG[ADD], then parse the key.
 2412|      0|                    if (in[pos].first != OP_CHECKSIGADD && in[pos].first != OP_CHECKSIG) return {};
  ------------------
  |  Branch (2412:25): [True: 0, False: 0]
  |  Branch (2412:60): [True: 0, False: 0]
  ------------------
 2413|      0|                    if (in[pos + 1].second.size() != 32) return {};
  ------------------
  |  Branch (2413:25): [True: 0, False: 0]
  ------------------
 2414|      0|                    auto key = ctx.FromPKBytes(in[pos + 1].second.begin(), in[pos + 1].second.end());
 2415|      0|                    if (!key) return {};
  ------------------
  |  Branch (2415:25): [True: 0, False: 0]
  ------------------
 2416|      0|                    keys.push_back(std::move(*key));
 2417|       |                    // Make sure early we don't parse an arbitrary large expression.
 2418|      0|                    if (keys.size() > MAX_PUBKEYS_PER_MULTI_A) return {};
  ------------------
  |  Branch (2418:25): [True: 0, False: 0]
  ------------------
 2419|       |                    // OP_CHECKSIG means it was the last one to parse.
 2420|      0|                    if (in[pos].first == OP_CHECKSIG) break;
  ------------------
  |  Branch (2420:25): [True: 0, False: 0]
  ------------------
 2421|      0|                }
 2422|      0|                if (keys.size() < (size_t)*k) return {};
  ------------------
  |  Branch (2422:21): [True: 0, False: 0]
  ------------------
 2423|      0|                in += 2 + keys.size() * 2;
 2424|      0|                std::reverse(keys.begin(), keys.end());
 2425|      0|                constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::MULTI_A, std::move(keys), *k);
 2426|      0|                break;
 2427|      0|            }
 2428|       |            /** In the following wrappers, we only need to push SINGLE_BKV_EXPR rather
 2429|       |             * than BKV_EXPR, because and_v commutes with these wrappers. For example,
 2430|       |             * c:and_v(X,Y) produces the same script as and_v(X,c:Y). */
 2431|       |            // c: wrapper
 2432|    388|            if (in[0].first == OP_CHECKSIG) {
  ------------------
  |  Branch (2432:17): [True: 58, False: 330]
  ------------------
 2433|     58|                ++in;
 2434|     58|                to_parse.emplace_back(DecodeContext::CHECK, -1, -1);
 2435|     58|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2436|     58|                break;
 2437|     58|            }
 2438|       |            // v: wrapper
 2439|    330|            if (in[0].first == OP_VERIFY) {
  ------------------
  |  Branch (2439:17): [True: 33, False: 297]
  ------------------
 2440|     33|                ++in;
 2441|     33|                to_parse.emplace_back(DecodeContext::VERIFY, -1, -1);
 2442|     33|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2443|     33|                break;
 2444|     33|            }
 2445|       |            // n: wrapper
 2446|    297|            if (in[0].first == OP_0NOTEQUAL) {
  ------------------
  |  Branch (2446:17): [True: 0, False: 297]
  ------------------
 2447|      0|                ++in;
 2448|      0|                to_parse.emplace_back(DecodeContext::ZERO_NOTEQUAL, -1, -1);
 2449|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2450|      0|                break;
 2451|      0|            }
 2452|       |            // Thresh
 2453|    297|            if (last - in >= 3 && in[0].first == OP_EQUAL && (num = ParseScriptNumber(in[1]))) {
  ------------------
  |  Branch (2453:17): [True: 278, False: 19]
  |  Branch (2453:17): [True: 0, False: 297]
  |  Branch (2453:35): [True: 0, False: 278]
  |  Branch (2453:62): [True: 0, False: 0]
  ------------------
 2454|      0|                if (*num < 1) return {};
  ------------------
  |  Branch (2454:21): [True: 0, False: 0]
  ------------------
 2455|      0|                in += 2;
 2456|      0|                to_parse.emplace_back(DecodeContext::THRESH_W, 0, *num);
 2457|      0|                break;
 2458|      0|            }
 2459|       |            // OP_ENDIF can be WRAP_J, WRAP_D, ANDOR, OR_C, OR_D, or OR_I
 2460|    297|            if (in[0].first == OP_ENDIF) {
  ------------------
  |  Branch (2460:17): [True: 0, False: 297]
  ------------------
 2461|      0|                ++in;
 2462|      0|                to_parse.emplace_back(DecodeContext::ENDIF, -1, -1);
 2463|      0|                to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2464|      0|                break;
 2465|      0|            }
 2466|       |            /** In and_b and or_b nodes, we only look for SINGLE_BKV_EXPR, because
 2467|       |             * or_b(and_v(X,Y),Z) has script [X] [Y] [Z] OP_BOOLOR, the same as
 2468|       |             * and_v(X,or_b(Y,Z)). In this example, the former of these is invalid as
 2469|       |             * miniscript, while the latter is valid. So we leave the and_v "outside"
 2470|       |             * while decoding. */
 2471|       |            // and_b
 2472|    297|            if (in[0].first == OP_BOOLAND) {
  ------------------
  |  Branch (2472:17): [True: 1, False: 296]
  ------------------
 2473|      1|                ++in;
 2474|      1|                to_parse.emplace_back(DecodeContext::AND_B, -1, -1);
 2475|      1|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2476|      1|                to_parse.emplace_back(DecodeContext::W_EXPR, -1, -1);
 2477|      1|                break;
 2478|      1|            }
 2479|       |            // or_b
 2480|    296|            if (in[0].first == OP_BOOLOR) {
  ------------------
  |  Branch (2480:17): [True: 2, False: 294]
  ------------------
 2481|      2|                ++in;
 2482|      2|                to_parse.emplace_back(DecodeContext::OR_B, -1, -1);
 2483|      2|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2484|      2|                to_parse.emplace_back(DecodeContext::W_EXPR, -1, -1);
 2485|      2|                break;
 2486|      2|            }
 2487|       |            // Unrecognised expression
 2488|    294|            return {};
 2489|    296|        }
 2490|  2.36k|        case DecodeContext::BKV_EXPR: {
  ------------------
  |  Branch (2490:9): [True: 2.36k, False: 3.68k]
  ------------------
 2491|  2.36k|            to_parse.emplace_back(DecodeContext::MAYBE_AND_V, -1, -1);
 2492|  2.36k|            to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2493|  2.36k|            break;
 2494|    296|        }
 2495|      3|        case DecodeContext::W_EXPR: {
  ------------------
  |  Branch (2495:9): [True: 3, False: 6.04k]
  ------------------
 2496|       |            // a: wrapper
 2497|      3|            if (in >= last) return {};
  ------------------
  |  Branch (2497:17): [True: 0, False: 3]
  ------------------
 2498|      3|            if (in[0].first == OP_FROMALTSTACK) {
  ------------------
  |  Branch (2498:17): [True: 0, False: 3]
  ------------------
 2499|      0|                ++in;
 2500|      0|                to_parse.emplace_back(DecodeContext::ALT, -1, -1);
 2501|      3|            } else {
 2502|      3|                to_parse.emplace_back(DecodeContext::SWAP, -1, -1);
 2503|      3|            }
 2504|      3|            to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2505|      3|            break;
 2506|      3|        }
 2507|  1.19k|        case DecodeContext::MAYBE_AND_V: {
  ------------------
  |  Branch (2507:9): [True: 1.19k, False: 4.84k]
  ------------------
 2508|       |            // If we reach a potential AND_V top-level, check if the next part of the script could be another AND_V child
 2509|       |            // These op-codes cannot end any well-formed miniscript so cannot be used in an and_v node.
 2510|  1.19k|            if (in < last && in[0].first != OP_IF && in[0].first != OP_ELSE && in[0].first != OP_NOTIF && in[0].first != OP_TOALTSTACK && in[0].first != OP_SWAP) {
  ------------------
  |  Branch (2510:17): [True: 1.09k, False: 101]
  |  Branch (2510:30): [True: 1.09k, False: 0]
  |  Branch (2510:54): [True: 1.09k, False: 0]
  |  Branch (2510:80): [True: 1.09k, False: 0]
  |  Branch (2510:107): [True: 1.09k, False: 0]
  |  Branch (2510:139): [True: 1.09k, False: 2]
  ------------------
 2511|  1.09k|                to_parse.emplace_back(DecodeContext::AND_V, -1, -1);
 2512|       |                // BKV_EXPR can contain more AND_V nodes
 2513|  1.09k|                to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2514|  1.09k|            }
 2515|  1.19k|            break;
 2516|      3|        }
 2517|      0|        case DecodeContext::SWAP: {
  ------------------
  |  Branch (2517:9): [True: 0, False: 6.04k]
  ------------------
 2518|      0|            if (in >= last || in[0].first != OP_SWAP || constructed.empty()) return {};
  ------------------
  |  Branch (2518:17): [True: 0, False: 0]
  |  Branch (2518:31): [True: 0, False: 0]
  |  Branch (2518:57): [True: 0, False: 0]
  ------------------
 2519|      0|            ++in;
 2520|      0|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_S, Vector(std::move(constructed.back()))};
 2521|      0|            break;
 2522|      0|        }
 2523|      0|        case DecodeContext::ALT: {
  ------------------
  |  Branch (2523:9): [True: 0, False: 6.04k]
  ------------------
 2524|      0|            if (in >= last || in[0].first != OP_TOALTSTACK || constructed.empty()) return {};
  ------------------
  |  Branch (2524:17): [True: 0, False: 0]
  |  Branch (2524:31): [True: 0, False: 0]
  |  Branch (2524:63): [True: 0, False: 0]
  ------------------
 2525|      0|            ++in;
 2526|      0|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_A, Vector(std::move(constructed.back()))};
 2527|      0|            break;
 2528|      0|        }
 2529|      2|        case DecodeContext::CHECK: {
  ------------------
  |  Branch (2529:9): [True: 2, False: 6.04k]
  ------------------
 2530|      2|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2530:17): [True: 0, False: 2]
  ------------------
 2531|      2|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_C, Vector(std::move(constructed.back()))};
 2532|      2|            break;
 2533|      2|        }
 2534|      0|        case DecodeContext::DUP_IF: {
  ------------------
  |  Branch (2534:9): [True: 0, False: 6.04k]
  ------------------
 2535|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2535:17): [True: 0, False: 0]
  ------------------
 2536|      0|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_D, Vector(std::move(constructed.back()))};
 2537|      0|            break;
 2538|      0|        }
 2539|      0|        case DecodeContext::VERIFY: {
  ------------------
  |  Branch (2539:9): [True: 0, False: 6.04k]
  ------------------
 2540|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2540:17): [True: 0, False: 0]
  ------------------
 2541|      0|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_V, Vector(std::move(constructed.back()))};
 2542|      0|            break;
 2543|      0|        }
 2544|      0|        case DecodeContext::NON_ZERO: {
  ------------------
  |  Branch (2544:9): [True: 0, False: 6.04k]
  ------------------
 2545|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2545:17): [True: 0, False: 0]
  ------------------
 2546|      0|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_J, Vector(std::move(constructed.back()))};
 2547|      0|            break;
 2548|      0|        }
 2549|      0|        case DecodeContext::ZERO_NOTEQUAL: {
  ------------------
  |  Branch (2549:9): [True: 0, False: 6.04k]
  ------------------
 2550|      0|            if (constructed.empty()) return {};
  ------------------
  |  Branch (2550:17): [True: 0, False: 0]
  ------------------
 2551|      0|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::WRAP_N, Vector(std::move(constructed.back()))};
 2552|      0|            break;
 2553|      0|        }
 2554|     23|        case DecodeContext::AND_V: {
  ------------------
  |  Branch (2554:9): [True: 23, False: 6.02k]
  ------------------
 2555|     23|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2555:17): [True: 0, False: 23]
  ------------------
 2556|     23|            BuildBack(ctx.MsContext(), Fragment::AND_V, constructed, /*reverse=*/true);
 2557|     23|            break;
 2558|     23|        }
 2559|      0|        case DecodeContext::AND_B: {
  ------------------
  |  Branch (2559:9): [True: 0, False: 6.04k]
  ------------------
 2560|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2560:17): [True: 0, False: 0]
  ------------------
 2561|      0|            BuildBack(ctx.MsContext(), Fragment::AND_B, constructed, /*reverse=*/true);
 2562|      0|            break;
 2563|      0|        }
 2564|      0|        case DecodeContext::OR_B: {
  ------------------
  |  Branch (2564:9): [True: 0, False: 6.04k]
  ------------------
 2565|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2565:17): [True: 0, False: 0]
  ------------------
 2566|      0|            BuildBack(ctx.MsContext(), Fragment::OR_B, constructed, /*reverse=*/true);
 2567|      0|            break;
 2568|      0|        }
 2569|      0|        case DecodeContext::OR_C: {
  ------------------
  |  Branch (2569:9): [True: 0, False: 6.04k]
  ------------------
 2570|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2570:17): [True: 0, False: 0]
  ------------------
 2571|      0|            BuildBack(ctx.MsContext(), Fragment::OR_C, constructed, /*reverse=*/true);
 2572|      0|            break;
 2573|      0|        }
 2574|      0|        case DecodeContext::OR_D: {
  ------------------
  |  Branch (2574:9): [True: 0, False: 6.04k]
  ------------------
 2575|      0|            if (constructed.size() < 2) return {};
  ------------------
  |  Branch (2575:17): [True: 0, False: 0]
  ------------------
 2576|      0|            BuildBack(ctx.MsContext(), Fragment::OR_D, constructed, /*reverse=*/true);
 2577|      0|            break;
 2578|      0|        }
 2579|      0|        case DecodeContext::ANDOR: {
  ------------------
  |  Branch (2579:9): [True: 0, False: 6.04k]
  ------------------
 2580|      0|            if (constructed.size() < 3) return {};
  ------------------
  |  Branch (2580:17): [True: 0, False: 0]
  ------------------
 2581|      0|            Node left{std::move(constructed.back())};
 2582|      0|            constructed.pop_back();
 2583|      0|            Node right{std::move(constructed.back())};
 2584|      0|            constructed.pop_back();
 2585|      0|            Node mid{std::move(constructed.back())};
 2586|      0|            constructed.back() = Node{internal::NoDupCheck{}, ctx.MsContext(), Fragment::ANDOR, Vector(std::move(left), std::move(mid), std::move(right))};
 2587|      0|            break;
 2588|      0|        }
 2589|      0|        case DecodeContext::THRESH_W: {
  ------------------
  |  Branch (2589:9): [True: 0, False: 6.04k]
  ------------------
 2590|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2590:17): [True: 0, False: 0]
  ------------------
 2591|      0|            if (in[0].first == OP_ADD) {
  ------------------
  |  Branch (2591:17): [True: 0, False: 0]
  ------------------
 2592|      0|                ++in;
 2593|      0|                to_parse.emplace_back(DecodeContext::THRESH_W, n+1, k);
 2594|      0|                to_parse.emplace_back(DecodeContext::W_EXPR, -1, -1);
 2595|      0|            } else {
 2596|      0|                to_parse.emplace_back(DecodeContext::THRESH_E, n+1, k);
 2597|       |                // All children of thresh have type modifier d, so cannot be and_v
 2598|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2599|      0|            }
 2600|      0|            break;
 2601|      0|        }
 2602|      0|        case DecodeContext::THRESH_E: {
  ------------------
  |  Branch (2602:9): [True: 0, False: 6.04k]
  ------------------
 2603|      0|            if (k < 1 || k > n || constructed.size() < static_cast<size_t>(n)) return {};
  ------------------
  |  Branch (2603:17): [True: 0, False: 0]
  |  Branch (2603:26): [True: 0, False: 0]
  |  Branch (2603:35): [True: 0, False: 0]
  ------------------
 2604|      0|            std::vector<Node<Key>> subs;
 2605|      0|            for (int i = 0; i < n; ++i) {
  ------------------
  |  Branch (2605:29): [True: 0, False: 0]
  ------------------
 2606|      0|                Node sub{std::move(constructed.back())};
 2607|      0|                constructed.pop_back();
 2608|      0|                subs.push_back(std::move(sub));
 2609|      0|            }
 2610|      0|            constructed.emplace_back(internal::NoDupCheck{}, ctx.MsContext(), Fragment::THRESH, std::move(subs), k);
 2611|      0|            break;
 2612|      0|        }
 2613|      0|        case DecodeContext::ENDIF: {
  ------------------
  |  Branch (2613:9): [True: 0, False: 6.04k]
  ------------------
 2614|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2614:17): [True: 0, False: 0]
  ------------------
 2615|       |
 2616|       |            // could be andor or or_i
 2617|      0|            if (in[0].first == OP_ELSE) {
  ------------------
  |  Branch (2617:17): [True: 0, False: 0]
  ------------------
 2618|      0|                ++in;
 2619|      0|                to_parse.emplace_back(DecodeContext::ENDIF_ELSE, -1, -1);
 2620|      0|                to_parse.emplace_back(DecodeContext::BKV_EXPR, -1, -1);
 2621|      0|            }
 2622|       |            // could be j: or d: wrapper
 2623|      0|            else if (in[0].first == OP_IF) {
  ------------------
  |  Branch (2623:22): [True: 0, False: 0]
  ------------------
 2624|      0|                if (last - in >= 2 && in[1].first == OP_DUP) {
  ------------------
  |  Branch (2624:21): [True: 0, False: 0]
  |  Branch (2624:39): [True: 0, False: 0]
  ------------------
 2625|      0|                    in += 2;
 2626|      0|                    to_parse.emplace_back(DecodeContext::DUP_IF, -1, -1);
 2627|      0|                } else if (last - in >= 3 && in[1].first == OP_0NOTEQUAL && in[2].first == OP_SIZE) {
  ------------------
  |  Branch (2627:28): [True: 0, False: 0]
  |  Branch (2627:46): [True: 0, False: 0]
  |  Branch (2627:77): [True: 0, False: 0]
  ------------------
 2628|      0|                    in += 3;
 2629|      0|                    to_parse.emplace_back(DecodeContext::NON_ZERO, -1, -1);
 2630|      0|                }
 2631|      0|                else {
 2632|      0|                    return {};
 2633|      0|                }
 2634|       |            // could be or_c or or_d
 2635|      0|            } else if (in[0].first == OP_NOTIF) {
  ------------------
  |  Branch (2635:24): [True: 0, False: 0]
  ------------------
 2636|      0|                ++in;
 2637|      0|                to_parse.emplace_back(DecodeContext::ENDIF_NOTIF, -1, -1);
 2638|      0|            }
 2639|      0|            else {
 2640|      0|                return {};
 2641|      0|            }
 2642|      0|            break;
 2643|      0|        }
 2644|      0|        case DecodeContext::ENDIF_NOTIF: {
  ------------------
  |  Branch (2644:9): [True: 0, False: 6.04k]
  ------------------
 2645|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2645:17): [True: 0, False: 0]
  ------------------
 2646|      0|            if (in[0].first == OP_IFDUP) {
  ------------------
  |  Branch (2646:17): [True: 0, False: 0]
  ------------------
 2647|      0|                ++in;
 2648|      0|                to_parse.emplace_back(DecodeContext::OR_D, -1, -1);
 2649|      0|            } else {
 2650|      0|                to_parse.emplace_back(DecodeContext::OR_C, -1, -1);
 2651|      0|            }
 2652|       |            // or_c and or_d both require X to have type modifier d so, can't contain and_v
 2653|      0|            to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2654|      0|            break;
 2655|      0|        }
 2656|      0|        case DecodeContext::ENDIF_ELSE: {
  ------------------
  |  Branch (2656:9): [True: 0, False: 6.04k]
  ------------------
 2657|      0|            if (in >= last) return {};
  ------------------
  |  Branch (2657:17): [True: 0, False: 0]
  ------------------
 2658|      0|            if (in[0].first == OP_IF) {
  ------------------
  |  Branch (2658:17): [True: 0, False: 0]
  ------------------
 2659|      0|                ++in;
 2660|      0|                BuildBack(ctx.MsContext(), Fragment::OR_I, constructed, /*reverse=*/true);
 2661|      0|            } else if (in[0].first == OP_NOTIF) {
  ------------------
  |  Branch (2661:24): [True: 0, False: 0]
  ------------------
 2662|      0|                ++in;
 2663|      0|                to_parse.emplace_back(DecodeContext::ANDOR, -1, -1);
 2664|       |                // andor requires X to have type modifier d, so it can't be and_v
 2665|      0|                to_parse.emplace_back(DecodeContext::SINGLE_BKV_EXPR, -1, -1);
 2666|      0|            } else {
 2667|      0|                return {};
 2668|      0|            }
 2669|      0|            break;
 2670|      0|        }
 2671|  6.04k|        }
 2672|  6.04k|    }
 2673|     90|    if (constructed.size() != 1) return {};
  ------------------
  |  Branch (2673:9): [True: 0, False: 90]
  ------------------
 2674|     90|    Node tl_node{std::move(constructed.front())};
 2675|     90|    tl_node.DuplicateKeyCheck(ctx);
 2676|       |    // Note that due to how ComputeType works (only assign the type to the node if the
 2677|       |    // subs' types are valid) this would fail if any node of tree is badly typed.
 2678|     90|    if (!tl_node.IsValidTopLevel()) return {};
  ------------------
  |  Branch (2678:9): [True: 10, False: 80]
  ------------------
 2679|     80|    return tl_node;
 2680|     90|}
_ZNK10miniscript4NodeI7CPubKeyE7IsValidEv:
 1675|  3.57k|    bool IsValid() const {
 1676|  3.57k|        if (GetType() == ""_mst) return false;
  ------------------
  |  Branch (1676:13): [True: 25, False: 3.55k]
  ------------------
 1677|  3.55k|        return ScriptSize() <= internal::MaxScriptSize(m_script_ctx);
 1678|  3.57k|    }
_ZNK10miniscript4NodeI7CPubKeyE7GetTypeEv:
 1617|  4.91k|    Type GetType() const { return typ; }
_ZNK10miniscript4NodeI7CPubKeyE10ScriptSizeEv:
 1559|  3.60k|    size_t ScriptSize() const { return scriptlen; }
_ZN10miniscript4NodeI7CPubKeyEC2ENS_8internal10NoDupCheckENS_17MiniscriptContextENS_8FragmentEj:
 1731|  1.19k|        : fragment(nt), k(val), m_script_ctx{script_ctx}, ops(CalcOps()), ss(CalcStackSize()), ws(CalcWitnessSize()), typ(CalcType()), scriptlen(CalcScriptLen()) {}
_ZNK10miniscript4NodeI7CPubKeyE7CalcOpsEv:
 1004|  1.22k|    internal::Ops CalcOps() const {
 1005|  1.22k|        switch (fragment) {
  ------------------
  |  Branch (1005:17): [True: 1.22k, False: 0]
  ------------------
 1006|      0|            case Fragment::JUST_1: return {0, 0, {}};
  ------------------
  |  Branch (1006:13): [True: 0, False: 1.22k]
  ------------------
 1007|  1.19k|            case Fragment::JUST_0: return {0, {}, 0};
  ------------------
  |  Branch (1007:13): [True: 1.19k, False: 25]
  ------------------
 1008|      0|            case Fragment::PK_K: return {0, 0, 0};
  ------------------
  |  Branch (1008:13): [True: 0, False: 1.22k]
  ------------------
 1009|      0|            case Fragment::PK_H: return {3, 0, 0};
  ------------------
  |  Branch (1009:13): [True: 0, False: 1.22k]
  ------------------
 1010|      0|            case Fragment::OLDER:
  ------------------
  |  Branch (1010:13): [True: 0, False: 1.22k]
  ------------------
 1011|      0|            case Fragment::AFTER: return {1, 0, {}};
  ------------------
  |  Branch (1011:13): [True: 0, False: 1.22k]
  ------------------
 1012|      0|            case Fragment::SHA256:
  ------------------
  |  Branch (1012:13): [True: 0, False: 1.22k]
  ------------------
 1013|      0|            case Fragment::RIPEMD160:
  ------------------
  |  Branch (1013:13): [True: 0, False: 1.22k]
  ------------------
 1014|      0|            case Fragment::HASH256:
  ------------------
  |  Branch (1014:13): [True: 0, False: 1.22k]
  ------------------
 1015|      0|            case Fragment::HASH160: return {4, 0, {}};
  ------------------
  |  Branch (1015:13): [True: 0, False: 1.22k]
  ------------------
 1016|     23|            case Fragment::AND_V: return {subs[0].ops.count + subs[1].ops.count, subs[0].ops.sat + subs[1].ops.sat, {}};
  ------------------
  |  Branch (1016:13): [True: 23, False: 1.20k]
  ------------------
 1017|      0|            case Fragment::AND_B: {
  ------------------
  |  Branch (1017:13): [True: 0, False: 1.22k]
  ------------------
 1018|      0|                const auto count{1 + subs[0].ops.count + subs[1].ops.count};
 1019|      0|                const auto sat{subs[0].ops.sat + subs[1].ops.sat};
 1020|      0|                const auto dsat{subs[0].ops.dsat + subs[1].ops.dsat};
 1021|      0|                return {count, sat, dsat};
 1022|      0|            }
 1023|      0|            case Fragment::OR_B: {
  ------------------
  |  Branch (1023:13): [True: 0, False: 1.22k]
  ------------------
 1024|      0|                const auto count{1 + subs[0].ops.count + subs[1].ops.count};
 1025|      0|                const auto sat{(subs[0].ops.sat + subs[1].ops.dsat) | (subs[1].ops.sat + subs[0].ops.dsat)};
 1026|      0|                const auto dsat{subs[0].ops.dsat + subs[1].ops.dsat};
 1027|      0|                return {count, sat, dsat};
 1028|      0|            }
 1029|      0|            case Fragment::OR_D: {
  ------------------
  |  Branch (1029:13): [True: 0, False: 1.22k]
  ------------------
 1030|      0|                const auto count{3 + subs[0].ops.count + subs[1].ops.count};
 1031|      0|                const auto sat{subs[0].ops.sat | (subs[1].ops.sat + subs[0].ops.dsat)};
 1032|      0|                const auto dsat{subs[0].ops.dsat + subs[1].ops.dsat};
 1033|      0|                return {count, sat, dsat};
 1034|      0|            }
 1035|      0|            case Fragment::OR_C: {
  ------------------
  |  Branch (1035:13): [True: 0, False: 1.22k]
  ------------------
 1036|      0|                const auto count{2 + subs[0].ops.count + subs[1].ops.count};
 1037|      0|                const auto sat{subs[0].ops.sat | (subs[1].ops.sat + subs[0].ops.dsat)};
 1038|      0|                return {count, sat, {}};
 1039|      0|            }
 1040|      0|            case Fragment::OR_I: {
  ------------------
  |  Branch (1040:13): [True: 0, False: 1.22k]
  ------------------
 1041|      0|                const auto count{3 + subs[0].ops.count + subs[1].ops.count};
 1042|      0|                const auto sat{subs[0].ops.sat | subs[1].ops.sat};
 1043|      0|                const auto dsat{subs[0].ops.dsat | subs[1].ops.dsat};
 1044|      0|                return {count, sat, dsat};
 1045|      0|            }
 1046|      0|            case Fragment::ANDOR: {
  ------------------
  |  Branch (1046:13): [True: 0, False: 1.22k]
  ------------------
 1047|      0|                const auto count{3 + subs[0].ops.count + subs[1].ops.count + subs[2].ops.count};
 1048|      0|                const auto sat{(subs[1].ops.sat + subs[0].ops.sat) | (subs[0].ops.dsat + subs[2].ops.sat)};
 1049|      0|                const auto dsat{subs[0].ops.dsat + subs[2].ops.dsat};
 1050|      0|                return {count, sat, dsat};
 1051|      0|            }
 1052|      0|            case Fragment::MULTI: return {1, (uint32_t)keys.size(), (uint32_t)keys.size()};
  ------------------
  |  Branch (1052:13): [True: 0, False: 1.22k]
  ------------------
 1053|      0|            case Fragment::MULTI_A: return {(uint32_t)keys.size() + 1, 0, 0};
  ------------------
  |  Branch (1053:13): [True: 0, False: 1.22k]
  ------------------
 1054|      0|            case Fragment::WRAP_S:
  ------------------
  |  Branch (1054:13): [True: 0, False: 1.22k]
  ------------------
 1055|      2|            case Fragment::WRAP_C:
  ------------------
  |  Branch (1055:13): [True: 2, False: 1.22k]
  ------------------
 1056|      2|            case Fragment::WRAP_N: return {1 + subs[0].ops.count, subs[0].ops.sat, subs[0].ops.dsat};
  ------------------
  |  Branch (1056:13): [True: 0, False: 1.22k]
  ------------------
 1057|      0|            case Fragment::WRAP_A: return {2 + subs[0].ops.count, subs[0].ops.sat, subs[0].ops.dsat};
  ------------------
  |  Branch (1057:13): [True: 0, False: 1.22k]
  ------------------
 1058|      0|            case Fragment::WRAP_D: return {3 + subs[0].ops.count, subs[0].ops.sat, 0};
  ------------------
  |  Branch (1058:13): [True: 0, False: 1.22k]
  ------------------
 1059|      0|            case Fragment::WRAP_J: return {4 + subs[0].ops.count, subs[0].ops.sat, 0};
  ------------------
  |  Branch (1059:13): [True: 0, False: 1.22k]
  ------------------
 1060|      0|            case Fragment::WRAP_V: return {subs[0].ops.count + (subs[0].GetType() << "x"_mst), subs[0].ops.sat, {}};
  ------------------
  |  Branch (1060:13): [True: 0, False: 1.22k]
  ------------------
 1061|      0|            case Fragment::THRESH: {
  ------------------
  |  Branch (1061:13): [True: 0, False: 1.22k]
  ------------------
 1062|      0|                uint32_t count = 0;
 1063|      0|                auto sats = Vector(internal::MaxInt<uint32_t>(0));
 1064|      0|                for (const auto& sub : subs) {
  ------------------
  |  Branch (1064:38): [True: 0, False: 0]
  ------------------
 1065|      0|                    count += sub.ops.count + 1;
 1066|      0|                    auto next_sats = Vector(sats[0] + sub.ops.dsat);
 1067|      0|                    for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + sub.ops.dsat) | (sats[j - 1] + sub.ops.sat));
  ------------------
  |  Branch (1067:40): [True: 0, False: 0]
  ------------------
 1068|      0|                    next_sats.push_back(sats[sats.size() - 1] + sub.ops.sat);
 1069|      0|                    sats = std::move(next_sats);
 1070|      0|                }
 1071|      0|                assert(k < sats.size());
  ------------------
  |  Branch (1071:17): [True: 0, False: 0]
  ------------------
 1072|      0|                return {count, sats[k], sats[0]};
 1073|      0|            }
 1074|  1.22k|        }
 1075|  1.22k|        assert(false);
  ------------------
  |  Branch (1075:9): [Folded, False: 0]
  ------------------
 1076|      0|    }
_ZNK10miniscript4NodeI7CPubKeyE13CalcStackSizeEv:
 1078|  1.22k|    internal::StackSize CalcStackSize() const {
 1079|  1.22k|        using namespace internal;
 1080|  1.22k|        switch (fragment) {
  ------------------
  |  Branch (1080:17): [True: 1.22k, False: 0]
  ------------------
 1081|  1.19k|            case Fragment::JUST_0: return {{}, SatInfo::Push()};
  ------------------
  |  Branch (1081:13): [True: 1.19k, False: 25]
  ------------------
 1082|      0|            case Fragment::JUST_1: return {SatInfo::Push(), {}};
  ------------------
  |  Branch (1082:13): [True: 0, False: 1.22k]
  ------------------
 1083|      0|            case Fragment::OLDER:
  ------------------
  |  Branch (1083:13): [True: 0, False: 1.22k]
  ------------------
 1084|      0|            case Fragment::AFTER: return {SatInfo::Push() + SatInfo::Nop(), {}};
  ------------------
  |  Branch (1084:13): [True: 0, False: 1.22k]
  ------------------
 1085|      0|            case Fragment::PK_K: return {SatInfo::Push()};
  ------------------
  |  Branch (1085:13): [True: 0, False: 1.22k]
  ------------------
 1086|      0|            case Fragment::PK_H: return {SatInfo::OP_DUP() + SatInfo::Hash() + SatInfo::Push() + SatInfo::OP_EQUALVERIFY()};
  ------------------
  |  Branch (1086:13): [True: 0, False: 1.22k]
  ------------------
 1087|      0|            case Fragment::SHA256:
  ------------------
  |  Branch (1087:13): [True: 0, False: 1.22k]
  ------------------
 1088|      0|            case Fragment::RIPEMD160:
  ------------------
  |  Branch (1088:13): [True: 0, False: 1.22k]
  ------------------
 1089|      0|            case Fragment::HASH256:
  ------------------
  |  Branch (1089:13): [True: 0, False: 1.22k]
  ------------------
 1090|      0|            case Fragment::HASH160: return {
  ------------------
  |  Branch (1090:13): [True: 0, False: 1.22k]
  ------------------
 1091|      0|                SatInfo::OP_SIZE() + SatInfo::Push() + SatInfo::OP_EQUALVERIFY() + SatInfo::Hash() + SatInfo::Push() + SatInfo::OP_EQUAL(),
 1092|      0|                {}
 1093|      0|            };
 1094|      0|            case Fragment::ANDOR: {
  ------------------
  |  Branch (1094:13): [True: 0, False: 1.22k]
  ------------------
 1095|      0|                const auto& x{subs[0].ss};
 1096|      0|                const auto& y{subs[1].ss};
 1097|      0|                const auto& z{subs[2].ss};
 1098|      0|                return {
 1099|      0|                    (x.Sat() + SatInfo::If() + y.Sat()) | (x.Dsat() + SatInfo::If() + z.Sat()),
 1100|      0|                    x.Dsat() + SatInfo::If() + z.Dsat()
 1101|      0|                };
 1102|      0|            }
 1103|     23|            case Fragment::AND_V: {
  ------------------
  |  Branch (1103:13): [True: 23, False: 1.20k]
  ------------------
 1104|     23|                const auto& x{subs[0].ss};
 1105|     23|                const auto& y{subs[1].ss};
 1106|     23|                return {x.Sat() + y.Sat(), {}};
 1107|      0|            }
 1108|      0|            case Fragment::AND_B: {
  ------------------
  |  Branch (1108:13): [True: 0, False: 1.22k]
  ------------------
 1109|      0|                const auto& x{subs[0].ss};
 1110|      0|                const auto& y{subs[1].ss};
 1111|      0|                return {x.Sat() + y.Sat() + SatInfo::BinaryOp(), x.Dsat() + y.Dsat() + SatInfo::BinaryOp()};
 1112|      0|            }
 1113|      0|            case Fragment::OR_B: {
  ------------------
  |  Branch (1113:13): [True: 0, False: 1.22k]
  ------------------
 1114|      0|                const auto& x{subs[0].ss};
 1115|      0|                const auto& y{subs[1].ss};
 1116|      0|                return {
 1117|      0|                    ((x.Sat() + y.Dsat()) | (x.Dsat() + y.Sat())) + SatInfo::BinaryOp(),
 1118|      0|                    x.Dsat() + y.Dsat() + SatInfo::BinaryOp()
 1119|      0|                };
 1120|      0|            }
 1121|      0|            case Fragment::OR_C: {
  ------------------
  |  Branch (1121:13): [True: 0, False: 1.22k]
  ------------------
 1122|      0|                const auto& x{subs[0].ss};
 1123|      0|                const auto& y{subs[1].ss};
 1124|      0|                return {(x.Sat() + SatInfo::If()) | (x.Dsat() + SatInfo::If() + y.Sat()), {}};
 1125|      0|            }
 1126|      0|            case Fragment::OR_D: {
  ------------------
  |  Branch (1126:13): [True: 0, False: 1.22k]
  ------------------
 1127|      0|                const auto& x{subs[0].ss};
 1128|      0|                const auto& y{subs[1].ss};
 1129|      0|                return {
 1130|      0|                    (x.Sat() + SatInfo::OP_IFDUP(true) + SatInfo::If()) | (x.Dsat() + SatInfo::OP_IFDUP(false) + SatInfo::If() + y.Sat()),
 1131|      0|                    x.Dsat() + SatInfo::OP_IFDUP(false) + SatInfo::If() + y.Dsat()
 1132|      0|                };
 1133|      0|            }
 1134|      0|            case Fragment::OR_I: {
  ------------------
  |  Branch (1134:13): [True: 0, False: 1.22k]
  ------------------
 1135|      0|                const auto& x{subs[0].ss};
 1136|      0|                const auto& y{subs[1].ss};
 1137|      0|                return {SatInfo::If() + (x.Sat() | y.Sat()), SatInfo::If() + (x.Dsat() | y.Dsat())};
 1138|      0|            }
 1139|       |            // multi(k, key1, key2, ..., key_n) starts off with k+1 stack elements (a 0, plus k
 1140|       |            // signatures), then reaches n+k+3 stack elements after pushing the n keys, plus k and
 1141|       |            // n itself, and ends with 1 stack element (success or failure). Thus, it net removes
 1142|       |            // k elements (from k+1 to 1), while reaching k+n+2 more than it ends with.
 1143|      0|            case Fragment::MULTI: return {SatInfo(k, k + keys.size() + 2)};
  ------------------
  |  Branch (1143:13): [True: 0, False: 1.22k]
  ------------------
 1144|       |            // multi_a(k, key1, key2, ..., key_n) starts off with n stack elements (the
 1145|       |            // signatures), reaches 1 more (after the first key push), and ends with 1. Thus it net
 1146|       |            // removes n-1 elements (from n to 1) while reaching n more than it ends with.
 1147|      0|            case Fragment::MULTI_A: return {SatInfo(keys.size() - 1, keys.size())};
  ------------------
  |  Branch (1147:13): [True: 0, False: 1.22k]
  ------------------
 1148|      0|            case Fragment::WRAP_A:
  ------------------
  |  Branch (1148:13): [True: 0, False: 1.22k]
  ------------------
 1149|      0|            case Fragment::WRAP_N:
  ------------------
  |  Branch (1149:13): [True: 0, False: 1.22k]
  ------------------
 1150|      0|            case Fragment::WRAP_S: return subs[0].ss;
  ------------------
  |  Branch (1150:13): [True: 0, False: 1.22k]
  ------------------
 1151|      2|            case Fragment::WRAP_C: return {
  ------------------
  |  Branch (1151:13): [True: 2, False: 1.22k]
  ------------------
 1152|      2|                subs[0].ss.Sat() + SatInfo::OP_CHECKSIG(),
 1153|      2|                subs[0].ss.Dsat() + SatInfo::OP_CHECKSIG()
 1154|      2|            };
 1155|      0|            case Fragment::WRAP_D: return {
  ------------------
  |  Branch (1155:13): [True: 0, False: 1.22k]
  ------------------
 1156|      0|                SatInfo::OP_DUP() + SatInfo::If() + subs[0].ss.Sat(),
 1157|      0|                SatInfo::OP_DUP() + SatInfo::If()
 1158|      0|            };
 1159|      0|            case Fragment::WRAP_V: return {subs[0].ss.Sat() + SatInfo::OP_VERIFY(), {}};
  ------------------
  |  Branch (1159:13): [True: 0, False: 1.22k]
  ------------------
 1160|      0|            case Fragment::WRAP_J: return {
  ------------------
  |  Branch (1160:13): [True: 0, False: 1.22k]
  ------------------
 1161|      0|                SatInfo::OP_SIZE() + SatInfo::OP_0NOTEQUAL() + SatInfo::If() + subs[0].ss.Sat(),
 1162|      0|                SatInfo::OP_SIZE() + SatInfo::OP_0NOTEQUAL() + SatInfo::If()
 1163|      0|            };
 1164|      0|            case Fragment::THRESH: {
  ------------------
  |  Branch (1164:13): [True: 0, False: 1.22k]
  ------------------
 1165|       |                // sats[j] is the SatInfo corresponding to all traces reaching j satisfactions.
 1166|      0|                auto sats = Vector(SatInfo::Empty());
 1167|      0|                for (size_t i = 0; i < subs.size(); ++i) {
  ------------------
  |  Branch (1167:36): [True: 0, False: 0]
  ------------------
 1168|       |                    // Loop over the subexpressions, processing them one by one. After adding
 1169|       |                    // element i we need to add OP_ADD (if i>0).
 1170|      0|                    auto add = i ? SatInfo::BinaryOp() : SatInfo::Empty();
  ------------------
  |  Branch (1170:32): [True: 0, False: 0]
  ------------------
 1171|       |                    // Construct a variable that will become the next sats, starting with index 0.
 1172|      0|                    auto next_sats = Vector(sats[0] + subs[i].ss.Dsat() + add);
 1173|       |                    // Then loop to construct next_sats[1..i].
 1174|      0|                    for (size_t j = 1; j < sats.size(); ++j) {
  ------------------
  |  Branch (1174:40): [True: 0, False: 0]
  ------------------
 1175|      0|                        next_sats.push_back(((sats[j] + subs[i].ss.Dsat()) | (sats[j - 1] + subs[i].ss.Sat())) + add);
 1176|      0|                    }
 1177|       |                    // Finally construct next_sats[i+1].
 1178|      0|                    next_sats.push_back(sats[sats.size() - 1] + subs[i].ss.Sat() + add);
 1179|       |                    // Switch over.
 1180|      0|                    sats = std::move(next_sats);
 1181|      0|                }
 1182|       |                // To satisfy thresh we need k satisfactions; to dissatisfy we need 0. In both
 1183|       |                // cases a push of k and an OP_EQUAL follow.
 1184|      0|                return {
 1185|      0|                    sats[k] + SatInfo::Push() + SatInfo::OP_EQUAL(),
 1186|      0|                    sats[0] + SatInfo::Push() + SatInfo::OP_EQUAL()
 1187|      0|                };
 1188|      0|            }
 1189|  1.22k|        }
 1190|  1.22k|        assert(false);
  ------------------
  |  Branch (1190:9): [Folded, False: 0]
  ------------------
 1191|      0|    }
_ZNK10miniscript4NodeI7CPubKeyE15CalcWitnessSizeEv:
 1193|  1.22k|    internal::WitnessSize CalcWitnessSize() const {
 1194|  1.22k|        const uint32_t sig_size = IsTapscript(m_script_ctx) ? 1 + 65 : 1 + 72;
  ------------------
  |  Branch (1194:35): [True: 0, False: 1.22k]
  ------------------
 1195|  1.22k|        const uint32_t pubkey_size = IsTapscript(m_script_ctx) ? 1 + 32 : 1 + 33;
  ------------------
  |  Branch (1195:38): [True: 0, False: 1.22k]
  ------------------
 1196|  1.22k|        switch (fragment) {
  ------------------
  |  Branch (1196:17): [True: 1.22k, False: 0]
  ------------------
 1197|  1.19k|            case Fragment::JUST_0: return {{}, 0};
  ------------------
  |  Branch (1197:13): [True: 1.19k, False: 25]
  ------------------
 1198|      0|            case Fragment::JUST_1:
  ------------------
  |  Branch (1198:13): [True: 0, False: 1.22k]
  ------------------
 1199|      0|            case Fragment::OLDER:
  ------------------
  |  Branch (1199:13): [True: 0, False: 1.22k]
  ------------------
 1200|      0|            case Fragment::AFTER: return {0, {}};
  ------------------
  |  Branch (1200:13): [True: 0, False: 1.22k]
  ------------------
 1201|      0|            case Fragment::PK_K: return {sig_size, 1};
  ------------------
  |  Branch (1201:13): [True: 0, False: 1.22k]
  ------------------
 1202|      0|            case Fragment::PK_H: return {sig_size + pubkey_size, 1 + pubkey_size};
  ------------------
  |  Branch (1202:13): [True: 0, False: 1.22k]
  ------------------
 1203|      0|            case Fragment::SHA256:
  ------------------
  |  Branch (1203:13): [True: 0, False: 1.22k]
  ------------------
 1204|      0|            case Fragment::RIPEMD160:
  ------------------
  |  Branch (1204:13): [True: 0, False: 1.22k]
  ------------------
 1205|      0|            case Fragment::HASH256:
  ------------------
  |  Branch (1205:13): [True: 0, False: 1.22k]
  ------------------
 1206|      0|            case Fragment::HASH160: return {1 + 32, {}};
  ------------------
  |  Branch (1206:13): [True: 0, False: 1.22k]
  ------------------
 1207|      0|            case Fragment::ANDOR: {
  ------------------
  |  Branch (1207:13): [True: 0, False: 1.22k]
  ------------------
 1208|      0|                const auto sat{(subs[0].ws.sat + subs[1].ws.sat) | (subs[0].ws.dsat + subs[2].ws.sat)};
 1209|      0|                const auto dsat{subs[0].ws.dsat + subs[2].ws.dsat};
 1210|      0|                return {sat, dsat};
 1211|      0|            }
 1212|     23|            case Fragment::AND_V: return {subs[0].ws.sat + subs[1].ws.sat, {}};
  ------------------
  |  Branch (1212:13): [True: 23, False: 1.20k]
  ------------------
 1213|      0|            case Fragment::AND_B: return {subs[0].ws.sat + subs[1].ws.sat, subs[0].ws.dsat + subs[1].ws.dsat};
  ------------------
  |  Branch (1213:13): [True: 0, False: 1.22k]
  ------------------
 1214|      0|            case Fragment::OR_B: {
  ------------------
  |  Branch (1214:13): [True: 0, False: 1.22k]
  ------------------
 1215|      0|                const auto sat{(subs[0].ws.dsat + subs[1].ws.sat) | (subs[0].ws.sat + subs[1].ws.dsat)};
 1216|      0|                const auto dsat{subs[0].ws.dsat + subs[1].ws.dsat};
 1217|      0|                return {sat, dsat};
 1218|      0|            }
 1219|      0|            case Fragment::OR_C: return {subs[0].ws.sat | (subs[0].ws.dsat + subs[1].ws.sat), {}};
  ------------------
  |  Branch (1219:13): [True: 0, False: 1.22k]
  ------------------
 1220|      0|            case Fragment::OR_D: return {subs[0].ws.sat | (subs[0].ws.dsat + subs[1].ws.sat), subs[0].ws.dsat + subs[1].ws.dsat};
  ------------------
  |  Branch (1220:13): [True: 0, False: 1.22k]
  ------------------
 1221|      0|            case Fragment::OR_I: return {(subs[0].ws.sat + 1 + 1) | (subs[1].ws.sat + 1), (subs[0].ws.dsat + 1 + 1) | (subs[1].ws.dsat + 1)};
  ------------------
  |  Branch (1221:13): [True: 0, False: 1.22k]
  ------------------
 1222|      0|            case Fragment::MULTI: return {k * sig_size + 1, k + 1};
  ------------------
  |  Branch (1222:13): [True: 0, False: 1.22k]
  ------------------
 1223|      0|            case Fragment::MULTI_A: return {k * sig_size + static_cast<uint32_t>(keys.size()) - k, static_cast<uint32_t>(keys.size())};
  ------------------
  |  Branch (1223:13): [True: 0, False: 1.22k]
  ------------------
 1224|      0|            case Fragment::WRAP_A:
  ------------------
  |  Branch (1224:13): [True: 0, False: 1.22k]
  ------------------
 1225|      0|            case Fragment::WRAP_N:
  ------------------
  |  Branch (1225:13): [True: 0, False: 1.22k]
  ------------------
 1226|      0|            case Fragment::WRAP_S:
  ------------------
  |  Branch (1226:13): [True: 0, False: 1.22k]
  ------------------
 1227|      2|            case Fragment::WRAP_C: return subs[0].ws;
  ------------------
  |  Branch (1227:13): [True: 2, False: 1.22k]
  ------------------
 1228|      0|            case Fragment::WRAP_D: return {1 + 1 + subs[0].ws.sat, 1};
  ------------------
  |  Branch (1228:13): [True: 0, False: 1.22k]
  ------------------
 1229|      0|            case Fragment::WRAP_V: return {subs[0].ws.sat, {}};
  ------------------
  |  Branch (1229:13): [True: 0, False: 1.22k]
  ------------------
 1230|      0|            case Fragment::WRAP_J: return {subs[0].ws.sat, 1};
  ------------------
  |  Branch (1230:13): [True: 0, False: 1.22k]
  ------------------
 1231|      0|            case Fragment::THRESH: {
  ------------------
  |  Branch (1231:13): [True: 0, False: 1.22k]
  ------------------
 1232|      0|                auto sats = Vector(internal::MaxInt<uint32_t>(0));
 1233|      0|                for (const auto& sub : subs) {
  ------------------
  |  Branch (1233:38): [True: 0, False: 0]
  ------------------
 1234|      0|                    auto next_sats = Vector(sats[0] + sub.ws.dsat);
 1235|      0|                    for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + sub.ws.dsat) | (sats[j - 1] + sub.ws.sat));
  ------------------
  |  Branch (1235:40): [True: 0, False: 0]
  ------------------
 1236|      0|                    next_sats.push_back(sats[sats.size() - 1] + sub.ws.sat);
 1237|      0|                    sats = std::move(next_sats);
 1238|      0|                }
 1239|      0|                assert(k < sats.size());
  ------------------
  |  Branch (1239:17): [True: 0, False: 0]
  ------------------
 1240|      0|                return {sats[k], sats[0]};
 1241|      0|            }
 1242|  1.22k|        }
 1243|  1.22k|        assert(false);
  ------------------
  |  Branch (1243:9): [Folded, False: 0]
  ------------------
 1244|      0|    }
_ZNK10miniscript4NodeI7CPubKeyE8CalcTypeEv:
  780|  1.22k|    Type CalcType() const {
  781|  1.22k|        using namespace internal;
  782|       |
  783|       |        // THRESH has a variable number of subexpressions
  784|  1.22k|        std::vector<Type> sub_types;
  785|  1.22k|        if (fragment == Fragment::THRESH) {
  ------------------
  |  Branch (785:13): [True: 0, False: 1.22k]
  ------------------
  786|      0|            for (const auto& sub : subs) sub_types.push_back(sub.GetType());
  ------------------
  |  Branch (786:34): [True: 0, False: 0]
  ------------------
  787|      0|        }
  788|       |        // All other nodes than THRESH can be computed just from the types of the 0-3 subexpressions.
  789|  1.22k|        Type x = subs.size() > 0 ? subs[0].GetType() : ""_mst;
  ------------------
  |  Branch (789:18): [True: 25, False: 1.19k]
  ------------------
  790|  1.22k|        Type y = subs.size() > 1 ? subs[1].GetType() : ""_mst;
  ------------------
  |  Branch (790:18): [True: 23, False: 1.20k]
  ------------------
  791|  1.22k|        Type z = subs.size() > 2 ? subs[2].GetType() : ""_mst;
  ------------------
  |  Branch (791:18): [True: 0, False: 1.22k]
  ------------------
  792|       |
  793|  1.22k|        return SanitizeType(ComputeType(fragment, x, y, z, sub_types, k, data.size(), subs.size(), keys.size(), m_script_ctx));
  794|  1.22k|    }
_ZNK10miniscript4NodeI7CPubKeyE13CalcScriptLenEv:
  619|  1.22k|    {
  620|  1.22k|        size_t subsize = 0;
  621|  1.22k|        for (const auto& sub : subs) {
  ------------------
  |  Branch (621:30): [True: 48, False: 1.22k]
  ------------------
  622|     48|            subsize += sub.ScriptSize();
  623|     48|        }
  624|  1.22k|        Type sub0type = subs.size() > 0 ? subs[0].GetType() : ""_mst;
  ------------------
  |  Branch (624:25): [True: 25, False: 1.19k]
  ------------------
  625|  1.22k|        return internal::ComputeScriptLen(fragment, sub0type, subsize, k, subs.size(), keys.size(), m_script_ctx);
  626|  1.22k|    }
_ZN10miniscript4NodeI7CPubKeyEC2ENS_8internal10NoDupCheckENS_17MiniscriptContextENS_8FragmentENSt3__16vectorIS2_NS7_9allocatorIS2_EEEEj:
 1729|     25|        : fragment(nt), k(val), subs(std::move(sub)), m_script_ctx{script_ctx}, ops(CalcOps()), ss(CalcStackSize()), ws(CalcWitnessSize()), typ(CalcType()), scriptlen(CalcScriptLen()) {}
_ZN10miniscript4NodeI7CPubKeyEaSEOS2_:
 1753|     25|    Node& operator=(Node&&) noexcept = default;
_ZN10miniscript8internal9BuildBackI7CPubKeyEEvNS_17MiniscriptContextENS_8FragmentERNSt3__16vectorINS_4NodeIT_EENS5_9allocatorIS9_EEEEb:
 1838|     23|{
 1839|     23|    Node<Key> child{std::move(constructed.back())};
 1840|     23|    constructed.pop_back();
 1841|     23|    if (reverse) {
  ------------------
  |  Branch (1841:9): [True: 23, False: 0]
  ------------------
 1842|     23|        constructed.back() = Node<Key>{internal::NoDupCheck{}, script_ctx, nt, Vector(std::move(child), std::move(constructed.back()))};
 1843|     23|    } else {
 1844|      0|        constructed.back() = Node<Key>{internal::NoDupCheck{}, script_ctx, nt, Vector(std::move(constructed.back()), std::move(child))};
 1845|      0|    }
 1846|     23|}
_ZN10miniscript4NodeI7CPubKeyEC2EOS2_:
 1752|  1.83k|    Node(Node&&) noexcept = default;
_ZNK10miniscript4NodeI7CPubKeyE17DuplicateKeyCheckI12WshSatisfierEEvRKT_:
 1501|     90|    {
 1502|       |        // We cannot use a lambda here, as lambdas are non assignable, and the set operations
 1503|       |        // below require moving the comparators around.
 1504|     90|        struct Comp {
 1505|     90|            const Ctx* ctx_ptr;
 1506|     90|            Comp(const Ctx& ctx) : ctx_ptr(&ctx) {}
 1507|     90|            bool operator()(const Key& a, const Key& b) const { return ctx_ptr->KeyCompare(a, b); }
 1508|     90|        };
 1509|       |
 1510|       |        // state in the recursive computation:
 1511|       |        // - std::nullopt means "this node has duplicates"
 1512|       |        // - an std::set means "this node has no duplicate keys, and they are: ...".
 1513|     90|        using keyset = std::set<Key, Comp>;
 1514|     90|        using state = std::optional<keyset>;
 1515|       |
 1516|     90|        auto upfn = [&ctx](const Node& node, std::span<state> subs) -> state {
 1517|       |            // If this node is already known to have duplicates, nothing left to do.
 1518|     90|            if (node.has_duplicate_keys.has_value() && *node.has_duplicate_keys) return {};
 1519|       |
 1520|       |            // Check if one of the children is already known to have duplicates.
 1521|     90|            for (auto& sub : subs) {
 1522|     90|                if (!sub.has_value()) {
 1523|     90|                    node.has_duplicate_keys = true;
 1524|     90|                    return {};
 1525|     90|                }
 1526|     90|            }
 1527|       |
 1528|       |            // Start building the set of keys involved in this node and children.
 1529|       |            // Start by keys in this node directly.
 1530|     90|            size_t keys_count = node.keys.size();
 1531|     90|            keyset key_set{node.keys.begin(), node.keys.end(), Comp(ctx)};
 1532|     90|            if (key_set.size() != keys_count) {
 1533|       |                // It already has duplicates; bail out.
 1534|     90|                node.has_duplicate_keys = true;
 1535|     90|                return {};
 1536|     90|            }
 1537|       |
 1538|       |            // Merge the keys from the children into this set.
 1539|     90|            for (auto& sub : subs) {
 1540|     90|                keys_count += sub->size();
 1541|       |                // Small optimization: std::set::merge is linear in the size of the second arg but
 1542|       |                // logarithmic in the size of the first.
 1543|     90|                if (key_set.size() < sub->size()) std::swap(key_set, *sub);
 1544|     90|                key_set.merge(*sub);
 1545|     90|                if (key_set.size() != keys_count) {
 1546|     90|                    node.has_duplicate_keys = true;
 1547|     90|                    return {};
 1548|     90|                }
 1549|     90|            }
 1550|       |
 1551|     90|            node.has_duplicate_keys = false;
 1552|     90|            return key_set;
 1553|     90|        };
 1554|       |
 1555|     90|        TreeEval<state>(upfn);
 1556|     90|    }
_ZNK10miniscript4NodeI7CPubKeyE8TreeEvalINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS7_IS8_EEvSB_EUlRKS2_NS4_4spanISG_Lm18446744073709551615EEEE_EES9_T0_:
  748|     90|    {
  749|     90|        struct DummyState {};
  750|     90|        return std::move(*TreeEvalMaybe<Result>(DummyState{},
  751|     90|            [](DummyState, const Node&, size_t) { return DummyState{}; },
  752|     90|            [&upfn](DummyState, const Node& node, std::span<Result> subs) {
  753|     90|                Result res{upfn(node, subs)};
  754|     90|                return std::optional<Result>(std::move(res));
  755|     90|            }
  756|     90|        ));
  757|     90|    }
_ZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS2_8TreeEvalISG_ZNKS7_IS8_EEvSB_EUlRKS2_NS4_4spanISG_Lm18446744073709551615EEEE_EES9_T0_E10DummyStateZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_mE_ZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_SL_E_EENS5_IS9_EESN_T1_T2_:
  653|     90|    {
  654|       |        /** Entries of the explicit stack tracked in this algorithm. */
  655|     90|        struct StackElem
  656|     90|        {
  657|     90|            const Node& node; //!< The node being evaluated.
  658|     90|            size_t expanded; //!< How many children of this node have been expanded.
  659|     90|            State state; //!< The state for that node.
  660|       |
  661|     90|            StackElem(const Node& node_, size_t exp_, State&& state_) :
  662|     90|                node(node_), expanded(exp_), state(std::move(state_)) {}
  663|     90|        };
  664|       |        /* Stack of tree nodes being explored. */
  665|     90|        std::vector<StackElem> stack;
  666|       |        /* Results of subtrees so far. Their order and mapping to tree nodes
  667|       |         * is implicitly defined by stack. */
  668|     90|        std::vector<Result> results;
  669|     90|        stack.emplace_back(*this, 0, std::move(root_state));
  670|       |
  671|       |        /* Here is a demonstration of the algorithm, for an example tree A(B,C(D,E),F).
  672|       |         * State variables are omitted for simplicity.
  673|       |         *
  674|       |         * First: stack=[(A,0)] results=[]
  675|       |         *        stack=[(A,1),(B,0)] results=[]
  676|       |         *        stack=[(A,1)] results=[B]
  677|       |         *        stack=[(A,2),(C,0)] results=[B]
  678|       |         *        stack=[(A,2),(C,1),(D,0)] results=[B]
  679|       |         *        stack=[(A,2),(C,1)] results=[B,D]
  680|       |         *        stack=[(A,2),(C,2),(E,0)] results=[B,D]
  681|       |         *        stack=[(A,2),(C,2)] results=[B,D,E]
  682|       |         *        stack=[(A,2)] results=[B,C]
  683|       |         *        stack=[(A,3),(F,0)] results=[B,C]
  684|       |         *        stack=[(A,3)] results=[B,C,F]
  685|       |         * Final: stack=[] results=[A]
  686|       |         */
  687|    220|        while (stack.size()) {
  ------------------
  |  Branch (687:16): [True: 130, False: 90]
  ------------------
  688|    130|            const Node& node = stack.back().node;
  689|    130|            if (stack.back().expanded < node.subs.size()) {
  ------------------
  |  Branch (689:17): [True: 20, False: 110]
  ------------------
  690|       |                /* We encounter a tree node with at least one unexpanded child.
  691|       |                 * Expand it. By the time we hit this node again, the result of
  692|       |                 * that child (and all earlier children) will be at the end of `results`. */
  693|     20|                size_t child_index = stack.back().expanded++;
  694|     20|                State child_state = downfn(stack.back().state, node, child_index);
  695|     20|                stack.emplace_back(node.subs[child_index], 0, std::move(child_state));
  696|     20|                continue;
  697|     20|            }
  698|       |            // Invoke upfn with the last node.subs.size() elements of results as input.
  699|    130|            assert(results.size() >= node.subs.size());
  ------------------
  |  Branch (699:13): [True: 110, False: 0]
  ------------------
  700|    110|            std::optional<Result> result{upfn(std::move(stack.back().state), node,
  701|    110|                std::span<Result>{results}.last(node.subs.size()))};
  702|       |            // If evaluation returns std::nullopt, abort immediately.
  703|    110|            if (!result) return {};
  ------------------
  |  Branch (703:17): [True: 0, False: 110]
  ------------------
  704|       |            // Replace the last node.subs.size() elements of results with the new result.
  705|    110|            results.erase(results.end() - node.subs.size(), results.end());
  706|    110|            results.push_back(std::move(*result));
  707|    110|            stack.pop_back();
  708|    110|        }
  709|       |        // The final remaining results element is the root result, return it.
  710|     90|        assert(results.size() >= 1);
  ------------------
  |  Branch (710:9): [True: 90, False: 0]
  ------------------
  711|     90|        CHECK_NONFATAL(results.size() == 1);
  ------------------
  |  |  113|     90|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  712|     90|        return std::move(results[0]);
  713|     90|    }
_ZZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS2_8TreeEvalISG_ZNKS7_IS8_EEvSB_EUlRKS2_NS4_4spanISG_Lm18446744073709551615EEEE_EES9_T0_E10DummyStateZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_mE_ZNKSH_ISG_SM_EES9_SN_EUlSO_SJ_SL_E_EENS5_IS9_EESN_T1_T2_EN9StackElemC2ESJ_mOSO_:
  662|    110|                node(node_), expanded(exp_), state(std::move(state_)) {}
_ZZNK10miniscript4NodeI7CPubKeyE8TreeEvalINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS7_IS8_EEvSB_EUlRKS2_NS4_4spanISG_Lm18446744073709551615EEEE_EES9_T0_ENKUlZNKS3_ISG_SL_EES9_SM_E10DummyStateSI_mE_clESN_SI_m:
  751|     20|            [](DummyState, const Node&, size_t) { return DummyState{}; },
_ZZNK10miniscript4NodeI7CPubKeyE8TreeEvalINSt3__18optionalINS4_3setIS1_ZNKS2_17DuplicateKeyCheckI12WshSatisfierEEvRKT_E4CompNS4_9allocatorIS1_EEEEEEZNKS7_IS8_EEvSB_EUlRKS2_NS4_4spanISG_Lm18446744073709551615EEEE_EES9_T0_ENKUlZNKS3_ISG_SL_EES9_SM_E10DummyStateSI_SK_E_clESN_SI_SK_:
  752|    110|            [&upfn](DummyState, const Node& node, std::span<Result> subs) {
  753|    110|                Result res{upfn(node, subs)};
  754|    110|                return std::optional<Result>(std::move(res));
  755|    110|            }
_ZZNK10miniscript4NodeI7CPubKeyE17DuplicateKeyCheckI12WshSatisfierEEvRKT_ENKUlRKS2_NSt3__14spanINSA_8optionalINSA_3setIS1_ZNKS3_IS4_EEvS7_E4CompNSA_9allocatorIS1_EEEEEELm18446744073709551615EEEE_clES9_SJ_:
 1516|    110|        auto upfn = [&ctx](const Node& node, std::span<state> subs) -> state {
 1517|       |            // If this node is already known to have duplicates, nothing left to do.
 1518|    110|            if (node.has_duplicate_keys.has_value() && *node.has_duplicate_keys) return {};
  ------------------
  |  Branch (1518:17): [True: 0, False: 110]
  |  Branch (1518:56): [True: 0, False: 0]
  ------------------
 1519|       |
 1520|       |            // Check if one of the children is already known to have duplicates.
 1521|    110|            for (auto& sub : subs) {
  ------------------
  |  Branch (1521:28): [True: 20, False: 110]
  ------------------
 1522|     20|                if (!sub.has_value()) {
  ------------------
  |  Branch (1522:21): [True: 0, False: 20]
  ------------------
 1523|      0|                    node.has_duplicate_keys = true;
 1524|      0|                    return {};
 1525|      0|                }
 1526|     20|            }
 1527|       |
 1528|       |            // Start building the set of keys involved in this node and children.
 1529|       |            // Start by keys in this node directly.
 1530|    110|            size_t keys_count = node.keys.size();
 1531|    110|            keyset key_set{node.keys.begin(), node.keys.end(), Comp(ctx)};
 1532|    110|            if (key_set.size() != keys_count) {
  ------------------
  |  Branch (1532:17): [True: 0, False: 110]
  ------------------
 1533|       |                // It already has duplicates; bail out.
 1534|      0|                node.has_duplicate_keys = true;
 1535|      0|                return {};
 1536|      0|            }
 1537|       |
 1538|       |            // Merge the keys from the children into this set.
 1539|    110|            for (auto& sub : subs) {
  ------------------
  |  Branch (1539:28): [True: 20, False: 110]
  ------------------
 1540|     20|                keys_count += sub->size();
 1541|       |                // Small optimization: std::set::merge is linear in the size of the second arg but
 1542|       |                // logarithmic in the size of the first.
 1543|     20|                if (key_set.size() < sub->size()) std::swap(key_set, *sub);
  ------------------
  |  Branch (1543:21): [True: 0, False: 20]
  ------------------
 1544|     20|                key_set.merge(*sub);
 1545|     20|                if (key_set.size() != keys_count) {
  ------------------
  |  Branch (1545:21): [True: 0, False: 20]
  ------------------
 1546|      0|                    node.has_duplicate_keys = true;
 1547|      0|                    return {};
 1548|      0|                }
 1549|     20|            }
 1550|       |
 1551|    110|            node.has_duplicate_keys = false;
 1552|    110|            return key_set;
 1553|    110|        };
_ZZNK10miniscript4NodeI7CPubKeyE17DuplicateKeyCheckI12WshSatisfierEEvRKT_EN4CompC2ERKS4_:
 1506|    110|            Comp(const Ctx& ctx) : ctx_ptr(&ctx) {}
_ZNK10miniscript4NodeI7CPubKeyE15IsValidTopLevelEv:
 1681|     90|    bool IsValidTopLevel() const { return IsValid() && GetType() << "B"_mst; }
  ------------------
  |  Branch (1681:43): [True: 80, False: 10]
  |  Branch (1681:56): [True: 80, False: 0]
  ------------------
_ZNK10miniscript4NodeI7CPubKeyE7SatisfyI12WshSatisfierEENS_12AvailabilityERKT_RNSt3__16vectorINSA_IhNS9_9allocatorIhEEEENSB_ISD_EEEEb:
 1709|     79|    Availability Satisfy(const Ctx& ctx, std::vector<std::vector<unsigned char>>& stack, bool nonmalleable = true) const {
 1710|     79|        auto ret = ProduceInput(ctx);
 1711|     79|        if (nonmalleable && (ret.sat.malleable || !ret.sat.has_sig)) return Availability::NO;
  ------------------
  |  Branch (1711:13): [True: 79, False: 0]
  |  Branch (1711:30): [True: 0, False: 79]
  |  Branch (1711:51): [True: 79, False: 0]
  ------------------
 1712|      0|        stack = std::move(ret.sat.stack);
 1713|      0|        return ret.sat.available;
 1714|     79|    }
_ZNK10miniscript4NodeI7CPubKeyE12ProduceInputI12WshSatisfierEENS_8internal11InputResultERKT_:
 1247|     79|    internal::InputResult ProduceInput(const Ctx& ctx) const {
 1248|     79|        using namespace internal;
 1249|       |
 1250|       |        // Internal function which is invoked for every tree node, constructing satisfaction/dissatisfactions
 1251|       |        // given those of its subnodes.
 1252|     79|        auto helper = [&ctx](const Node& node, std::span<InputResult> subres) -> InputResult {
 1253|     79|            switch (node.fragment) {
 1254|     79|                case Fragment::PK_K: {
 1255|     79|                    std::vector<unsigned char> sig;
 1256|     79|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1257|     79|                    return {ZERO, InputStack(std::move(sig)).SetWithSig().SetAvailable(avail)};
 1258|     79|                }
 1259|     79|                case Fragment::PK_H: {
 1260|     79|                    std::vector<unsigned char> key = ctx.ToPKBytes(node.keys[0]), sig;
 1261|     79|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1262|     79|                    return {ZERO + InputStack(key), (InputStack(std::move(sig)).SetWithSig() + InputStack(key)).SetAvailable(avail)};
 1263|     79|                }
 1264|     79|                case Fragment::MULTI_A: {
 1265|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1266|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1267|     79|                    std::vector<InputStack> sats = Vector(EMPTY);
 1268|     79|                    for (size_t i = 0; i < node.keys.size(); ++i) {
 1269|       |                        // Get the signature for the i'th key in reverse order (the signature for the first key needs to
 1270|       |                        // be at the top of the stack, contrary to CHECKMULTISIG's satisfaction).
 1271|     79|                        std::vector<unsigned char> sig;
 1272|     79|                        Availability avail = ctx.Sign(node.keys[node.keys.size() - 1 - i], sig);
 1273|       |                        // Compute signature stack for just this key.
 1274|     79|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1275|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1276|       |                        // next_sats[j] are equal to either the existing sats[j] + ZERO, or sats[j-1] plus a signature
 1277|       |                        // for the current (i'th) key. The very last element needs all signatures filled.
 1278|     79|                        std::vector<InputStack> next_sats;
 1279|     79|                        next_sats.push_back(sats[0] + ZERO);
 1280|     79|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + ZERO) | (std::move(sats[j - 1]) + sat));
 1281|     79|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1282|       |                        // Switch over.
 1283|     79|                        sats = std::move(next_sats);
 1284|     79|                    }
 1285|       |                    // The dissatisfaction consists of as many empty vectors as there are keys, which is the same as
 1286|       |                    // satisfying 0 keys.
 1287|     79|                    auto& nsat{sats[0]};
 1288|     79|                    CHECK_NONFATAL(node.k != 0);
 1289|     79|                    assert(node.k < sats.size());
 1290|     79|                    return {std::move(nsat), std::move(sats[node.k])};
 1291|     79|                }
 1292|     79|                case Fragment::MULTI: {
 1293|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1294|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1295|       |                    // sats[0] starts off being {0}, due to the CHECKMULTISIG bug that pops off one element too many.
 1296|     79|                    std::vector<InputStack> sats = Vector(ZERO);
 1297|     79|                    for (size_t i = 0; i < node.keys.size(); ++i) {
 1298|     79|                        std::vector<unsigned char> sig;
 1299|     79|                        Availability avail = ctx.Sign(node.keys[i], sig);
 1300|       |                        // Compute signature stack for just the i'th key.
 1301|     79|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1302|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1303|       |                        // next_sats[j] are equal to either the existing sats[j], or sats[j-1] plus a signature for the
 1304|       |                        // current (i'th) key. The very last element needs all signatures filled.
 1305|     79|                        std::vector<InputStack> next_sats;
 1306|     79|                        next_sats.push_back(sats[0]);
 1307|     79|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back(sats[j] | (std::move(sats[j - 1]) + sat));
 1308|     79|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1309|       |                        // Switch over.
 1310|     79|                        sats = std::move(next_sats);
 1311|     79|                    }
 1312|       |                    // The dissatisfaction consists of k+1 stack elements all equal to 0.
 1313|     79|                    InputStack nsat = ZERO;
 1314|     79|                    for (size_t i = 0; i < node.k; ++i) nsat = std::move(nsat) + ZERO;
 1315|     79|                    assert(node.k < sats.size());
 1316|     79|                    return {std::move(nsat), std::move(sats[node.k])};
 1317|     79|                }
 1318|     79|                case Fragment::THRESH: {
 1319|       |                    // sats[k] represents the best stack that satisfies k out of the *last* i subexpressions.
 1320|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1321|       |                    // sats[0] starts off empty.
 1322|     79|                    std::vector<InputStack> sats = Vector(EMPTY);
 1323|     79|                    for (size_t i = 0; i < subres.size(); ++i) {
 1324|       |                        // Introduce an alias for the i'th last satisfaction/dissatisfaction.
 1325|     79|                        auto& res = subres[subres.size() - i - 1];
 1326|       |                        // Compute the next sats vector: next_sats[0] is sats[0] plus res.nsat (thus containing all dissatisfactions
 1327|       |                        // so far. next_sats[j] is either sats[j] + res.nsat (reusing j earlier satisfactions) or sats[j-1] + res.sat
 1328|       |                        // (reusing j-1 earlier satisfactions plus a new one). The very last next_sats[j] is all satisfactions.
 1329|     79|                        std::vector<InputStack> next_sats;
 1330|     79|                        next_sats.push_back(sats[0] + res.nsat);
 1331|     79|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + res.nsat) | (std::move(sats[j - 1]) + res.sat));
 1332|     79|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(res.sat));
 1333|       |                        // Switch over.
 1334|     79|                        sats = std::move(next_sats);
 1335|     79|                    }
 1336|       |                    // At this point, sats[k].sat is the best satisfaction for the overall thresh() node. The best dissatisfaction
 1337|       |                    // is computed by gathering all sats[i].nsat for i != k.
 1338|     79|                    InputStack nsat = INVALID;
 1339|     79|                    for (size_t i = 0; i < sats.size(); ++i) {
 1340|       |                        // i==k is the satisfaction; i==0 is the canonical dissatisfaction;
 1341|       |                        // the rest are non-canonical (a no-signature dissatisfaction - the i=0
 1342|       |                        // form - is always available) and malleable (due to overcompleteness).
 1343|       |                        // Marking the solutions malleable here is not strictly necessary, as they
 1344|       |                        // should already never be picked in non-malleable solutions due to the
 1345|       |                        // availability of the i=0 form.
 1346|     79|                        if (i != 0 && i != node.k) sats[i].SetMalleable().SetNonCanon();
 1347|       |                        // Include all dissatisfactions (even these non-canonical ones) in nsat.
 1348|     79|                        if (i != node.k) nsat = std::move(nsat) | std::move(sats[i]);
 1349|     79|                    }
 1350|     79|                    assert(node.k < sats.size());
 1351|     79|                    return {std::move(nsat), std::move(sats[node.k])};
 1352|     79|                }
 1353|     79|                case Fragment::OLDER: {
 1354|     79|                    return {INVALID, ctx.CheckOlder(node.k) ? EMPTY : INVALID};
 1355|     79|                }
 1356|     79|                case Fragment::AFTER: {
 1357|     79|                    return {INVALID, ctx.CheckAfter(node.k) ? EMPTY : INVALID};
 1358|     79|                }
 1359|     79|                case Fragment::SHA256: {
 1360|     79|                    std::vector<unsigned char> preimage;
 1361|     79|                    Availability avail = ctx.SatSHA256(node.data, preimage);
 1362|     79|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1363|     79|                }
 1364|     79|                case Fragment::RIPEMD160: {
 1365|     79|                    std::vector<unsigned char> preimage;
 1366|     79|                    Availability avail = ctx.SatRIPEMD160(node.data, preimage);
 1367|     79|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1368|     79|                }
 1369|     79|                case Fragment::HASH256: {
 1370|     79|                    std::vector<unsigned char> preimage;
 1371|     79|                    Availability avail = ctx.SatHASH256(node.data, preimage);
 1372|     79|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1373|     79|                }
 1374|     79|                case Fragment::HASH160: {
 1375|     79|                    std::vector<unsigned char> preimage;
 1376|     79|                    Availability avail = ctx.SatHASH160(node.data, preimage);
 1377|     79|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1378|     79|                }
 1379|     79|                case Fragment::AND_V: {
 1380|     79|                    auto& x = subres[0], &y = subres[1];
 1381|       |                    // As the dissatisfaction here only consist of a single option, it doesn't
 1382|       |                    // actually need to be listed (it's not required for reasoning about malleability of
 1383|       |                    // other options), and is never required (no valid miniscript relies on the ability
 1384|       |                    // to satisfy the type V left subexpression). It's still listed here for
 1385|       |                    // completeness, as a hypothetical (not currently implemented) satisfier that doesn't
 1386|       |                    // care about malleability might in some cases prefer it still.
 1387|     79|                    return {(y.nsat + x.sat).SetNonCanon(), y.sat + x.sat};
 1388|     79|                }
 1389|     79|                case Fragment::AND_B: {
 1390|     79|                    auto& x = subres[0], &y = subres[1];
 1391|       |                    // Note that it is not strictly necessary to mark the 2nd and 3rd dissatisfaction here
 1392|       |                    // as malleable. While they are definitely malleable, they are also non-canonical due
 1393|       |                    // to the guaranteed existence of a no-signature other dissatisfaction (the 1st)
 1394|       |                    // option. Because of that, the 2nd and 3rd option will never be chosen, even if they
 1395|       |                    // weren't marked as malleable.
 1396|     79|                    return {(y.nsat + x.nsat) | (y.sat + x.nsat).SetMalleable().SetNonCanon() | (y.nsat + x.sat).SetMalleable().SetNonCanon(), y.sat + x.sat};
 1397|     79|                }
 1398|     79|                case Fragment::OR_B: {
 1399|     79|                    auto& x = subres[0], &z = subres[1];
 1400|       |                    // The (sat(Z) sat(X)) solution is overcomplete (attacker can change either into dsat).
 1401|     79|                    return {z.nsat + x.nsat, (z.nsat + x.sat) | (z.sat + x.nsat) | (z.sat + x.sat).SetMalleable().SetNonCanon()};
 1402|     79|                }
 1403|     79|                case Fragment::OR_C: {
 1404|     79|                    auto& x = subres[0], &z = subres[1];
 1405|     79|                    return {INVALID, std::move(x.sat) | (z.sat + x.nsat)};
 1406|     79|                }
 1407|     79|                case Fragment::OR_D: {
 1408|     79|                    auto& x = subres[0], &z = subres[1];
 1409|     79|                    return {z.nsat + x.nsat, std::move(x.sat) | (z.sat + x.nsat)};
 1410|     79|                }
 1411|     79|                case Fragment::OR_I: {
 1412|     79|                    auto& x = subres[0], &z = subres[1];
 1413|     79|                    return {(x.nsat + ONE) | (z.nsat + ZERO), (x.sat + ONE) | (z.sat + ZERO)};
 1414|     79|                }
 1415|     79|                case Fragment::ANDOR: {
 1416|     79|                    auto& x = subres[0], &y = subres[1], &z = subres[2];
 1417|     79|                    return {(y.nsat + x.sat).SetNonCanon() | (z.nsat + x.nsat), (y.sat + x.sat) | (z.sat + x.nsat)};
 1418|     79|                }
 1419|     79|                case Fragment::WRAP_A:
 1420|     79|                case Fragment::WRAP_S:
 1421|     79|                case Fragment::WRAP_C:
 1422|     79|                case Fragment::WRAP_N:
 1423|     79|                    return std::move(subres[0]);
 1424|     79|                case Fragment::WRAP_D: {
 1425|     79|                    auto &x = subres[0];
 1426|     79|                    return {ZERO, x.sat + ONE};
 1427|     79|                }
 1428|     79|                case Fragment::WRAP_J: {
 1429|     79|                    auto &x = subres[0];
 1430|       |                    // If a dissatisfaction with a nonzero top stack element exists, an alternative dissatisfaction exists.
 1431|       |                    // As the dissatisfaction logic currently doesn't keep track of this nonzeroness property, and thus even
 1432|       |                    // if a dissatisfaction with a top zero element is found, we don't know whether another one with a
 1433|       |                    // nonzero top stack element exists. Make the conservative assumption that whenever the subexpression is weakly
 1434|       |                    // dissatisfiable, this alternative dissatisfaction exists and leads to malleability.
 1435|     79|                    return {InputStack(ZERO).SetMalleable(x.nsat.available != Availability::NO && !x.nsat.has_sig), std::move(x.sat)};
 1436|     79|                }
 1437|     79|                case Fragment::WRAP_V: {
 1438|     79|                    auto &x = subres[0];
 1439|     79|                    return {INVALID, std::move(x.sat)};
 1440|     79|                }
 1441|     79|                case Fragment::JUST_0: return {EMPTY, INVALID};
 1442|     79|                case Fragment::JUST_1: return {INVALID, EMPTY};
 1443|     79|            }
 1444|     79|            assert(false);
 1445|     79|            return {INVALID, INVALID};
 1446|     79|        };
 1447|       |
 1448|     79|        auto tester = [&helper](const Node& node, std::span<InputResult> subres) -> InputResult {
 1449|     79|            auto ret = helper(node, subres);
 1450|       |
 1451|       |            // Do a consistency check between the satisfaction code and the type checker
 1452|       |            // (the actual satisfaction code in ProduceInputHelper does not use GetType)
 1453|       |
 1454|       |            // For 'z' nodes, available satisfactions/dissatisfactions must have stack size 0.
 1455|     79|            if (node.GetType() << "z"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.stack.size() == 0);
 1456|     79|            if (node.GetType() << "z"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.stack.size() == 0);
 1457|       |
 1458|       |            // For 'o' nodes, available satisfactions/dissatisfactions must have stack size 1.
 1459|     79|            if (node.GetType() << "o"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.stack.size() == 1);
 1460|     79|            if (node.GetType() << "o"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.stack.size() == 1);
 1461|       |
 1462|       |            // For 'n' nodes, available satisfactions/dissatisfactions must have stack size 1 or larger. For satisfactions,
 1463|       |            // the top element cannot be 0.
 1464|     79|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.stack.size() >= 1);
 1465|     79|            if (node.GetType() << "n"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.stack.size() >= 1);
 1466|     79|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(!ret.sat.stack.back().empty());
 1467|       |
 1468|       |            // For 'd' nodes, a dissatisfaction must exist, and they must not need a signature. If it is non-malleable,
 1469|       |            // it must be canonical.
 1470|     79|            if (node.GetType() << "d"_mst) CHECK_NONFATAL(ret.nsat.available != Availability::NO);
 1471|     79|            if (node.GetType() << "d"_mst) CHECK_NONFATAL(!ret.nsat.has_sig);
 1472|     79|            if (node.GetType() << "d"_mst && !ret.nsat.malleable) CHECK_NONFATAL(!ret.nsat.non_canon);
 1473|       |
 1474|       |            // For 'f'/'s' nodes, dissatisfactions/satisfactions must have a signature.
 1475|     79|            if (node.GetType() << "f"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.has_sig);
 1476|     79|            if (node.GetType() << "s"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.has_sig);
 1477|       |
 1478|       |            // For non-malleable 'e' nodes, a non-malleable dissatisfaction must exist.
 1479|     79|            if (node.GetType() << "me"_mst) CHECK_NONFATAL(ret.nsat.available != Availability::NO);
 1480|     79|            if (node.GetType() << "me"_mst) CHECK_NONFATAL(!ret.nsat.malleable);
 1481|       |
 1482|       |            // For 'm' nodes, if a satisfaction exists, it must be non-malleable.
 1483|     79|            if (node.GetType() << "m"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(!ret.sat.malleable);
 1484|       |
 1485|       |            // If a non-malleable satisfaction exists, it must be canonical.
 1486|     79|            if (ret.sat.available != Availability::NO && !ret.sat.malleable) CHECK_NONFATAL(!ret.sat.non_canon);
 1487|       |
 1488|     79|            return ret;
 1489|     79|        };
 1490|       |
 1491|     79|        return TreeEval<InputResult>(tester);
 1492|     79|    }
_ZNK10miniscript4NodeI7CPubKeyE8TreeEvalINS_8internal11InputResultEZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_NSt3__14spanIS5_Lm18446744073709551615EEEE0_EES8_T0_:
  748|     79|    {
  749|     79|        struct DummyState {};
  750|     79|        return std::move(*TreeEvalMaybe<Result>(DummyState{},
  751|     79|            [](DummyState, const Node&, size_t) { return DummyState{}; },
  752|     79|            [&upfn](DummyState, const Node& node, std::span<Result> subs) {
  753|     79|                Result res{upfn(node, subs)};
  754|     79|                return std::optional<Result>(std::move(res));
  755|     79|            }
  756|     79|        ));
  757|     79|    }
_ZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINS_8internal11InputResultEZNKS2_8TreeEvalIS5_ZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_NSt3__14spanIS5_Lm18446744073709551615EEEE0_EES9_T0_E10DummyStateZNKS6_IS5_SH_EES9_SI_EUlSJ_SD_mE_ZNKS6_IS5_SH_EES9_SI_EUlSJ_SD_SG_E_EENSE_8optionalIS9_EESI_T1_T2_:
  653|     79|    {
  654|       |        /** Entries of the explicit stack tracked in this algorithm. */
  655|     79|        struct StackElem
  656|     79|        {
  657|     79|            const Node& node; //!< The node being evaluated.
  658|     79|            size_t expanded; //!< How many children of this node have been expanded.
  659|     79|            State state; //!< The state for that node.
  660|       |
  661|     79|            StackElem(const Node& node_, size_t exp_, State&& state_) :
  662|     79|                node(node_), expanded(exp_), state(std::move(state_)) {}
  663|     79|        };
  664|       |        /* Stack of tree nodes being explored. */
  665|     79|        std::vector<StackElem> stack;
  666|       |        /* Results of subtrees so far. Their order and mapping to tree nodes
  667|       |         * is implicitly defined by stack. */
  668|     79|        std::vector<Result> results;
  669|     79|        stack.emplace_back(*this, 0, std::move(root_state));
  670|       |
  671|       |        /* Here is a demonstration of the algorithm, for an example tree A(B,C(D,E),F).
  672|       |         * State variables are omitted for simplicity.
  673|       |         *
  674|       |         * First: stack=[(A,0)] results=[]
  675|       |         *        stack=[(A,1),(B,0)] results=[]
  676|       |         *        stack=[(A,1)] results=[B]
  677|       |         *        stack=[(A,2),(C,0)] results=[B]
  678|       |         *        stack=[(A,2),(C,1),(D,0)] results=[B]
  679|       |         *        stack=[(A,2),(C,1)] results=[B,D]
  680|       |         *        stack=[(A,2),(C,2),(E,0)] results=[B,D]
  681|       |         *        stack=[(A,2),(C,2)] results=[B,D,E]
  682|       |         *        stack=[(A,2)] results=[B,C]
  683|       |         *        stack=[(A,3),(F,0)] results=[B,C]
  684|       |         *        stack=[(A,3)] results=[B,C,F]
  685|       |         * Final: stack=[] results=[A]
  686|       |         */
  687|    158|        while (stack.size()) {
  ------------------
  |  Branch (687:16): [True: 79, False: 79]
  ------------------
  688|     79|            const Node& node = stack.back().node;
  689|     79|            if (stack.back().expanded < node.subs.size()) {
  ------------------
  |  Branch (689:17): [True: 0, False: 79]
  ------------------
  690|       |                /* We encounter a tree node with at least one unexpanded child.
  691|       |                 * Expand it. By the time we hit this node again, the result of
  692|       |                 * that child (and all earlier children) will be at the end of `results`. */
  693|      0|                size_t child_index = stack.back().expanded++;
  694|      0|                State child_state = downfn(stack.back().state, node, child_index);
  695|      0|                stack.emplace_back(node.subs[child_index], 0, std::move(child_state));
  696|      0|                continue;
  697|      0|            }
  698|       |            // Invoke upfn with the last node.subs.size() elements of results as input.
  699|     79|            assert(results.size() >= node.subs.size());
  ------------------
  |  Branch (699:13): [True: 79, False: 0]
  ------------------
  700|     79|            std::optional<Result> result{upfn(std::move(stack.back().state), node,
  701|     79|                std::span<Result>{results}.last(node.subs.size()))};
  702|       |            // If evaluation returns std::nullopt, abort immediately.
  703|     79|            if (!result) return {};
  ------------------
  |  Branch (703:17): [True: 0, False: 79]
  ------------------
  704|       |            // Replace the last node.subs.size() elements of results with the new result.
  705|     79|            results.erase(results.end() - node.subs.size(), results.end());
  706|     79|            results.push_back(std::move(*result));
  707|     79|            stack.pop_back();
  708|     79|        }
  709|       |        // The final remaining results element is the root result, return it.
  710|     79|        assert(results.size() >= 1);
  ------------------
  |  Branch (710:9): [True: 79, False: 0]
  ------------------
  711|     79|        CHECK_NONFATAL(results.size() == 1);
  ------------------
  |  |  113|     79|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  712|     79|        return std::move(results[0]);
  713|     79|    }
_ZZNK10miniscript4NodeI7CPubKeyE13TreeEvalMaybeINS_8internal11InputResultEZNKS2_8TreeEvalIS5_ZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_NSt3__14spanIS5_Lm18446744073709551615EEEE0_EES9_T0_E10DummyStateZNKS6_IS5_SH_EES9_SI_EUlSJ_SD_mE_ZNKS6_IS5_SH_EES9_SI_EUlSJ_SD_SG_E_EENSE_8optionalIS9_EESI_T1_T2_EN9StackElemC2ESD_mOSJ_:
  662|     79|                node(node_), expanded(exp_), state(std::move(state_)) {}
_ZZNK10miniscript4NodeI7CPubKeyE8TreeEvalINS_8internal11InputResultEZNKS2_12ProduceInputI12WshSatisfierEES5_RKT_EUlRKS2_NSt3__14spanIS5_Lm18446744073709551615EEEE0_EES8_T0_ENKUlZNKS3_IS5_SG_EES8_SH_E10DummyStateSC_SF_E_clESI_SC_SF_:
  752|     79|            [&upfn](DummyState, const Node& node, std::span<Result> subs) {
  753|     79|                Result res{upfn(node, subs)};
  754|     79|                return std::optional<Result>(std::move(res));
  755|     79|            }
_ZZNK10miniscript4NodeI7CPubKeyE12ProduceInputI12WshSatisfierEENS_8internal11InputResultERKT_ENKUlRKS2_NSt3__14spanIS6_Lm18446744073709551615EEEE0_clESB_SE_:
 1448|     79|        auto tester = [&helper](const Node& node, std::span<InputResult> subres) -> InputResult {
 1449|     79|            auto ret = helper(node, subres);
 1450|       |
 1451|       |            // Do a consistency check between the satisfaction code and the type checker
 1452|       |            // (the actual satisfaction code in ProduceInputHelper does not use GetType)
 1453|       |
 1454|       |            // For 'z' nodes, available satisfactions/dissatisfactions must have stack size 0.
 1455|     79|            if (node.GetType() << "z"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.stack.size() == 0);
  ------------------
  |  |  113|     79|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1455:17): [True: 79, False: 0]
  |  Branch (1455:17): [True: 79, False: 0]
  |  Branch (1455:46): [True: 79, False: 0]
  ------------------
 1456|     79|            if (node.GetType() << "z"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.stack.size() == 0);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1456:17): [True: 79, False: 0]
  |  Branch (1456:17): [True: 0, False: 79]
  |  Branch (1456:46): [True: 0, False: 79]
  ------------------
 1457|       |
 1458|       |            // For 'o' nodes, available satisfactions/dissatisfactions must have stack size 1.
 1459|     79|            if (node.GetType() << "o"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.stack.size() == 1);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1459:17): [True: 0, False: 79]
  |  Branch (1459:17): [True: 0, False: 79]
  |  Branch (1459:46): [True: 0, False: 0]
  ------------------
 1460|     79|            if (node.GetType() << "o"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.stack.size() == 1);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1460:17): [True: 0, False: 79]
  |  Branch (1460:17): [True: 0, False: 79]
  |  Branch (1460:46): [True: 0, False: 0]
  ------------------
 1461|       |
 1462|       |            // For 'n' nodes, available satisfactions/dissatisfactions must have stack size 1 or larger. For satisfactions,
 1463|       |            // the top element cannot be 0.
 1464|     79|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.stack.size() >= 1);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1464:17): [True: 0, False: 79]
  |  Branch (1464:17): [True: 0, False: 79]
  |  Branch (1464:46): [True: 0, False: 0]
  ------------------
 1465|     79|            if (node.GetType() << "n"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.stack.size() >= 1);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1465:17): [True: 0, False: 79]
  |  Branch (1465:17): [True: 0, False: 79]
  |  Branch (1465:46): [True: 0, False: 0]
  ------------------
 1466|     79|            if (node.GetType() << "n"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(!ret.sat.stack.back().empty());
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1466:17): [True: 0, False: 79]
  |  Branch (1466:17): [True: 0, False: 79]
  |  Branch (1466:46): [True: 0, False: 0]
  ------------------
 1467|       |
 1468|       |            // For 'd' nodes, a dissatisfaction must exist, and they must not need a signature. If it is non-malleable,
 1469|       |            // it must be canonical.
 1470|     79|            if (node.GetType() << "d"_mst) CHECK_NONFATAL(ret.nsat.available != Availability::NO);
  ------------------
  |  |  113|     79|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1470:17): [True: 79, False: 0]
  ------------------
 1471|     79|            if (node.GetType() << "d"_mst) CHECK_NONFATAL(!ret.nsat.has_sig);
  ------------------
  |  |  113|     79|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1471:17): [True: 79, False: 0]
  ------------------
 1472|     79|            if (node.GetType() << "d"_mst && !ret.nsat.malleable) CHECK_NONFATAL(!ret.nsat.non_canon);
  ------------------
  |  |  113|     79|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1472:17): [True: 79, False: 0]
  |  Branch (1472:17): [True: 79, False: 0]
  |  Branch (1472:46): [True: 79, False: 0]
  ------------------
 1473|       |
 1474|       |            // For 'f'/'s' nodes, dissatisfactions/satisfactions must have a signature.
 1475|     79|            if (node.GetType() << "f"_mst && ret.nsat.available != Availability::NO) CHECK_NONFATAL(ret.nsat.has_sig);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1475:17): [True: 0, False: 79]
  |  Branch (1475:17): [True: 0, False: 79]
  |  Branch (1475:46): [True: 0, False: 0]
  ------------------
 1476|     79|            if (node.GetType() << "s"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(ret.sat.has_sig);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1476:17): [True: 79, False: 0]
  |  Branch (1476:17): [True: 0, False: 79]
  |  Branch (1476:46): [True: 0, False: 79]
  ------------------
 1477|       |
 1478|       |            // For non-malleable 'e' nodes, a non-malleable dissatisfaction must exist.
 1479|     79|            if (node.GetType() << "me"_mst) CHECK_NONFATAL(ret.nsat.available != Availability::NO);
  ------------------
  |  |  113|     79|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1479:17): [True: 79, False: 0]
  ------------------
 1480|     79|            if (node.GetType() << "me"_mst) CHECK_NONFATAL(!ret.nsat.malleable);
  ------------------
  |  |  113|     79|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1480:17): [True: 79, False: 0]
  ------------------
 1481|       |
 1482|       |            // For 'm' nodes, if a satisfaction exists, it must be non-malleable.
 1483|     79|            if (node.GetType() << "m"_mst && ret.sat.available != Availability::NO) CHECK_NONFATAL(!ret.sat.malleable);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1483:17): [True: 79, False: 0]
  |  Branch (1483:17): [True: 0, False: 79]
  |  Branch (1483:46): [True: 0, False: 79]
  ------------------
 1484|       |
 1485|       |            // If a non-malleable satisfaction exists, it must be canonical.
 1486|     79|            if (ret.sat.available != Availability::NO && !ret.sat.malleable) CHECK_NONFATAL(!ret.sat.non_canon);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
  |  Branch (1486:17): [True: 0, False: 79]
  |  Branch (1486:58): [True: 0, False: 0]
  ------------------
 1487|       |
 1488|     79|            return ret;
 1489|     79|        };
_ZZNK10miniscript4NodeI7CPubKeyE12ProduceInputI12WshSatisfierEENS_8internal11InputResultERKT_ENKUlRKS2_NSt3__14spanIS6_Lm18446744073709551615EEEE_clESB_SE_:
 1252|     79|        auto helper = [&ctx](const Node& node, std::span<InputResult> subres) -> InputResult {
 1253|     79|            switch (node.fragment) {
  ------------------
  |  Branch (1253:21): [True: 79, False: 0]
  ------------------
 1254|      0|                case Fragment::PK_K: {
  ------------------
  |  Branch (1254:17): [True: 0, False: 79]
  ------------------
 1255|      0|                    std::vector<unsigned char> sig;
 1256|      0|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1257|      0|                    return {ZERO, InputStack(std::move(sig)).SetWithSig().SetAvailable(avail)};
 1258|      0|                }
 1259|      0|                case Fragment::PK_H: {
  ------------------
  |  Branch (1259:17): [True: 0, False: 79]
  ------------------
 1260|      0|                    std::vector<unsigned char> key = ctx.ToPKBytes(node.keys[0]), sig;
 1261|      0|                    Availability avail = ctx.Sign(node.keys[0], sig);
 1262|      0|                    return {ZERO + InputStack(key), (InputStack(std::move(sig)).SetWithSig() + InputStack(key)).SetAvailable(avail)};
 1263|      0|                }
 1264|      0|                case Fragment::MULTI_A: {
  ------------------
  |  Branch (1264:17): [True: 0, False: 79]
  ------------------
 1265|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1266|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1267|      0|                    std::vector<InputStack> sats = Vector(EMPTY);
 1268|      0|                    for (size_t i = 0; i < node.keys.size(); ++i) {
  ------------------
  |  Branch (1268:40): [True: 0, False: 0]
  ------------------
 1269|       |                        // Get the signature for the i'th key in reverse order (the signature for the first key needs to
 1270|       |                        // be at the top of the stack, contrary to CHECKMULTISIG's satisfaction).
 1271|      0|                        std::vector<unsigned char> sig;
 1272|      0|                        Availability avail = ctx.Sign(node.keys[node.keys.size() - 1 - i], sig);
 1273|       |                        // Compute signature stack for just this key.
 1274|      0|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1275|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1276|       |                        // next_sats[j] are equal to either the existing sats[j] + ZERO, or sats[j-1] plus a signature
 1277|       |                        // for the current (i'th) key. The very last element needs all signatures filled.
 1278|      0|                        std::vector<InputStack> next_sats;
 1279|      0|                        next_sats.push_back(sats[0] + ZERO);
 1280|      0|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + ZERO) | (std::move(sats[j - 1]) + sat));
  ------------------
  |  Branch (1280:44): [True: 0, False: 0]
  ------------------
 1281|      0|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1282|       |                        // Switch over.
 1283|      0|                        sats = std::move(next_sats);
 1284|      0|                    }
 1285|       |                    // The dissatisfaction consists of as many empty vectors as there are keys, which is the same as
 1286|       |                    // satisfying 0 keys.
 1287|      0|                    auto& nsat{sats[0]};
 1288|      0|                    CHECK_NONFATAL(node.k != 0);
  ------------------
  |  |  113|      0|    inline_check_non_fatal(condition, std::source_location::current(), #condition)
  ------------------
 1289|      0|                    assert(node.k < sats.size());
  ------------------
  |  Branch (1289:21): [True: 0, False: 0]
  ------------------
 1290|      0|                    return {std::move(nsat), std::move(sats[node.k])};
 1291|      0|                }
 1292|      0|                case Fragment::MULTI: {
  ------------------
  |  Branch (1292:17): [True: 0, False: 79]
  ------------------
 1293|       |                    // sats[j] represents the best stack containing j valid signatures (out of the first i keys).
 1294|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1295|       |                    // sats[0] starts off being {0}, due to the CHECKMULTISIG bug that pops off one element too many.
 1296|      0|                    std::vector<InputStack> sats = Vector(ZERO);
 1297|      0|                    for (size_t i = 0; i < node.keys.size(); ++i) {
  ------------------
  |  Branch (1297:40): [True: 0, False: 0]
  ------------------
 1298|      0|                        std::vector<unsigned char> sig;
 1299|      0|                        Availability avail = ctx.Sign(node.keys[i], sig);
 1300|       |                        // Compute signature stack for just the i'th key.
 1301|      0|                        auto sat = InputStack(std::move(sig)).SetWithSig().SetAvailable(avail);
 1302|       |                        // Compute the next sats vector: next_sats[0] is a copy of sats[0] (no signatures). All further
 1303|       |                        // next_sats[j] are equal to either the existing sats[j], or sats[j-1] plus a signature for the
 1304|       |                        // current (i'th) key. The very last element needs all signatures filled.
 1305|      0|                        std::vector<InputStack> next_sats;
 1306|      0|                        next_sats.push_back(sats[0]);
 1307|      0|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back(sats[j] | (std::move(sats[j - 1]) + sat));
  ------------------
  |  Branch (1307:44): [True: 0, False: 0]
  ------------------
 1308|      0|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(sat));
 1309|       |                        // Switch over.
 1310|      0|                        sats = std::move(next_sats);
 1311|      0|                    }
 1312|       |                    // The dissatisfaction consists of k+1 stack elements all equal to 0.
 1313|      0|                    InputStack nsat = ZERO;
 1314|      0|                    for (size_t i = 0; i < node.k; ++i) nsat = std::move(nsat) + ZERO;
  ------------------
  |  Branch (1314:40): [True: 0, False: 0]
  ------------------
 1315|      0|                    assert(node.k < sats.size());
  ------------------
  |  Branch (1315:21): [True: 0, False: 0]
  ------------------
 1316|      0|                    return {std::move(nsat), std::move(sats[node.k])};
 1317|      0|                }
 1318|      0|                case Fragment::THRESH: {
  ------------------
  |  Branch (1318:17): [True: 0, False: 79]
  ------------------
 1319|       |                    // sats[k] represents the best stack that satisfies k out of the *last* i subexpressions.
 1320|       |                    // In the loop below, these stacks are built up using a dynamic programming approach.
 1321|       |                    // sats[0] starts off empty.
 1322|      0|                    std::vector<InputStack> sats = Vector(EMPTY);
 1323|      0|                    for (size_t i = 0; i < subres.size(); ++i) {
  ------------------
  |  Branch (1323:40): [True: 0, False: 0]
  ------------------
 1324|       |                        // Introduce an alias for the i'th last satisfaction/dissatisfaction.
 1325|      0|                        auto& res = subres[subres.size() - i - 1];
 1326|       |                        // Compute the next sats vector: next_sats[0] is sats[0] plus res.nsat (thus containing all dissatisfactions
 1327|       |                        // so far. next_sats[j] is either sats[j] + res.nsat (reusing j earlier satisfactions) or sats[j-1] + res.sat
 1328|       |                        // (reusing j-1 earlier satisfactions plus a new one). The very last next_sats[j] is all satisfactions.
 1329|      0|                        std::vector<InputStack> next_sats;
 1330|      0|                        next_sats.push_back(sats[0] + res.nsat);
 1331|      0|                        for (size_t j = 1; j < sats.size(); ++j) next_sats.push_back((sats[j] + res.nsat) | (std::move(sats[j - 1]) + res.sat));
  ------------------
  |  Branch (1331:44): [True: 0, False: 0]
  ------------------
 1332|      0|                        next_sats.push_back(std::move(sats[sats.size() - 1]) + std::move(res.sat));
 1333|       |                        // Switch over.
 1334|      0|                        sats = std::move(next_sats);
 1335|      0|                    }
 1336|       |                    // At this point, sats[k].sat is the best satisfaction for the overall thresh() node. The best dissatisfaction
 1337|       |                    // is computed by gathering all sats[i].nsat for i != k.
 1338|      0|                    InputStack nsat = INVALID;
 1339|      0|                    for (size_t i = 0; i < sats.size(); ++i) {
  ------------------
  |  Branch (1339:40): [True: 0, False: 0]
  ------------------
 1340|       |                        // i==k is the satisfaction; i==0 is the canonical dissatisfaction;
 1341|       |                        // the rest are non-canonical (a no-signature dissatisfaction - the i=0
 1342|       |                        // form - is always available) and malleable (due to overcompleteness).
 1343|       |                        // Marking the solutions malleable here is not strictly necessary, as they
 1344|       |                        // should already never be picked in non-malleable solutions due to the
 1345|       |                        // availability of the i=0 form.
 1346|      0|                        if (i != 0 && i != node.k) sats[i].SetMalleable().SetNonCanon();
  ------------------
  |  Branch (1346:29): [True: 0, False: 0]
  |  Branch (1346:39): [True: 0, False: 0]
  ------------------
 1347|       |                        // Include all dissatisfactions (even these non-canonical ones) in nsat.
 1348|      0|                        if (i != node.k) nsat = std::move(nsat) | std::move(sats[i]);
  ------------------
  |  Branch (1348:29): [True: 0, False: 0]
  ------------------
 1349|      0|                    }
 1350|      0|                    assert(node.k < sats.size());
  ------------------
  |  Branch (1350:21): [True: 0, False: 0]
  ------------------
 1351|      0|                    return {std::move(nsat), std::move(sats[node.k])};
 1352|      0|                }
 1353|      0|                case Fragment::OLDER: {
  ------------------
  |  Branch (1353:17): [True: 0, False: 79]
  ------------------
 1354|      0|                    return {INVALID, ctx.CheckOlder(node.k) ? EMPTY : INVALID};
  ------------------
  |  Branch (1354:38): [True: 0, False: 0]
  ------------------
 1355|      0|                }
 1356|      0|                case Fragment::AFTER: {
  ------------------
  |  Branch (1356:17): [True: 0, False: 79]
  ------------------
 1357|      0|                    return {INVALID, ctx.CheckAfter(node.k) ? EMPTY : INVALID};
  ------------------
  |  Branch (1357:38): [True: 0, False: 0]
  ------------------
 1358|      0|                }
 1359|      0|                case Fragment::SHA256: {
  ------------------
  |  Branch (1359:17): [True: 0, False: 79]
  ------------------
 1360|      0|                    std::vector<unsigned char> preimage;
 1361|      0|                    Availability avail = ctx.SatSHA256(node.data, preimage);
 1362|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1363|      0|                }
 1364|      0|                case Fragment::RIPEMD160: {
  ------------------
  |  Branch (1364:17): [True: 0, False: 79]
  ------------------
 1365|      0|                    std::vector<unsigned char> preimage;
 1366|      0|                    Availability avail = ctx.SatRIPEMD160(node.data, preimage);
 1367|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1368|      0|                }
 1369|      0|                case Fragment::HASH256: {
  ------------------
  |  Branch (1369:17): [True: 0, False: 79]
  ------------------
 1370|      0|                    std::vector<unsigned char> preimage;
 1371|      0|                    Availability avail = ctx.SatHASH256(node.data, preimage);
 1372|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1373|      0|                }
 1374|      0|                case Fragment::HASH160: {
  ------------------
  |  Branch (1374:17): [True: 0, False: 79]
  ------------------
 1375|      0|                    std::vector<unsigned char> preimage;
 1376|      0|                    Availability avail = ctx.SatHASH160(node.data, preimage);
 1377|      0|                    return {ZERO32, InputStack(std::move(preimage)).SetAvailable(avail)};
 1378|      0|                }
 1379|      0|                case Fragment::AND_V: {
  ------------------
  |  Branch (1379:17): [True: 0, False: 79]
  ------------------
 1380|      0|                    auto& x = subres[0], &y = subres[1];
 1381|       |                    // As the dissatisfaction here only consist of a single option, it doesn't
 1382|       |                    // actually need to be listed (it's not required for reasoning about malleability of
 1383|       |                    // other options), and is never required (no valid miniscript relies on the ability
 1384|       |                    // to satisfy the type V left subexpression). It's still listed here for
 1385|       |                    // completeness, as a hypothetical (not currently implemented) satisfier that doesn't
 1386|       |                    // care about malleability might in some cases prefer it still.
 1387|      0|                    return {(y.nsat + x.sat).SetNonCanon(), y.sat + x.sat};
 1388|      0|                }
 1389|      0|                case Fragment::AND_B: {
  ------------------
  |  Branch (1389:17): [True: 0, False: 79]
  ------------------
 1390|      0|                    auto& x = subres[0], &y = subres[1];
 1391|       |                    // Note that it is not strictly necessary to mark the 2nd and 3rd dissatisfaction here
 1392|       |                    // as malleable. While they are definitely malleable, they are also non-canonical due
 1393|       |                    // to the guaranteed existence of a no-signature other dissatisfaction (the 1st)
 1394|       |                    // option. Because of that, the 2nd and 3rd option will never be chosen, even if they
 1395|       |                    // weren't marked as malleable.
 1396|      0|                    return {(y.nsat + x.nsat) | (y.sat + x.nsat).SetMalleable().SetNonCanon() | (y.nsat + x.sat).SetMalleable().SetNonCanon(), y.sat + x.sat};
 1397|      0|                }
 1398|      0|                case Fragment::OR_B: {
  ------------------
  |  Branch (1398:17): [True: 0, False: 79]
  ------------------
 1399|      0|                    auto& x = subres[0], &z = subres[1];
 1400|       |                    // The (sat(Z) sat(X)) solution is overcomplete (attacker can change either into dsat).
 1401|      0|                    return {z.nsat + x.nsat, (z.nsat + x.sat) | (z.sat + x.nsat) | (z.sat + x.sat).SetMalleable().SetNonCanon()};
 1402|      0|                }
 1403|      0|                case Fragment::OR_C: {
  ------------------
  |  Branch (1403:17): [True: 0, False: 79]
  ------------------
 1404|      0|                    auto& x = subres[0], &z = subres[1];
 1405|      0|                    return {INVALID, std::move(x.sat) | (z.sat + x.nsat)};
 1406|      0|                }
 1407|      0|                case Fragment::OR_D: {
  ------------------
  |  Branch (1407:17): [True: 0, False: 79]
  ------------------
 1408|      0|                    auto& x = subres[0], &z = subres[1];
 1409|      0|                    return {z.nsat + x.nsat, std::move(x.sat) | (z.sat + x.nsat)};
 1410|      0|                }
 1411|      0|                case Fragment::OR_I: {
  ------------------
  |  Branch (1411:17): [True: 0, False: 79]
  ------------------
 1412|      0|                    auto& x = subres[0], &z = subres[1];
 1413|      0|                    return {(x.nsat + ONE) | (z.nsat + ZERO), (x.sat + ONE) | (z.sat + ZERO)};
 1414|      0|                }
 1415|      0|                case Fragment::ANDOR: {
  ------------------
  |  Branch (1415:17): [True: 0, False: 79]
  ------------------
 1416|      0|                    auto& x = subres[0], &y = subres[1], &z = subres[2];
 1417|      0|                    return {(y.nsat + x.sat).SetNonCanon() | (z.nsat + x.nsat), (y.sat + x.sat) | (z.sat + x.nsat)};
 1418|      0|                }
 1419|      0|                case Fragment::WRAP_A:
  ------------------
  |  Branch (1419:17): [True: 0, False: 79]
  ------------------
 1420|      0|                case Fragment::WRAP_S:
  ------------------
  |  Branch (1420:17): [True: 0, False: 79]
  ------------------
 1421|      0|                case Fragment::WRAP_C:
  ------------------
  |  Branch (1421:17): [True: 0, False: 79]
  ------------------
 1422|      0|                case Fragment::WRAP_N:
  ------------------
  |  Branch (1422:17): [True: 0, False: 79]
  ------------------
 1423|      0|                    return std::move(subres[0]);
 1424|      0|                case Fragment::WRAP_D: {
  ------------------
  |  Branch (1424:17): [True: 0, False: 79]
  ------------------
 1425|      0|                    auto &x = subres[0];
 1426|      0|                    return {ZERO, x.sat + ONE};
 1427|      0|                }
 1428|      0|                case Fragment::WRAP_J: {
  ------------------
  |  Branch (1428:17): [True: 0, False: 79]
  ------------------
 1429|      0|                    auto &x = subres[0];
 1430|       |                    // If a dissatisfaction with a nonzero top stack element exists, an alternative dissatisfaction exists.
 1431|       |                    // As the dissatisfaction logic currently doesn't keep track of this nonzeroness property, and thus even
 1432|       |                    // if a dissatisfaction with a top zero element is found, we don't know whether another one with a
 1433|       |                    // nonzero top stack element exists. Make the conservative assumption that whenever the subexpression is weakly
 1434|       |                    // dissatisfiable, this alternative dissatisfaction exists and leads to malleability.
 1435|      0|                    return {InputStack(ZERO).SetMalleable(x.nsat.available != Availability::NO && !x.nsat.has_sig), std::move(x.sat)};
  ------------------
  |  Branch (1435:59): [True: 0, False: 0]
  |  Branch (1435:99): [True: 0, False: 0]
  ------------------
 1436|      0|                }
 1437|      0|                case Fragment::WRAP_V: {
  ------------------
  |  Branch (1437:17): [True: 0, False: 79]
  ------------------
 1438|      0|                    auto &x = subres[0];
 1439|      0|                    return {INVALID, std::move(x.sat)};
 1440|      0|                }
 1441|     79|                case Fragment::JUST_0: return {EMPTY, INVALID};
  ------------------
  |  Branch (1441:17): [True: 79, False: 0]
  ------------------
 1442|      0|                case Fragment::JUST_1: return {INVALID, EMPTY};
  ------------------
  |  Branch (1442:17): [True: 0, False: 79]
  ------------------
 1443|     79|            }
 1444|     79|            assert(false);
  ------------------
  |  Branch (1444:13): [Folded, False: 0]
  ------------------
 1445|      0|            return {INVALID, INVALID};
 1446|      0|        };

_ZN9CScriptIDC2ERK7CScript:
   17|  23.0k|CScriptID::CScriptID(const CScript& in) : BaseHash(Hash160(in)) {}
_ZNK7CScript13IsPayToAnchorEv:
  208|  3.21k|{
  209|  3.21k|    return (this->size() == 4 &&
  ------------------
  |  Branch (209:13): [True: 2.07k, False: 1.14k]
  ------------------
  210|  2.07k|        (*this)[0] == OP_1 &&
  ------------------
  |  Branch (210:9): [True: 1.38k, False: 685]
  ------------------
  211|  1.38k|        (*this)[1] == 0x02 &&
  ------------------
  |  Branch (211:9): [True: 1.38k, False: 0]
  ------------------
  212|  1.38k|        (*this)[2] == 0x4e &&
  ------------------
  |  Branch (212:9): [True: 960, False: 428]
  ------------------
  213|    960|        (*this)[3] == 0x73);
  ------------------
  |  Branch (213:9): [True: 727, False: 233]
  ------------------
  214|  3.21k|}
_ZN7CScript13IsPayToAnchorEiRKNSt3__16vectorIhNS0_9allocatorIhEEEE:
  217|  1.84k|{
  218|  1.84k|    return version == 1 &&
  ------------------
  |  Branch (218:12): [True: 1.17k, False: 673]
  ------------------
  219|  1.17k|        program.size() == 2 &&
  ------------------
  |  Branch (219:9): [True: 911, False: 260]
  ------------------
  220|    911|        program[0] == 0x4e &&
  ------------------
  |  Branch (220:9): [True: 620, False: 291]
  ------------------
  221|    620|        program[1] == 0x73;
  ------------------
  |  Branch (221:9): [True: 373, False: 247]
  ------------------
  222|  1.84k|}
_ZNK7CScript17IsPayToScriptHashEv:
  225|   243k|{
  226|       |    // Extra-fast test for pay-to-script-hash CScripts:
  227|   243k|    return (this->size() == 23 &&
  ------------------
  |  Branch (227:13): [True: 38.0k, False: 205k]
  ------------------
  228|  38.0k|            (*this)[0] == OP_HASH160 &&
  ------------------
  |  Branch (228:13): [True: 37.2k, False: 829]
  ------------------
  229|  37.2k|            (*this)[1] == 0x14 &&
  ------------------
  |  Branch (229:13): [True: 37.0k, False: 230]
  ------------------
  230|  37.0k|            (*this)[22] == OP_EQUAL);
  ------------------
  |  Branch (230:13): [True: 37.0k, False: 4]
  ------------------
  231|   243k|}
_ZNK7CScript16IsWitnessProgramERiRNSt3__16vectorIhNS1_9allocatorIhEEEE:
  251|   261k|{
  252|   261k|    if (this->size() < 4 || this->size() > 42) {
  ------------------
  |  Branch (252:9): [True: 35.2k, False: 226k]
  |  Branch (252:29): [True: 49.0k, False: 177k]
  ------------------
  253|  84.2k|        return false;
  254|  84.2k|    }
  255|   177k|    if ((*this)[0] != OP_0 && ((*this)[0] < OP_1 || (*this)[0] > OP_16)) {
  ------------------
  |  Branch (255:9): [True: 125k, False: 51.9k]
  |  Branch (255:32): [True: 7.88k, False: 117k]
  |  Branch (255:53): [True: 81.7k, False: 35.9k]
  ------------------
  256|  89.6k|        return false;
  257|  89.6k|    }
  258|  87.8k|    if ((size_t)((*this)[1] + 2) == this->size()) {
  ------------------
  |  Branch (258:9): [True: 77.6k, False: 10.1k]
  ------------------
  259|  77.6k|        version = DecodeOP_N((opcodetype)(*this)[0]);
  260|  77.6k|        program = std::vector<unsigned char>(this->begin() + 2, this->end());
  261|  77.6k|        return true;
  262|  77.6k|    }
  263|  10.1k|    return false;
  264|  87.8k|}
_ZNK7CScript10IsPushOnlyEN9prevectorILj36EhjiE14const_iteratorE:
  267|  16.2k|{
  268|  5.30M|    while (pc < end())
  ------------------
  |  Branch (268:12): [True: 5.29M, False: 14.7k]
  ------------------
  269|  5.29M|    {
  270|  5.29M|        opcodetype opcode;
  271|  5.29M|        if (!GetOp(pc, opcode))
  ------------------
  |  Branch (271:13): [True: 1.01k, False: 5.29M]
  ------------------
  272|  1.01k|            return false;
  273|       |        // Note that IsPushOnly() *does* consider OP_RESERVED to be a
  274|       |        // push-type opcode, however execution of OP_RESERVED fails, so
  275|       |        // it's not relevant to P2SH/BIP62 as the scriptSig would fail prior to
  276|       |        // the P2SH special validation code being executed.
  277|  5.29M|        if (opcode > OP_16)
  ------------------
  |  Branch (277:13): [True: 549, False: 5.29M]
  ------------------
  278|    549|            return false;
  279|  5.29M|    }
  280|  14.7k|    return true;
  281|  16.2k|}
_ZNK7CScript10IsPushOnlyEv:
  284|  14.3k|{
  285|  14.3k|    return this->IsPushOnly(begin());
  286|  14.3k|}
_Z11GetScriptOpRN9prevectorILj36EhjiE14const_iteratorES1_R10opcodetypePNSt3__16vectorIhNS5_9allocatorIhEEEE:
  314|  90.2M|{
  315|  90.2M|    opcodeRet = OP_INVALIDOPCODE;
  316|  90.2M|    if (pvchRet)
  ------------------
  |  Branch (316:9): [True: 11.2M, False: 79.0M]
  ------------------
  317|  11.2M|        pvchRet->clear();
  318|  90.2M|    if (pc >= end)
  ------------------
  |  Branch (318:9): [True: 183k, False: 90.0M]
  ------------------
  319|   183k|        return false;
  320|       |
  321|       |    // Read instruction
  322|  90.0M|    if (end - pc < 1)
  ------------------
  |  Branch (322:9): [True: 0, False: 90.0M]
  ------------------
  323|      0|        return false;
  324|  90.0M|    unsigned int opcode = *pc++;
  325|       |
  326|       |    // Immediate operand
  327|  90.0M|    if (opcode <= OP_PUSHDATA4)
  ------------------
  |  Branch (327:9): [True: 17.9M, False: 72.0M]
  ------------------
  328|  17.9M|    {
  329|  17.9M|        unsigned int nSize = 0;
  330|  17.9M|        if (opcode < OP_PUSHDATA1)
  ------------------
  |  Branch (330:13): [True: 16.2M, False: 1.73M]
  ------------------
  331|  16.2M|        {
  332|  16.2M|            nSize = opcode;
  333|  16.2M|        }
  334|  1.73M|        else if (opcode == OP_PUSHDATA1)
  ------------------
  |  Branch (334:18): [True: 1.55M, False: 178k]
  ------------------
  335|  1.55M|        {
  336|  1.55M|            if (end - pc < 1)
  ------------------
  |  Branch (336:17): [True: 846, False: 1.55M]
  ------------------
  337|    846|                return false;
  338|  1.55M|            nSize = *pc++;
  339|  1.55M|        }
  340|   178k|        else if (opcode == OP_PUSHDATA2)
  ------------------
  |  Branch (340:18): [True: 119k, False: 58.7k]
  ------------------
  341|   119k|        {
  342|   119k|            if (end - pc < 2)
  ------------------
  |  Branch (342:17): [True: 572, False: 119k]
  ------------------
  343|    572|                return false;
  344|   119k|            nSize = ReadLE16(&pc[0]);
  345|   119k|            pc += 2;
  346|   119k|        }
  347|  58.7k|        else if (opcode == OP_PUSHDATA4)
  ------------------
  |  Branch (347:18): [True: 58.7k, False: 0]
  ------------------
  348|  58.7k|        {
  349|  58.7k|            if (end - pc < 4)
  ------------------
  |  Branch (349:17): [True: 545, False: 58.1k]
  ------------------
  350|    545|                return false;
  351|  58.1k|            nSize = ReadLE32(&pc[0]);
  352|  58.1k|            pc += 4;
  353|  58.1k|        }
  354|  17.9M|        if (end - pc < 0 || (unsigned int)(end - pc) < nSize)
  ------------------
  |  Branch (354:13): [True: 0, False: 17.9M]
  |  Branch (354:29): [True: 24.4k, False: 17.9M]
  ------------------
  355|  24.4k|            return false;
  356|  17.9M|        if (pvchRet)
  ------------------
  |  Branch (356:13): [True: 8.91M, False: 9.02M]
  ------------------
  357|  8.91M|            pvchRet->assign(pc, pc + nSize);
  358|  17.9M|        pc += nSize;
  359|  17.9M|    }
  360|       |
  361|  90.0M|    opcodeRet = static_cast<opcodetype>(opcode);
  362|  90.0M|    return true;
  363|  90.0M|}
_Z16CheckMinimalPushRKNSt3__16vectorIhNS_9allocatorIhEEEE10opcodetype:
  373|  2.87M|bool CheckMinimalPush(const std::vector<unsigned char>& data, opcodetype opcode) {
  374|       |    // Excludes OP_1NEGATE, OP_1-16 since they are by definition minimal
  375|  2.87M|    assert(0 <= opcode && opcode <= OP_PUSHDATA4);
  ------------------
  |  Branch (375:5): [True: 2.87M, False: 0]
  |  Branch (375:5): [True: 2.87M, False: 0]
  |  Branch (375:5): [True: 2.87M, False: 0]
  ------------------
  376|  2.87M|    if (data.size() == 0) {
  ------------------
  |  Branch (376:9): [True: 2.51M, False: 355k]
  ------------------
  377|       |        // Should have used OP_0.
  378|  2.51M|        return opcode == OP_0;
  379|  2.51M|    } else if (data.size() == 1 && data[0] >= 1 && data[0] <= 16) {
  ------------------
  |  Branch (379:16): [True: 12.3k, False: 342k]
  |  Branch (379:36): [True: 7.20k, False: 5.19k]
  |  Branch (379:52): [True: 1.20k, False: 5.99k]
  ------------------
  380|       |        // Should have used OP_1 .. OP_16.
  381|  1.20k|        return false;
  382|   353k|    } else if (data.size() == 1 && data[0] == 0x81) {
  ------------------
  |  Branch (382:16): [True: 11.1k, False: 342k]
  |  Branch (382:36): [True: 220, False: 10.9k]
  ------------------
  383|       |        // Should have used OP_1NEGATE.
  384|    220|        return false;
  385|   353k|    } else if (data.size() <= 75) {
  ------------------
  |  Branch (385:16): [True: 351k, False: 2.46k]
  ------------------
  386|       |        // Must have used a direct push (opcode indicating number of bytes pushed + those bytes).
  387|   351k|        return opcode == data.size();
  388|   351k|    } else if (data.size() <= 255) {
  ------------------
  |  Branch (388:16): [True: 784, False: 1.68k]
  ------------------
  389|       |        // Must have used OP_PUSHDATA.
  390|    784|        return opcode == OP_PUSHDATA1;
  391|  1.68k|    } else if (data.size() <= 65535) {
  ------------------
  |  Branch (391:16): [True: 1.68k, False: 0]
  ------------------
  392|       |        // Must have used OP_PUSHDATA2.
  393|  1.68k|        return opcode == OP_PUSHDATA2;
  394|  1.68k|    }
  395|      0|    return true;
  396|  2.87M|}

_Z12ToByteVectorI16WitnessV0KeyHashENSt3__16vectorIhNS1_9allocatorIhEEEERKT_:
   69|  4.02k|{
   70|  4.02k|    return std::vector<unsigned char>(in.begin(), in.end());
   71|  4.02k|}
_ZN7CScript10EncodeOP_NEi:
  516|    351|    {
  517|    351|        assert(n >= 0 && n <= 16);
  ------------------
  |  Branch (517:9): [True: 351, False: 0]
  |  Branch (517:9): [True: 351, False: 0]
  |  Branch (517:9): [True: 351, False: 0]
  ------------------
  518|    351|        if (n == 0)
  ------------------
  |  Branch (518:13): [True: 0, False: 351]
  ------------------
  519|      0|            return OP_0;
  520|    351|        return (opcodetype)(OP_1+n-1);
  521|    351|    }
_Z12ToByteVectorINSt3__16vectorIhNS0_9allocatorIhEEEEES4_RKT_:
   69|  7.04k|{
   70|  7.04k|    return std::vector<unsigned char>(in.begin(), in.end());
   71|  7.04k|}
_ZN9CScriptIDC2ERK7uint160:
  601|  17.1k|    explicit CScriptID(const uint160& in) : BaseHash(in) {}
_ZN7CScriptlsERK10CScriptNum:
  479|  15.8k|    {
  480|  15.8k|        *this << b.getvch();
  481|  15.8k|        return *this;
  482|  15.8k|    }
_Z12ToByteVectorI7CPubKeyENSt3__16vectorIhNS1_9allocatorIhEEEERKT_:
   69|  30.9k|{
   70|  30.9k|    return std::vector<unsigned char>(in.begin(), in.end());
   71|  30.9k|}
_ZN7CScript16SerializationOpsI12ParamsStreamIR10SpanReader20TransactionSerParamsES_17ActionUnserializeEEvRT0_RT_T1_:
  456|   899k|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  148|   899k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN7CScript16SerializationOpsI10SpanReaderS_17ActionUnserializeEEvRT0_RT_T1_:
  456|  3.16k|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  148|  3.16k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN7CScriptlsEl:
  468|  74.7k|    CScript& operator<<(int64_t b) LIFETIMEBOUND { return push_int64(b); }
_ZN7CScript10push_int64El:
  435|  74.7k|    {
  436|  74.7k|        if (n == -1 || (n >= 1 && n <= 16))
  ------------------
  |  Branch (436:13): [True: 388, False: 74.3k]
  |  Branch (436:25): [True: 9.79k, False: 64.5k]
  |  Branch (436:35): [True: 6.50k, False: 3.29k]
  ------------------
  437|  6.88k|        {
  438|  6.88k|            push_back(n + (OP_1 - 1));
  439|  6.88k|        }
  440|  67.8k|        else if (n == 0)
  ------------------
  |  Branch (440:18): [True: 8.87k, False: 58.9k]
  ------------------
  441|  8.87k|        {
  442|  8.87k|            push_back(OP_0);
  443|  8.87k|        }
  444|  58.9k|        else
  445|  58.9k|        {
  446|  58.9k|            *this << CScriptNum::serialize(n);
  447|  58.9k|        }
  448|  74.7k|        return *this;
  449|  74.7k|    }
_ZN14CScriptWitnessC2Ev:
  584|   455k|    CScriptWitness() = default;
_ZN7CScript16SerializationOpsI12ParamsStreamIR10HashWriter20TransactionSerParamsEKS_15ActionSerializeEEvRT0_RT_T1_:
  456|   226k|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  148|   226k|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZNK7CScript5GetOpERN9prevectorILj36EhjiE14const_iteratorER10opcodetypeRNSt3__16vectorIhNS6_9allocatorIhEEEE:
  498|  11.2M|    {
  499|  11.2M|        return GetScriptOp(pc, end(), opcodeRet, &vchRet);
  500|  11.2M|    }
_ZNK7CScript5GetOpERN9prevectorILj36EhjiE14const_iteratorER10opcodetype:
  503|  79.0M|    {
  504|  79.0M|        return GetScriptOp(pc, end(), opcodeRet, nullptr);
  505|  79.0M|    }
_ZN7CScriptC2Ev:
  452|  8.74M|    CScript() = default;
_ZN10CScriptNumC2ERKl:
  240|   548k|    {
  241|   548k|        m_value = n;
  242|   548k|    }
_ZNK10CScriptNum6getvchEv:
  338|   573k|    {
  339|   573k|        return serialize(m_value);
  340|   573k|    }
_ZN10CScriptNum9serializeERKl:
  343|   632k|    {
  344|   632k|        if(value == 0)
  ------------------
  |  Branch (344:12): [True: 47.6k, False: 584k]
  ------------------
  345|  47.6k|            return std::vector<unsigned char>();
  346|       |
  347|   584k|        std::vector<unsigned char> result;
  348|   584k|        const bool neg = value < 0;
  349|   584k|        uint64_t absvalue = neg ? ~static_cast<uint64_t>(value) + 1 : static_cast<uint64_t>(value);
  ------------------
  |  Branch (349:29): [True: 80.1k, False: 504k]
  ------------------
  350|       |
  351|  1.65M|        while(absvalue)
  ------------------
  |  Branch (351:15): [True: 1.07M, False: 584k]
  ------------------
  352|  1.07M|        {
  353|  1.07M|            result.push_back(absvalue & 0xff);
  354|  1.07M|            absvalue >>= 8;
  355|  1.07M|        }
  356|       |
  357|       |//    - If the most significant byte is >= 0x80 and the value is positive, push a
  358|       |//    new zero-byte to make the significant byte < 0x80 again.
  359|       |
  360|       |//    - If the most significant byte is >= 0x80 and the value is negative, push a
  361|       |//    new 0x80 byte that will be popped off when converting to an integral.
  362|       |
  363|       |//    - If the most significant byte is < 0x80 and the value is negative, add
  364|       |//    0x80 to it, since it will be subtracted and interpreted as a negative when
  365|       |//    converting to an integral.
  366|       |
  367|   584k|        if (result.back() & 0x80)
  ------------------
  |  Branch (367:13): [True: 73.2k, False: 511k]
  ------------------
  368|  73.2k|            result.push_back(neg ? 0x80 : 0);
  ------------------
  |  Branch (368:30): [True: 67.6k, False: 5.57k]
  ------------------
  369|   511k|        else if (neg)
  ------------------
  |  Branch (369:18): [True: 12.4k, False: 499k]
  ------------------
  370|  12.4k|            result.back() |= 0x80;
  371|       |
  372|   584k|        return result;
  373|   632k|    }
_ZN10CScriptNumC2ERKNSt3__16vectorIhNS0_9allocatorIhEEEEbm:
  248|   255k|    {
  249|   255k|        if (vch.size() > nMaxNumSize) {
  ------------------
  |  Branch (249:13): [True: 2.21k, False: 253k]
  ------------------
  250|  2.21k|            throw scriptnum_error("script number overflow");
  251|  2.21k|        }
  252|   253k|        if (fRequireMinimal && vch.size() > 0) {
  ------------------
  |  Branch (252:13): [True: 242k, False: 10.8k]
  |  Branch (252:32): [True: 119k, False: 123k]
  ------------------
  253|       |            // Check that the number is encoded with the minimum possible
  254|       |            // number of bytes.
  255|       |            //
  256|       |            // If the most-significant-byte - excluding the sign bit - is zero
  257|       |            // then we're not minimal. Note how this test also rejects the
  258|       |            // negative-zero encoding, 0x80.
  259|   119k|            if ((vch.back() & 0x7f) == 0) {
  ------------------
  |  Branch (259:17): [True: 3.78k, False: 115k]
  ------------------
  260|       |                // One exception: if there's more than one byte and the most
  261|       |                // significant bit of the second-most-significant-byte is set
  262|       |                // it would conflict with the sign bit. An example of this case
  263|       |                // is +-255, which encode to 0xff00 and 0xff80 respectively.
  264|       |                // (big-endian).
  265|  3.78k|                if (vch.size() <= 1 || (vch[vch.size() - 2] & 0x80) == 0) {
  ------------------
  |  Branch (265:21): [True: 464, False: 3.32k]
  |  Branch (265:40): [True: 864, False: 2.45k]
  ------------------
  266|  1.32k|                    throw scriptnum_error("non-minimally encoded script number");
  267|  1.32k|                }
  268|  3.78k|            }
  269|   119k|        }
  270|   251k|        m_value = set_vch(vch);
  271|   251k|    }
_ZN15scriptnum_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE:
  224|  3.54k|    explicit scriptnum_error(const std::string& str) : std::runtime_error(str) {}
_ZN10CScriptNum7set_vchERKNSt3__16vectorIhNS0_9allocatorIhEEEE:
  377|   251k|    {
  378|   251k|      if (vch.empty())
  ------------------
  |  Branch (378:11): [True: 128k, False: 123k]
  ------------------
  379|   128k|          return 0;
  380|       |
  381|   123k|      int64_t result = 0;
  382|   330k|      for (size_t i = 0; i != vch.size(); ++i)
  ------------------
  |  Branch (382:26): [True: 207k, False: 123k]
  ------------------
  383|   207k|          result |= static_cast<int64_t>(vch[i]) << 8*i;
  384|       |
  385|       |      // If the input vector's most significant byte is 0x80, remove it from
  386|       |      // the result's msb and return a negative.
  387|   123k|      if (vch.back() & 0x80)
  ------------------
  |  Branch (387:11): [True: 13.9k, False: 109k]
  ------------------
  388|  13.9k|          return -((int64_t)(result & ~(0x80ULL << (8 * (vch.size() - 1)))));
  389|       |
  390|   109k|      return result;
  391|   123k|    }
_ZNK10CScriptNumssERKl:
  274|   137k|    inline auto operator<=>(const int64_t& rhs) const    { return m_value <=> rhs; }
_ZNK10CScriptNumanERKl:
  287|  26.4k|    inline CScriptNum operator&(   const int64_t& rhs)    const { return CScriptNum(m_value & rhs);}
_ZNK10CScriptNumeqERKl:
  273|  56.9k|    inline bool operator==(const int64_t& rhs) const    { return m_value == rhs; }
_ZNK10CScriptNum6getintEv:
  327|  69.3k|    {
  328|  69.3k|        if (m_value > std::numeric_limits<int>::max())
  ------------------
  |  Branch (328:13): [True: 0, False: 69.3k]
  ------------------
  329|      0|            return std::numeric_limits<int>::max();
  330|  69.3k|        else if (m_value < std::numeric_limits<int>::min())
  ------------------
  |  Branch (330:18): [True: 0, False: 69.3k]
  ------------------
  331|      0|            return std::numeric_limits<int>::min();
  332|  69.3k|        return m_value;
  333|  69.3k|    }
_ZN10CScriptNumpLERKS_:
  284|  4.57k|    inline CScriptNum& operator+=( const CScriptNum& rhs)       { return operator+=(rhs.m_value);  }
_ZN10CScriptNumpLERKl:
  305|  4.57k|    {
  306|  4.57k|        assert(rhs == 0 || (rhs > 0 && m_value <= std::numeric_limits<int64_t>::max() - rhs) ||
  ------------------
  |  Branch (306:9): [True: 4.57k, False: 0]
  |  Branch (306:9): [True: 4.57k, False: 0]
  |  Branch (306:9): [True: 0, False: 4.57k]
  |  Branch (306:9): [True: 0, False: 0]
  |  Branch (306:9): [True: 0, False: 0]
  |  Branch (306:9): [True: 4.57k, False: 0]
  ------------------
  307|  4.57k|                           (rhs < 0 && m_value >= std::numeric_limits<int64_t>::min() - rhs));
  308|  4.57k|        m_value += rhs;
  309|  4.57k|        return *this;
  310|  4.57k|    }
_ZN10CScriptNummIERKS_:
  285|  7.30k|    inline CScriptNum& operator-=( const CScriptNum& rhs)       { return operator-=(rhs.m_value);  }
_ZN10CScriptNummIERKl:
  313|  7.30k|    {
  314|  7.30k|        assert(rhs == 0 || (rhs > 0 && m_value >= std::numeric_limits<int64_t>::min() + rhs) ||
  ------------------
  |  Branch (314:9): [True: 7.30k, False: 0]
  |  Branch (314:9): [True: 7.30k, False: 0]
  |  Branch (314:9): [True: 0, False: 7.30k]
  |  Branch (314:9): [True: 0, False: 0]
  |  Branch (314:9): [True: 0, False: 0]
  |  Branch (314:9): [True: 7.30k, False: 0]
  ------------------
  315|  7.30k|                           (rhs < 0 && m_value <= std::numeric_limits<int64_t>::max() + rhs));
  316|  7.30k|        m_value -= rhs;
  317|  7.30k|        return *this;
  318|  7.30k|    }
_ZNK10CScriptNumngEv:
  293|  2.82k|    {
  294|  2.82k|        assert(m_value != std::numeric_limits<int64_t>::min());
  ------------------
  |  Branch (294:9): [True: 2.82k, False: 0]
  ------------------
  295|  2.82k|        return CScriptNum(-m_value);
  296|  2.82k|    }
_ZNK10CScriptNumssERKS_:
  277|  47.4k|    inline auto operator<=>(const CScriptNum& rhs) const { return operator<=>(rhs.m_value); }
_ZNK10CScriptNumeqERKS_:
  276|  42.9k|    inline bool operator==(const CScriptNum& rhs) const { return operator==(rhs.m_value); }
_ZN10CScriptNumaSERKl:
  299|  52.7k|    {
  300|  52.7k|        m_value = rhs;
  301|  52.7k|        return *this;
  302|  52.7k|    }
_ZNK10CScriptNumplERKS_:
  281|    484|    inline CScriptNum operator+(   const CScriptNum& rhs) const { return operator+(rhs.m_value);   }
_ZNK10CScriptNummiERKS_:
  282|  2.65k|    inline CScriptNum operator-(   const CScriptNum& rhs) const { return operator-(rhs.m_value);   }
_ZNK10CScriptNummiERKl:
  280|  2.65k|    inline CScriptNum operator-(   const int64_t& rhs)    const { return CScriptNum(m_value - rhs);}
_ZNK10CScriptNumplERKl:
  279|    484|    inline CScriptNum operator+(   const int64_t& rhs)    const { return CScriptNum(m_value + rhs);}
_ZN7CScriptlsENSt3__14spanIKhLm18446744073709551615EEE:
  493|  8.49M|    {
  494|  8.49M|        return *this << std::as_bytes(b);
  495|  8.49M|    }
_ZN7CScriptlsENSt3__14spanIKSt4byteLm18446744073709551615EEE:
  485|  8.49M|    {
  486|  8.49M|        AppendDataSize(b.size());
  487|  8.49M|        AppendData({reinterpret_cast<const value_type*>(b.data()), b.size()});
  488|  8.49M|        return *this;
  489|  8.49M|    }
_ZN7CScript14AppendDataSizeEj:
  409|  8.49M|    {
  410|  8.49M|        if (size < OP_PUSHDATA1) {
  ------------------
  |  Branch (410:13): [True: 413k, False: 8.08M]
  ------------------
  411|   413k|            insert(end(), static_cast<value_type>(size));
  412|  8.08M|        } else if (size <= 0xff) {
  ------------------
  |  Branch (412:20): [True: 8.08M, False: 208]
  ------------------
  413|  8.08M|            insert(end(), OP_PUSHDATA1);
  414|  8.08M|            insert(end(), static_cast<value_type>(size));
  415|  8.08M|        } else if (size <= 0xffff) {
  ------------------
  |  Branch (415:20): [True: 208, False: 0]
  ------------------
  416|    208|            insert(end(), OP_PUSHDATA2);
  417|    208|            value_type data[2];
  418|    208|            WriteLE16(data, size);
  419|    208|            insert(end(), std::cbegin(data), std::cend(data));
  420|    208|        } else {
  421|      0|            insert(end(), OP_PUSHDATA4);
  422|      0|            value_type data[4];
  423|      0|            WriteLE32(data, size);
  424|      0|            insert(end(), std::cbegin(data), std::cend(data));
  425|      0|        }
  426|  8.49M|    }
_ZN7CScript10AppendDataENSt3__14spanIKhLm18446744073709551615EEE:
  429|  8.49M|    {
  430|  8.49M|        insert(end(), data.begin(), data.end());
  431|  8.49M|    }
_ZNK14CScriptWitness6IsNullEv:
  586|   128k|    bool IsNull() const { return stack.empty(); }
_ZN7CScript16SerializationOpsI10HashWriterKS_15ActionSerializeEEvRT0_RT_T1_:
  456|  6.92M|    SERIALIZE_METHODS(CScript, obj) { READWRITE(AsBase<CScriptBase>(obj)); }
  ------------------
  |  |  148|  6.92M|#define READWRITE(...) (ser_action.SerReadWriteMany(s, __VA_ARGS__))
  ------------------
_ZN7CScriptlsE10opcodetype:
  471|   578k|    {
  472|   578k|        if (opcode < 0 || opcode > 0xff)
  ------------------
  |  Branch (472:13): [True: 0, False: 578k]
  |  Branch (472:27): [True: 0, False: 578k]
  ------------------
  473|      0|            throw std::runtime_error("CScript::operator<<(): invalid opcode");
  474|   578k|        insert(end(), (unsigned char)opcode);
  475|   578k|        return *this;
  476|   578k|    }
_ZN7CScriptC2ITkNSt3__114input_iteratorEN9prevectorILj36EhjiE14const_iteratorEEET_S5_:
  454|  95.2k|    CScript(InputIterator first, InputIterator last) : CScriptBase{first, last} { }
_ZN7CScript5clearEv:
  570|   697k|    {
  571|       |        // The default prevector::clear() does not release memory
  572|   697k|        CScriptBase::clear();
  573|   697k|        shrink_to_fit();
  574|   697k|    }
_ZN7CScriptC2ITkNSt3__114input_iteratorENS1_11__wrap_iterIPKhEEEET_S6_:
  454|  19.3k|    CScript(InputIterator first, InputIterator last) : CScriptBase{first, last} { }
_ZN7CScript10DecodeOP_NE10opcodetype:
  509|  88.6k|    {
  510|  88.6k|        if (opcode == OP_0)
  ------------------
  |  Branch (510:13): [True: 48.8k, False: 39.7k]
  ------------------
  511|  48.8k|            return 0;
  512|  88.6k|        assert(opcode >= OP_1 && opcode <= OP_16);
  ------------------
  |  Branch (512:9): [True: 39.7k, False: 0]
  |  Branch (512:9): [True: 39.7k, False: 0]
  |  Branch (512:9): [True: 39.7k, False: 0]
  ------------------
  513|  39.7k|        return (int)opcode - (int)(OP_1 - 1);
  514|  39.7k|    }
_ZN7CScriptC2ITkNSt3__114input_iteratorENS1_11__wrap_iterIPhEEEET_S5_:
  454|  13.9k|    CScript(InputIterator first, InputIterator last) : CScriptBase{first, last} { }

_Z17ScriptErrorString13ScriptError_t:
   11|  49.2k|{
   12|  49.2k|    switch (serror)
  ------------------
  |  Branch (12:13): [True: 49.2k, False: 0]
  ------------------
   13|  49.2k|    {
   14|      0|        case SCRIPT_ERR_OK:
  ------------------
  |  Branch (14:9): [True: 0, False: 49.2k]
  ------------------
   15|      0|            return "No error";
   16|  2.75k|        case SCRIPT_ERR_EVAL_FALSE:
  ------------------
  |  Branch (16:9): [True: 2.75k, False: 46.5k]
  ------------------
   17|  2.75k|            return "Script evaluated without error but finished with a false/empty top stack element";
   18|    268|        case SCRIPT_ERR_VERIFY:
  ------------------
  |  Branch (18:9): [True: 268, False: 49.0k]
  ------------------
   19|    268|            return "Script failed an OP_VERIFY operation";
   20|    266|        case SCRIPT_ERR_EQUALVERIFY:
  ------------------
  |  Branch (20:9): [True: 266, False: 49.0k]
  ------------------
   21|    266|            return "Script failed an OP_EQUALVERIFY operation";
   22|     13|        case SCRIPT_ERR_CHECKMULTISIGVERIFY:
  ------------------
  |  Branch (22:9): [True: 13, False: 49.2k]
  ------------------
   23|     13|            return "Script failed an OP_CHECKMULTISIGVERIFY operation";
   24|    270|        case SCRIPT_ERR_CHECKSIGVERIFY:
  ------------------
  |  Branch (24:9): [True: 270, False: 49.0k]
  ------------------
   25|    270|            return "Script failed an OP_CHECKSIGVERIFY operation";
   26|    269|        case SCRIPT_ERR_NUMEQUALVERIFY:
  ------------------
  |  Branch (26:9): [True: 269, False: 49.0k]
  ------------------
   27|    269|            return "Script failed an OP_NUMEQUALVERIFY operation";
   28|     22|        case SCRIPT_ERR_SCRIPT_SIZE:
  ------------------
  |  Branch (28:9): [True: 22, False: 49.2k]
  ------------------
   29|     22|            return "Script is too big";
   30|    241|        case SCRIPT_ERR_PUSH_SIZE:
  ------------------
  |  Branch (30:9): [True: 241, False: 49.0k]
  ------------------
   31|    241|            return "Push value size limit exceeded";
   32|    505|        case SCRIPT_ERR_OP_COUNT:
  ------------------
  |  Branch (32:9): [True: 505, False: 48.7k]
  ------------------
   33|    505|            return "Operation limit exceeded";
   34|    207|        case SCRIPT_ERR_STACK_SIZE:
  ------------------
  |  Branch (34:9): [True: 207, False: 49.0k]
  ------------------
   35|    207|            return "Stack size limit exceeded";
   36|    481|        case SCRIPT_ERR_SIG_COUNT:
  ------------------
  |  Branch (36:9): [True: 481, False: 48.7k]
  ------------------
   37|    481|            return "Signature count negative or greater than pubkey count";
   38|    578|        case SCRIPT_ERR_PUBKEY_COUNT:
  ------------------
  |  Branch (38:9): [True: 578, False: 48.6k]
  ------------------
   39|    578|            return "Pubkey count negative or limit exceeded";
   40|  3.18k|        case SCRIPT_ERR_BAD_OPCODE:
  ------------------
  |  Branch (40:9): [True: 3.18k, False: 46.0k]
  ------------------
   41|  3.18k|            return "Opcode missing or not understood";
   42|  2.04k|        case SCRIPT_ERR_DISABLED_OPCODE:
  ------------------
  |  Branch (42:9): [True: 2.04k, False: 47.2k]
  ------------------
   43|  2.04k|            return "Attempted to use a disabled opcode";
   44|      0|        case SCRIPT_ERR_INVALID_STACK_OPERATION:
  ------------------
  |  Branch (44:9): [True: 0, False: 49.2k]
  ------------------
   45|      0|            return "Operation not valid with the current stack size";
   46|    225|        case SCRIPT_ERR_INVALID_ALTSTACK_OPERATION:
  ------------------
  |  Branch (46:9): [True: 225, False: 49.0k]
  ------------------
   47|    225|            return "Operation not valid with the current altstack size";
   48|    897|        case SCRIPT_ERR_OP_RETURN:
  ------------------
  |  Branch (48:9): [True: 897, False: 48.3k]
  ------------------
   49|    897|            return "OP_RETURN was encountered";
   50|  2.90k|        case SCRIPT_ERR_UNBALANCED_CONDITIONAL:
  ------------------
  |  Branch (50:9): [True: 2.90k, False: 46.3k]
  ------------------
   51|  2.90k|            return "Invalid OP_IF construction";
   52|    651|        case SCRIPT_ERR_NEGATIVE_LOCKTIME:
  ------------------
  |  Branch (52:9): [True: 651, False: 48.6k]
  ------------------
   53|    651|            return "Negative locktime";
   54|  3.44k|        case SCRIPT_ERR_UNSATISFIED_LOCKTIME:
  ------------------
  |  Branch (54:9): [True: 3.44k, False: 45.8k]
  ------------------
   55|  3.44k|            return "Locktime requirement not satisfied";
   56|  8.14k|        case SCRIPT_ERR_SIG_HASHTYPE:
  ------------------
  |  Branch (56:9): [True: 8.14k, False: 41.1k]
  ------------------
   57|  8.14k|            return "Signature hash type missing or not understood";
   58|  1.40k|        case SCRIPT_ERR_SIG_DER:
  ------------------
  |  Branch (58:9): [True: 1.40k, False: 47.8k]
  ------------------
   59|  1.40k|            return "Non-canonical DER signature";
   60|    592|        case SCRIPT_ERR_MINIMALDATA:
  ------------------
  |  Branch (60:9): [True: 592, False: 48.6k]
  ------------------
   61|    592|            return "Data push larger than necessary";
   62|     69|        case SCRIPT_ERR_SIG_PUSHONLY:
  ------------------
  |  Branch (62:9): [True: 69, False: 49.2k]
  ------------------
   63|     69|            return "Only push operators allowed in signatures";
   64|      0|        case SCRIPT_ERR_SIG_HIGH_S:
  ------------------
  |  Branch (64:9): [True: 0, False: 49.2k]
  ------------------
   65|      0|            return "Non-canonical signature: S value is unnecessarily high";
   66|    357|        case SCRIPT_ERR_SIG_NULLDUMMY:
  ------------------
  |  Branch (66:9): [True: 357, False: 48.9k]
  ------------------
   67|    357|            return "Dummy CHECKMULTISIG argument must be zero";
   68|     13|        case SCRIPT_ERR_MINIMALIF:
  ------------------
  |  Branch (68:9): [True: 13, False: 49.2k]
  ------------------
   69|     13|            return "OP_IF/NOTIF argument must be minimal";
   70|      0|        case SCRIPT_ERR_SIG_NULLFAIL:
  ------------------
  |  Branch (70:9): [True: 0, False: 49.2k]
  ------------------
   71|      0|            return "Signature must be zero for failed CHECK(MULTI)SIG operation";
   72|    335|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS:
  ------------------
  |  Branch (72:9): [True: 335, False: 48.9k]
  ------------------
   73|    335|            return "NOPx reserved for soft-fork upgrades";
   74|    792|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM:
  ------------------
  |  Branch (74:9): [True: 792, False: 48.4k]
  ------------------
   75|    792|            return "Witness version reserved for soft-fork upgrades";
   76|      0|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION:
  ------------------
  |  Branch (76:9): [True: 0, False: 49.2k]
  ------------------
   77|      0|            return "Taproot version reserved for soft-fork upgrades";
   78|      0|        case SCRIPT_ERR_DISCOURAGE_OP_SUCCESS:
  ------------------
  |  Branch (78:9): [True: 0, False: 49.2k]
  ------------------
   79|      0|            return "OP_SUCCESSx reserved for soft-fork upgrades";
   80|      0|        case SCRIPT_ERR_DISCOURAGE_UPGRADABLE_PUBKEYTYPE:
  ------------------
  |  Branch (80:9): [True: 0, False: 49.2k]
  ------------------
   81|      0|            return "Public key version reserved for soft-fork upgrades";
   82|  1.36k|        case SCRIPT_ERR_PUBKEYTYPE:
  ------------------
  |  Branch (82:9): [True: 1.36k, False: 47.9k]
  ------------------
   83|  1.36k|            return "Public key is neither compressed or uncompressed";
   84|  1.57k|        case SCRIPT_ERR_CLEANSTACK:
  ------------------
  |  Branch (84:9): [True: 1.57k, False: 47.6k]
  ------------------
   85|  1.57k|            return "Stack size must be exactly one after execution";
   86|    359|        case SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH:
  ------------------
  |  Branch (86:9): [True: 359, False: 48.9k]
  ------------------
   87|    359|            return "Witness program has incorrect length";
   88|  7.91k|        case SCRIPT_ERR_WITNESS_PROGRAM_WITNESS_EMPTY:
  ------------------
  |  Branch (88:9): [True: 7.91k, False: 41.3k]
  ------------------
   89|  7.91k|            return "Witness program was passed an empty witness";
   90|  1.85k|        case SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH:
  ------------------
  |  Branch (90:9): [True: 1.85k, False: 47.4k]
  ------------------
   91|  1.85k|            return "Witness program hash mismatch";
   92|    204|        case SCRIPT_ERR_WITNESS_MALLEATED:
  ------------------
  |  Branch (92:9): [True: 204, False: 49.0k]
  ------------------
   93|    204|            return "Witness requires empty scriptSig";
   94|      0|        case SCRIPT_ERR_WITNESS_MALLEATED_P2SH:
  ------------------
  |  Branch (94:9): [True: 0, False: 49.2k]
  ------------------
   95|      0|            return "Witness requires only-redeemscript scriptSig";
   96|    199|        case SCRIPT_ERR_WITNESS_UNEXPECTED:
  ------------------
  |  Branch (96:9): [True: 199, False: 49.0k]
  ------------------
   97|    199|            return "Witness provided for non-witness script";
   98|      0|        case SCRIPT_ERR_WITNESS_PUBKEYTYPE:
  ------------------
  |  Branch (98:9): [True: 0, False: 49.2k]
  ------------------
   99|      0|            return "Using non-compressed keys in segwit";
  100|    823|        case SCRIPT_ERR_SCHNORR_SIG_SIZE:
  ------------------
  |  Branch (100:9): [True: 823, False: 48.4k]
  ------------------
  101|    823|            return "Invalid Schnorr signature size";
  102|     83|        case SCRIPT_ERR_SCHNORR_SIG_HASHTYPE:
  ------------------
  |  Branch (102:9): [True: 83, False: 49.1k]
  ------------------
  103|     83|            return "Invalid Schnorr signature hash type";
  104|    315|        case SCRIPT_ERR_SCHNORR_SIG:
  ------------------
  |  Branch (104:9): [True: 315, False: 48.9k]
  ------------------
  105|    315|            return "Invalid Schnorr signature";
  106|    874|        case SCRIPT_ERR_TAPROOT_WRONG_CONTROL_SIZE:
  ------------------
  |  Branch (106:9): [True: 874, False: 48.4k]
  ------------------
  107|    874|            return "Invalid Taproot control block size";
  108|      0|        case SCRIPT_ERR_TAPSCRIPT_VALIDATION_WEIGHT:
  ------------------
  |  Branch (108:9): [True: 0, False: 49.2k]
  ------------------
  109|      0|            return "Too much signature validation relative to witness weight";
  110|      0|        case SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG:
  ------------------
  |  Branch (110:9): [True: 0, False: 49.2k]
  ------------------
  111|      0|            return "OP_CHECKMULTISIG(VERIFY) is not available in tapscript";
  112|      0|        case SCRIPT_ERR_TAPSCRIPT_MINIMALIF:
  ------------------
  |  Branch (112:9): [True: 0, False: 49.2k]
  ------------------
  113|      0|            return "OP_IF/NOTIF argument must be minimal in tapscript";
  114|      0|        case SCRIPT_ERR_TAPSCRIPT_EMPTY_PUBKEY:
  ------------------
  |  Branch (114:9): [True: 0, False: 49.2k]
  ------------------
  115|      0|            return "Empty public key in tapscript";
  116|    334|        case SCRIPT_ERR_OP_CODESEPARATOR:
  ------------------
  |  Branch (116:9): [True: 334, False: 48.9k]
  ------------------
  117|    334|            return "Using OP_CODESEPARATOR in non-witness script";
  118|  1.12k|        case SCRIPT_ERR_SIG_FINDANDDELETE:
  ------------------
  |  Branch (118:9): [True: 1.12k, False: 48.1k]
  ------------------
  119|  1.12k|            return "Signature is found in scriptCode";
  120|  1.33k|        case SCRIPT_ERR_SCRIPTNUM:
  ------------------
  |  Branch (120:9): [True: 1.33k, False: 47.9k]
  ------------------
  121|  1.33k|            return "Script number overflowed or is non-minimally encoded";
  122|      0|        case SCRIPT_ERR_UNKNOWN_ERROR:
  ------------------
  |  Branch (122:9): [True: 0, False: 49.2k]
  ------------------
  123|      0|        case SCRIPT_ERR_ERROR_COUNT:
  ------------------
  |  Branch (123:9): [True: 0, False: 49.2k]
  ------------------
  124|      0|            break;
  125|  49.2k|    } // no default case, so the compiler can warn about missing cases
  126|      0|    return "unknown error";
  127|  49.2k|}

_ZN34MutableTransactionSignatureCreatorC2ERK19CMutableTransactionjRKlRK11SignOptions:
   41|  2.42k|    : m_txto{tx}, nIn{input_idx}, m_options{options}, amount{amount}, checker{&m_txto, nIn, amount, MissingDataBehavior::FAIL},
   42|  2.42k|      m_txdata(nullptr)
   43|  2.42k|{
   44|  2.42k|}
_ZN34MutableTransactionSignatureCreatorC2ERK19CMutableTransactionjRKlPK26PrecomputedTransactionDataRK11SignOptions:
   47|  87.7k|    : m_txto{tx}, nIn{input_idx}, m_options{options}, amount{amount},
   48|  87.7k|      checker{txdata ? MutableTransactionSignatureChecker{&m_txto, nIn, amount, *txdata, MissingDataBehavior::FAIL} :
  ------------------
  |  Branch (48:15): [True: 87.7k, False: 0]
  ------------------
   49|  87.7k|                       MutableTransactionSignatureChecker{&m_txto, nIn, amount, MissingDataBehavior::FAIL}},
   50|  87.7k|      m_txdata(txdata)
   51|  87.7k|{
   52|  87.7k|}
_ZNK34MutableTransactionSignatureCreator9CreateSigERK15SigningProviderRNSt3__16vectorIhNS3_9allocatorIhEEEERK6CKeyIDRK7CScript10SigVersion:
   55|  34.8k|{
   56|  34.8k|    assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
  ------------------
  |  Branch (56:5): [True: 27.8k, False: 7.00k]
  |  Branch (56:5): [True: 7.00k, False: 0]
  |  Branch (56:5): [True: 34.8k, False: 0]
  ------------------
   57|       |
   58|  34.8k|    CKey key;
   59|  34.8k|    if (!provider.GetKey(address, key))
  ------------------
  |  Branch (59:9): [True: 2.16k, False: 32.7k]
  ------------------
   60|  2.16k|        return false;
   61|       |
   62|       |    // Signing with uncompressed keys is disabled in witness scripts
   63|  32.7k|    if (sigversion == SigVersion::WITNESS_V0 && !key.IsCompressed())
  ------------------
  |  Branch (63:9): [True: 6.99k, False: 25.7k]
  |  Branch (63:49): [True: 267, False: 6.73k]
  ------------------
   64|    267|        return false;
   65|       |
   66|       |    // Signing without known amount does not work in witness scripts.
   67|  32.4k|    if (sigversion == SigVersion::WITNESS_V0 && !MoneyRange(amount)) return false;
  ------------------
  |  Branch (67:9): [True: 6.73k, False: 25.7k]
  |  Branch (67:49): [True: 464, False: 6.26k]
  ------------------
   68|       |
   69|       |    // BASE/WITNESS_V0 signatures don't support explicit SIGHASH_DEFAULT, use SIGHASH_ALL instead.
   70|  31.9k|    const int hashtype = m_options.sighash_type == SIGHASH_DEFAULT ? SIGHASH_ALL : m_options.sighash_type;
  ------------------
  |  Branch (70:26): [True: 586, False: 31.3k]
  ------------------
   71|       |
   72|  31.9k|    uint256 hash = SignatureHash(scriptCode, m_txto, nIn, hashtype, amount, sigversion, m_txdata);
   73|  31.9k|    if (!key.Sign(hash, vchSig))
  ------------------
  |  Branch (73:9): [True: 0, False: 31.9k]
  ------------------
   74|      0|        return false;
   75|  31.9k|    vchSig.push_back((unsigned char)hashtype);
   76|  31.9k|    return true;
   77|  31.9k|}
_ZNK34MutableTransactionSignatureCreator16CreateSchnorrSigERK15SigningProviderRNSt3__16vectorIhNS3_9allocatorIhEEEERK11XOnlyPubKeyPK7uint256SE_10SigVersion:
  104|  12.1k|{
  105|  12.1k|    CKey key;
  106|  12.1k|    if (!provider.GetKeyByXOnly(pubkey, key)) return false;
  ------------------
  |  Branch (106:9): [True: 12.1k, False: 0]
  ------------------
  107|       |
  108|      0|    std::optional<uint256> hash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
  109|      0|    if (!hash.has_value()) return false;
  ------------------
  |  Branch (109:9): [True: 0, False: 0]
  ------------------
  110|       |
  111|      0|    sig.resize(64);
  112|       |    // Use uint256{} as aux_rnd for now.
  113|      0|    if (!key.SignSchnorr(*hash, sig, merkle_root, {})) return false;
  ------------------
  |  Branch (113:9): [True: 0, False: 0]
  ------------------
  114|      0|    if (m_options.sighash_type) sig.push_back(m_options.sighash_type);
  ------------------
  |  Branch (114:9): [True: 0, False: 0]
  ------------------
  115|      0|    return true;
  116|      0|}
_Z16ProduceSignatureRK15SigningProviderRK20BaseSignatureCreatorRK7CScriptR13SignatureData:
  746|   113k|{
  747|   113k|    if (sigdata.complete) return true;
  ------------------
  |  Branch (747:9): [True: 568, False: 112k]
  ------------------
  748|       |
  749|   112k|    std::vector<valtype> result;
  750|   112k|    TxoutType whichType;
  751|   112k|    bool solved = SignStep(provider, creator, fromPubKey, result, whichType, SigVersion::BASE, sigdata);
  752|   112k|    bool P2SH = false;
  753|   112k|    CScript subscript;
  754|       |
  755|   112k|    if (solved && whichType == TxoutType::SCRIPTHASH)
  ------------------
  |  Branch (755:9): [True: 35.8k, False: 76.6k]
  |  Branch (755:19): [True: 8.10k, False: 27.7k]
  ------------------
  756|  8.10k|    {
  757|       |        // Solver returns the subscript that needs to be evaluated;
  758|       |        // the final scriptSig is the signatures from that
  759|       |        // and then the serialized subscript:
  760|  8.10k|        subscript = CScript(result[0].begin(), result[0].end());
  761|  8.10k|        sigdata.redeem_script = subscript;
  762|  8.10k|        solved = solved && SignStep(provider, creator, subscript, result, whichType, SigVersion::BASE, sigdata) && whichType != TxoutType::SCRIPTHASH;
  ------------------
  |  Branch (762:18): [True: 8.10k, False: 0]
  |  Branch (762:28): [True: 6.55k, False: 1.55k]
  |  Branch (762:116): [True: 6.55k, False: 0]
  ------------------
  763|  8.10k|        P2SH = true;
  764|  8.10k|    }
  765|       |
  766|   112k|    if (solved && whichType == TxoutType::WITNESS_V0_KEYHASH)
  ------------------
  |  Branch (766:9): [True: 34.3k, False: 78.2k]
  |  Branch (766:19): [True: 7.04k, False: 27.2k]
  ------------------
  767|  7.04k|    {
  768|  7.04k|        CScript witnessscript;
  769|  7.04k|        witnessscript << OP_DUP << OP_HASH160 << ToByteVector(result[0]) << OP_EQUALVERIFY << OP_CHECKSIG;
  770|  7.04k|        TxoutType subType;
  771|  7.04k|        solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata);
  ------------------
  |  Branch (771:18): [True: 7.04k, False: 0]
  |  Branch (771:28): [True: 6.09k, False: 953]
  ------------------
  772|  7.04k|        sigdata.scriptWitness.stack = result;
  773|  7.04k|        sigdata.witness = true;
  774|  7.04k|        result.clear();
  775|  7.04k|    }
  776|   105k|    else if (solved && whichType == TxoutType::WITNESS_V0_SCRIPTHASH)
  ------------------
  |  Branch (776:14): [True: 27.2k, False: 78.2k]
  |  Branch (776:24): [True: 1.72k, False: 25.5k]
  ------------------
  777|  1.72k|    {
  778|  1.72k|        CScript witnessscript(result[0].begin(), result[0].end());
  779|  1.72k|        sigdata.witness_script = witnessscript;
  780|       |
  781|  1.72k|        TxoutType subType{TxoutType::NONSTANDARD};
  782|  1.72k|        solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata) && subType != TxoutType::SCRIPTHASH && subType != TxoutType::WITNESS_V0_SCRIPTHASH && subType != TxoutType::WITNESS_V0_KEYHASH;
  ------------------
  |  Branch (782:18): [True: 1.72k, False: 0]
  |  Branch (782:28): [True: 66, False: 1.66k]
  |  Branch (782:124): [True: 66, False: 0]
  |  Branch (782:160): [True: 66, False: 0]
  |  Branch (782:207): [True: 0, False: 66]
  ------------------
  783|       |
  784|       |        // If we couldn't find a solution with the legacy satisfier, try satisfying the script using Miniscript.
  785|       |        // Note we need to check if the result stack is empty before, because it might be used even if the Script
  786|       |        // isn't fully solved. For instance the CHECKMULTISIG satisfaction in SignStep() pushes partial signatures
  787|       |        // and the extractor relies on this behaviour to combine witnesses.
  788|  1.72k|        if (!solved && result.empty()) {
  ------------------
  |  Branch (788:13): [True: 1.72k, False: 0]
  |  Branch (788:24): [True: 1.66k, False: 66]
  ------------------
  789|  1.66k|            WshSatisfier ms_satisfier{provider, sigdata, creator, witnessscript};
  790|  1.66k|            const auto ms = miniscript::FromScript(witnessscript, ms_satisfier);
  791|  1.66k|            solved = ms && ms->Satisfy(ms_satisfier, result) == miniscript::Availability::YES;
  ------------------
  |  Branch (791:22): [True: 79, False: 1.58k]
  |  Branch (791:28): [True: 0, False: 79]
  ------------------
  792|  1.66k|        }
  793|  1.72k|        result.emplace_back(witnessscript.begin(), witnessscript.end());
  794|       |
  795|  1.72k|        sigdata.scriptWitness.stack = result;
  796|  1.72k|        sigdata.witness = true;
  797|  1.72k|        result.clear();
  798|   103k|    } else if (whichType == TxoutType::WITNESS_V1_TAPROOT && !P2SH) {
  ------------------
  |  Branch (798:16): [True: 6.09k, False: 97.6k]
  |  Branch (798:62): [True: 6.09k, False: 0]
  ------------------
  799|  6.09k|        sigdata.witness = true;
  800|  6.09k|        if (solved) {
  ------------------
  |  Branch (800:13): [True: 20, False: 6.07k]
  ------------------
  801|     20|            sigdata.scriptWitness.stack = std::move(result);
  802|     20|        }
  803|  6.09k|        result.clear();
  804|  97.6k|    } else if (solved && whichType == TxoutType::WITNESS_UNKNOWN) {
  ------------------
  |  Branch (804:16): [True: 25.5k, False: 72.1k]
  |  Branch (804:26): [True: 0, False: 25.5k]
  ------------------
  805|      0|        sigdata.witness = true;
  806|      0|    }
  807|       |
  808|   112k|    if (!sigdata.witness) sigdata.scriptWitness.stack.clear();
  ------------------
  |  Branch (808:9): [True: 97.6k, False: 14.8k]
  ------------------
  809|   112k|    if (P2SH) {
  ------------------
  |  Branch (809:9): [True: 8.10k, False: 104k]
  ------------------
  810|  8.10k|        result.emplace_back(subscript.begin(), subscript.end());
  811|  8.10k|    }
  812|   112k|    sigdata.scriptSig = PushAll(result);
  813|       |
  814|       |    // Test solution
  815|   112k|    sigdata.complete = solved && VerifyScript(sigdata.scriptSig, fromPubKey, &sigdata.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, creator.Checker());
  ------------------
  |  Branch (815:24): [True: 31.6k, False: 80.8k]
  |  Branch (815:34): [True: 1.45k, False: 30.1k]
  ------------------
  816|   112k|    return sigdata.complete;
  817|   113k|}
_Z19DataFromTransactionRK19CMutableTransactionjRK6CTxOut:
  854|  92.1k|{
  855|  92.1k|    SignatureData data;
  856|  92.1k|    assert(tx.vin.size() > nIn);
  ------------------
  |  Branch (856:5): [True: 92.1k, False: 0]
  ------------------
  857|  92.1k|    data.scriptSig = tx.vin[nIn].scriptSig;
  858|  92.1k|    data.scriptWitness = tx.vin[nIn].scriptWitness;
  859|  92.1k|    Stacks stack(data);
  860|       |
  861|       |    // Get signatures
  862|  92.1k|    MutableTransactionSignatureChecker tx_checker(&tx, nIn, txout.nValue, MissingDataBehavior::FAIL);
  863|  92.1k|    SignatureExtractorChecker extractor_checker(data, tx_checker);
  864|  92.1k|    if (VerifyScript(data.scriptSig, txout.scriptPubKey, &data.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, extractor_checker)) {
  ------------------
  |  Branch (864:9): [True: 630, False: 91.4k]
  ------------------
  865|    630|        data.complete = true;
  866|    630|        return data;
  867|    630|    }
  868|       |
  869|       |    // Get scripts
  870|  91.4k|    std::vector<std::vector<unsigned char>> solutions;
  871|  91.4k|    TxoutType script_type = Solver(txout.scriptPubKey, solutions);
  872|  91.4k|    SigVersion sigversion = SigVersion::BASE;
  873|  91.4k|    CScript next_script = txout.scriptPubKey;
  874|       |
  875|  91.4k|    if (script_type == TxoutType::SCRIPTHASH && !stack.script.empty() && !stack.script.back().empty()) {
  ------------------
  |  Branch (875:9): [True: 11.5k, False: 79.9k]
  |  Branch (875:49): [True: 1.60k, False: 9.90k]
  |  Branch (875:74): [True: 1.26k, False: 342]
  ------------------
  876|       |        // Get the redeemScript
  877|  1.26k|        CScript redeem_script(stack.script.back().begin(), stack.script.back().end());
  878|  1.26k|        data.redeem_script = redeem_script;
  879|  1.26k|        next_script = std::move(redeem_script);
  880|       |
  881|       |        // Get redeemScript type
  882|  1.26k|        script_type = Solver(next_script, solutions);
  883|  1.26k|        stack.script.pop_back();
  884|  1.26k|    }
  885|  91.4k|    if (script_type == TxoutType::WITNESS_V0_SCRIPTHASH && !stack.witness.empty() && !stack.witness.back().empty()) {
  ------------------
  |  Branch (885:9): [True: 6.80k, False: 84.6k]
  |  Branch (885:60): [True: 3.20k, False: 3.60k]
  |  Branch (885:86): [True: 2.89k, False: 314]
  ------------------
  886|       |        // Get the witnessScript
  887|  2.89k|        CScript witness_script(stack.witness.back().begin(), stack.witness.back().end());
  888|  2.89k|        data.witness_script = witness_script;
  889|  2.89k|        next_script = std::move(witness_script);
  890|       |
  891|       |        // Get witnessScript type
  892|  2.89k|        script_type = Solver(next_script, solutions);
  893|  2.89k|        stack.witness.pop_back();
  894|  2.89k|        stack.script = std::move(stack.witness);
  895|  2.89k|        stack.witness.clear();
  896|  2.89k|        sigversion = SigVersion::WITNESS_V0;
  897|  2.89k|    }
  898|  91.4k|    if (script_type == TxoutType::MULTISIG && !stack.script.empty()) {
  ------------------
  |  Branch (898:9): [True: 0, False: 91.4k]
  |  Branch (898:47): [True: 0, False: 0]
  ------------------
  899|       |        // Build a map of pubkey -> signature by matching sigs to pubkeys:
  900|      0|        assert(solutions.size() > 1);
  ------------------
  |  Branch (900:9): [True: 0, False: 0]
  ------------------
  901|      0|        unsigned int num_pubkeys = solutions.size()-2;
  902|      0|        unsigned int last_success_key = 0;
  903|      0|        for (const valtype& sig : stack.script) {
  ------------------
  |  Branch (903:33): [True: 0, False: 0]
  ------------------
  904|      0|            for (unsigned int i = last_success_key; i < num_pubkeys; ++i) {
  ------------------
  |  Branch (904:53): [True: 0, False: 0]
  ------------------
  905|      0|                const valtype& pubkey = solutions[i+1];
  906|       |                // We either have a signature for this pubkey, or we have found a signature and it is valid
  907|      0|                if (data.signatures.contains(CPubKey(pubkey).GetID()) || extractor_checker.CheckECDSASignature(sig, pubkey, next_script, sigversion)) {
  ------------------
  |  Branch (907:21): [True: 0, False: 0]
  |  Branch (907:21): [True: 0, False: 0]
  |  Branch (907:74): [True: 0, False: 0]
  ------------------
  908|      0|                    last_success_key = i + 1;
  909|      0|                    break;
  910|      0|                }
  911|      0|            }
  912|      0|        }
  913|      0|    }
  914|       |
  915|  91.4k|    return data;
  916|  91.4k|}
_Z11UpdateInputR5CTxInRK13SignatureData:
  919|  93.3k|{
  920|  93.3k|    input.scriptSig = data.scriptSig;
  921|  93.3k|    input.scriptWitness = data.scriptWitness;
  922|  93.3k|}
_ZN13SignatureData18MergeSignatureDataES_:
  925|  14.2k|{
  926|  14.2k|    if (complete) return;
  ------------------
  |  Branch (926:9): [True: 28, False: 14.1k]
  ------------------
  927|  14.1k|    if (sigdata.complete) {
  ------------------
  |  Branch (927:9): [True: 0, False: 14.1k]
  ------------------
  928|      0|        *this = std::move(sigdata);
  929|      0|        return;
  930|      0|    }
  931|  14.1k|    if (redeem_script.empty() && !sigdata.redeem_script.empty()) {
  ------------------
  |  Branch (931:9): [True: 14.1k, False: 9]
  |  Branch (931:34): [True: 0, False: 14.1k]
  ------------------
  932|      0|        redeem_script = sigdata.redeem_script;
  933|      0|    }
  934|  14.1k|    if (witness_script.empty() && !sigdata.witness_script.empty()) {
  ------------------
  |  Branch (934:9): [True: 14.1k, False: 33]
  |  Branch (934:35): [True: 0, False: 14.1k]
  ------------------
  935|      0|        witness_script = sigdata.witness_script;
  936|      0|    }
  937|  14.1k|    signatures.insert(std::make_move_iterator(sigdata.signatures.begin()), std::make_move_iterator(sigdata.signatures.end()));
  938|  14.1k|}
_Z15SignTransactionR19CMutableTransactionPK15SigningProviderRKNSt3__13mapI9COutPoint4CoinNS4_4lessIS6_EENS4_9allocatorINS4_4pairIKS6_S7_EEEEEERK11SignOptionsRNS5_Ii13bilingual_strNS8_IiEENSA_INSB_IKiSL_EEEEEE:
 1026|  7.72k|{
 1027|  7.72k|    bool fHashSingle = ((options.sighash_type & ~SIGHASH_ANYONECANPAY) == SIGHASH_SINGLE);
 1028|       |
 1029|       |    // Use CTransaction for the constant parts of the
 1030|       |    // transaction to avoid rehashing.
 1031|  7.72k|    const CTransaction txConst(mtx);
 1032|       |
 1033|  7.72k|    PrecomputedTransactionData txdata;
 1034|  7.72k|    std::vector<CTxOut> spent_outputs;
 1035|  18.2k|    for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
  ------------------
  |  Branch (1035:30): [True: 13.8k, False: 4.36k]
  ------------------
 1036|  13.8k|        CTxIn& txin = mtx.vin[i];
 1037|  13.8k|        auto coin = coins.find(txin.prevout);
 1038|  13.8k|        if (coin == coins.end() || coin->second.IsSpent()) {
  ------------------
  |  Branch (1038:13): [True: 3.36k, False: 10.5k]
  |  Branch (1038:13): [True: 3.36k, False: 10.5k]
  |  Branch (1038:36): [True: 0, False: 10.5k]
  ------------------
 1039|  3.36k|            txdata.Init(txConst, /*spent_outputs=*/{}, /*force=*/true);
 1040|  3.36k|            break;
 1041|  10.5k|        } else {
 1042|  10.5k|            spent_outputs.emplace_back(coin->second.out.nValue, coin->second.out.scriptPubKey);
 1043|  10.5k|        }
 1044|  13.8k|    }
 1045|  7.72k|    if (spent_outputs.size() == mtx.vin.size()) {
  ------------------
  |  Branch (1045:9): [True: 4.36k, False: 3.36k]
  ------------------
 1046|  4.36k|        txdata.Init(txConst, std::move(spent_outputs), true);
 1047|  4.36k|    }
 1048|       |
 1049|       |    // Sign what we can:
 1050|   146k|    for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
  ------------------
  |  Branch (1050:30): [True: 138k, False: 7.72k]
  ------------------
 1051|   138k|        CTxIn& txin = mtx.vin[i];
 1052|   138k|        auto coin = coins.find(txin.prevout);
 1053|   138k|        if (coin == coins.end() || coin->second.IsSpent()) {
  ------------------
  |  Branch (1053:13): [True: 48.4k, False: 89.9k]
  |  Branch (1053:13): [True: 48.4k, False: 89.9k]
  |  Branch (1053:36): [True: 0, False: 89.9k]
  ------------------
 1054|  48.4k|            input_errors[i] = _("Input not found or already spent");
 1055|  48.4k|            continue;
 1056|  48.4k|        }
 1057|  89.9k|        const CScript& prevPubKey = coin->second.out.scriptPubKey;
 1058|  89.9k|        const CAmount& amount = coin->second.out.nValue;
 1059|       |
 1060|  89.9k|        SignatureData sigdata = DataFromTransaction(mtx, i, coin->second.out);
 1061|       |        // Only sign SIGHASH_SINGLE if there's a corresponding output:
 1062|  89.9k|        if (!fHashSingle || (i < mtx.vout.size())) {
  ------------------
  |  Branch (1062:13): [True: 87.3k, False: 2.67k]
  |  Branch (1062:29): [True: 433, False: 2.24k]
  ------------------
 1063|  87.7k|            ProduceSignature(*keystore, MutableTransactionSignatureCreator(mtx, i, amount, &txdata, options), prevPubKey, sigdata);
 1064|  87.7k|        }
 1065|       |
 1066|  89.9k|        UpdateInput(txin, sigdata);
 1067|       |
 1068|       |        // amount must be specified for valid segwit signature
 1069|  89.9k|        if (amount == MAX_MONEY && !txin.scriptWitness.IsNull()) {
  ------------------
  |  Branch (1069:13): [True: 0, False: 89.9k]
  |  Branch (1069:36): [True: 0, False: 0]
  ------------------
 1070|      0|            input_errors[i] = _("Missing amount");
 1071|      0|            continue;
 1072|      0|        }
 1073|       |
 1074|  89.9k|        ScriptError serror = SCRIPT_ERR_OK;
 1075|  89.9k|        if (!sigdata.complete && !VerifyScript(txin.scriptSig, prevPubKey, &txin.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, TransactionSignatureChecker(&txConst, i, amount, txdata, MissingDataBehavior::FAIL), &serror)) {
  ------------------
  |  Branch (1075:13): [True: 88.0k, False: 1.90k]
  |  Branch (1075:13): [True: 87.6k, False: 2.29k]
  |  Branch (1075:34): [True: 87.6k, False: 393]
  ------------------
 1076|  87.6k|            if (serror == SCRIPT_ERR_INVALID_STACK_OPERATION) {
  ------------------
  |  Branch (1076:17): [True: 16.0k, False: 71.6k]
  ------------------
 1077|       |                // Unable to sign input and verification failed (possible attempt to partially sign).
 1078|  16.0k|                input_errors[i] = Untranslated("Unable to sign input, invalid stack size (possibly missing key)");
 1079|  71.6k|            } else if (serror == SCRIPT_ERR_SIG_NULLFAIL) {
  ------------------
  |  Branch (1079:24): [True: 22.3k, False: 49.2k]
  ------------------
 1080|       |                // Verification failed (possibly due to insufficient signatures).
 1081|  22.3k|                input_errors[i] = Untranslated("CHECK(MULTI)SIG failing with non-zero signature (possibly need more signatures)");
 1082|  49.2k|            } else {
 1083|  49.2k|                input_errors[i] = Untranslated(ScriptErrorString(serror));
 1084|  49.2k|            }
 1085|  87.6k|        } else {
 1086|       |            // If this input succeeds, make sure there is no error set for it
 1087|  2.29k|            input_errors.erase(i);
 1088|  2.29k|        }
 1089|  89.9k|    }
 1090|  7.72k|    return input_errors.empty();
 1091|  7.72k|}
sign.cpp:_ZL8SignStepRK15SigningProviderRK20BaseSignatureCreatorRK7CScriptRNSt3__16vectorINS9_IhNS8_9allocatorIhEEEENSA_ISC_EEEER9TxoutType10SigVersionR13SignatureData:
  646|   129k|{
  647|   129k|    CScript scriptRet;
  648|   129k|    ret.clear();
  649|   129k|    std::vector<unsigned char> sig;
  650|       |
  651|   129k|    std::vector<valtype> vSolutions;
  652|   129k|    whichTypeRet = Solver(scriptPubKey, vSolutions);
  653|       |
  654|   129k|    switch (whichTypeRet) {
  ------------------
  |  Branch (654:13): [True: 129k, False: 0]
  ------------------
  655|  60.8k|    case TxoutType::NONSTANDARD:
  ------------------
  |  Branch (655:5): [True: 60.8k, False: 68.6k]
  ------------------
  656|  61.1k|    case TxoutType::NULL_DATA:
  ------------------
  |  Branch (656:5): [True: 324, False: 129k]
  ------------------
  657|  61.9k|    case TxoutType::WITNESS_UNKNOWN:
  ------------------
  |  Branch (657:5): [True: 805, False: 128k]
  ------------------
  658|  61.9k|        return false;
  659|  1.77k|    case TxoutType::PUBKEY:
  ------------------
  |  Branch (659:5): [True: 1.77k, False: 127k]
  ------------------
  660|  1.77k|        if (!CreateSig(creator, sigdata, provider, sig, CPubKey(vSolutions[0]), scriptPubKey, sigversion)) return false;
  ------------------
  |  Branch (660:13): [True: 1.75k, False: 20]
  ------------------
  661|     20|        ret.push_back(std::move(sig));
  662|     20|        return true;
  663|  34.7k|    case TxoutType::PUBKEYHASH: {
  ------------------
  |  Branch (663:5): [True: 34.7k, False: 94.7k]
  ------------------
  664|  34.7k|        CKeyID keyID = CKeyID(uint160(vSolutions[0]));
  665|  34.7k|        CPubKey pubkey;
  666|  34.7k|        if (!GetPubKey(provider, sigdata, keyID, pubkey)) {
  ------------------
  |  Branch (666:13): [True: 3.04k, False: 31.6k]
  ------------------
  667|       |            // Pubkey could not be found, add to missing
  668|  3.04k|            sigdata.missing_pubkeys.push_back(keyID);
  669|  3.04k|            return false;
  670|  3.04k|        }
  671|  31.6k|        if (!CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) return false;
  ------------------
  |  Branch (671:13): [True: 683, False: 30.9k]
  ------------------
  672|  30.9k|        ret.push_back(std::move(sig));
  673|  30.9k|        ret.push_back(ToByteVector(pubkey));
  674|  30.9k|        return true;
  675|  31.6k|    }
  676|  11.0k|    case TxoutType::SCRIPTHASH: {
  ------------------
  |  Branch (676:5): [True: 11.0k, False: 118k]
  ------------------
  677|  11.0k|        uint160 h160{vSolutions[0]};
  678|  11.0k|        if (GetCScript(provider, sigdata, CScriptID{h160}, scriptRet)) {
  ------------------
  |  Branch (678:13): [True: 8.10k, False: 2.97k]
  ------------------
  679|  8.10k|            ret.emplace_back(scriptRet.begin(), scriptRet.end());
  680|  8.10k|            return true;
  681|  8.10k|        }
  682|       |        // Could not find redeemScript, add to missing
  683|  2.97k|        sigdata.missing_redeem_script = h160;
  684|  2.97k|        return false;
  685|  11.0k|    }
  686|    299|    case TxoutType::MULTISIG: {
  ------------------
  |  Branch (686:5): [True: 299, False: 129k]
  ------------------
  687|    299|        size_t required = vSolutions.front()[0];
  688|    299|        ret.emplace_back(); // workaround CHECKMULTISIG bug
  689|  3.64k|        for (size_t i = 1; i < vSolutions.size() - 1; ++i) {
  ------------------
  |  Branch (689:28): [True: 3.34k, False: 299]
  ------------------
  690|  3.34k|            CPubKey pubkey = CPubKey(vSolutions[i]);
  691|       |            // We need to always call CreateSig in order to fill sigdata with all
  692|       |            // possible signatures that we can create. This will allow further PSBT
  693|       |            // processing to work as it needs all possible signature and pubkey pairs
  694|  3.34k|            if (CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) {
  ------------------
  |  Branch (694:17): [True: 3.08k, False: 258]
  ------------------
  695|  3.08k|                if (ret.size() < required + 1) {
  ------------------
  |  Branch (695:21): [True: 2.01k, False: 1.07k]
  ------------------
  696|  2.01k|                    ret.push_back(std::move(sig));
  697|  2.01k|                }
  698|  3.08k|            }
  699|  3.34k|        }
  700|    299|        bool ok = ret.size() == required + 1;
  701|    395|        for (size_t i = 0; i + ret.size() < required + 1; ++i) {
  ------------------
  |  Branch (701:28): [True: 96, False: 299]
  ------------------
  702|     96|            ret.emplace_back();
  703|     96|        }
  704|    299|        return ok;
  705|  11.0k|    }
  706|  7.11k|    case TxoutType::WITNESS_V0_KEYHASH:
  ------------------
  |  Branch (706:5): [True: 7.11k, False: 122k]
  ------------------
  707|  7.11k|        ret.push_back(vSolutions[0]);
  708|  7.11k|        return true;
  709|       |
  710|  6.06k|    case TxoutType::WITNESS_V0_SCRIPTHASH:
  ------------------
  |  Branch (710:5): [True: 6.06k, False: 123k]
  ------------------
  711|  6.06k|        if (GetCScript(provider, sigdata, CScriptID{RIPEMD160(vSolutions[0])}, scriptRet)) {
  ------------------
  |  Branch (711:13): [True: 1.72k, False: 4.33k]
  ------------------
  712|  1.72k|            ret.emplace_back(scriptRet.begin(), scriptRet.end());
  713|  1.72k|            return true;
  714|  1.72k|        }
  715|       |        // Could not find witnessScript, add to missing
  716|  4.33k|        sigdata.missing_witness_script = uint256(vSolutions[0]);
  717|  4.33k|        return false;
  718|       |
  719|  6.09k|    case TxoutType::WITNESS_V1_TAPROOT:
  ------------------
  |  Branch (719:5): [True: 6.09k, False: 123k]
  ------------------
  720|  6.09k|        return SignTaproot(provider, creator, WitnessV1Taproot(XOnlyPubKey{vSolutions[0]}), sigdata, ret);
  721|       |
  722|    362|    case TxoutType::ANCHOR:
  ------------------
  |  Branch (722:5): [True: 362, False: 129k]
  ------------------
  723|    362|        return true;
  724|   129k|    } // no default case, so the compiler can warn about missing cases
  725|   129k|    assert(false);
  ------------------
  |  Branch (725:5): [Folded, False: 0]
  ------------------
  726|      0|}
sign.cpp:_ZL9CreateSigRK20BaseSignatureCreatorR13SignatureDataRK15SigningProviderRNSt3__16vectorIhNS7_9allocatorIhEEEERK7CPubKeyRK7CScript10SigVersion:
  262|  36.7k|{
  263|  36.7k|    CKeyID keyid = pubkey.GetID();
  264|  36.7k|    const auto it = sigdata.signatures.find(keyid);
  265|  36.7k|    if (it != sigdata.signatures.end()) {
  ------------------
  |  Branch (265:9): [True: 647, False: 36.1k]
  ------------------
  266|    647|        sig_out = it->second.second;
  267|    647|        return true;
  268|    647|    }
  269|  36.1k|    KeyOriginInfo info;
  270|  36.1k|    if (provider.GetKeyOrigin(keyid, info)) {
  ------------------
  |  Branch (270:9): [True: 0, False: 36.1k]
  ------------------
  271|      0|        sigdata.misc_pubkeys.emplace(keyid, std::make_pair(pubkey, std::move(info)));
  272|      0|    }
  273|  36.1k|    if (creator.CreateSig(provider, sig_out, keyid, scriptcode, sigversion)) {
  ------------------
  |  Branch (273:9): [True: 33.4k, False: 2.69k]
  ------------------
  274|  33.4k|        auto i = sigdata.signatures.emplace(keyid, SigPair(pubkey, sig_out));
  275|  33.4k|        assert(i.second);
  ------------------
  |  Branch (275:9): [True: 33.4k, False: 0]
  ------------------
  276|  33.4k|        return true;
  277|  33.4k|    }
  278|       |    // Could not make signature or signature not found, add keyid to missing
  279|  2.69k|    sigdata.missing_sigs.push_back(keyid);
  280|  2.69k|    return false;
  281|  36.1k|}
sign.cpp:_ZL9GetPubKeyRK15SigningProviderRK13SignatureDataRK6CKeyIDR7CPubKey:
  239|  34.7k|{
  240|       |    // Look for pubkey in all partial sigs
  241|  34.7k|    const auto it = sigdata.signatures.find(address);
  242|  34.7k|    if (it != sigdata.signatures.end()) {
  ------------------
  |  Branch (242:9): [True: 0, False: 34.7k]
  ------------------
  243|      0|        pubkey = it->second.first;
  244|      0|        return true;
  245|      0|    }
  246|       |    // Look for pubkey in pubkey lists
  247|  34.7k|    const auto& pk_it = sigdata.misc_pubkeys.find(address);
  248|  34.7k|    if (pk_it != sigdata.misc_pubkeys.end()) {
  ------------------
  |  Branch (248:9): [True: 0, False: 34.7k]
  ------------------
  249|      0|        pubkey = pk_it->second.first;
  250|      0|        return true;
  251|      0|    }
  252|  34.7k|    const auto& tap_pk_it = sigdata.tap_pubkeys.find(address);
  253|  34.7k|    if (tap_pk_it != sigdata.tap_pubkeys.end()) {
  ------------------
  |  Branch (253:9): [True: 0, False: 34.7k]
  ------------------
  254|      0|        pubkey = tap_pk_it->second.GetEvenCorrespondingCPubKey();
  255|      0|        return true;
  256|      0|    }
  257|       |    // Query the underlying provider
  258|  34.7k|    return provider.GetPubKey(address, pubkey);
  259|  34.7k|}
sign.cpp:_ZL10GetCScriptRK15SigningProviderRK13SignatureDataRK9CScriptIDR7CScript:
  223|  17.1k|{
  224|  17.1k|    if (provider.GetCScript(scriptid, script)) {
  ------------------
  |  Branch (224:9): [True: 6.55k, False: 10.5k]
  ------------------
  225|  6.55k|        return true;
  226|  6.55k|    }
  227|       |    // Look for scripts in SignatureData
  228|  10.5k|    if (CScriptID(sigdata.redeem_script) == scriptid) {
  ------------------
  |  Branch (228:9): [True: 2.14k, False: 8.44k]
  ------------------
  229|  2.14k|        script = sigdata.redeem_script;
  230|  2.14k|        return true;
  231|  8.44k|    } else if (CScriptID(sigdata.witness_script) == scriptid) {
  ------------------
  |  Branch (231:16): [True: 1.13k, False: 7.31k]
  ------------------
  232|  1.13k|        script = sigdata.witness_script;
  233|  1.13k|        return true;
  234|  1.13k|    }
  235|  7.31k|    return false;
  236|  10.5k|}
sign.cpp:_ZL11SignTaprootRK15SigningProviderRK20BaseSignatureCreatorRK16WitnessV1TaprootR13SignatureDataRNSt3__16vectorINSB_IhNSA_9allocatorIhEEEENSC_ISE_EEEE:
  559|  6.09k|{
  560|  6.09k|    TaprootSpendData spenddata;
  561|  6.09k|    TaprootBuilder builder;
  562|       |
  563|       |    // Gather information about this output.
  564|  6.09k|    if (provider.GetTaprootSpendData(output, spenddata)) {
  ------------------
  |  Branch (564:9): [True: 0, False: 6.09k]
  ------------------
  565|      0|        sigdata.tr_spenddata.Merge(spenddata);
  566|      0|    }
  567|  6.09k|    if (provider.GetTaprootBuilder(output, builder)) {
  ------------------
  |  Branch (567:9): [True: 0, False: 6.09k]
  ------------------
  568|      0|        sigdata.tr_builder = builder;
  569|      0|    }
  570|  6.09k|    if (auto agg_keys = provider.GetAllMuSig2ParticipantPubkeys(); !agg_keys.empty()) {
  ------------------
  |  Branch (570:68): [True: 0, False: 6.09k]
  ------------------
  571|      0|        sigdata.musig2_pubkeys.insert(agg_keys.begin(), agg_keys.end());
  572|      0|    }
  573|       |
  574|       |
  575|       |    // Try key path spending.
  576|  6.09k|    {
  577|  6.09k|        KeyOriginInfo internal_key_info;
  578|  6.09k|        if (provider.GetKeyOriginByXOnly(sigdata.tr_spenddata.internal_key, internal_key_info)) {
  ------------------
  |  Branch (578:13): [True: 0, False: 6.09k]
  ------------------
  579|      0|            auto it = sigdata.taproot_misc_pubkeys.find(sigdata.tr_spenddata.internal_key);
  580|      0|            if (it == sigdata.taproot_misc_pubkeys.end()) {
  ------------------
  |  Branch (580:17): [True: 0, False: 0]
  ------------------
  581|      0|                sigdata.taproot_misc_pubkeys.emplace(sigdata.tr_spenddata.internal_key, std::make_pair(std::set<uint256>(), internal_key_info));
  582|      0|            }
  583|      0|        }
  584|       |
  585|  6.09k|        KeyOriginInfo output_key_info;
  586|  6.09k|        if (provider.GetKeyOriginByXOnly(output, output_key_info)) {
  ------------------
  |  Branch (586:13): [True: 0, False: 6.09k]
  ------------------
  587|      0|            auto it = sigdata.taproot_misc_pubkeys.find(output);
  588|      0|            if (it == sigdata.taproot_misc_pubkeys.end()) {
  ------------------
  |  Branch (588:17): [True: 0, False: 0]
  ------------------
  589|      0|                sigdata.taproot_misc_pubkeys.emplace(output, std::make_pair(std::set<uint256>(), output_key_info));
  590|      0|            }
  591|      0|        }
  592|       |
  593|  6.09k|        auto make_keypath_sig = [&](const XOnlyPubKey& pk, const uint256* merkle_root) {
  594|  6.09k|            std::vector<unsigned char> sig;
  595|  6.09k|            if (creator.CreateSchnorrSig(provider, sig, pk, nullptr, merkle_root, SigVersion::TAPROOT)) {
  596|  6.09k|                sigdata.taproot_key_path_sig = sig;
  597|  6.09k|            } else {
  598|  6.09k|                SignMuSig2(creator, sigdata, provider, sig, pk, merkle_root, /*leaf_hash=*/nullptr, SigVersion::TAPROOT);
  599|  6.09k|            }
  600|  6.09k|        };
  601|       |
  602|       |        // First try signing with internal key
  603|  6.09k|        if (sigdata.taproot_key_path_sig.size() == 0) {
  ------------------
  |  Branch (603:13): [True: 6.09k, False: 0]
  ------------------
  604|  6.09k|            make_keypath_sig(sigdata.tr_spenddata.internal_key, &sigdata.tr_spenddata.merkle_root);
  605|  6.09k|        }
  606|       |        // Try signing with output key if still no signature
  607|  6.09k|        if (sigdata.taproot_key_path_sig.size() == 0) {
  ------------------
  |  Branch (607:13): [True: 6.07k, False: 20]
  ------------------
  608|  6.07k|            make_keypath_sig(output, nullptr);
  609|  6.07k|        }
  610|  6.09k|        if (sigdata.taproot_key_path_sig.size()) {
  ------------------
  |  Branch (610:13): [True: 20, False: 6.07k]
  ------------------
  611|     20|            result = Vector(sigdata.taproot_key_path_sig);
  612|     20|            return true;
  613|     20|        }
  614|  6.09k|    }
  615|       |
  616|       |    // Try script path spending.
  617|  6.07k|    std::vector<std::vector<unsigned char>> smallest_result_stack;
  618|  6.07k|    for (const auto& [key, control_blocks] : sigdata.tr_spenddata.scripts) {
  ------------------
  |  Branch (618:44): [True: 0, False: 6.07k]
  ------------------
  619|      0|        const auto& [script, leaf_ver] = key;
  620|      0|        std::vector<std::vector<unsigned char>> result_stack;
  621|      0|        if (SignTaprootScript(provider, creator, sigdata, leaf_ver, script, result_stack)) {
  ------------------
  |  Branch (621:13): [True: 0, False: 0]
  ------------------
  622|      0|            result_stack.emplace_back(std::begin(script), std::end(script)); // Push the script
  623|      0|            result_stack.push_back(*control_blocks.begin()); // Push the smallest control block
  624|      0|            if (smallest_result_stack.size() == 0 ||
  ------------------
  |  Branch (624:17): [True: 0, False: 0]
  ------------------
  625|      0|                GetSerializeSize(result_stack) < GetSerializeSize(smallest_result_stack)) {
  ------------------
  |  Branch (625:17): [True: 0, False: 0]
  ------------------
  626|      0|                smallest_result_stack = std::move(result_stack);
  627|      0|            }
  628|      0|        }
  629|      0|    }
  630|  6.07k|    if (smallest_result_stack.size() != 0) {
  ------------------
  |  Branch (630:9): [True: 0, False: 6.07k]
  ------------------
  631|      0|        result = std::move(smallest_result_stack);
  632|      0|        return true;
  633|      0|    }
  634|       |
  635|  6.07k|    return false;
  636|  6.07k|}
sign.cpp:_ZZL11SignTaprootRK15SigningProviderRK20BaseSignatureCreatorRK16WitnessV1TaprootR13SignatureDataRNSt3__16vectorINSB_IhNSA_9allocatorIhEEEENSC_ISE_EEEEENK3$_0clERK11XOnlyPubKeyPK7uint256:
  593|  12.1k|        auto make_keypath_sig = [&](const XOnlyPubKey& pk, const uint256* merkle_root) {
  594|  12.1k|            std::vector<unsigned char> sig;
  595|  12.1k|            if (creator.CreateSchnorrSig(provider, sig, pk, nullptr, merkle_root, SigVersion::TAPROOT)) {
  ------------------
  |  Branch (595:17): [True: 20, False: 12.1k]
  ------------------
  596|     20|                sigdata.taproot_key_path_sig = sig;
  597|  12.1k|            } else {
  598|  12.1k|                SignMuSig2(creator, sigdata, provider, sig, pk, merkle_root, /*leaf_hash=*/nullptr, SigVersion::TAPROOT);
  599|  12.1k|            }
  600|  12.1k|        };
sign.cpp:_ZL10SignMuSig2RK20BaseSignatureCreatorR13SignatureDataRK15SigningProviderRNSt3__16vectorIhNS7_9allocatorIhEEEERK11XOnlyPubKeyPK7uint256SI_10SigVersion:
  284|  12.1k|{
  285|  12.1k|    Assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
  ------------------
  |  |  116|  12.1k|#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
  |  |  ------------------
  |  |  |  Branch (116:50): [True: 12.1k, False: 0]
  |  |  |  Branch (116:50): [True: 0, False: 0]
  |  |  ------------------
  ------------------
  286|       |
  287|       |    // Lookup derivation paths for the script pubkey
  288|  12.1k|    KeyOriginInfo agg_info;
  289|  12.1k|    auto misc_pk_it = sigdata.taproot_misc_pubkeys.find(script_pubkey);
  290|  12.1k|    if (misc_pk_it != sigdata.taproot_misc_pubkeys.end()) {
  ------------------
  |  Branch (290:9): [True: 0, False: 12.1k]
  ------------------
  291|      0|        agg_info = misc_pk_it->second.second;
  292|      0|    }
  293|       |
  294|  12.1k|    for (const auto& [agg_pub, part_pks] : sigdata.musig2_pubkeys) {
  ------------------
  |  Branch (294:42): [True: 0, False: 12.1k]
  ------------------
  295|      0|        if (part_pks.empty()) continue;
  ------------------
  |  Branch (295:13): [True: 0, False: 0]
  ------------------
  296|       |
  297|       |        // Fill participant derivation path info
  298|      0|        for (const auto& part_pk : part_pks) {
  ------------------
  |  Branch (298:34): [True: 0, False: 0]
  ------------------
  299|      0|            KeyOriginInfo part_info;
  300|      0|            if (provider.GetKeyOrigin(part_pk.GetID(), part_info)) {
  ------------------
  |  Branch (300:17): [True: 0, False: 0]
  ------------------
  301|      0|                XOnlyPubKey xonly_part(part_pk);
  302|      0|                auto it = sigdata.taproot_misc_pubkeys.find(xonly_part);
  303|      0|                if (it == sigdata.taproot_misc_pubkeys.end()) {
  ------------------
  |  Branch (303:21): [True: 0, False: 0]
  ------------------
  304|      0|                    it = sigdata.taproot_misc_pubkeys.emplace(xonly_part, std::make_pair(std::set<uint256>(), part_info)).first;
  305|      0|                }
  306|      0|                if (leaf_hash) it->second.first.insert(*leaf_hash);
  ------------------
  |  Branch (306:21): [True: 0, False: 0]
  ------------------
  307|      0|            }
  308|      0|        }
  309|       |
  310|       |        // The pubkey in the script may not be the actual aggregate of the participants, but derived from it.
  311|       |        // Check the derivation, and compute the BIP 32 derivation tweaks
  312|      0|        std::vector<std::pair<uint256, bool>> tweaks;
  313|      0|        CPubKey plain_pub = agg_pub;
  314|      0|        if (XOnlyPubKey(agg_pub) != script_pubkey) {
  ------------------
  |  Branch (314:13): [True: 0, False: 0]
  ------------------
  315|      0|            if (agg_info.path.empty()) continue;
  ------------------
  |  Branch (315:17): [True: 0, False: 0]
  ------------------
  316|      0|            if (agg_info.fingerprint != agg_pub.GetID().fingerprint()) {
  ------------------
  |  Branch (316:17): [True: 0, False: 0]
  ------------------
  317|      0|                continue;
  318|      0|            }
  319|       |            // Get the BIP32 derivation tweaks
  320|      0|            CExtPubKey extpub = CreateMuSig2SyntheticXpub(agg_pub);
  321|      0|            for (const uint32_t i : agg_info.path) {
  ------------------
  |  Branch (321:35): [True: 0, False: 0]
  ------------------
  322|      0|                if (i >> 31) return false; // Hardened derivation is not possible from a public key
  ------------------
  |  Branch (322:21): [True: 0, False: 0]
  ------------------
  323|      0|                auto& [t, xonly] = tweaks.emplace_back();
  324|      0|                xonly = false;
  325|      0|                if (!extpub.Derive(extpub, i, &t)) {
  ------------------
  |  Branch (325:21): [True: 0, False: 0]
  ------------------
  326|      0|                    return false;
  327|      0|                }
  328|      0|            }
  329|      0|            if (XOnlyPubKey(extpub.pubkey) != script_pubkey) continue;
  ------------------
  |  Branch (329:17): [True: 0, False: 0]
  ------------------
  330|      0|            plain_pub = extpub.pubkey;
  331|      0|        }
  332|       |
  333|       |        // Add the merkle root tweak
  334|      0|        if (sigversion == SigVersion::TAPROOT && merkle_root) {
  ------------------
  |  Branch (334:13): [True: 0, False: 0]
  |  Branch (334:50): [True: 0, False: 0]
  ------------------
  335|      0|            tweaks.emplace_back(script_pubkey.ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root), true);
  ------------------
  |  Branch (335:67): [True: 0, False: 0]
  ------------------
  336|      0|            std::optional<std::pair<XOnlyPubKey, bool>> tweaked = script_pubkey.CreateTapTweak(merkle_root->IsNull() ? nullptr : merkle_root);
  ------------------
  |  Branch (336:96): [True: 0, False: 0]
  ------------------
  337|      0|            if (!Assume(tweaked)) return false;
  ------------------
  |  |  128|      0|#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
  ------------------
  |  Branch (337:17): [True: 0, False: 0]
  ------------------
  338|      0|            plain_pub = tweaked->first.GetCPubKeys().at(tweaked->second ? 1 : 0);
  ------------------
  |  Branch (338:57): [True: 0, False: 0]
  ------------------
  339|      0|        }
  340|       |
  341|       |        // First try to aggregate
  342|      0|        if (creator.CreateMuSig2AggregateSig(part_pks, sig_out, agg_pub, plain_pub, leaf_hash, tweaks, sigversion, sigdata)) {
  ------------------
  |  Branch (342:13): [True: 0, False: 0]
  ------------------
  343|      0|            if (sigversion == SigVersion::TAPROOT) {
  ------------------
  |  Branch (343:17): [True: 0, False: 0]
  ------------------
  344|      0|                sigdata.taproot_key_path_sig = sig_out;
  345|      0|            } else {
  346|      0|                auto lookup_key = std::make_pair(script_pubkey, leaf_hash ? *leaf_hash : uint256());
  ------------------
  |  Branch (346:65): [True: 0, False: 0]
  ------------------
  347|      0|                sigdata.taproot_script_sigs[lookup_key] = sig_out;
  348|      0|            }
  349|      0|            continue;
  350|      0|        }
  351|       |        // Cannot aggregate, try making partial sigs for every participant
  352|      0|        auto pub_key_leaf_hash = std::make_pair(plain_pub, leaf_hash ? *leaf_hash : uint256());
  ------------------
  |  Branch (352:60): [True: 0, False: 0]
  ------------------
  353|      0|        for (const CPubKey& part_pk : part_pks) {
  ------------------
  |  Branch (353:37): [True: 0, False: 0]
  ------------------
  354|      0|            uint256 partial_sig;
  355|      0|            if (creator.CreateMuSig2PartialSig(provider, partial_sig, agg_pub, plain_pub, part_pk, leaf_hash, tweaks, sigversion, sigdata) && Assume(!partial_sig.IsNull())) {
  ------------------
  |  |  128|      0|#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
  |  |  ------------------
  |  |  |  Branch (128:21): [True: 0, False: 0]
  |  |  ------------------
  ------------------
  |  Branch (355:17): [True: 0, False: 0]
  |  Branch (355:17): [True: 0, False: 0]
  ------------------
  356|      0|                sigdata.musig2_partial_sigs[pub_key_leaf_hash].emplace(part_pk, partial_sig);
  357|      0|            }
  358|      0|        }
  359|       |        // If there are any partial signatures, continue with next aggregate pubkey
  360|      0|        auto partial_sigs_it = sigdata.musig2_partial_sigs.find(pub_key_leaf_hash);
  361|      0|        if (partial_sigs_it != sigdata.musig2_partial_sigs.end() && !partial_sigs_it->second.empty()) {
  ------------------
  |  Branch (361:13): [True: 0, False: 0]
  |  Branch (361:13): [True: 0, False: 0]
  |  Branch (361:69): [True: 0, False: 0]
  ------------------
  362|      0|            continue;
  363|      0|        }
  364|       |        // No partial sigs, try to make pubnonces
  365|      0|        std::map<CPubKey, std::vector<uint8_t>>& pubnonces = sigdata.musig2_pubnonces[pub_key_leaf_hash];
  366|      0|        for (const CPubKey& part_pk : part_pks) {
  ------------------
  |  Branch (366:37): [True: 0, False: 0]
  ------------------
  367|      0|            if (pubnonces.contains(part_pk)) continue;
  ------------------
  |  Branch (367:17): [True: 0, False: 0]
  ------------------
  368|      0|            std::vector<uint8_t> pubnonce = creator.CreateMuSig2Nonce(provider, agg_pub, plain_pub, part_pk, leaf_hash, merkle_root, sigversion, sigdata);
  369|      0|            if (pubnonce.empty()) continue;
  ------------------
  |  Branch (369:17): [True: 0, False: 0]
  ------------------
  370|      0|            pubnonces[part_pk] = std::move(pubnonce);
  371|      0|        }
  372|      0|    }
  373|  12.1k|    return true;
  374|  12.1k|}
_ZN12WshSatisfierC2ERK15SigningProviderR13SignatureDataRK20BaseSignatureCreatorRK7CScript:
  485|  1.66k|                          : Satisfier(provider, sig_data, creator, witscript, miniscript::MiniscriptContext::P2WSH) {}
_ZN9SatisfierI7CPubKeyEC2ERK15SigningProviderR13SignatureDataRK20BaseSignatureCreatorRK7CScriptN10miniscript17MiniscriptContextE:
  433|  1.66k|                       miniscript::MiniscriptContext script_ctx) : m_provider(provider),
  434|  1.66k|                                                                   m_sig_data(sig_data),
  435|  1.66k|                                                                   m_creator(creator),
  436|  1.66k|                                                                   m_witness_script(witscript),
  437|  1.66k|                                                                   m_script_ctx(script_ctx) {}
sign.cpp:_ZL7PushAllRKNSt3__16vectorINS0_IhNS_9allocatorIhEEEENS1_IS3_EEEE:
  729|   112k|{
  730|   112k|    CScript result;
  731|   112k|    for (const valtype& v : values) {
  ------------------
  |  Branch (731:27): [True: 60.3k, False: 112k]
  ------------------
  732|  60.3k|        if (v.size() == 0) {
  ------------------
  |  Branch (732:13): [True: 1.42k, False: 58.8k]
  ------------------
  733|  1.42k|            result << OP_0;
  734|  58.8k|        } else if (v.size() == 1 && v[0] >= 1 && v[0] <= 16) {
  ------------------
  |  Branch (734:20): [True: 404, False: 58.4k]
  |  Branch (734:37): [True: 394, False: 10]
  |  Branch (734:50): [True: 351, False: 43]
  ------------------
  735|    351|            result << CScript::EncodeOP_N(v[0]);
  736|  58.5k|        } else if (v.size() == 1 && v[0] == 0x81) {
  ------------------
  |  Branch (736:20): [True: 53, False: 58.4k]
  |  Branch (736:37): [True: 18, False: 35]
  ------------------
  737|     18|            result << OP_1NEGATE;
  738|  58.5k|        } else {
  739|  58.5k|            result << v;
  740|  58.5k|        }
  741|  60.3k|    }
  742|   112k|    return result;
  743|   112k|}
sign.cpp:_ZN12_GLOBAL__N_16StacksC2ERK13SignatureData:
  846|  92.1k|    explicit Stacks(const SignatureData& data) : witness(data.scriptWitness.stack) {
  847|  92.1k|        EvalScript(script, data.scriptSig, SCRIPT_VERIFY_STRICTENC, BaseSignatureChecker(), SigVersion::BASE);
  848|  92.1k|    }
sign.cpp:_ZN12_GLOBAL__N_125SignatureExtractorCheckerC2ER13SignatureDataR20BaseSignatureChecker:
  826|  92.1k|    SignatureExtractorChecker(SignatureData& sigdata, BaseSignatureChecker& checker) : DeferringSignatureChecker(checker), sigdata(sigdata) {}
sign.cpp:_ZNK12_GLOBAL__N_125SignatureExtractorChecker19CheckECDSASignatureERKNSt3__16vectorIhNS1_9allocatorIhEEEES7_RK7CScript10SigVersion:
  829|  1.03k|    {
  830|  1.03k|        if (m_checker.CheckECDSASignature(scriptSig, vchPubKey, scriptCode, sigversion)) {
  ------------------
  |  Branch (830:13): [True: 0, False: 1.03k]
  ------------------
  831|      0|            CPubKey pubkey(vchPubKey);
  832|      0|            sigdata.signatures.emplace(pubkey.GetID(), SigPair(pubkey, scriptSig));
  833|      0|            return true;
  834|      0|        }
  835|  1.03k|        return false;
  836|  1.03k|    }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureChecker19CheckECDSASignatureERKNSt3__16vectorIhNS1_9allocatorIhEEEES7_RK7CScript10SigVersion:
  946|  1.03k|    bool CheckECDSASignature(const std::vector<unsigned char>& sig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override { return sig.size() != 0; }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureChecker21CheckSchnorrSignatureENSt3__14spanIKhLm18446744073709551615EEES4_10SigVersionR19ScriptExecutionDataP13ScriptError_t:
  947|     18|    bool CheckSchnorrSignature(std::span<const unsigned char> sig, std::span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror) const override { return sig.size() != 0; }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureCreator7CheckerEv:
  962|    315|    const BaseSignatureChecker& Checker() const override { return DUMMY_CHECKER; }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureCreator9CreateSigERK15SigningProviderRNSt3__16vectorIhNS4_9allocatorIhEEEERK6CKeyIDRK7CScript10SigVersion:
  964|  2.46k|    {
  965|       |        // Create a dummy signature that is a valid DER-encoding
  966|  2.46k|        vchSig.assign(m_r_len + m_s_len + 7, '\000');
  967|  2.46k|        vchSig[0] = 0x30;
  968|  2.46k|        vchSig[1] = m_r_len + m_s_len + 4;
  969|  2.46k|        vchSig[2] = 0x02;
  970|  2.46k|        vchSig[3] = m_r_len;
  971|  2.46k|        vchSig[4] = 0x01;
  972|  2.46k|        vchSig[4 + m_r_len] = 0x02;
  973|  2.46k|        vchSig[5 + m_r_len] = m_s_len;
  974|  2.46k|        vchSig[6 + m_r_len] = 0x01;
  975|  2.46k|        vchSig[6 + m_r_len + m_s_len] = SIGHASH_ALL;
  976|  2.46k|        return true;
  977|  2.46k|    }
sign.cpp:_ZNK12_GLOBAL__N_121DummySignatureCreator16CreateSchnorrSigERK15SigningProviderRNSt3__16vectorIhNS4_9allocatorIhEEEERK11XOnlyPubKeyPK7uint256SF_10SigVersion:
  979|     20|    {
  980|     20|        sig.assign(64, '\000');
  981|     20|        return true;
  982|     20|    }
_ZNK9SatisfierI7CPubKeyE9MsContextEv:
  476|  2.88k|    miniscript::MiniscriptContext MsContext() const {
  477|  2.88k|        return m_script_ctx;
  478|  2.88k|    }
_ZNK12WshSatisfier11FromPKBytesINSt3__111__wrap_iterIPhEEEENS1_8optionalI7CPubKeyEET_S8_:
  489|      3|    std::optional<CPubKey> FromPKBytes(I first, I last) const {
  490|      3|        CPubKey pubkey{first, last};
  491|      3|        if (pubkey.IsValid()) return pubkey;
  ------------------
  |  Branch (491:13): [True: 0, False: 3]
  ------------------
  492|      3|        return {};
  493|      3|    }

_ZN13SignatureDataC2ERK7CScript:
  118|  26.2k|    explicit SignatureData(const CScript& script) : scriptSig(script) {}
_ZNK34MutableTransactionSignatureCreator7CheckerEv:
   67|  31.3k|    const BaseSignatureChecker& Checker() const override { return checker; }
_ZN13SignatureDataC2Ev:
  117|   117k|    SignatureData() = default;
_ZN20BaseSignatureCreatorD2Ev:
   41|  90.1k|    virtual ~BaseSignatureCreator() = default;

_ZN23FillableSigningProvider32ImplicitlyLearnRelatedKeyScriptsERK7CPubKey:
  164|  9.90k|{
  165|  9.90k|    AssertLockHeld(cs_KeyStore);
  ------------------
  |  |  144|  9.90k|#define AssertLockHeld(cs) AssertLockHeldInternal(#cs, __FILE__, __LINE__, &cs)
  ------------------
  166|  9.90k|    CKeyID key_id = pubkey.GetID();
  167|       |    // This adds the redeemscripts necessary to detect P2WPKH and P2SH-P2WPKH
  168|       |    // outputs. Technically P2WPKH outputs don't have a redeemscript to be
  169|       |    // spent. However, our current IsMine logic requires the corresponding
  170|       |    // P2SH-P2WPKH redeemscript to be present in the wallet in order to accept
  171|       |    // payment even to P2WPKH outputs.
  172|       |    // Also note that having superfluous scripts in the keystore never hurts.
  173|       |    // They're only used to guide recursion in signing and IsMine logic - if
  174|       |    // a script is present but we can't do anything with it, it has no effect.
  175|       |    // "Implicitly" refers to fact that scripts are derived automatically from
  176|       |    // existing keys, and are present in memory, even without being explicitly
  177|       |    // loaded (e.g. from a file).
  178|  9.90k|    if (pubkey.IsCompressed()) {
  ------------------
  |  Branch (178:9): [True: 4.02k, False: 5.88k]
  ------------------
  179|  4.02k|        CScript script = GetScriptForDestination(WitnessV0KeyHash(key_id));
  180|       |        // This does not use AddCScript, as it may be overridden.
  181|  4.02k|        CScriptID id(script);
  182|  4.02k|        mapScripts[id] = std::move(script);
  183|  4.02k|    }
  184|  9.90k|}
_ZNK23FillableSigningProvider9GetPubKeyERK6CKeyIDR7CPubKey:
  187|  34.7k|{
  188|  34.7k|    CKey key;
  189|  34.7k|    if (!GetKey(address, key)) {
  ------------------
  |  Branch (189:9): [True: 3.04k, False: 31.6k]
  ------------------
  190|  3.04k|        return false;
  191|  3.04k|    }
  192|  31.6k|    vchPubKeyOut = key.GetPubKey();
  193|  31.6k|    return true;
  194|  34.7k|}
_ZN23FillableSigningProvider12AddKeyPubKeyERK4CKeyRK7CPubKey:
  197|  9.90k|{
  198|  9.90k|    LOCK(cs_KeyStore);
  ------------------
  |  |  268|  9.90k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  9.90k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  9.90k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  9.90k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  199|  9.90k|    mapKeys[pubkey.GetID()] = key;
  200|  9.90k|    ImplicitlyLearnRelatedKeyScripts(pubkey);
  201|  9.90k|    return true;
  202|  9.90k|}
_ZNK23FillableSigningProvider6GetKeyERK6CKeyIDR4CKey:
  221|  93.8k|{
  222|  93.8k|    LOCK(cs_KeyStore);
  ------------------
  |  |  268|  93.8k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  93.8k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  93.8k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  93.8k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  223|  93.8k|    KeyMap::const_iterator mi = mapKeys.find(address);
  224|  93.8k|    if (mi != mapKeys.end()) {
  ------------------
  |  Branch (224:9): [True: 64.3k, False: 29.4k]
  ------------------
  225|  64.3k|        keyOut = mi->second;
  226|  64.3k|        return true;
  227|  64.3k|    }
  228|  29.4k|    return false;
  229|  93.8k|}
_ZNK23FillableSigningProvider10GetCScriptERK9CScriptIDR7CScript:
  260|  17.1k|{
  261|  17.1k|    LOCK(cs_KeyStore);
  ------------------
  |  |  268|  17.1k|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|  17.1k|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|  17.1k|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|  17.1k|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  262|  17.1k|    ScriptMap::const_iterator mi = mapScripts.find(hash);
  263|  17.1k|    if (mi != mapScripts.end())
  ------------------
  |  Branch (263:9): [True: 6.55k, False: 10.5k]
  ------------------
  264|  6.55k|    {
  265|  6.55k|        redeemScriptOut = (*mi).second;
  266|  6.55k|        return true;
  267|  6.55k|    }
  268|  10.5k|    return false;
  269|  17.1k|}

_ZNK15SigningProvider13GetKeyByXOnlyERK11XOnlyPubKeyR4CKey:
  186|  12.1k|    {
  187|  24.2k|        for (const auto& id : pubkey.GetKeyIDs()) {
  ------------------
  |  Branch (187:29): [True: 24.2k, False: 12.1k]
  ------------------
  188|  24.2k|            if (GetKey(id, key)) return true;
  ------------------
  |  Branch (188:17): [True: 0, False: 24.2k]
  ------------------
  189|  24.2k|        }
  190|  12.1k|        return false;
  191|  12.1k|    }
_ZNK15SigningProvider19GetKeyOriginByXOnlyERK11XOnlyPubKeyR13KeyOriginInfo:
  202|  12.1k|    {
  203|  24.3k|        for (const auto& id : pubkey.GetKeyIDs()) {
  ------------------
  |  Branch (203:29): [True: 24.3k, False: 12.1k]
  ------------------
  204|  24.3k|            if (GetKeyOrigin(id, info)) return true;
  ------------------
  |  Branch (204:17): [True: 0, False: 24.3k]
  ------------------
  205|  24.3k|        }
  206|  12.1k|        return false;
  207|  12.1k|    }
_ZN23FillableSigningProvider6AddKeyERK4CKey:
  322|  9.90k|    virtual bool AddKey(const CKey &key) { return AddKeyPubKey(key, key.GetPubKey()); }
_ZN15SigningProviderD2Ev:
  170|  12.0k|    virtual ~SigningProvider() = default;
_ZNK15SigningProvider12GetKeyOriginERK6CKeyIDR13KeyOriginInfo:
  176|  60.5k|    virtual bool GetKeyOrigin(const CKeyID& keyid, KeyOriginInfo& info) const { return false; }
_ZNK15SigningProvider19GetTaprootSpendDataERK11XOnlyPubKeyR16TaprootSpendData:
  177|  6.09k|    virtual bool GetTaprootSpendData(const XOnlyPubKey& output_key, TaprootSpendData& spenddata) const { return false; }
_ZNK15SigningProvider17GetTaprootBuilderERK11XOnlyPubKeyR14TaprootBuilder:
  178|  6.09k|    virtual bool GetTaprootBuilder(const XOnlyPubKey& output_key, TaprootBuilder& builder) const { return false; }
_ZNK15SigningProvider30GetAllMuSig2ParticipantPubkeysEv:
  180|  6.09k|    virtual std::map<CPubKey, std::vector<CPubKey>> GetAllMuSig2ParticipantPubkeys() const {return {}; }

_Z6SolverRK7CScriptRNSt3__16vectorINS3_IhNS2_9allocatorIhEEEENS4_IS6_EEEE:
  142|   225k|{
  143|   225k|    vSolutionsRet.clear();
  144|       |
  145|       |    // Shortcut for pay-to-script-hash, which are more constrained than the other types:
  146|       |    // it is always OP_HASH160 20 [20 byte hash] OP_EQUAL
  147|   225k|    if (scriptPubKey.IsPayToScriptHash())
  ------------------
  |  Branch (147:9): [True: 22.6k, False: 202k]
  ------------------
  148|  22.6k|    {
  149|  22.6k|        std::vector<unsigned char> hashBytes(scriptPubKey.begin()+2, scriptPubKey.begin()+22);
  150|  22.6k|        vSolutionsRet.push_back(hashBytes);
  151|  22.6k|        return TxoutType::SCRIPTHASH;
  152|  22.6k|    }
  153|       |
  154|   202k|    int witnessversion;
  155|   202k|    std::vector<unsigned char> witnessprogram;
  156|   202k|    if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
  ------------------
  |  Branch (156:9): [True: 36.1k, False: 166k]
  ------------------
  157|  36.1k|        if (witnessversion == 0 && witnessprogram.size() == WITNESS_V0_KEYHASH_SIZE) {
  ------------------
  |  Branch (157:13): [True: 21.4k, False: 14.7k]
  |  Branch (157:36): [True: 7.71k, False: 13.7k]
  ------------------
  158|  7.71k|            vSolutionsRet.push_back(std::move(witnessprogram));
  159|  7.71k|            return TxoutType::WITNESS_V0_KEYHASH;
  160|  7.71k|        }
  161|  28.4k|        if (witnessversion == 0 && witnessprogram.size() == WITNESS_V0_SCRIPTHASH_SIZE) {
  ------------------
  |  Branch (161:13): [True: 13.7k, False: 14.7k]
  |  Branch (161:36): [True: 12.8k, False: 845]
  ------------------
  162|  12.8k|            vSolutionsRet.push_back(std::move(witnessprogram));
  163|  12.8k|            return TxoutType::WITNESS_V0_SCRIPTHASH;
  164|  12.8k|        }
  165|  15.6k|        if (witnessversion == 1 && witnessprogram.size() == WITNESS_V1_TAPROOT_SIZE) {
  ------------------
  |  Branch (165:13): [True: 14.0k, False: 1.56k]
  |  Branch (165:36): [True: 12.3k, False: 1.65k]
  ------------------
  166|  12.3k|            vSolutionsRet.push_back(std::move(witnessprogram));
  167|  12.3k|            return TxoutType::WITNESS_V1_TAPROOT;
  168|  12.3k|        }
  169|  3.21k|        if (scriptPubKey.IsPayToAnchor()) {
  ------------------
  |  Branch (169:13): [True: 727, False: 2.48k]
  ------------------
  170|    727|            return TxoutType::ANCHOR;
  171|    727|        }
  172|  2.48k|        if (witnessversion != 0) {
  ------------------
  |  Branch (172:13): [True: 1.64k, False: 845]
  ------------------
  173|  1.64k|            vSolutionsRet.push_back(std::vector<unsigned char>{(unsigned char)witnessversion});
  174|  1.64k|            vSolutionsRet.push_back(std::move(witnessprogram));
  175|  1.64k|            return TxoutType::WITNESS_UNKNOWN;
  176|  1.64k|        }
  177|    845|        return TxoutType::NONSTANDARD;
  178|  2.48k|    }
  179|       |
  180|       |    // Provably prunable, data-carrying output
  181|       |    //
  182|       |    // So long as script passes the IsUnspendable() test and all but the first
  183|       |    // byte passes the IsPushOnly() test we don't care what exactly is in the
  184|       |    // script.
  185|   166k|    if (scriptPubKey.size() >= 1 && scriptPubKey[0] == OP_RETURN && scriptPubKey.IsPushOnly(scriptPubKey.begin()+1)) {
  ------------------
  |  Branch (185:9): [True: 137k, False: 28.6k]
  |  Branch (185:9): [True: 614, False: 165k]
  |  Branch (185:37): [True: 1.90k, False: 135k]
  |  Branch (185:69): [True: 614, False: 1.28k]
  ------------------
  186|    614|        return TxoutType::NULL_DATA;
  187|    614|    }
  188|       |
  189|   165k|    std::vector<unsigned char> data;
  190|   165k|    if (MatchPayToPubkey(scriptPubKey, data)) {
  ------------------
  |  Branch (190:9): [True: 3.99k, False: 161k]
  ------------------
  191|  3.99k|        vSolutionsRet.push_back(std::move(data));
  192|  3.99k|        return TxoutType::PUBKEY;
  193|  3.99k|    }
  194|       |
  195|   161k|    if (MatchPayToPubkeyHash(scriptPubKey, data)) {
  ------------------
  |  Branch (195:9): [True: 62.3k, False: 99.2k]
  ------------------
  196|  62.3k|        vSolutionsRet.push_back(std::move(data));
  197|  62.3k|        return TxoutType::PUBKEYHASH;
  198|  62.3k|    }
  199|       |
  200|  99.2k|    int required;
  201|  99.2k|    std::vector<std::vector<unsigned char>> keys;
  202|  99.2k|    if (MatchMultisig(scriptPubKey, required, keys)) {
  ------------------
  |  Branch (202:9): [True: 299, False: 98.9k]
  ------------------
  203|    299|        vSolutionsRet.push_back({static_cast<unsigned char>(required)}); // safe as required is in range 1..20
  204|    299|        vSolutionsRet.insert(vSolutionsRet.end(), keys.begin(), keys.end());
  205|    299|        vSolutionsRet.push_back({static_cast<unsigned char>(keys.size())}); // safe as size is in range 1..20
  206|    299|        return TxoutType::MULTISIG;
  207|    299|    }
  208|       |
  209|  98.9k|    vSolutionsRet.clear();
  210|  98.9k|    return TxoutType::NONSTANDARD;
  211|  99.2k|}
solver.cpp:_ZL15GetScriptNumber10opcodetypeNSt3__16vectorIhNS0_9allocatorIhEEEEii:
   67|  11.1k|{
   68|  11.1k|    int count;
   69|  11.1k|    if (IsSmallInteger(opcode)) {
  ------------------
  |  Branch (69:9): [True: 5.74k, False: 5.37k]
  ------------------
   70|  5.74k|        count = CScript::DecodeOP_N(opcode);
   71|  5.74k|    } else if (IsPushdataOp(opcode)) {
  ------------------
  |  Branch (71:16): [True: 3.23k, False: 2.13k]
  ------------------
   72|  3.23k|        if (!CheckMinimalPush(data, opcode)) return {};
  ------------------
  |  Branch (72:13): [True: 372, False: 2.86k]
  ------------------
   73|  2.86k|        try {
   74|  2.86k|            count = CScriptNum(data, /* fRequireMinimal = */ true).getint();
   75|  2.86k|        } catch (const scriptnum_error&) {
   76|    686|            return {};
   77|    686|        }
   78|  2.86k|    } else {
   79|  2.13k|        return {};
   80|  2.13k|    }
   81|  7.92k|    if (count < min || count > max) return {};
  ------------------
  |  Branch (81:9): [True: 1.20k, False: 6.71k]
  |  Branch (81:24): [True: 960, False: 5.75k]
  ------------------
   82|  5.75k|    return count;
   83|  7.92k|}
solver.cpp:_ZL14IsSmallInteger10opcodetype:
   60|  11.1k|{
   61|  11.1k|    return opcode >= OP_1 && opcode <= OP_16;
  ------------------
  |  Branch (61:12): [True: 6.75k, False: 4.36k]
  |  Branch (61:30): [True: 5.74k, False: 1.01k]
  ------------------
   62|  11.1k|}
solver.cpp:_ZL16MatchPayToPubkeyRK7CScriptRNSt3__16vectorIhNS2_9allocatorIhEEEE:
   37|   165k|{
   38|   165k|    if (script.size() == CPubKey::SIZE + 2 && script[0] == CPubKey::SIZE && script.back() == OP_CHECKSIG) {
  ------------------
  |  Branch (38:9): [True: 3.55k, False: 162k]
  |  Branch (38:47): [True: 3.33k, False: 220]
  |  Branch (38:77): [True: 2.71k, False: 612]
  ------------------
   39|  2.71k|        pubkey = valtype(script.begin() + 1, script.begin() + CPubKey::SIZE + 1);
   40|  2.71k|        return CPubKey::ValidSize(pubkey);
   41|  2.71k|    }
   42|   162k|    if (script.size() == CPubKey::COMPRESSED_SIZE + 2 && script[0] == CPubKey::COMPRESSED_SIZE && script.back() == OP_CHECKSIG) {
  ------------------
  |  Branch (42:9): [True: 4.14k, False: 158k]
  |  Branch (42:58): [True: 3.57k, False: 573]
  |  Branch (42:99): [True: 2.78k, False: 788]
  ------------------
   43|  2.78k|        pubkey = valtype(script.begin() + 1, script.begin() + CPubKey::COMPRESSED_SIZE + 1);
   44|  2.78k|        return CPubKey::ValidSize(pubkey);
   45|  2.78k|    }
   46|   160k|    return false;
   47|   162k|}
solver.cpp:_ZL20MatchPayToPubkeyHashRK7CScriptRNSt3__16vectorIhNS2_9allocatorIhEEEE:
   50|   161k|{
   51|   161k|    if (script.size() == 25 && script[0] == OP_DUP && script[1] == OP_HASH160 && script[2] == 20 && script[23] == OP_EQUALVERIFY && script[24] == OP_CHECKSIG) {
  ------------------
  |  Branch (51:9): [True: 64.0k, False: 97.6k]
  |  Branch (51:32): [True: 63.1k, False: 824]
  |  Branch (51:55): [True: 62.9k, False: 202]
  |  Branch (51:82): [True: 62.7k, False: 204]
  |  Branch (51:101): [True: 62.5k, False: 198]
  |  Branch (51:133): [True: 62.3k, False: 196]
  ------------------
   52|  62.3k|        pubkeyhash = valtype(script.begin () + 3, script.begin() + 23);
   53|  62.3k|        return true;
   54|  62.3k|    }
   55|  99.2k|    return false;
   56|   161k|}
solver.cpp:_ZL13MatchMultisigRK7CScriptRiRNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEE:
   86|  99.2k|{
   87|  99.2k|    opcodetype opcode;
   88|  99.2k|    valtype data;
   89|       |
   90|  99.2k|    CScript::const_iterator it = script.begin();
   91|  99.2k|    if (script.size() < 1 || script.back() != OP_CHECKMULTISIG) return false;
  ------------------
  |  Branch (91:9): [True: 28.6k, False: 70.6k]
  |  Branch (91:30): [True: 63.6k, False: 6.92k]
  ------------------
   92|       |
   93|  6.92k|    if (!script.GetOp(it, opcode, data)) return false;
  ------------------
  |  Branch (93:9): [True: 202, False: 6.72k]
  ------------------
   94|  6.72k|    auto req_sigs = GetScriptNumber(opcode, data, 1, MAX_PUBKEYS_PER_MULTISIG);
   95|  6.72k|    if (!req_sigs) return false;
  ------------------
  |  Branch (95:9): [True: 2.33k, False: 4.39k]
  ------------------
   96|  4.39k|    required_sigs = *req_sigs;
   97|  8.26k|    while (script.GetOp(it, opcode, data) && CPubKey::ValidSize(data)) {
  ------------------
  |  Branch (97:12): [True: 8.06k, False: 198]
  |  Branch (97:46): [True: 3.87k, False: 4.19k]
  ------------------
   98|  3.87k|        pubkeys.emplace_back(std::move(data));
   99|  3.87k|    }
  100|  4.39k|    auto num_keys = GetScriptNumber(opcode, data, required_sigs, MAX_PUBKEYS_PER_MULTISIG);
  101|  4.39k|    if (!num_keys) return false;
  ------------------
  |  Branch (101:9): [True: 3.02k, False: 1.36k]
  ------------------
  102|  1.36k|    if (pubkeys.size() != static_cast<unsigned long>(*num_keys)) return false;
  ------------------
  |  Branch (102:9): [True: 1.06k, False: 302]
  ------------------
  103|       |
  104|    302|    return (it + 1 == script.end());
  105|  1.36k|}

_Z12IsPushdataOp10opcodetype:
   41|  27.5k|{
   42|  27.5k|    return opcode > OP_FALSE && opcode <= OP_PUSHDATA4;
  ------------------
  |  Branch (42:12): [True: 23.4k, False: 4.02k]
  |  Branch (42:33): [True: 3.72k, False: 19.7k]
  ------------------
   43|  27.5k|}

_ZN19script_verify_flagsC2E23script_verify_flag_name:
   25|  1.71M|    constexpr explicit(false) script_verify_flags(script_verify_flag_name f) : m_value{value_type{1} << static_cast<uint8_t>(f)} { }
_ZN19script_verify_flags8from_intEm:
   35|  1.62M|    static constexpr script_verify_flags from_int(value_type f) { script_verify_flags r; r.m_value = f; return r; }
_Zor19script_verify_flagsS_:
   40|   130k|    friend constexpr script_verify_flags operator|(script_verify_flags a, script_verify_flags b) { return from_int(a.m_value | b.m_value); }
_Zan19script_verify_flagsS_:
   41|  1.49M|    friend constexpr script_verify_flags operator&(script_verify_flags a, script_verify_flags b) { return from_int(a.m_value & b.m_value); }
_ZNK19script_verify_flagscvbEv:
   48|   443k|    constexpr explicit operator bool() const { return m_value != 0; }
_ZNK19script_verify_flagseqES_:
   49|  1.05M|    constexpr bool operator==(script_verify_flags other) const { return m_value == other.m_value; }
_Zor23script_verify_flag_nameS_:
   67|  65.0k|{
   68|  65.0k|    return script_verify_flags{f1} | f2;
   69|  65.0k|}

secp256k1.c:secp256k1_ecdsa_sig_serialize:
  171|  31.9k|static int secp256k1_ecdsa_sig_serialize(unsigned char *sig, size_t *size, const secp256k1_scalar* ar, const secp256k1_scalar* as) {
  172|  31.9k|    unsigned char r[33] = {0}, s[33] = {0};
  173|  31.9k|    unsigned char *rp = r, *sp = s;
  174|  31.9k|    size_t lenR = 33, lenS = 33;
  175|  31.9k|    secp256k1_scalar_get_b32(&r[1], ar);
  176|  31.9k|    secp256k1_scalar_get_b32(&s[1], as);
  177|  64.4k|    while (lenR > 1 && rp[0] == 0 && rp[1] < 0x80) { lenR--; rp++; }
  ------------------
  |  Branch (177:12): [True: 64.4k, False: 0]
  |  Branch (177:24): [True: 32.6k, False: 31.7k]
  |  Branch (177:38): [True: 32.4k, False: 256]
  ------------------
  178|  64.3k|    while (lenS > 1 && sp[0] == 0 && sp[1] < 0x80) { lenS--; sp++; }
  ------------------
  |  Branch (178:12): [True: 64.3k, False: 0]
  |  Branch (178:24): [True: 32.5k, False: 31.7k]
  |  Branch (178:38): [True: 32.3k, False: 249]
  ------------------
  179|  31.9k|    if (*size < 6+lenS+lenR) {
  ------------------
  |  Branch (179:9): [True: 0, False: 31.9k]
  ------------------
  180|      0|        *size = 6 + lenS + lenR;
  181|      0|        return 0;
  182|      0|    }
  183|  31.9k|    *size = 6 + lenS + lenR;
  184|  31.9k|    sig[0] = 0x30;
  185|  31.9k|    sig[1] = 4 + lenS + lenR;
  186|  31.9k|    sig[2] = 0x02;
  187|  31.9k|    sig[3] = lenR;
  188|  31.9k|    memcpy(sig+4, rp, lenR);
  189|  31.9k|    sig[4+lenR] = 0x02;
  190|  31.9k|    sig[5+lenR] = lenS;
  191|  31.9k|    memcpy(sig+lenR+6, sp, lenS);
  192|  31.9k|    return 1;
  193|  31.9k|}
secp256k1.c:secp256k1_ecdsa_sig_verify:
  195|  76.7k|static int secp256k1_ecdsa_sig_verify(const secp256k1_scalar *sigr, const secp256k1_scalar *sigs, const secp256k1_ge *pubkey, const secp256k1_scalar *message) {
  196|  76.7k|    unsigned char c[32];
  197|  76.7k|    secp256k1_scalar sn, u1, u2;
  198|  76.7k|#if !defined(EXHAUSTIVE_TEST_ORDER)
  199|  76.7k|    int range;
  200|  76.7k|    secp256k1_fe xr;
  201|  76.7k|#endif
  202|  76.7k|    secp256k1_gej pubkeyj;
  203|  76.7k|    secp256k1_gej pr;
  204|       |
  205|  76.7k|    if (secp256k1_scalar_is_zero(sigr) || secp256k1_scalar_is_zero(sigs)) {
  ------------------
  |  Branch (205:9): [True: 0, False: 76.7k]
  |  Branch (205:43): [True: 0, False: 76.7k]
  ------------------
  206|      0|        return 0;
  207|      0|    }
  208|       |
  209|  76.7k|    secp256k1_scalar_inverse_var(&sn, sigs);
  210|  76.7k|    secp256k1_scalar_mul(&u1, &sn, message);
  211|  76.7k|    secp256k1_scalar_mul(&u2, &sn, sigr);
  212|  76.7k|    secp256k1_gej_set_ge(&pubkeyj, pubkey);
  213|  76.7k|    secp256k1_ecmult(&pr, &pubkeyj, &u2, &u1);
  214|  76.7k|    if (secp256k1_gej_is_infinity(&pr)) {
  ------------------
  |  Branch (214:9): [True: 0, False: 76.7k]
  ------------------
  215|      0|        return 0;
  216|      0|    }
  217|       |
  218|       |#if defined(EXHAUSTIVE_TEST_ORDER)
  219|       |{
  220|       |    secp256k1_scalar computed_r;
  221|       |    secp256k1_ge pr_ge;
  222|       |    secp256k1_ge_set_gej(&pr_ge, &pr);
  223|       |    secp256k1_fe_normalize(&pr_ge.x);
  224|       |
  225|       |    secp256k1_fe_get_b32(c, &pr_ge.x);
  226|       |    secp256k1_scalar_set_b32(&computed_r, c, NULL);
  227|       |    return secp256k1_scalar_eq(sigr, &computed_r);
  228|       |}
  229|       |#else
  230|       |
  231|       |    /* Interpret sigr as a field element xr  */
  232|  76.7k|    secp256k1_scalar_get_b32(c, sigr);
  233|  76.7k|    range = secp256k1_fe_set_b32_limit(&xr, c);
  ------------------
  |  |   88|  76.7k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  234|       |#ifdef VERIFY
  235|       |    /* We know that c is in range; it comes from a scalar. */
  236|       |    VERIFY_CHECK(range);
  237|       |#else
  238|  76.7k|    (void)range;
  239|  76.7k|#endif
  240|       |
  241|       |    /** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n)
  242|       |     *  in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p),
  243|       |     *  compute the remainder modulo n, and compare it to xr. However:
  244|       |     *
  245|       |     *        xr == X(pr) mod n
  246|       |     *    <=> exists h. (xr + h * n < p && xr + h * n == X(pr))
  247|       |     *    [Since 2 * n > p, h can only be 0 or 1]
  248|       |     *    <=> (xr == X(pr)) || (xr + n < p && xr + n == X(pr))
  249|       |     *    [In Jacobian coordinates, X(pr) is pr.x / pr.z^2 mod p]
  250|       |     *    <=> (xr == pr.x / pr.z^2 mod p) || (xr + n < p && xr + n == pr.x / pr.z^2 mod p)
  251|       |     *    [Multiplying both sides of the equations by pr.z^2 mod p]
  252|       |     *    <=> (xr * pr.z^2 mod p == pr.x) || (xr + n < p && (xr + n) * pr.z^2 mod p == pr.x)
  253|       |     *
  254|       |     *  Thus, we can avoid the inversion, but we have to check both cases separately.
  255|       |     *  secp256k1_gej_eq_x implements the (xr * pr.z^2 mod p == pr.x) test.
  256|       |     */
  257|  76.7k|    if (secp256k1_gej_eq_x_var(&xr, &pr)) {
  ------------------
  |  Branch (257:9): [True: 32.9k, False: 43.7k]
  ------------------
  258|       |        /* xr * pr.z^2 mod p == pr.x, so the signature is valid. */
  259|  32.9k|        return 1;
  260|  32.9k|    }
  261|  43.7k|    if (secp256k1_fe_cmp_var(&xr, &secp256k1_ecdsa_const_p_minus_order) >= 0) {
  ------------------
  |  |   86|  43.7k|#  define secp256k1_fe_cmp_var secp256k1_fe_impl_cmp_var
  ------------------
  |  Branch (261:9): [True: 43.7k, False: 0]
  ------------------
  262|       |        /* xr + n >= p, so we can skip testing the second case. */
  263|  43.7k|        return 0;
  264|  43.7k|    }
  265|      0|    secp256k1_fe_add(&xr, &secp256k1_ecdsa_const_order_as_fe);
  ------------------
  |  |   92|      0|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  266|      0|    if (secp256k1_gej_eq_x_var(&xr, &pr)) {
  ------------------
  |  Branch (266:9): [True: 0, False: 0]
  ------------------
  267|       |        /* (xr + n) * pr.z^2 mod p == pr.x, so the signature is valid. */
  268|      0|        return 1;
  269|      0|    }
  270|      0|    return 0;
  271|      0|#endif
  272|      0|}
secp256k1.c:secp256k1_ecdsa_sig_sign:
  274|  67.0k|static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, secp256k1_scalar *sigr, secp256k1_scalar *sigs, const secp256k1_scalar *seckey, const secp256k1_scalar *message, const secp256k1_scalar *nonce, int *recid) {
  275|  67.0k|    unsigned char b[32];
  276|  67.0k|    secp256k1_ge r;
  277|  67.0k|    secp256k1_scalar n;
  278|  67.0k|    int overflow = 0;
  279|  67.0k|    int high;
  280|       |
  281|  67.0k|    secp256k1_ecmult_gen_ge(ctx, &r, nonce);
  282|  67.0k|    secp256k1_fe_normalize(&r.x);
  ------------------
  |  |   78|  67.0k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  283|  67.0k|    secp256k1_fe_normalize(&r.y);
  ------------------
  |  |   78|  67.0k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  284|  67.0k|    secp256k1_fe_get_b32(b, &r.x);
  ------------------
  |  |   89|  67.0k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
  285|  67.0k|    secp256k1_scalar_set_b32(sigr, b, &overflow);
  286|  67.0k|    if (recid) {
  ------------------
  |  Branch (286:9): [True: 0, False: 67.0k]
  ------------------
  287|       |        /* The overflow condition is cryptographically unreachable as hitting it requires finding the discrete log
  288|       |         * of some P where P.x >= order, and only 1 in about 2^127 points meet this criteria.
  289|       |         */
  290|      0|        *recid = (overflow << 1) | secp256k1_fe_is_odd(&r.y);
  ------------------
  |  |   85|      0|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  291|      0|    }
  292|  67.0k|    secp256k1_scalar_mul(&n, sigr, seckey);
  293|  67.0k|    secp256k1_scalar_add(&n, &n, message);
  294|  67.0k|    secp256k1_scalar_inverse(sigs, nonce);
  295|  67.0k|    secp256k1_scalar_mul(sigs, sigs, &n);
  296|  67.0k|    secp256k1_scalar_clear(&n);
  297|  67.0k|    secp256k1_ge_clear(&r);
  298|  67.0k|    high = secp256k1_scalar_is_high(sigs);
  299|  67.0k|    secp256k1_scalar_cond_negate(sigs, high);
  300|  67.0k|    if (recid) {
  ------------------
  |  Branch (300:9): [True: 0, False: 67.0k]
  ------------------
  301|      0|        *recid ^= high;
  302|      0|    }
  303|       |    /* P.x = order is on the curve, so technically sig->r could end up being zero, which would be an invalid signature.
  304|       |     * This is cryptographically unreachable as hitting it requires finding the discrete log of P.x = N.
  305|       |     */
  306|  67.0k|    return (int)(!secp256k1_scalar_is_zero(sigr)) & (int)(!secp256k1_scalar_is_zero(sigs));
  307|  67.0k|}

secp256k1.c:secp256k1_eckey_pubkey_parse:
   18|  48.9k|static int secp256k1_eckey_pubkey_parse(secp256k1_ge *elem, const unsigned char *pub, size_t size) {
   19|  48.9k|    if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
  ------------------
  |  |  220|  91.1k|#define SECP256K1_TAG_PUBKEY_EVEN 0x02
  ------------------
                  if (size == 33 && (pub[0] == SECP256K1_TAG_PUBKEY_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_ODD)) {
  ------------------
  |  |  221|  30.7k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
  |  Branch (19:9): [True: 45.5k, False: 3.39k]
  |  Branch (19:24): [True: 14.8k, False: 30.7k]
  |  Branch (19:63): [True: 30.7k, False: 0]
  ------------------
   20|  45.5k|        secp256k1_fe x;
   21|  45.5k|        return secp256k1_fe_set_b32_limit(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
  ------------------
  |  |   88|  45.5k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
                      return secp256k1_fe_set_b32_limit(&x, pub+1) && secp256k1_ge_set_xo_var(elem, &x, pub[0] == SECP256K1_TAG_PUBKEY_ODD);
  ------------------
  |  |  221|  44.8k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
  |  Branch (21:16): [True: 44.8k, False: 693]
  |  Branch (21:57): [True: 44.0k, False: 808]
  ------------------
   22|  45.5k|    } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  222|  6.79k|#define SECP256K1_TAG_PUBKEY_UNCOMPRESSED 0x04
  ------------------
                  } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  223|  3.64k|#define SECP256K1_TAG_PUBKEY_HYBRID_EVEN 0x06
  ------------------
                  } else if (size == 65 && (pub[0] == SECP256K1_TAG_PUBKEY_UNCOMPRESSED || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  224|     30|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (22:16): [True: 3.39k, False: 0]
  |  Branch (22:31): [True: 3.14k, False: 252]
  |  Branch (22:78): [True: 222, False: 30]
  |  Branch (22:124): [True: 30, False: 0]
  ------------------
   23|  3.39k|        secp256k1_fe x, y;
   24|  3.39k|        if (!secp256k1_fe_set_b32_limit(&x, pub+1) || !secp256k1_fe_set_b32_limit(&y, pub+33)) {
  ------------------
  |  |   88|  3.39k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
                      if (!secp256k1_fe_set_b32_limit(&x, pub+1) || !secp256k1_fe_set_b32_limit(&y, pub+33)) {
  ------------------
  |  |   88|  3.39k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  |  Branch (24:13): [True: 2, False: 3.39k]
  |  Branch (24:55): [True: 4, False: 3.39k]
  ------------------
   25|      6|            return 0;
   26|      6|        }
   27|  3.39k|        secp256k1_ge_set_xy(elem, &x, &y);
   28|  3.39k|        if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
  ------------------
  |  |  223|  6.78k|#define SECP256K1_TAG_PUBKEY_HYBRID_EVEN 0x06
  ------------------
                      if ((pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_EVEN || pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD) &&
  ------------------
  |  |  224|  3.17k|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (28:14): [True: 218, False: 3.17k]
  |  Branch (28:60): [True: 30, False: 3.14k]
  ------------------
   29|    248|            secp256k1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |   85|    248|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
                          secp256k1_fe_is_odd(&y) != (pub[0] == SECP256K1_TAG_PUBKEY_HYBRID_ODD)) {
  ------------------
  |  |  224|    248|#define SECP256K1_TAG_PUBKEY_HYBRID_ODD 0x07
  ------------------
  |  Branch (29:13): [True: 68, False: 180]
  ------------------
   30|     68|            return 0;
   31|     68|        }
   32|  3.32k|        return secp256k1_ge_is_valid_var(elem);
   33|  3.39k|    } else {
   34|      0|        return 0;
   35|      0|    }
   36|  48.9k|}
secp256k1.c:secp256k1_eckey_pubkey_serialize33:
   38|  30.3k|static void secp256k1_eckey_pubkey_serialize33(secp256k1_ge *elem, unsigned char *pub33) {
   39|  30.3k|    VERIFY_CHECK(!secp256k1_ge_is_infinity(elem));
   40|       |
   41|  30.3k|    secp256k1_fe_normalize_var(&elem->x);
  ------------------
  |  |   80|  30.3k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   42|  30.3k|    secp256k1_fe_normalize_var(&elem->y);
  ------------------
  |  |   80|  30.3k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   43|  30.3k|    pub33[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |   85|  30.3k|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
                  pub33[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |  221|  19.5k|#define SECP256K1_TAG_PUBKEY_ODD 0x03
  ------------------
                  pub33[0] = secp256k1_fe_is_odd(&elem->y) ? SECP256K1_TAG_PUBKEY_ODD : SECP256K1_TAG_PUBKEY_EVEN;
  ------------------
  |  |  220|  41.2k|#define SECP256K1_TAG_PUBKEY_EVEN 0x02
  ------------------
  |  Branch (43:16): [True: 19.5k, False: 10.8k]
  ------------------
   44|  30.3k|    secp256k1_fe_get_b32(&pub33[1], &elem->x);
  ------------------
  |  |   89|  30.3k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   45|  30.3k|}
secp256k1.c:secp256k1_eckey_pubkey_serialize65:
   47|  13.8k|static void secp256k1_eckey_pubkey_serialize65(secp256k1_ge *elem, unsigned char *pub65) {
   48|  13.8k|    VERIFY_CHECK(!secp256k1_ge_is_infinity(elem));
   49|       |
   50|  13.8k|    secp256k1_fe_normalize_var(&elem->x);
  ------------------
  |  |   80|  13.8k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   51|  13.8k|    secp256k1_fe_normalize_var(&elem->y);
  ------------------
  |  |   80|  13.8k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
   52|  13.8k|    pub65[0] = SECP256K1_TAG_PUBKEY_UNCOMPRESSED;
  ------------------
  |  |  222|  13.8k|#define SECP256K1_TAG_PUBKEY_UNCOMPRESSED 0x04
  ------------------
   53|  13.8k|    secp256k1_fe_get_b32(&pub65[1], &elem->x);
  ------------------
  |  |   89|  13.8k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   54|  13.8k|    secp256k1_fe_get_b32(&pub65[33], &elem->y);
  ------------------
  |  |   89|  13.8k|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
   55|  13.8k|}
secp256k1.c:secp256k1_eckey_pubkey_tweak_add:
   62|    387|static int secp256k1_eckey_pubkey_tweak_add(secp256k1_ge *key, const secp256k1_scalar *tweak) {
   63|    387|    secp256k1_gej pt;
   64|    387|    secp256k1_gej_set_ge(&pt, key);
   65|    387|    secp256k1_ecmult(&pt, &pt, &secp256k1_scalar_one, tweak);
   66|       |
   67|    387|    if (secp256k1_gej_is_infinity(&pt)) {
  ------------------
  |  Branch (67:9): [True: 0, False: 387]
  ------------------
   68|      0|        return 0;
   69|      0|    }
   70|    387|    secp256k1_ge_set_gej(key, &pt);
   71|    387|    return 1;
   72|    387|}

secp256k1.c:secp256k1_ecmult_gen_context_clear:
   26|      2|static void secp256k1_ecmult_gen_context_clear(secp256k1_ecmult_gen_context *ctx) {
   27|      2|    ctx->built = 0;
   28|      2|    secp256k1_scalar_clear(&ctx->scalar_offset);
   29|      2|    secp256k1_ge_clear(&ctx->ge_offset);
   30|      2|    secp256k1_fe_clear(&ctx->proj_blind);
   31|      2|}
secp256k1.c:secp256k1_ecmult_gen_context_is_built:
   22|   141k|static int secp256k1_ecmult_gen_context_is_built(const secp256k1_ecmult_gen_context* ctx) {
   23|   141k|    return ctx->built;
   24|   141k|}
secp256k1.c:secp256k1_ecmult_gen_gej:
   54|   141k|static void secp256k1_ecmult_gen_gej(const secp256k1_ecmult_gen_context *ctx, secp256k1_gej *r, const secp256k1_scalar *gn) {
   55|   141k|    uint32_t comb_off;
   56|   141k|    secp256k1_ge add;
   57|   141k|    secp256k1_fe neg;
   58|   141k|    secp256k1_ge_storage adds;
   59|   141k|    secp256k1_scalar d;
   60|       |    /* Array of uint32_t values large enough to store COMB_BITS bits. Only the bottom
   61|       |     * 8 are ever nonzero, but having the zero padding at the end if COMB_BITS>256
   62|       |     * avoids the need to deal with out-of-bounds reads from a scalar. */
   63|   141k|    uint32_t recoded[(COMB_BITS + 31) >> 5] = {0};
   64|   141k|    int first = 1, i;
   65|       |
   66|   141k|    memset(&adds, 0, sizeof(adds));
   67|       |
   68|       |    /* We want to compute R = gn*G.
   69|       |     *
   70|       |     * To blind the scalar used in the computation, we rewrite this to be
   71|       |     * R = (gn - b)*G + b*G, with a blinding value b determined by the context.
   72|       |     *
   73|       |     * The multiplication (gn-b)*G will be performed using a signed-digit multi-comb (see Section
   74|       |     * 3.3 of "Fast and compact elliptic-curve cryptography" by Mike Hamburg,
   75|       |     * https://eprint.iacr.org/2012/309).
   76|       |     *
   77|       |     * Let comb(s, P) = sum((2*s[i]-1)*2^i*P for i=0..COMB_BITS-1), where s[i] is the i'th bit of
   78|       |     * the binary representation of scalar s. So the s[i] values determine whether -2^i*P (s[i]=0)
   79|       |     * or +2^i*P (s[i]=1) are added together. COMB_BITS is at least 256, so all bits of s are
   80|       |     * covered. By manipulating:
   81|       |     *
   82|       |     *     comb(s, P) = sum((2*s[i]-1)*2^i*P for i=0..COMB_BITS-1)
   83|       |     * <=> comb(s, P) = sum((2*s[i]-1)*2^i for i=0..COMB_BITS-1) * P
   84|       |     * <=> comb(s, P) = (2*sum(s[i]*2^i for i=0..COMB_BITS-1) - sum(2^i for i=0..COMB_BITS-1)) * P
   85|       |     * <=> comb(s, P) = (2*s - (2^COMB_BITS - 1)) * P
   86|       |     *
   87|       |     * If we wanted to compute (gn-b)*G as comb(s, G), it would need to hold that
   88|       |     *
   89|       |     *     (gn - b) * G = (2*s - (2^COMB_BITS - 1)) * G
   90|       |     * <=> s = (gn - b + (2^COMB_BITS - 1))/2 (mod order)
   91|       |     *
   92|       |     * We use an alternative here that avoids the modular division by two: instead we compute
   93|       |     * (gn-b)*G as comb(d, G/2). For that to hold it must be the case that
   94|       |     *
   95|       |     *     (gn - b) * G = (2*d - (2^COMB_BITS - 1)) * (G/2)
   96|       |     * <=> d = gn - b + (2^COMB_BITS - 1)/2 (mod order)
   97|       |     *
   98|       |     * Adding precomputation, our final equations become:
   99|       |     *
  100|       |     *     ctx->scalar_offset = (2^COMB_BITS - 1)/2 - b (mod order)
  101|       |     *     ctx->ge_offset = b*G
  102|       |     *     d = gn + ctx->scalar_offset (mod order)
  103|       |     *     R = comb(d, G/2) + ctx->ge_offset
  104|       |     *
  105|       |     * comb(d, G/2) function is then computed by summing + or - 2^(i-1)*G, for i=0..COMB_BITS-1,
  106|       |     * depending on the value of the bits d[i] of the binary representation of scalar d.
  107|       |     */
  108|       |
  109|       |    /* Compute the scalar d = (gn + ctx->scalar_offset). */
  110|   141k|    secp256k1_scalar_add(&d, &ctx->scalar_offset, gn);
  111|       |    /* Convert to recoded array. */
  112|  1.27M|    for (i = 0; i < 8 && i < ((COMB_BITS + 31) >> 5); ++i) {
  ------------------
  |  |   85|  1.13M|#define COMB_BITS (COMB_BLOCKS * COMB_TEETH * COMB_SPACING)
  |  |  ------------------
  |  |  |  |   79|  1.13M|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  |  |  ------------------
  |  |  |  |  |  |  190|  1.13M|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  |  Branch (112:17): [True: 1.13M, False: 141k]
  |  Branch (112:26): [True: 1.13M, False: 0]
  ------------------
  113|  1.13M|        recoded[i] = secp256k1_scalar_get_bits_limb32(&d, 32 * i, 32);
  114|  1.13M|    }
  115|   141k|    secp256k1_scalar_clear(&d);
  116|       |
  117|       |    /* In secp256k1_ecmult_gen_prec_table we have precomputed sums of the
  118|       |     * (2*d[i]-1) * 2^(i-1) * G points, for various combinations of i positions.
  119|       |     * We rewrite our equation in terms of these table entries.
  120|       |     *
  121|       |     * Let mask(b) = sum(2^((b*COMB_TEETH + t)*COMB_SPACING) for t=0..COMB_TEETH-1),
  122|       |     * with b ranging from 0 to COMB_BLOCKS-1. So for example with COMB_BLOCKS=11,
  123|       |     * COMB_TEETH=6, COMB_SPACING=4, we would have:
  124|       |     *   mask(0)  = 2^0   + 2^4   + 2^8   + 2^12  + 2^16  + 2^20,
  125|       |     *   mask(1)  = 2^24  + 2^28  + 2^32  + 2^36  + 2^40  + 2^44,
  126|       |     *   mask(2)  = 2^48  + 2^52  + 2^56  + 2^60  + 2^64  + 2^68,
  127|       |     *   ...
  128|       |     *   mask(10) = 2^240 + 2^244 + 2^248 + 2^252 + 2^256 + 2^260
  129|       |     *
  130|       |     * We will split up the bits d[i] using these masks. Specifically, each mask is
  131|       |     * used COMB_SPACING times, with different shifts:
  132|       |     *
  133|       |     * d = (d & mask(0)<<0) + (d & mask(1)<<0) + ... + (d & mask(COMB_BLOCKS-1)<<0) +
  134|       |     *     (d & mask(0)<<1) + (d & mask(1)<<1) + ... + (d & mask(COMB_BLOCKS-1)<<1) +
  135|       |     *     ...
  136|       |     *     (d & mask(0)<<(COMB_SPACING-1)) + ...
  137|       |     *
  138|       |     * Now define table(b, m) = (m - mask(b)/2) * G, and we will precompute these values for
  139|       |     * b=0..COMB_BLOCKS-1, and for all values m which (d & mask(b)) can take (so m can take on
  140|       |     * 2^COMB_TEETH distinct values).
  141|       |     *
  142|       |     * If m=(d & mask(b)), then table(b, m) is the sum of 2^i * (2*d[i]-1) * G/2, with i
  143|       |     * iterating over the set bits in mask(b). In our example, table(2, 2^48 + 2^56 + 2^68)
  144|       |     * would equal (2^48 - 2^52 + 2^56 - 2^60 - 2^64 + 2^68) * G/2.
  145|       |     *
  146|       |     * With that, we can rewrite comb(d, G/2) as:
  147|       |     *
  148|       |     *     2^0 * (table(0, d>>0 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>0 & mask(COMP_BLOCKS-1)))
  149|       |     *   + 2^1 * (table(0, d>>1 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>1 & mask(COMP_BLOCKS-1)))
  150|       |     *   + 2^2 * (table(0, d>>2 & mask(0)) + ... + table(COMB_BLOCKS-1, d>>2 & mask(COMP_BLOCKS-1)))
  151|       |     *   + ...
  152|       |     *   + 2^(COMB_SPACING-1) * (table(0, d>>(COMB_SPACING-1) & mask(0)) + ...)
  153|       |     *
  154|       |     * Or more generically as
  155|       |     *
  156|       |     *   sum(2^i * sum(table(b, d>>i & mask(b)), b=0..COMB_BLOCKS-1), i=0..COMB_SPACING-1)
  157|       |     *
  158|       |     * This is implemented using an outer loop that runs in reverse order over the lines of this
  159|       |     * equation, which in each iteration runs an inner loop that adds the terms of that line and
  160|       |     * then doubles the result before proceeding to the next line.
  161|       |     *
  162|       |     * In pseudocode:
  163|       |     *   c = infinity
  164|       |     *   for comb_off in range(COMB_SPACING - 1, -1, -1):
  165|       |     *     for block in range(COMB_BLOCKS):
  166|       |     *       c += table(block, (d >> comb_off) & mask(block))
  167|       |     *     if comb_off > 0:
  168|       |     *       c = 2*c
  169|       |     *   return c
  170|       |     *
  171|       |     * This computes c = comb(d, G/2), and thus finally R = c + ctx->ge_offset. Note that it would
  172|       |     * be possible to apply an initial offset instead of a final offset (moving ge_offset to take
  173|       |     * the place of infinity above), but the chosen approach allows using (in a future improvement)
  174|       |     * an incomplete addition formula for most of the multiplication.
  175|       |     *
  176|       |     * The last question is how to implement the table(b, m) function. For any value of b,
  177|       |     * m=(d & mask(b)) can only take on at most 2^COMB_TEETH possible values (the last one may have
  178|       |     * fewer as there mask(b) may exceed the curve order). So we could create COMB_BLOCK tables
  179|       |     * which contain a value for each such m value.
  180|       |     *
  181|       |     * Now note that if m=(d & mask(b)), then flipping the relevant bits of m results in negating
  182|       |     * the result of table(b, m). This is because table(b,m XOR mask(b)) = table(b, mask(b) - m) =
  183|       |     * (mask(b) - m - mask(b)/2)*G = (-m + mask(b)/2)*G = -(m - mask(b)/2)*G = -table(b, m).
  184|       |     * Because of this it suffices to only store the first half of the m values for every b. If an
  185|       |     * entry from the second half is needed, we look up its bit-flipped version instead, and negate
  186|       |     * it.
  187|       |     *
  188|       |     * secp256k1_ecmult_gen_prec_table[b][index] stores the table(b, m) entries. Index
  189|       |     * is the relevant mask(b) bits of m packed together without gaps. */
  190|       |
  191|       |    /* Outer loop: iterate over comb_off from COMB_SPACING - 1 down to 0. */
  192|   141k|    comb_off = COMB_SPACING - 1;
  ------------------
  |  |   79|   141k|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  ------------------
  |  |  |  |  190|   141k|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  ------------------
  ------------------
  193|   141k|    while (1) {
  ------------------
  |  Branch (193:12): [True: 141k, Folded]
  ------------------
  194|   141k|        uint32_t block;
  195|   141k|        uint32_t bit_pos = comb_off;
  196|       |        /* Inner loop: for each block, add table entries to the result. */
  197|  6.23M|        for (block = 0; block < COMB_BLOCKS; ++block) {
  ------------------
  |  Branch (197:25): [True: 6.09M, False: 141k]
  ------------------
  198|       |            /* Gather the mask(block)-selected bits of d into bits. They're packed:
  199|       |             * bits[tooth] = d[(block*COMB_TEETH + tooth)*COMB_SPACING + comb_off]. */
  200|  6.09M|            uint32_t bits = 0, sign, abs, index, tooth;
  201|       |            /* Instead of reading individual bits here to construct the bits variable,
  202|       |             * build up the result by xoring rotated reads together. In every iteration,
  203|       |             * one additional bit is made correct, starting at the bottom. The bits
  204|       |             * above that contain junk. This reduces leakage by avoiding computations
  205|       |             * on variables that can have only a low number of possible values (e.g.,
  206|       |             * just two values when reading a single bit into a variable.) See:
  207|       |             * https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-alam.pdf
  208|       |             */
  209|  42.6M|            for (tooth = 0; tooth < COMB_TEETH; ++tooth) {
  ------------------
  |  Branch (209:29): [True: 36.5M, False: 6.09M]
  ------------------
  210|       |                /* Construct bitdata s.t. the bottom bit is the bit we'd like to read.
  211|       |                 *
  212|       |                 * We could just set bitdata = recoded[bit_pos >> 5] >> (bit_pos & 0x1f)
  213|       |                 * but this would simply discard the bits that fall off at the bottom,
  214|       |                 * and thus, for example, bitdata could still have only two values if we
  215|       |                 * happen to shift by exactly 31 positions. We use a rotation instead,
  216|       |                 * which ensures that bitdata doesn't lose entropy. This relies on the
  217|       |                 * rotation being atomic, i.e., the compiler emitting an actual rot
  218|       |                 * instruction. */
  219|  36.5M|                uint32_t bitdata = secp256k1_rotr32(recoded[bit_pos >> 5], bit_pos & 0x1f);
  220|       |
  221|       |                /* Clear the bit at position tooth, but sssh, don't tell clang. */
  222|  36.5M|                uint32_t volatile vmask = ~(1 << tooth);
  223|  36.5M|                bits &= vmask;
  224|       |
  225|       |                /* Write the bit into position tooth (and junk into higher bits). */
  226|  36.5M|                bits ^= bitdata << tooth;
  227|  36.5M|                bit_pos += COMB_SPACING;
  ------------------
  |  |   79|  36.5M|#define COMB_SPACING CEIL_DIV(COMB_RANGE, COMB_BLOCKS * COMB_TEETH)
  |  |  ------------------
  |  |  |  |  190|  36.5M|#define CEIL_DIV(x, y) (1 + ((x) - 1) / (y))
  |  |  ------------------
  ------------------
  228|  36.5M|            }
  229|       |
  230|       |            /* If the top bit of bits is 1, flip them all (corresponding to looking up
  231|       |             * the negated table value), and remember to negate the result in sign. */
  232|  6.09M|            sign = (bits >> (COMB_TEETH - 1)) & 1;
  233|  6.09M|            abs = (bits ^ -sign) & (COMB_POINTS - 1);
  ------------------
  |  |   87|  6.09M|#define COMB_POINTS (1 << (COMB_TEETH - 1))
  ------------------
  234|  6.09M|            VERIFY_CHECK(sign == 0 || sign == 1);
  235|  6.09M|            VERIFY_CHECK(abs < COMB_POINTS);
  236|       |
  237|       |            /** This uses a conditional move to avoid any secret data in array indexes.
  238|       |             *   _Any_ use of secret indexes has been demonstrated to result in timing
  239|       |             *   sidechannels, even when the cache-line access patterns are uniform.
  240|       |             *  See also:
  241|       |             *   "A word of warning", CHES 2013 Rump Session, by Daniel J. Bernstein and Peter Schwabe
  242|       |             *    (https://cryptojedi.org/peter/data/chesrump-20130822.pdf) and
  243|       |             *   "Cache Attacks and Countermeasures: the Case of AES", RSA 2006,
  244|       |             *    by Dag Arne Osvik, Adi Shamir, and Eran Tromer
  245|       |             *    (https://eprint.iacr.org/2005/271.pdf)
  246|       |             */
  247|   200M|            for (index = 0; index < COMB_POINTS; ++index) {
  ------------------
  |  |   87|   200M|#define COMB_POINTS (1 << (COMB_TEETH - 1))
  ------------------
  |  Branch (247:29): [True: 194M, False: 6.09M]
  ------------------
  248|   194M|                secp256k1_ge_storage_cmov(&adds, &secp256k1_ecmult_gen_prec_table[block][index], index == abs);
  249|   194M|            }
  250|       |
  251|       |            /* Set add=adds or add=-adds, in constant time, based on sign. */
  252|  6.09M|            secp256k1_ge_from_storage(&add, &adds);
  253|  6.09M|            secp256k1_fe_negate(&neg, &add.y, 1);
  ------------------
  |  |  211|  6.09M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  6.09M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  6.09M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 6.09M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  6.09M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 6.09M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  6.09M|    } \
  |  |  |  |   94|  6.09M|    stmt; \
  |  |  |  |   95|  6.09M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 6.09M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  254|  6.09M|            secp256k1_fe_cmov(&add.y, &neg, sign);
  ------------------
  |  |   95|  6.09M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  255|       |
  256|       |            /* Add the looked up and conditionally negated value to r. */
  257|  6.09M|            if (EXPECT(first, 0)) {
  ------------------
  |  |  146|  6.09M|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  ------------------
  |  |  |  Branch (146:21): [True: 141k, False: 5.94M]
  |  |  ------------------
  ------------------
  258|       |                /* If this is the first table lookup, we can skip addition. */
  259|   141k|                secp256k1_gej_set_ge(r, &add);
  260|       |                /* Give the entry a random Z coordinate to blind intermediary results. */
  261|   141k|                secp256k1_gej_rescale(r, &ctx->proj_blind);
  262|   141k|                first = 0;
  263|  5.94M|            } else {
  264|  5.94M|                secp256k1_gej_add_ge(r, r, &add);
  265|  5.94M|            }
  266|  6.09M|        }
  267|       |
  268|       |        /* Double the result, except in the last iteration. */
  269|   141k|        if (comb_off-- == 0) break;
  ------------------
  |  Branch (269:13): [True: 141k, False: 0]
  ------------------
  270|      0|        secp256k1_gej_double(r, r);
  271|      0|    }
  272|       |
  273|       |    /* Correct for the scalar_offset added at the start (ge_offset = b*G, while b was
  274|       |     * subtracted from the input scalar gn). */
  275|   141k|    secp256k1_gej_add_ge(r, r, &ctx->ge_offset);
  276|       |
  277|       |    /* Cleanup. */
  278|   141k|    secp256k1_fe_clear(&neg);
  279|   141k|    secp256k1_ge_clear(&add);
  280|   141k|    secp256k1_memclear_explicit(&adds, sizeof(adds));
  281|   141k|    secp256k1_memclear_explicit(&recoded, sizeof(recoded));
  282|   141k|}
secp256k1.c:secp256k1_ecmult_gen_ge:
  284|   141k|SECP256K1_INLINE static void secp256k1_ecmult_gen_ge(const secp256k1_ecmult_gen_context *ctx, secp256k1_ge *r, const secp256k1_scalar *a) {
  285|   141k|    secp256k1_gej rj;
  286|   141k|    secp256k1_ecmult_gen_gej(ctx, &rj, a);
  287|   141k|    secp256k1_ge_set_gej(r, &rj);
  288|       |    /* Jacobian coordinates resulting from our multiplication algorithm could potentially leak
  289|       |     * information about the secret input scalar, so clear the memory out to be on the safe side. */
  290|   141k|    secp256k1_gej_clear(&rj);
  291|   141k|}

secp256k1.c:secp256k1_ecmult:
  365|  77.3k|static void secp256k1_ecmult(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
  366|  77.3k|    secp256k1_fe aux[ECMULT_TABLE_SIZE(WINDOW_A)];
  367|  77.3k|    secp256k1_ge pre_a[ECMULT_TABLE_SIZE(WINDOW_A)];
  368|  77.3k|    struct secp256k1_strauss_point_state ps[1];
  369|  77.3k|    struct secp256k1_strauss_state state;
  370|       |
  371|  77.3k|    state.aux = aux;
  372|  77.3k|    state.pre_a = pre_a;
  373|  77.3k|    state.ps = ps;
  374|  77.3k|    secp256k1_ecmult_strauss_wnaf(&state, r, 1, a, na, ng);
  375|  77.3k|}
secp256k1.c:secp256k1_ecmult_strauss_wnaf:
  252|  77.3k|static void secp256k1_ecmult_strauss_wnaf(const struct secp256k1_strauss_state *state, secp256k1_gej *r, size_t num, const secp256k1_gej *a, const secp256k1_scalar *na, const secp256k1_scalar *ng) {
  253|  77.3k|    secp256k1_ge tmpa;
  254|  77.3k|    secp256k1_fe Z;
  255|       |    /* Split G factors. */
  256|  77.3k|    secp256k1_scalar ng_1, ng_128;
  257|  77.3k|    int wnaf_ng_1[129];
  258|  77.3k|    int bits_ng_1 = 0;
  259|  77.3k|    int wnaf_ng_128[129];
  260|  77.3k|    int bits_ng_128 = 0;
  261|  77.3k|    int i;
  262|  77.3k|    int bits = 0;
  263|  77.3k|    size_t np;
  264|  77.3k|    size_t no = 0;
  265|       |
  266|  77.3k|    secp256k1_fe_set_int(&Z, 1);
  ------------------
  |  |   83|  77.3k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  267|   154k|    for (np = 0; np < num; ++np) {
  ------------------
  |  Branch (267:18): [True: 77.3k, False: 77.3k]
  ------------------
  268|  77.3k|        secp256k1_gej tmp;
  269|  77.3k|        secp256k1_scalar na_1, na_lam;
  270|  77.3k|        if (secp256k1_scalar_is_zero(&na[np]) || secp256k1_gej_is_infinity(&a[np])) {
  ------------------
  |  Branch (270:13): [True: 0, False: 77.3k]
  |  Branch (270:50): [True: 0, False: 77.3k]
  ------------------
  271|      0|            continue;
  272|      0|        }
  273|       |        /* split na into na_1 and na_lam (where na = na_1 + na_lam*lambda, and na_1 and na_lam are ~128 bit) */
  274|  77.3k|        secp256k1_scalar_split_lambda(&na_1, &na_lam, &na[np]);
  275|       |
  276|       |        /* build wnaf representation for na_1 and na_lam. */
  277|  77.3k|        state->ps[no].bits_na_1   = secp256k1_ecmult_wnaf_small(state->ps[no].wnaf_na_1,   129, &na_1,   WINDOW_A);
  ------------------
  |  |   32|  77.3k|#  define WINDOW_A 5
  ------------------
  278|  77.3k|        state->ps[no].bits_na_lam = secp256k1_ecmult_wnaf_small(state->ps[no].wnaf_na_lam, 129, &na_lam, WINDOW_A);
  ------------------
  |  |   32|  77.3k|#  define WINDOW_A 5
  ------------------
  279|  77.3k|        VERIFY_CHECK(state->ps[no].bits_na_1 <= 129);
  280|  77.3k|        VERIFY_CHECK(state->ps[no].bits_na_lam <= 129);
  281|  77.3k|        if (state->ps[no].bits_na_1 > bits) {
  ------------------
  |  Branch (281:13): [True: 77.3k, False: 0]
  ------------------
  282|  77.3k|            bits = state->ps[no].bits_na_1;
  283|  77.3k|        }
  284|  77.3k|        if (state->ps[no].bits_na_lam > bits) {
  ------------------
  |  Branch (284:13): [True: 29.9k, False: 47.4k]
  ------------------
  285|  29.9k|            bits = state->ps[no].bits_na_lam;
  286|  29.9k|        }
  287|       |
  288|       |        /* Calculate odd multiples of a.
  289|       |         * All multiples are brought to the same Z 'denominator', which is stored
  290|       |         * in Z. Due to secp256k1' isomorphism we can do all operations pretending
  291|       |         * that the Z coordinate was 1, use affine addition formulae, and correct
  292|       |         * the Z coordinate of the result once at the end.
  293|       |         * The exception is the precomputed G table points, which are actually
  294|       |         * affine. Compared to the base used for other points, they have a Z ratio
  295|       |         * of 1/Z, so we can use secp256k1_gej_add_zinv_var, which uses the same
  296|       |         * isomorphism to efficiently add with a known Z inverse.
  297|       |         */
  298|  77.3k|        tmp = a[np];
  299|  77.3k|        if (no) {
  ------------------
  |  Branch (299:13): [True: 0, False: 77.3k]
  ------------------
  300|      0|            secp256k1_gej_rescale(&tmp, &Z);
  301|      0|        }
  302|  77.3k|        secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  77.3k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                      secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  77.3k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                      secp256k1_ecmult_odd_multiples_table(ECMULT_TABLE_SIZE(WINDOW_A), state->pre_a + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &Z, &tmp);
  ------------------
  |  |   41|  77.3k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  303|  77.3k|        if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   93|      0|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                      if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   41|      0|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                      if (no) secp256k1_fe_mul(state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + no * ECMULT_TABLE_SIZE(WINDOW_A), &(a[np].z));
  ------------------
  |  |   41|      0|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  |  Branch (303:13): [True: 0, False: 77.3k]
  ------------------
  304|       |
  305|  77.3k|        ++no;
  306|  77.3k|    }
  307|       |
  308|       |    /* Bring them to the same Z denominator. */
  309|  77.3k|    if (no) {
  ------------------
  |  Branch (309:9): [True: 77.3k, False: 0]
  ------------------
  310|  77.3k|        secp256k1_ge_table_set_globalz(ECMULT_TABLE_SIZE(WINDOW_A) * no, state->pre_a, state->aux);
  ------------------
  |  |   41|  77.3k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  311|  77.3k|    }
  312|       |
  313|   154k|    for (np = 0; np < no; ++np) {
  ------------------
  |  Branch (313:18): [True: 77.3k, False: 77.3k]
  ------------------
  314|  77.3k|        size_t j;
  315|   696k|        for (j = 0; j < ECMULT_TABLE_SIZE(WINDOW_A); j++) {
  ------------------
  |  |   41|   696k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  |  Branch (315:21): [True: 618k, False: 77.3k]
  ------------------
  316|   618k|            secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + j], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + j].x, &secp256k1_const_beta);
  ------------------
  |  |   93|   618k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                          secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + j], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + j].x, &secp256k1_const_beta);
  ------------------
  |  |   41|   618k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                          secp256k1_fe_mul(&state->aux[np * ECMULT_TABLE_SIZE(WINDOW_A) + j], &state->pre_a[np * ECMULT_TABLE_SIZE(WINDOW_A) + j].x, &secp256k1_const_beta);
  ------------------
  |  |   41|   618k|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
  317|   618k|        }
  318|  77.3k|    }
  319|       |
  320|  77.3k|    if (ng) {
  ------------------
  |  Branch (320:9): [True: 77.3k, False: 0]
  ------------------
  321|       |        /* split ng into ng_1 and ng_128 (where gn = gn_1 + gn_128*2^128, and gn_1 and gn_128 are ~128 bit) */
  322|  77.3k|        secp256k1_scalar_split_128(&ng_1, &ng_128, ng);
  323|       |
  324|       |        /* Build wnaf representation for ng_1 and ng_128 */
  325|  77.3k|        bits_ng_1   = secp256k1_ecmult_wnaf(wnaf_ng_1,   129, &ng_1,   WINDOW_G);
  ------------------
  |  |   31|  77.3k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  326|  77.3k|        bits_ng_128 = secp256k1_ecmult_wnaf(wnaf_ng_128, 129, &ng_128, WINDOW_G);
  ------------------
  |  |   31|  77.3k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  327|  77.3k|        if (bits_ng_1 > bits) {
  ------------------
  |  Branch (327:13): [True: 17.8k, False: 59.5k]
  ------------------
  328|  17.8k|            bits = bits_ng_1;
  329|  17.8k|        }
  330|  77.3k|        if (bits_ng_128 > bits) {
  ------------------
  |  Branch (330:13): [True: 14.3k, False: 63.0k]
  ------------------
  331|  14.3k|            bits = bits_ng_128;
  332|  14.3k|        }
  333|  77.3k|    }
  334|       |
  335|  77.3k|    secp256k1_gej_set_infinity(r);
  336|       |
  337|  9.93M|    for (i = bits - 1; i >= 0; i--) {
  ------------------
  |  Branch (337:24): [True: 9.85M, False: 77.3k]
  ------------------
  338|  9.85M|        int n;
  339|  9.85M|        secp256k1_gej_double_var(r, r, NULL);
  340|  19.7M|        for (np = 0; np < no; ++np) {
  ------------------
  |  Branch (340:22): [True: 9.85M, False: 9.85M]
  ------------------
  341|  9.85M|            if (i < state->ps[np].bits_na_1 && (n = state->ps[np].wnaf_na_1[i])) {
  ------------------
  |  Branch (341:17): [True: 9.66M, False: 192k]
  |  Branch (341:48): [True: 1.66M, False: 8.00M]
  ------------------
  342|  1.66M|                secp256k1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|  1.66M|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   32|  1.66M|#  define WINDOW_A 5
  ------------------
  343|  1.66M|                secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
  344|  1.66M|            }
  345|  9.85M|            if (i < state->ps[np].bits_na_lam && (n = state->ps[np].wnaf_na_lam[i])) {
  ------------------
  |  Branch (345:17): [True: 9.64M, False: 216k]
  |  Branch (345:50): [True: 1.65M, False: 7.98M]
  ------------------
  346|  1.65M|                secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|  1.65M|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   41|  1.65M|#define ECMULT_TABLE_SIZE(w) ((size_t)1 << ((w)-2))
  ------------------
                              secp256k1_ecmult_table_get_ge_lambda(&tmpa, state->pre_a + np * ECMULT_TABLE_SIZE(WINDOW_A), state->aux + np * ECMULT_TABLE_SIZE(WINDOW_A), n, WINDOW_A);
  ------------------
  |  |   32|  1.65M|#  define WINDOW_A 5
  ------------------
  347|  1.65M|                secp256k1_gej_add_ge_var(r, r, &tmpa, NULL);
  348|  1.65M|            }
  349|  9.85M|        }
  350|  9.85M|        if (i < bits_ng_1 && (n = wnaf_ng_1[i])) {
  ------------------
  |  Branch (350:13): [True: 9.40M, False: 451k]
  |  Branch (350:30): [True: 655k, False: 8.75M]
  ------------------
  351|   655k|            secp256k1_ecmult_table_get_ge_storage(&tmpa, secp256k1_pre_g, n, WINDOW_G);
  ------------------
  |  |   31|   655k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  352|   655k|            secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);
  353|   655k|        }
  354|  9.85M|        if (i < bits_ng_128 && (n = wnaf_ng_128[i])) {
  ------------------
  |  Branch (354:13): [True: 9.41M, False: 440k]
  |  Branch (354:32): [True: 656k, False: 8.76M]
  ------------------
  355|   656k|            secp256k1_ecmult_table_get_ge_storage(&tmpa, secp256k1_pre_g_128, n, WINDOW_G);
  ------------------
  |  |   31|   656k|#    define WINDOW_G ECMULT_WINDOW_SIZE
  ------------------
  356|   656k|            secp256k1_gej_add_zinv_var(r, r, &tmpa, &Z);
  357|   656k|        }
  358|  9.85M|    }
  359|       |
  360|  77.3k|    if (!secp256k1_gej_is_infinity(r)) {
  ------------------
  |  Branch (360:9): [True: 77.3k, False: 0]
  ------------------
  361|  77.3k|        secp256k1_fe_mul(&r->z, &r->z, &Z);
  ------------------
  |  |   93|  77.3k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  362|  77.3k|    }
  363|  77.3k|}
secp256k1.c:secp256k1_ecmult_wnaf_small:
  224|   154k|static int secp256k1_ecmult_wnaf_small(int8_t *wnaf, int len, const secp256k1_scalar *a, int w) {
  225|   154k|    int wnaf_tmp[256];
  226|   154k|    int ret, i;
  227|       |
  228|   154k|    VERIFY_CHECK(2 <= w && w <= 8);
  229|   154k|    ret = secp256k1_ecmult_wnaf(wnaf_tmp, len, a, w);
  230|       |
  231|  20.1M|    for (i = 0; i < len; i++) {
  ------------------
  |  Branch (231:17): [True: 19.9M, False: 154k]
  ------------------
  232|  19.9M|        wnaf[i] = (int8_t)wnaf_tmp[i];
  233|  19.9M|    }
  234|       |
  235|   154k|    return ret;
  236|   154k|}
secp256k1.c:secp256k1_ecmult_odd_multiples_table:
   73|  77.3k|static void secp256k1_ecmult_odd_multiples_table(size_t n, secp256k1_ge *pre_a, secp256k1_fe *zr, secp256k1_fe *z, const secp256k1_gej *a) {
   74|  77.3k|    secp256k1_gej d, ai;
   75|  77.3k|    secp256k1_ge d_ge;
   76|  77.3k|    size_t i;
   77|       |
   78|  77.3k|    VERIFY_CHECK(!secp256k1_gej_is_infinity(a));
   79|       |
   80|  77.3k|    secp256k1_gej_double_var(&d, a, NULL);
   81|       |
   82|       |    /*
   83|       |     * Perform the additions using an isomorphic curve Y^2 = X^3 + 7*C^6 where C := d.z.
   84|       |     * The isomorphism, phi, maps a secp256k1 point (x, y) to the point (x*C^2, y*C^3) on the other curve.
   85|       |     * In Jacobian coordinates phi maps (x, y, z) to (x*C^2, y*C^3, z) or, equivalently to (x, y, z/C).
   86|       |     *
   87|       |     *     phi(x, y, z) = (x*C^2, y*C^3, z) = (x, y, z/C)
   88|       |     *   d_ge := phi(d) = (d.x, d.y, 1)
   89|       |     *     ai := phi(a) = (a.x*C^2, a.y*C^3, a.z)
   90|       |     *
   91|       |     * The group addition functions work correctly on these isomorphic curves.
   92|       |     * In particular phi(d) is easy to represent in affine coordinates under this isomorphism.
   93|       |     * This lets us use the faster secp256k1_gej_add_ge_var group addition function that we wouldn't be able to use otherwise.
   94|       |     */
   95|  77.3k|    secp256k1_ge_set_xy(&d_ge, &d.x, &d.y);
   96|  77.3k|    secp256k1_ge_set_gej_zinv(&pre_a[0], a, &d.z);
   97|  77.3k|    secp256k1_gej_set_ge(&ai, &pre_a[0]);
   98|  77.3k|    ai.z = a->z;
   99|       |
  100|       |    /* pre_a[0] is the point (a.x*C^2, a.y*C^3, a.z*C) which is equivalent to a.
  101|       |     * Set zr[0] to C, which is the ratio between the omitted z(pre_a[0]) value and a.z.
  102|       |     */
  103|  77.3k|    zr[0] = d.z;
  104|       |
  105|   618k|    for (i = 1; i < n; i++) {
  ------------------
  |  Branch (105:17): [True: 541k, False: 77.3k]
  ------------------
  106|   541k|        secp256k1_gej_add_ge_var(&ai, &ai, &d_ge, &zr[i]);
  107|   541k|        secp256k1_ge_set_xy(&pre_a[i], &ai.x, &ai.y);
  108|   541k|    }
  109|       |
  110|       |    /* Multiply the last z-coordinate by C to undo the isomorphism.
  111|       |     * Since the z-coordinates of the pre_a values are implied by the zr array of z-coordinate ratios,
  112|       |     * undoing the isomorphism here undoes the isomorphism for all pre_a values.
  113|       |     */
  114|  77.3k|    secp256k1_fe_mul(z, &ai.z, &d.z);
  ------------------
  |  |   93|  77.3k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  115|  77.3k|}
secp256k1.c:secp256k1_ecmult_wnaf:
  162|   309k|static int secp256k1_ecmult_wnaf(int *wnaf, int len, const secp256k1_scalar *a, int w) {
  163|   309k|    secp256k1_scalar s;
  164|   309k|    int last_set_bit = -1;
  165|   309k|    int bit = 0;
  166|   309k|    int sign = 1;
  167|   309k|    int carry = 0;
  168|       |
  169|   309k|    VERIFY_CHECK(wnaf != NULL);
  170|   309k|    VERIFY_CHECK(0 <= len && len <= 256);
  171|   309k|    VERIFY_CHECK(a != NULL);
  172|   309k|    VERIFY_CHECK(2 <= w && w <= 31);
  173|       |
  174|  40.2M|    for (bit = 0; bit < len; bit++) {
  ------------------
  |  Branch (174:19): [True: 39.9M, False: 309k]
  ------------------
  175|  39.9M|        wnaf[bit] = 0;
  176|  39.9M|    }
  177|       |
  178|   309k|    s = *a;
  179|   309k|    if (secp256k1_scalar_get_bits_limb32(&s, 255, 1)) {
  ------------------
  |  Branch (179:9): [True: 76.5k, False: 232k]
  ------------------
  180|  76.5k|        secp256k1_scalar_negate(&s, &s);
  181|  76.5k|        sign = -1;
  182|  76.5k|    }
  183|       |
  184|   309k|    bit = 0;
  185|  9.79M|    while (bit < len) {
  ------------------
  |  Branch (185:12): [True: 9.48M, False: 309k]
  ------------------
  186|  9.48M|        int now;
  187|  9.48M|        int word;
  188|  9.48M|        if (secp256k1_scalar_get_bits_limb32(&s, bit, 1) == (unsigned int)carry) {
  ------------------
  |  Branch (188:13): [True: 4.84M, False: 4.63M]
  ------------------
  189|  4.84M|            bit++;
  190|  4.84M|            continue;
  191|  4.84M|        }
  192|       |
  193|  4.63M|        now = w;
  194|  4.63M|        if (now > len - bit) {
  ------------------
  |  Branch (194:13): [True: 203k, False: 4.43M]
  ------------------
  195|   203k|            now = len - bit;
  196|   203k|        }
  197|       |
  198|  4.63M|        word = secp256k1_scalar_get_bits_var(&s, bit, now) + carry;
  199|       |
  200|  4.63M|        carry = (word >> (w-1)) & 1;
  201|  4.63M|        word -= carry << w;
  202|       |
  203|  4.63M|        wnaf[bit] = sign * word;
  204|  4.63M|        last_set_bit = bit;
  205|       |
  206|  4.63M|        bit += now;
  207|  4.63M|    }
  208|       |#ifdef VERIFY
  209|       |    {
  210|       |        int verify_bit = bit;
  211|       |
  212|       |        VERIFY_CHECK(carry == 0);
  213|       |
  214|       |        while (verify_bit < 256) {
  215|       |            VERIFY_CHECK(secp256k1_scalar_get_bits_limb32(&s, verify_bit, 1) == 0);
  216|       |            verify_bit++;
  217|       |        }
  218|       |    }
  219|       |#endif
  220|   309k|    return last_set_bit + 1;
  221|   309k|}
secp256k1.c:secp256k1_ecmult_table_get_ge:
  125|  1.66M|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge(secp256k1_ge *r, const secp256k1_ge *pre, int n, int w) {
  126|  1.66M|    secp256k1_ecmult_table_verify(n,w);
  127|  1.66M|    if (n > 0) {
  ------------------
  |  Branch (127:9): [True: 832k, False: 832k]
  ------------------
  128|   832k|        *r = pre[(n-1)/2];
  129|   832k|    } else {
  130|   832k|        *r = pre[(-n-1)/2];
  131|   832k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   832k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   832k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   832k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 832k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   832k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 832k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   832k|    } \
  |  |  |  |   94|   832k|    stmt; \
  |  |  |  |   95|   832k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 832k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  132|   832k|    }
  133|  1.66M|}
secp256k1.c:secp256k1_ecmult_table_verify:
  117|  4.63M|SECP256K1_INLINE static void secp256k1_ecmult_table_verify(int n, int w) {
  118|  4.63M|    (void)n;
  119|  4.63M|    (void)w;
  120|  4.63M|    VERIFY_CHECK(((n) & 1) == 1);
  121|  4.63M|    VERIFY_CHECK((n) >= -((1 << ((w)-1)) - 1));
  122|  4.63M|    VERIFY_CHECK((n) <=  ((1 << ((w)-1)) - 1));
  123|  4.63M|}
secp256k1.c:secp256k1_ecmult_table_get_ge_lambda:
  135|  1.65M|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge_lambda(secp256k1_ge *r, const secp256k1_ge *pre, const secp256k1_fe *x, int n, int w) {
  136|  1.65M|    secp256k1_ecmult_table_verify(n,w);
  137|  1.65M|    if (n > 0) {
  ------------------
  |  Branch (137:9): [True: 834k, False: 823k]
  ------------------
  138|   834k|        secp256k1_ge_set_xy(r, &x[(n-1)/2], &pre[(n-1)/2].y);
  139|   834k|    } else {
  140|   823k|        secp256k1_ge_set_xy(r, &x[(-n-1)/2], &pre[(-n-1)/2].y);
  141|   823k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   823k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   823k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   823k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 823k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   823k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 823k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   823k|    } \
  |  |  |  |   94|   823k|    stmt; \
  |  |  |  |   95|   823k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 823k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  142|   823k|    }
  143|  1.65M|}
secp256k1.c:secp256k1_ecmult_table_get_ge_storage:
  145|  1.31M|SECP256K1_INLINE static void secp256k1_ecmult_table_get_ge_storage(secp256k1_ge *r, const secp256k1_ge_storage *pre, int n, int w) {
  146|  1.31M|    secp256k1_ecmult_table_verify(n,w);
  147|  1.31M|    if (n > 0) {
  ------------------
  |  Branch (147:9): [True: 725k, False: 587k]
  ------------------
  148|   725k|        secp256k1_ge_from_storage(r, &pre[(n-1)/2]);
  149|   725k|    } else {
  150|   587k|        secp256k1_ge_from_storage(r, &pre[(-n-1)/2]);
  151|   587k|        secp256k1_fe_negate(&(r->y), &(r->y), 1);
  ------------------
  |  |  211|   587k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   587k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   587k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 587k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   587k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 587k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   587k|    } \
  |  |  |  |   94|   587k|    stmt; \
  |  |  |  |   95|   587k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 587k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  152|   587k|    }
  153|  1.31M|}

secp256k1.c:secp256k1_fe_impl_sqr:
  317|  98.0M|SECP256K1_FORCE_INLINE static void secp256k1_fe_impl_sqr(secp256k1_fe *r, const secp256k1_fe *a) {
  318|  98.0M|    secp256k1_fe_sqr_inner(r->n, a->n);
  319|  98.0M|}
secp256k1.c:secp256k1_fe_impl_mul:
  313|   119M|SECP256K1_FORCE_INLINE static void secp256k1_fe_impl_mul(secp256k1_fe *r, const secp256k1_fe *a, const secp256k1_fe * SECP256K1_RESTRICT b) {
  314|   119M|    secp256k1_fe_mul_inner(r->n, a->n, b->n);
  315|   119M|}
secp256k1.c:secp256k1_fe_impl_add_int:
  301|  49.8k|SECP256K1_INLINE static void secp256k1_fe_impl_add_int(secp256k1_fe *r, int a) {
  302|  49.8k|    r->n[0] += a;
  303|  49.8k|}
secp256k1.c:secp256k1_fe_impl_is_zero:
  206|   121k|SECP256K1_INLINE static int secp256k1_fe_impl_is_zero(const secp256k1_fe *a) {
  207|   121k|    const uint64_t *t = a->n;
  208|   121k|    return (t[0] | t[1] | t[2] | t[3] | t[4]) == 0;
  209|   121k|}
secp256k1.c:secp256k1_fe_impl_cmp_var:
  215|  43.7k|static int secp256k1_fe_impl_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b) {
  216|  43.7k|    int i;
  217|  43.7k|    for (i = 4; i >= 0; i--) {
  ------------------
  |  Branch (217:17): [True: 43.7k, False: 0]
  ------------------
  218|  43.7k|        if (a->n[i] > b->n[i]) {
  ------------------
  |  Branch (218:13): [True: 43.7k, False: 0]
  ------------------
  219|  43.7k|            return 1;
  220|  43.7k|        }
  221|      0|        if (a->n[i] < b->n[i]) {
  ------------------
  |  Branch (221:13): [True: 0, False: 0]
  ------------------
  222|      0|            return -1;
  223|      0|        }
  224|      0|    }
  225|      0|    return 0;
  226|  43.7k|}
secp256k1.c:secp256k1_fe_impl_add:
  305|   117M|SECP256K1_INLINE static void secp256k1_fe_impl_add(secp256k1_fe *r, const secp256k1_fe *a) {
  306|   117M|    r->n[0] += a->n[0];
  307|   117M|    r->n[1] += a->n[1];
  308|   117M|    r->n[2] += a->n[2];
  309|   117M|    r->n[3] += a->n[3];
  310|   117M|    r->n[4] += a->n[4];
  311|   117M|}
secp256k1.c:secp256k1_fe_impl_normalize_weak:
   80|  77.3k|static void secp256k1_fe_impl_normalize_weak(secp256k1_fe *r) {
   81|  77.3k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
   82|       |
   83|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
   84|  77.3k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
   85|       |
   86|       |    /* The first pass ensures the magnitude is 1, ... */
   87|  77.3k|    t0 += x * 0x1000003D1ULL;
   88|  77.3k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   89|  77.3k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
   90|  77.3k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
   91|  77.3k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
   92|       |
   93|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
   94|  77.3k|    VERIFY_CHECK(t4 >> 49 == 0);
   95|       |
   96|  77.3k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
   97|  77.3k|}
secp256k1.c:secp256k1_fe_impl_negate_unchecked:
  278|  61.7M|SECP256K1_INLINE static void secp256k1_fe_impl_negate_unchecked(secp256k1_fe *r, const secp256k1_fe *a, int m) {
  279|       |    /* For all legal values of m (0..31), the following properties hold: */
  280|  61.7M|    VERIFY_CHECK(0xFFFFEFFFFFC2FULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
  281|  61.7M|    VERIFY_CHECK(0xFFFFFFFFFFFFFULL * 2 * (m + 1) >= 0xFFFFFFFFFFFFFULL * 2 * m);
  282|  61.7M|    VERIFY_CHECK(0x0FFFFFFFFFFFFULL * 2 * (m + 1) >= 0x0FFFFFFFFFFFFULL * 2 * m);
  283|       |
  284|       |    /* Due to the properties above, the left hand in the subtractions below is never less than
  285|       |     * the right hand. */
  286|  61.7M|    r->n[0] = 0xFFFFEFFFFFC2FULL * 2 * (m + 1) - a->n[0];
  287|  61.7M|    r->n[1] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[1];
  288|  61.7M|    r->n[2] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[2];
  289|  61.7M|    r->n[3] = 0xFFFFFFFFFFFFFULL * 2 * (m + 1) - a->n[3];
  290|  61.7M|    r->n[4] = 0x0FFFFFFFFFFFFULL * 2 * (m + 1) - a->n[4];
  291|  61.7M|}
secp256k1.c:secp256k1_fe_impl_cmov:
  321|  42.6M|SECP256K1_INLINE static void secp256k1_fe_impl_cmov(secp256k1_fe *r, const secp256k1_fe *a, int flag) {
  322|  42.6M|    uint64_t mask0, mask1;
  323|  42.6M|    volatile int vflag = flag;
  324|  42.6M|    VERIFY_CHECK(flag == 0 || flag == 1);
  325|  42.6M|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
  ------------------
  |  |  114|  42.6M|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|  42.6M|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 42.6M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  326|  42.6M|    mask0 = vflag + ~((uint64_t)0);
  327|  42.6M|    mask1 = ~mask0;
  328|  42.6M|    r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
  329|  42.6M|    r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
  330|  42.6M|    r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
  331|  42.6M|    r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
  332|  42.6M|    r->n[4] = (r->n[4] & mask0) | (a->n[4] & mask1);
  333|  42.6M|}
secp256k1.c:secp256k1_fe_impl_normalizes_to_zero:
  137|  12.3M|static int secp256k1_fe_impl_normalizes_to_zero(const secp256k1_fe *r) {
  138|  12.3M|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  139|       |
  140|       |    /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
  141|  12.3M|    uint64_t z0, z1;
  142|       |
  143|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  144|  12.3M|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
  145|       |
  146|       |    /* The first pass ensures the magnitude is 1, ... */
  147|  12.3M|    t0 += x * 0x1000003D1ULL;
  148|  12.3M|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL; z0  = t0; z1  = t0 ^ 0x1000003D0ULL;
  149|  12.3M|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
  150|  12.3M|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
  151|  12.3M|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
  152|  12.3M|                                                z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
  153|       |
  154|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  155|  12.3M|    VERIFY_CHECK(t4 >> 49 == 0);
  156|       |
  157|  12.3M|    return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
  158|  12.3M|}
secp256k1.c:secp256k1_fe_impl_set_int:
  201|  1.05M|SECP256K1_INLINE static void secp256k1_fe_impl_set_int(secp256k1_fe *r, int a) {
  202|  1.05M|    r->n[0] = a;
  203|  1.05M|    r->n[1] = r->n[2] = r->n[3] = r->n[4] = 0;
  204|  1.05M|}
secp256k1.c:secp256k1_fe_impl_mul_int_unchecked:
  293|  22.0M|SECP256K1_INLINE static void secp256k1_fe_impl_mul_int_unchecked(secp256k1_fe *r, int a) {
  294|  22.0M|    r->n[0] *= a;
  295|  22.0M|    r->n[1] *= a;
  296|  22.0M|    r->n[2] *= a;
  297|  22.0M|    r->n[3] *= a;
  298|  22.0M|    r->n[4] *= a;
  299|  22.0M|}
secp256k1.c:secp256k1_fe_impl_half:
  335|  15.9M|static SECP256K1_INLINE void secp256k1_fe_impl_half(secp256k1_fe *r) {
  336|  15.9M|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  337|  15.9M|    uint64_t one = (uint64_t)1;
  338|  15.9M|    uint64_t mask = -(t0 & one) >> 12;
  339|       |
  340|       |    /* Bounds analysis (over the rationals).
  341|       |     *
  342|       |     * Let m = r->magnitude
  343|       |     *     C = 0xFFFFFFFFFFFFFULL * 2
  344|       |     *     D = 0x0FFFFFFFFFFFFULL * 2
  345|       |     *
  346|       |     * Initial bounds: t0..t3 <= C * m
  347|       |     *                     t4 <= D * m
  348|       |     */
  349|       |
  350|  15.9M|    t0 += 0xFFFFEFFFFFC2FULL & mask;
  351|  15.9M|    t1 += mask;
  352|  15.9M|    t2 += mask;
  353|  15.9M|    t3 += mask;
  354|  15.9M|    t4 += mask >> 4;
  355|       |
  356|  15.9M|    VERIFY_CHECK((t0 & one) == 0);
  357|       |
  358|       |    /* t0..t3: added <= C/2
  359|       |     *     t4: added <= D/2
  360|       |     *
  361|       |     * Current bounds: t0..t3 <= C * (m + 1/2)
  362|       |     *                     t4 <= D * (m + 1/2)
  363|       |     */
  364|       |
  365|  15.9M|    r->n[0] = (t0 >> 1) + ((t1 & one) << 51);
  366|  15.9M|    r->n[1] = (t1 >> 1) + ((t2 & one) << 51);
  367|  15.9M|    r->n[2] = (t2 >> 1) + ((t3 & one) << 51);
  368|  15.9M|    r->n[3] = (t3 >> 1) + ((t4 & one) << 51);
  369|  15.9M|    r->n[4] = (t4 >> 1);
  370|       |
  371|       |    /* t0..t3: shifted right and added <= C/4 + 1/2
  372|       |     *     t4: shifted right
  373|       |     *
  374|       |     * Current bounds: t0..t3 <= C * (m/2 + 1/2)
  375|       |     *                     t4 <= D * (m/2 + 1/4)
  376|       |     *
  377|       |     * Therefore the output magnitude (M) has to be set such that:
  378|       |     *     t0..t3: C * M >= C * (m/2 + 1/2)
  379|       |     *         t4: D * M >= D * (m/2 + 1/4)
  380|       |     *
  381|       |     * It suffices for all limbs that, for any input magnitude m:
  382|       |     *     M >= m/2 + 1/2
  383|       |     *
  384|       |     * and since we want the smallest such integer value for M:
  385|       |     *     M == floor(m/2) + 1
  386|       |     */
  387|  15.9M|}
secp256k1.c:secp256k1_fe_impl_inv:
  453|   142k|static void secp256k1_fe_impl_inv(secp256k1_fe *r, const secp256k1_fe *x) {
  454|   142k|    secp256k1_fe tmp = *x;
  455|   142k|    secp256k1_modinv64_signed62 s;
  456|       |
  457|   142k|    secp256k1_fe_normalize(&tmp);
  ------------------
  |  |   78|   142k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  458|   142k|    secp256k1_fe_to_signed62(&s, &tmp);
  459|   142k|    secp256k1_modinv64(&s, &secp256k1_const_modinfo_fe);
  460|   142k|    secp256k1_fe_from_signed62(r, &s);
  461|   142k|}
secp256k1.c:secp256k1_fe_to_signed62:
  437|   142k|static void secp256k1_fe_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_fe *a) {
  438|   142k|    const uint64_t M62 = UINT64_MAX >> 2;
  439|   142k|    const uint64_t a0 = a->n[0], a1 = a->n[1], a2 = a->n[2], a3 = a->n[3], a4 = a->n[4];
  440|       |
  441|   142k|    r->v[0] = (a0       | a1 << 52) & M62;
  442|   142k|    r->v[1] = (a1 >> 10 | a2 << 42) & M62;
  443|   142k|    r->v[2] = (a2 >> 20 | a3 << 32) & M62;
  444|   142k|    r->v[3] = (a3 >> 30 | a4 << 22) & M62;
  445|   142k|    r->v[4] =  a4 >> 40;
  446|   142k|}
secp256k1.c:secp256k1_fe_from_signed62:
  417|   142k|static void secp256k1_fe_from_signed62(secp256k1_fe *r, const secp256k1_modinv64_signed62 *a) {
  418|   142k|    const uint64_t M52 = UINT64_MAX >> 12;
  419|   142k|    const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
  420|       |
  421|       |    /* The output from secp256k1_modinv64{_var} should be normalized to range [0,modulus), and
  422|       |     * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
  423|       |     */
  424|   142k|    VERIFY_CHECK(a0 >> 62 == 0);
  425|   142k|    VERIFY_CHECK(a1 >> 62 == 0);
  426|   142k|    VERIFY_CHECK(a2 >> 62 == 0);
  427|   142k|    VERIFY_CHECK(a3 >> 62 == 0);
  428|   142k|    VERIFY_CHECK(a4 >> 8 == 0);
  429|       |
  430|   142k|    r->n[0] =  a0                   & M52;
  431|   142k|    r->n[1] = (a0 >> 52 | a1 << 10) & M52;
  432|   142k|    r->n[2] = (a1 >> 42 | a2 << 20) & M52;
  433|   142k|    r->n[3] = (a2 >> 32 | a3 << 30) & M52;
  434|   142k|    r->n[4] = (a3 >> 22 | a4 << 40);
  435|   142k|}
secp256k1.c:secp256k1_fe_impl_set_b32_limit:
  265|   131k|static int secp256k1_fe_impl_set_b32_limit(secp256k1_fe *r, const unsigned char *a) {
  266|   131k|    secp256k1_fe_impl_set_b32_mod(r, a);
  267|   131k|    return !((r->n[4] == 0x0FFFFFFFFFFFFULL) & ((r->n[3] & r->n[2] & r->n[1]) == 0xFFFFFFFFFFFFFULL) & (r->n[0] >= 0xFFFFEFFFFFC2FULL));
  268|   131k|}
secp256k1.c:secp256k1_fe_impl_get_b32:
  271|   125k|static void secp256k1_fe_impl_get_b32(unsigned char *r, const secp256k1_fe *a) {
  272|   125k|    secp256k1_write_be64(&r[0], (a->n[4] << 16) | (a->n[3] >> 36));
  273|   125k|    secp256k1_write_be64(&r[8], (a->n[3] << 28) | (a->n[2] >> 24));
  274|   125k|    secp256k1_write_be64(&r[16], (a->n[2] << 40) | (a->n[1] >> 12));
  275|   125k|    secp256k1_write_be64(&r[24], (a->n[1] << 52) | a->n[0]);
  276|   125k|}
secp256k1.c:secp256k1_fe_impl_normalize_var:
   99|   136k|static void secp256k1_fe_impl_normalize_var(secp256k1_fe *r) {
  100|   136k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
  101|       |
  102|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  103|   136k|    uint64_t m;
  104|   136k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
  105|       |
  106|       |    /* The first pass ensures the magnitude is 1, ... */
  107|   136k|    t0 += x * 0x1000003D1ULL;
  108|   136k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
  109|   136k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
  110|   136k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
  111|   136k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
  112|       |
  113|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  114|   136k|    VERIFY_CHECK(t4 >> 49 == 0);
  115|       |
  116|       |    /* At most a single final reduction is needed; check if the value is >= the field characteristic */
  117|   136k|    x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
  118|   136k|        & (t0 >= 0xFFFFEFFFFFC2FULL));
  119|       |
  120|   136k|    if (x) {
  ------------------
  |  Branch (120:9): [True: 2, False: 136k]
  ------------------
  121|      2|        t0 += 0x1000003D1ULL;
  122|      2|        t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
  123|      2|        t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
  124|      2|        t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
  125|      2|        t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
  126|       |
  127|       |        /* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
  128|      2|        VERIFY_CHECK(t4 >> 48 == x);
  129|       |
  130|       |        /* Mask off the possible multiple of 2^256 from the final reduction */
  131|      2|        t4 &= 0x0FFFFFFFFFFFFULL;
  132|      2|    }
  133|       |
  134|   136k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
  135|   136k|}
secp256k1.c:secp256k1_fe_impl_is_odd:
  211|  77.4k|SECP256K1_INLINE static int secp256k1_fe_impl_is_odd(const secp256k1_fe *a) {
  212|  77.4k|    return a->n[0] & 1;
  213|  77.4k|}
secp256k1.c:secp256k1_fe_impl_from_storage:
  409|  15.0M|static SECP256K1_INLINE void secp256k1_fe_impl_from_storage(secp256k1_fe *r, const secp256k1_fe_storage *a) {
  410|  15.0M|    r->n[0] = a->n[0] & 0xFFFFFFFFFFFFFULL;
  411|  15.0M|    r->n[1] = a->n[0] >> 52 | ((a->n[1] << 12) & 0xFFFFFFFFFFFFFULL);
  412|  15.0M|    r->n[2] = a->n[1] >> 40 | ((a->n[2] << 24) & 0xFFFFFFFFFFFFFULL);
  413|  15.0M|    r->n[3] = a->n[2] >> 28 | ((a->n[3] << 36) & 0xFFFFFFFFFFFFFULL);
  414|  15.0M|    r->n[4] = a->n[3] >> 16;
  415|  15.0M|}
secp256k1.c:secp256k1_fe_impl_normalizes_to_zero_var:
  160|  5.10M|static int secp256k1_fe_impl_normalizes_to_zero_var(const secp256k1_fe *r) {
  161|  5.10M|    uint64_t t0, t1, t2, t3, t4;
  162|  5.10M|    uint64_t z0, z1;
  163|  5.10M|    uint64_t x;
  164|       |
  165|  5.10M|    t0 = r->n[0];
  166|  5.10M|    t4 = r->n[4];
  167|       |
  168|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
  169|  5.10M|    x = t4 >> 48;
  170|       |
  171|       |    /* The first pass ensures the magnitude is 1, ... */
  172|  5.10M|    t0 += x * 0x1000003D1ULL;
  173|       |
  174|       |    /* z0 tracks a possible raw value of 0, z1 tracks a possible raw value of P */
  175|  5.10M|    z0 = t0 & 0xFFFFFFFFFFFFFULL;
  176|  5.10M|    z1 = z0 ^ 0x1000003D0ULL;
  177|       |
  178|       |    /* Fast return path should catch the majority of cases */
  179|  5.10M|    if ((z0 != 0ULL) & (z1 != 0xFFFFFFFFFFFFFULL)) {
  ------------------
  |  Branch (179:9): [True: 5.10M, False: 51]
  ------------------
  180|  5.10M|        return 0;
  181|  5.10M|    }
  182|       |
  183|     51|    t1 = r->n[1];
  184|     51|    t2 = r->n[2];
  185|     51|    t3 = r->n[3];
  186|       |
  187|     51|    t4 &= 0x0FFFFFFFFFFFFULL;
  188|       |
  189|     51|    t1 += (t0 >> 52);
  190|     51|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; z0 |= t1; z1 &= t1;
  191|     51|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; z0 |= t2; z1 &= t2;
  192|     51|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; z0 |= t3; z1 &= t3;
  193|     51|                                                z0 |= t4; z1 &= t4 ^ 0xF000000000000ULL;
  194|       |
  195|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
  196|     51|    VERIFY_CHECK(t4 >> 49 == 0);
  197|       |
  198|     51|    return (z0 == 0) | (z1 == 0xFFFFFFFFFFFFFULL);
  199|  5.10M|}
secp256k1.c:secp256k1_fe_impl_inv_var:
  463|    262|static void secp256k1_fe_impl_inv_var(secp256k1_fe *r, const secp256k1_fe *x) {
  464|    262|    secp256k1_fe tmp = *x;
  465|    262|    secp256k1_modinv64_signed62 s;
  466|       |
  467|    262|    secp256k1_fe_normalize_var(&tmp);
  ------------------
  |  |   80|    262|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  468|    262|    secp256k1_fe_to_signed62(&s, &tmp);
  469|    262|    secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_fe);
  470|    262|    secp256k1_fe_from_signed62(r, &s);
  471|    262|}
secp256k1.c:secp256k1_fe_storage_cmov:
  389|   389M|static SECP256K1_INLINE void secp256k1_fe_storage_cmov(secp256k1_fe_storage *r, const secp256k1_fe_storage *a, int flag) {
  390|   389M|    uint64_t mask0, mask1;
  391|   389M|    volatile int vflag = flag;
  392|   389M|    VERIFY_CHECK(flag == 0 || flag == 1);
  393|   389M|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->n, sizeof(r->n));
  ------------------
  |  |  114|   389M|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   389M|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 389M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  394|   389M|    mask0 = vflag + ~((uint64_t)0);
  395|   389M|    mask1 = ~mask0;
  396|   389M|    r->n[0] = (r->n[0] & mask0) | (a->n[0] & mask1);
  397|   389M|    r->n[1] = (r->n[1] & mask0) | (a->n[1] & mask1);
  398|   389M|    r->n[2] = (r->n[2] & mask0) | (a->n[2] & mask1);
  399|   389M|    r->n[3] = (r->n[3] & mask0) | (a->n[3] & mask1);
  400|   389M|}
secp256k1.c:secp256k1_fe_impl_set_b32_mod:
  228|   131k|static void secp256k1_fe_impl_set_b32_mod(secp256k1_fe *r, const unsigned char *a) {
  229|   131k|    r->n[0] = (uint64_t)a[31]
  230|   131k|            | ((uint64_t)a[30] << 8)
  231|   131k|            | ((uint64_t)a[29] << 16)
  232|   131k|            | ((uint64_t)a[28] << 24)
  233|   131k|            | ((uint64_t)a[27] << 32)
  234|   131k|            | ((uint64_t)a[26] << 40)
  235|   131k|            | ((uint64_t)(a[25] & 0xF)  << 48);
  236|   131k|    r->n[1] = (uint64_t)((a[25] >> 4) & 0xF)
  237|   131k|            | ((uint64_t)a[24] << 4)
  238|   131k|            | ((uint64_t)a[23] << 12)
  239|   131k|            | ((uint64_t)a[22] << 20)
  240|   131k|            | ((uint64_t)a[21] << 28)
  241|   131k|            | ((uint64_t)a[20] << 36)
  242|   131k|            | ((uint64_t)a[19] << 44);
  243|   131k|    r->n[2] = (uint64_t)a[18]
  244|   131k|            | ((uint64_t)a[17] << 8)
  245|   131k|            | ((uint64_t)a[16] << 16)
  246|   131k|            | ((uint64_t)a[15] << 24)
  247|   131k|            | ((uint64_t)a[14] << 32)
  248|   131k|            | ((uint64_t)a[13] << 40)
  249|   131k|            | ((uint64_t)(a[12] & 0xF) << 48);
  250|   131k|    r->n[3] = (uint64_t)((a[12] >> 4) & 0xF)
  251|   131k|            | ((uint64_t)a[11] << 4)
  252|   131k|            | ((uint64_t)a[10] << 12)
  253|   131k|            | ((uint64_t)a[9]  << 20)
  254|   131k|            | ((uint64_t)a[8]  << 28)
  255|   131k|            | ((uint64_t)a[7]  << 36)
  256|   131k|            | ((uint64_t)a[6]  << 44);
  257|   131k|    r->n[4] = (uint64_t)a[5]
  258|   131k|            | ((uint64_t)a[4] << 8)
  259|   131k|            | ((uint64_t)a[3] << 16)
  260|   131k|            | ((uint64_t)a[2] << 24)
  261|   131k|            | ((uint64_t)a[1] << 32)
  262|   131k|            | ((uint64_t)a[0] << 40);
  263|   131k|}
secp256k1.c:secp256k1_fe_impl_normalize:
   43|   520k|static void secp256k1_fe_impl_normalize(secp256k1_fe *r) {
   44|   520k|    uint64_t t0 = r->n[0], t1 = r->n[1], t2 = r->n[2], t3 = r->n[3], t4 = r->n[4];
   45|       |
   46|       |    /* Reduce t4 at the start so there will be at most a single carry from the first pass */
   47|   520k|    uint64_t m;
   48|   520k|    uint64_t x = t4 >> 48; t4 &= 0x0FFFFFFFFFFFFULL;
   49|       |
   50|       |    /* The first pass ensures the magnitude is 1, ... */
   51|   520k|    t0 += x * 0x1000003D1ULL;
   52|   520k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   53|   520k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL; m = t1;
   54|   520k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL; m &= t2;
   55|   520k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL; m &= t3;
   56|       |
   57|       |    /* ... except for a possible carry at bit 48 of t4 (i.e. bit 256 of the field element) */
   58|   520k|    VERIFY_CHECK(t4 >> 49 == 0);
   59|       |
   60|       |    /* At most a single final reduction is needed; check if the value is >= the field characteristic */
   61|   520k|    x = (t4 >> 48) | ((t4 == 0x0FFFFFFFFFFFFULL) & (m == 0xFFFFFFFFFFFFFULL)
   62|   520k|        & (t0 >= 0xFFFFEFFFFFC2FULL));
   63|       |
   64|       |    /* Apply the final reduction (for constant-time behaviour, we do it always) */
   65|   520k|    t0 += x * 0x1000003D1ULL;
   66|   520k|    t1 += (t0 >> 52); t0 &= 0xFFFFFFFFFFFFFULL;
   67|   520k|    t2 += (t1 >> 52); t1 &= 0xFFFFFFFFFFFFFULL;
   68|   520k|    t3 += (t2 >> 52); t2 &= 0xFFFFFFFFFFFFFULL;
   69|   520k|    t4 += (t3 >> 52); t3 &= 0xFFFFFFFFFFFFFULL;
   70|       |
   71|       |    /* If t4 didn't carry to bit 48 already, then it should have after any final reduction */
   72|   520k|    VERIFY_CHECK(t4 >> 48 == x);
   73|       |
   74|       |    /* Mask off the possible multiple of 2^256 from the final reduction */
   75|   520k|    t4 &= 0x0FFFFFFFFFFFFULL;
   76|       |
   77|   520k|    r->n[0] = t0; r->n[1] = t1; r->n[2] = t2; r->n[3] = t3; r->n[4] = t4;
   78|   520k|}
secp256k1.c:secp256k1_fe_impl_to_storage:
  402|   244k|static void secp256k1_fe_impl_to_storage(secp256k1_fe_storage *r, const secp256k1_fe *a) {
  403|   244k|    r->n[0] = a->n[0] | a->n[1] << 52;
  404|   244k|    r->n[1] = a->n[1] >> 12 | a->n[2] << 40;
  405|   244k|    r->n[2] = a->n[2] >> 24 | a->n[3] << 28;
  406|   244k|    r->n[3] = a->n[3] >> 36 | a->n[4] << 16;
  407|   244k|}

secp256k1.c:secp256k1_fe_sqr_inner:
  154|  98.0M|SECP256K1_FORCE_INLINE static void secp256k1_fe_sqr_inner(uint64_t *r, const uint64_t *a) {
  155|  98.0M|    secp256k1_uint128 c, d;
  156|  98.0M|    uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
  157|  98.0M|    uint64_t t3, t4, tx, u0;
  158|  98.0M|    const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
  159|       |
  160|  98.0M|    VERIFY_BITS(a[0], 56);
  161|  98.0M|    VERIFY_BITS(a[1], 56);
  162|  98.0M|    VERIFY_BITS(a[2], 56);
  163|  98.0M|    VERIFY_BITS(a[3], 56);
  164|  98.0M|    VERIFY_BITS(a[4], 52);
  165|       |
  166|       |    /**  [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
  167|       |     *  px is a shorthand for sum(a[i]*a[x-i], i=0..x).
  168|       |     *  Note that [x 0 0 0 0 0] = [x*R].
  169|       |     */
  170|       |
  171|  98.0M|    secp256k1_u128_mul(&d, a0*2, a3);
  172|  98.0M|    secp256k1_u128_accum_mul(&d, a1*2, a2);
  173|  98.0M|    VERIFY_BITS_128(&d, 114);
  174|       |    /* [d 0 0 0] = [p3 0 0 0] */
  175|  98.0M|    secp256k1_u128_mul(&c, a4, a4);
  176|  98.0M|    VERIFY_BITS_128(&c, 112);
  177|       |    /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  178|  98.0M|    secp256k1_u128_accum_mul(&d, R, secp256k1_u128_to_u64(&c)); secp256k1_u128_rshift(&c, 64);
  179|  98.0M|    VERIFY_BITS_128(&d, 115);
  180|  98.0M|    VERIFY_BITS_128(&c, 48);
  181|       |    /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  182|  98.0M|    t3 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  183|  98.0M|    VERIFY_BITS(t3, 52);
  184|  98.0M|    VERIFY_BITS_128(&d, 63);
  185|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
  186|       |
  187|  98.0M|    a4 *= 2;
  188|  98.0M|    secp256k1_u128_accum_mul(&d, a0, a4);
  189|  98.0M|    secp256k1_u128_accum_mul(&d, a1*2, a3);
  190|  98.0M|    secp256k1_u128_accum_mul(&d, a2, a2);
  191|  98.0M|    VERIFY_BITS_128(&d, 115);
  192|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  193|  98.0M|    secp256k1_u128_accum_mul(&d, R << 12, secp256k1_u128_to_u64(&c));
  194|  98.0M|    VERIFY_BITS_128(&d, 116);
  195|       |    /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  196|  98.0M|    t4 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  197|  98.0M|    VERIFY_BITS(t4, 52);
  198|  98.0M|    VERIFY_BITS_128(&d, 64);
  199|       |    /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  200|  98.0M|    tx = (t4 >> 48); t4 &= (M >> 4);
  201|  98.0M|    VERIFY_BITS(tx, 4);
  202|  98.0M|    VERIFY_BITS(t4, 48);
  203|       |    /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
  204|       |
  205|  98.0M|    secp256k1_u128_mul(&c, a0, a0);
  206|  98.0M|    VERIFY_BITS_128(&c, 112);
  207|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
  208|  98.0M|    secp256k1_u128_accum_mul(&d, a1, a4);
  209|  98.0M|    secp256k1_u128_accum_mul(&d, a2*2, a3);
  210|  98.0M|    VERIFY_BITS_128(&d, 114);
  211|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  212|  98.0M|    u0 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
  213|  98.0M|    VERIFY_BITS(u0, 52);
  214|  98.0M|    VERIFY_BITS_128(&d, 62);
  215|       |    /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  216|       |    /* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  217|  98.0M|    u0 = (u0 << 4) | tx;
  218|  98.0M|    VERIFY_BITS(u0, 56);
  219|       |    /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  220|  98.0M|    secp256k1_u128_accum_mul(&c, u0, R >> 4);
  221|  98.0M|    VERIFY_BITS_128(&c, 113);
  222|       |    /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  223|  98.0M|    r[0] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  224|  98.0M|    VERIFY_BITS(r[0], 52);
  225|  98.0M|    VERIFY_BITS_128(&c, 61);
  226|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
  227|       |
  228|  98.0M|    a0 *= 2;
  229|  98.0M|    secp256k1_u128_accum_mul(&c, a0, a1);
  230|  98.0M|    VERIFY_BITS_128(&c, 114);
  231|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
  232|  98.0M|    secp256k1_u128_accum_mul(&d, a2, a4);
  233|  98.0M|    secp256k1_u128_accum_mul(&d, a3, a3);
  234|  98.0M|    VERIFY_BITS_128(&d, 114);
  235|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  236|  98.0M|    secp256k1_u128_accum_mul(&c, secp256k1_u128_to_u64(&d) & M, R); secp256k1_u128_rshift(&d, 52);
  237|  98.0M|    VERIFY_BITS_128(&c, 115);
  238|  98.0M|    VERIFY_BITS_128(&d, 62);
  239|       |    /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  240|  98.0M|    r[1] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  241|  98.0M|    VERIFY_BITS(r[1], 52);
  242|  98.0M|    VERIFY_BITS_128(&c, 63);
  243|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  244|       |
  245|  98.0M|    secp256k1_u128_accum_mul(&c, a0, a2);
  246|  98.0M|    secp256k1_u128_accum_mul(&c, a1, a1);
  247|  98.0M|    VERIFY_BITS_128(&c, 114);
  248|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
  249|  98.0M|    secp256k1_u128_accum_mul(&d, a3, a4);
  250|  98.0M|    VERIFY_BITS_128(&d, 114);
  251|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  252|  98.0M|    secp256k1_u128_accum_mul(&c, R, secp256k1_u128_to_u64(&d)); secp256k1_u128_rshift(&d, 64);
  253|  98.0M|    VERIFY_BITS_128(&c, 115);
  254|  98.0M|    VERIFY_BITS_128(&d, 50);
  255|       |    /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  256|  98.0M|    r[2] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  257|  98.0M|    VERIFY_BITS(r[2], 52);
  258|  98.0M|    VERIFY_BITS_128(&c, 63);
  259|       |    /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  260|       |
  261|  98.0M|    secp256k1_u128_accum_mul(&c, R << 12, secp256k1_u128_to_u64(&d));
  262|  98.0M|    secp256k1_u128_accum_u64(&c, t3);
  263|  98.0M|    VERIFY_BITS_128(&c, 100);
  264|       |    /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  265|  98.0M|    r[3] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  266|  98.0M|    VERIFY_BITS(r[3], 52);
  267|  98.0M|    VERIFY_BITS_128(&c, 48);
  268|       |    /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  269|  98.0M|    r[4] = secp256k1_u128_to_u64(&c) + t4;
  270|  98.0M|    VERIFY_BITS(r[4], 49);
  271|       |    /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  272|  98.0M|}
secp256k1.c:secp256k1_fe_mul_inner:
   18|   119M|SECP256K1_FORCE_INLINE static void secp256k1_fe_mul_inner(uint64_t *r, const uint64_t *a, const uint64_t * SECP256K1_RESTRICT b) {
   19|   119M|    secp256k1_uint128 c, d;
   20|   119M|    uint64_t t3, t4, tx, u0;
   21|   119M|    uint64_t a0 = a[0], a1 = a[1], a2 = a[2], a3 = a[3], a4 = a[4];
   22|   119M|    const uint64_t M = 0xFFFFFFFFFFFFFULL, R = 0x1000003D10ULL;
   23|       |
   24|   119M|    VERIFY_BITS(a[0], 56);
   25|   119M|    VERIFY_BITS(a[1], 56);
   26|   119M|    VERIFY_BITS(a[2], 56);
   27|   119M|    VERIFY_BITS(a[3], 56);
   28|   119M|    VERIFY_BITS(a[4], 52);
   29|   119M|    VERIFY_BITS(b[0], 56);
   30|   119M|    VERIFY_BITS(b[1], 56);
   31|   119M|    VERIFY_BITS(b[2], 56);
   32|   119M|    VERIFY_BITS(b[3], 56);
   33|   119M|    VERIFY_BITS(b[4], 52);
   34|   119M|    VERIFY_CHECK(r != b);
   35|   119M|    VERIFY_CHECK(a != b);
   36|       |
   37|       |    /*  [... a b c] is a shorthand for ... + a<<104 + b<<52 + c<<0 mod n.
   38|       |     *  for 0 <= x <= 4, px is a shorthand for sum(a[i]*b[x-i], i=0..x).
   39|       |     *  for 4 <= x <= 8, px is a shorthand for sum(a[i]*b[x-i], i=(x-4)..4)
   40|       |     *  Note that [x 0 0 0 0 0] = [x*R].
   41|       |     */
   42|       |
   43|   119M|    secp256k1_u128_mul(&d, a0, b[3]);
   44|   119M|    secp256k1_u128_accum_mul(&d, a1, b[2]);
   45|   119M|    secp256k1_u128_accum_mul(&d, a2, b[1]);
   46|   119M|    secp256k1_u128_accum_mul(&d, a3, b[0]);
   47|   119M|    VERIFY_BITS_128(&d, 114);
   48|       |    /* [d 0 0 0] = [p3 0 0 0] */
   49|   119M|    secp256k1_u128_mul(&c, a4, b[4]);
   50|   119M|    VERIFY_BITS_128(&c, 112);
   51|       |    /* [c 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   52|   119M|    secp256k1_u128_accum_mul(&d, R, secp256k1_u128_to_u64(&c)); secp256k1_u128_rshift(&c, 64);
   53|   119M|    VERIFY_BITS_128(&d, 115);
   54|   119M|    VERIFY_BITS_128(&c, 48);
   55|       |    /* [(c<<12) 0 0 0 0 0 d 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   56|   119M|    t3 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   57|   119M|    VERIFY_BITS(t3, 52);
   58|   119M|    VERIFY_BITS_128(&d, 63);
   59|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 0 p3 0 0 0] */
   60|       |
   61|   119M|    secp256k1_u128_accum_mul(&d, a0, b[4]);
   62|   119M|    secp256k1_u128_accum_mul(&d, a1, b[3]);
   63|   119M|    secp256k1_u128_accum_mul(&d, a2, b[2]);
   64|   119M|    secp256k1_u128_accum_mul(&d, a3, b[1]);
   65|   119M|    secp256k1_u128_accum_mul(&d, a4, b[0]);
   66|   119M|    VERIFY_BITS_128(&d, 115);
   67|       |    /* [(c<<12) 0 0 0 0 d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   68|   119M|    secp256k1_u128_accum_mul(&d, R << 12, secp256k1_u128_to_u64(&c));
   69|   119M|    VERIFY_BITS_128(&d, 116);
   70|       |    /* [d t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   71|   119M|    t4 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   72|   119M|    VERIFY_BITS(t4, 52);
   73|   119M|    VERIFY_BITS_128(&d, 64);
   74|       |    /* [d t4 t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   75|   119M|    tx = (t4 >> 48); t4 &= (M >> 4);
   76|   119M|    VERIFY_BITS(tx, 4);
   77|   119M|    VERIFY_BITS(t4, 48);
   78|       |    /* [d t4+(tx<<48) t3 0 0 0] = [p8 0 0 0 p4 p3 0 0 0] */
   79|       |
   80|   119M|    secp256k1_u128_mul(&c, a0, b[0]);
   81|   119M|    VERIFY_BITS_128(&c, 112);
   82|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 0 p4 p3 0 0 p0] */
   83|   119M|    secp256k1_u128_accum_mul(&d, a1, b[4]);
   84|   119M|    secp256k1_u128_accum_mul(&d, a2, b[3]);
   85|   119M|    secp256k1_u128_accum_mul(&d, a3, b[2]);
   86|   119M|    secp256k1_u128_accum_mul(&d, a4, b[1]);
   87|   119M|    VERIFY_BITS_128(&d, 114);
   88|       |    /* [d t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   89|   119M|    u0 = secp256k1_u128_to_u64(&d) & M; secp256k1_u128_rshift(&d, 52);
   90|   119M|    VERIFY_BITS(u0, 52);
   91|   119M|    VERIFY_BITS_128(&d, 62);
   92|       |    /* [d u0 t4+(tx<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   93|       |    /* [d 0 t4+(tx<<48)+(u0<<52) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   94|   119M|    u0 = (u0 << 4) | tx;
   95|   119M|    VERIFY_BITS(u0, 56);
   96|       |    /* [d 0 t4+(u0<<48) t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
   97|   119M|    secp256k1_u128_accum_mul(&c, u0, R >> 4);
   98|   119M|    VERIFY_BITS_128(&c, 113);
   99|       |    /* [d 0 t4 t3 0 0 c] = [p8 0 0 p5 p4 p3 0 0 p0] */
  100|   119M|    r[0] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  101|   119M|    VERIFY_BITS(r[0], 52);
  102|   119M|    VERIFY_BITS_128(&c, 61);
  103|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 0 p0] */
  104|       |
  105|   119M|    secp256k1_u128_accum_mul(&c, a0, b[1]);
  106|   119M|    secp256k1_u128_accum_mul(&c, a1, b[0]);
  107|   119M|    VERIFY_BITS_128(&c, 114);
  108|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 0 p5 p4 p3 0 p1 p0] */
  109|   119M|    secp256k1_u128_accum_mul(&d, a2, b[4]);
  110|   119M|    secp256k1_u128_accum_mul(&d, a3, b[3]);
  111|   119M|    secp256k1_u128_accum_mul(&d, a4, b[2]);
  112|   119M|    VERIFY_BITS_128(&d, 114);
  113|       |    /* [d 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  114|   119M|    secp256k1_u128_accum_mul(&c, secp256k1_u128_to_u64(&d) & M, R); secp256k1_u128_rshift(&d, 52);
  115|   119M|    VERIFY_BITS_128(&c, 115);
  116|   119M|    VERIFY_BITS_128(&d, 62);
  117|       |    /* [d 0 0 t4 t3 0 c r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  118|   119M|    r[1] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  119|   119M|    VERIFY_BITS(r[1], 52);
  120|   119M|    VERIFY_BITS_128(&c, 63);
  121|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 0 p1 p0] */
  122|       |
  123|   119M|    secp256k1_u128_accum_mul(&c, a0, b[2]);
  124|   119M|    secp256k1_u128_accum_mul(&c, a1, b[1]);
  125|   119M|    secp256k1_u128_accum_mul(&c, a2, b[0]);
  126|   119M|    VERIFY_BITS_128(&c, 114);
  127|       |    /* [d 0 0 t4 t3 c r1 r0] = [p8 0 p6 p5 p4 p3 p2 p1 p0] */
  128|   119M|    secp256k1_u128_accum_mul(&d, a3, b[4]);
  129|   119M|    secp256k1_u128_accum_mul(&d, a4, b[3]);
  130|   119M|    VERIFY_BITS_128(&d, 114);
  131|       |    /* [d 0 0 t4 t3 c t1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  132|   119M|    secp256k1_u128_accum_mul(&c, R, secp256k1_u128_to_u64(&d)); secp256k1_u128_rshift(&d, 64);
  133|   119M|    VERIFY_BITS_128(&c, 115);
  134|   119M|    VERIFY_BITS_128(&d, 50);
  135|       |    /* [(d<<12) 0 0 0 t4 t3 c r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  136|       |
  137|   119M|    r[2] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  138|   119M|    VERIFY_BITS(r[2], 52);
  139|   119M|    VERIFY_BITS_128(&c, 63);
  140|       |    /* [(d<<12) 0 0 0 t4 t3+c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  141|   119M|    secp256k1_u128_accum_mul(&c, R << 12, secp256k1_u128_to_u64(&d));
  142|   119M|    secp256k1_u128_accum_u64(&c, t3);
  143|   119M|    VERIFY_BITS_128(&c, 100);
  144|       |    /* [t4 c r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  145|   119M|    r[3] = secp256k1_u128_to_u64(&c) & M; secp256k1_u128_rshift(&c, 52);
  146|   119M|    VERIFY_BITS(r[3], 52);
  147|   119M|    VERIFY_BITS_128(&c, 48);
  148|       |    /* [t4+c r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  149|   119M|    r[4] = secp256k1_u128_to_u64(&c) + t4;
  150|   119M|    VERIFY_BITS(r[4], 49);
  151|       |    /* [r4 r3 r2 r1 r0] = [p8 p7 p6 p5 p4 p3 p2 p1 p0] */
  152|   119M|}

secp256k1.c:secp256k1_fe_verify:
  149|   243M|static void secp256k1_fe_verify(const secp256k1_fe *a) { (void)a; }
secp256k1.c:secp256k1_fe_verify_magnitude:
  150|   236M|static void secp256k1_fe_verify_magnitude(const secp256k1_fe *a, int m) { (void)a; (void)m; }
secp256k1.c:secp256k1_fe_sqrt:
   37|  46.5k|static int secp256k1_fe_sqrt(secp256k1_fe * SECP256K1_RESTRICT r, const secp256k1_fe * SECP256K1_RESTRICT a) {
   38|       |    /** Given that p is congruent to 3 mod 4, we can compute the square root of
   39|       |     *  a mod p as the (p+1)/4'th power of a.
   40|       |     *
   41|       |     *  As (p+1)/4 is an even number, it will have the same result for a and for
   42|       |     *  (-a). Only one of these two numbers actually has a square root however,
   43|       |     *  so we test at the end by squaring and comparing to the input.
   44|       |     *  Also because (p+1)/4 is an even number, the computed square root is
   45|       |     *  itself always a square (a ** ((p+1)/4) is the square of a ** ((p+1)/8)).
   46|       |     */
   47|  46.5k|    secp256k1_fe x2, x3, x6, x9, x11, x22, x44, x88, x176, x220, x223, t1;
   48|  46.5k|    int j, ret;
   49|       |
   50|  46.5k|    VERIFY_CHECK(r != a);
   51|  46.5k|    SECP256K1_FE_VERIFY(a);
  ------------------
  |  |  345|  46.5k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   52|  46.5k|    SECP256K1_FE_VERIFY_MAGNITUDE(a, 8);
  ------------------
  |  |  349|  46.5k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   53|       |
   54|       |    /** The binary representation of (p + 1)/4 has 3 blocks of 1s, with lengths in
   55|       |     *  { 2, 22, 223 }. Use an addition chain to calculate 2^n - 1 for each block:
   56|       |     *  1, [2], 3, 6, 9, 11, [22], 44, 88, 176, 220, [223]
   57|       |     */
   58|       |
   59|  46.5k|    secp256k1_fe_sqr(&x2, a);
  ------------------
  |  |   94|  46.5k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   60|  46.5k|    secp256k1_fe_mul(&x2, &x2, a);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   61|       |
   62|  46.5k|    secp256k1_fe_sqr(&x3, &x2);
  ------------------
  |  |   94|  46.5k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   63|  46.5k|    secp256k1_fe_mul(&x3, &x3, a);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   64|       |
   65|  46.5k|    x6 = x3;
   66|   186k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (66:15): [True: 139k, False: 46.5k]
  ------------------
   67|   139k|        secp256k1_fe_sqr(&x6, &x6);
  ------------------
  |  |   94|   139k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   68|   139k|    }
   69|  46.5k|    secp256k1_fe_mul(&x6, &x6, &x3);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   70|       |
   71|  46.5k|    x9 = x6;
   72|   186k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (72:15): [True: 139k, False: 46.5k]
  ------------------
   73|   139k|        secp256k1_fe_sqr(&x9, &x9);
  ------------------
  |  |   94|   139k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   74|   139k|    }
   75|  46.5k|    secp256k1_fe_mul(&x9, &x9, &x3);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   76|       |
   77|  46.5k|    x11 = x9;
   78|   139k|    for (j=0; j<2; j++) {
  ------------------
  |  Branch (78:15): [True: 93.1k, False: 46.5k]
  ------------------
   79|  93.1k|        secp256k1_fe_sqr(&x11, &x11);
  ------------------
  |  |   94|  93.1k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   80|  93.1k|    }
   81|  46.5k|    secp256k1_fe_mul(&x11, &x11, &x2);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   82|       |
   83|  46.5k|    x22 = x11;
   84|   558k|    for (j=0; j<11; j++) {
  ------------------
  |  Branch (84:15): [True: 512k, False: 46.5k]
  ------------------
   85|   512k|        secp256k1_fe_sqr(&x22, &x22);
  ------------------
  |  |   94|   512k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   86|   512k|    }
   87|  46.5k|    secp256k1_fe_mul(&x22, &x22, &x11);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   88|       |
   89|  46.5k|    x44 = x22;
   90|  1.07M|    for (j=0; j<22; j++) {
  ------------------
  |  Branch (90:15): [True: 1.02M, False: 46.5k]
  ------------------
   91|  1.02M|        secp256k1_fe_sqr(&x44, &x44);
  ------------------
  |  |   94|  1.02M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   92|  1.02M|    }
   93|  46.5k|    secp256k1_fe_mul(&x44, &x44, &x22);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
   94|       |
   95|  46.5k|    x88 = x44;
   96|  2.09M|    for (j=0; j<44; j++) {
  ------------------
  |  Branch (96:15): [True: 2.04M, False: 46.5k]
  ------------------
   97|  2.04M|        secp256k1_fe_sqr(&x88, &x88);
  ------------------
  |  |   94|  2.04M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
   98|  2.04M|    }
   99|  46.5k|    secp256k1_fe_mul(&x88, &x88, &x44);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  100|       |
  101|  46.5k|    x176 = x88;
  102|  4.14M|    for (j=0; j<88; j++) {
  ------------------
  |  Branch (102:15): [True: 4.09M, False: 46.5k]
  ------------------
  103|  4.09M|        secp256k1_fe_sqr(&x176, &x176);
  ------------------
  |  |   94|  4.09M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  104|  4.09M|    }
  105|  46.5k|    secp256k1_fe_mul(&x176, &x176, &x88);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  106|       |
  107|  46.5k|    x220 = x176;
  108|  2.09M|    for (j=0; j<44; j++) {
  ------------------
  |  Branch (108:15): [True: 2.04M, False: 46.5k]
  ------------------
  109|  2.04M|        secp256k1_fe_sqr(&x220, &x220);
  ------------------
  |  |   94|  2.04M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  110|  2.04M|    }
  111|  46.5k|    secp256k1_fe_mul(&x220, &x220, &x44);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  112|       |
  113|  46.5k|    x223 = x220;
  114|   186k|    for (j=0; j<3; j++) {
  ------------------
  |  Branch (114:15): [True: 139k, False: 46.5k]
  ------------------
  115|   139k|        secp256k1_fe_sqr(&x223, &x223);
  ------------------
  |  |   94|   139k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  116|   139k|    }
  117|  46.5k|    secp256k1_fe_mul(&x223, &x223, &x3);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  118|       |
  119|       |    /* The final result is then assembled using a sliding window over the blocks. */
  120|       |
  121|  46.5k|    t1 = x223;
  122|  1.11M|    for (j=0; j<23; j++) {
  ------------------
  |  Branch (122:15): [True: 1.07M, False: 46.5k]
  ------------------
  123|  1.07M|        secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|  1.07M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  124|  1.07M|    }
  125|  46.5k|    secp256k1_fe_mul(&t1, &t1, &x22);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  126|   325k|    for (j=0; j<6; j++) {
  ------------------
  |  Branch (126:15): [True: 279k, False: 46.5k]
  ------------------
  127|   279k|        secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|   279k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  128|   279k|    }
  129|  46.5k|    secp256k1_fe_mul(&t1, &t1, &x2);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  130|  46.5k|    secp256k1_fe_sqr(&t1, &t1);
  ------------------
  |  |   94|  46.5k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  131|  46.5k|    secp256k1_fe_sqr(r, &t1);
  ------------------
  |  |   94|  46.5k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  132|       |
  133|       |    /* Check that a square root was actually calculated */
  134|       |
  135|  46.5k|    secp256k1_fe_sqr(&t1, r);
  ------------------
  |  |   94|  46.5k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  136|  46.5k|    ret = secp256k1_fe_equal(&t1, a);
  137|       |
  138|       |#ifdef VERIFY
  139|       |    if (!ret) {
  140|       |        secp256k1_fe_negate(&t1, &t1, 1);
  141|       |        secp256k1_fe_normalize_var(&t1);
  142|       |        VERIFY_CHECK(secp256k1_fe_equal(&t1, a));
  143|       |    }
  144|       |#endif
  145|  46.5k|    return ret;
  146|  46.5k|}
secp256k1.c:secp256k1_fe_equal:
   25|   126k|SECP256K1_INLINE static int secp256k1_fe_equal(const secp256k1_fe *a, const secp256k1_fe *b) {
   26|   126k|    secp256k1_fe na;
   27|   126k|    SECP256K1_FE_VERIFY(a);
  ------------------
  |  |  345|   126k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   28|   126k|    SECP256K1_FE_VERIFY(b);
  ------------------
  |  |  345|   126k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   29|   126k|    SECP256K1_FE_VERIFY_MAGNITUDE(a, 1);
  ------------------
  |  |  349|   126k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   30|   126k|    SECP256K1_FE_VERIFY_MAGNITUDE(b, 30);
  ------------------
  |  |  349|   126k|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   31|       |
   32|   126k|    secp256k1_fe_negate(&na, a, 1);
  ------------------
  |  |  211|   126k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|   126k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|   126k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 126k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|   126k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 126k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|   126k|    } \
  |  |  |  |   94|   126k|    stmt; \
  |  |  |  |   95|   126k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 126k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
   33|   126k|    secp256k1_fe_add(&na, b);
  ------------------
  |  |   92|   126k|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
   34|   126k|    return secp256k1_fe_normalizes_to_zero(&na);
  ------------------
  |  |   81|   126k|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
   35|   126k|}
secp256k1.c:secp256k1_fe_clear:
   21|   141k|SECP256K1_INLINE static void secp256k1_fe_clear(secp256k1_fe *a) {
   22|   141k|    secp256k1_memclear_explicit(a, sizeof(secp256k1_fe));
   23|   141k|}

secp256k1.c:secp256k1_ge_set_xy:
  132|  2.28M|static void secp256k1_ge_set_xy(secp256k1_ge *r, const secp256k1_fe *x, const secp256k1_fe *y) {
  133|  2.28M|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  345|  2.28M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  134|  2.28M|    SECP256K1_FE_VERIFY(y);
  ------------------
  |  |  345|  2.28M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  135|       |
  136|  2.28M|    r->infinity = 0;
  137|  2.28M|    r->x = *x;
  138|  2.28M|    r->y = *y;
  139|       |
  140|  2.28M|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  2.28M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  141|  2.28M|}
secp256k1.c:secp256k1_ge_verify:
   78|  22.9M|static void secp256k1_ge_verify(const secp256k1_ge *a) {
   79|  22.9M|    SECP256K1_FE_VERIFY(&a->x);
  ------------------
  |  |  345|  22.9M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   80|  22.9M|    SECP256K1_FE_VERIFY(&a->y);
  ------------------
  |  |  345|  22.9M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   81|  22.9M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->x, SECP256K1_GE_X_MAGNITUDE_MAX);
  ------------------
  |  |  349|  22.9M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   82|  22.9M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->y, SECP256K1_GE_Y_MAGNITUDE_MAX);
  ------------------
  |  |  349|  22.9M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   83|  22.9M|    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
   84|  22.9M|    (void)a;
   85|  22.9M|}
secp256k1.c:secp256k1_ge_is_valid_var:
  446|  3.32k|static int secp256k1_ge_is_valid_var(const secp256k1_ge *a) {
  447|  3.32k|    secp256k1_fe y2, x3;
  448|  3.32k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|  3.32k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  449|       |
  450|  3.32k|    if (a->infinity) {
  ------------------
  |  Branch (450:9): [True: 0, False: 3.32k]
  ------------------
  451|      0|        return 0;
  452|      0|    }
  453|       |    /* y^2 = x^3 + 7 */
  454|  3.32k|    secp256k1_fe_sqr(&y2, &a->y);
  ------------------
  |  |   94|  3.32k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  455|  3.32k|    secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
  ------------------
  |  |   94|  3.32k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
                  secp256k1_fe_sqr(&x3, &a->x); secp256k1_fe_mul(&x3, &x3, &a->x);
  ------------------
  |  |   93|  3.32k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  456|  3.32k|    secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |  102|  3.32k|#  define secp256k1_fe_add_int secp256k1_fe_impl_add_int
  ------------------
                  secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |   73|  3.32k|#define SECP256K1_B 7
  ------------------
  457|  3.32k|    return secp256k1_fe_equal(&y2, &x3);
  458|  3.32k|}
secp256k1.c:secp256k1_ge_is_in_correct_subgroup:
  926|  47.7k|static int secp256k1_ge_is_in_correct_subgroup(const secp256k1_ge* ge) {
  927|       |#ifdef EXHAUSTIVE_TEST_ORDER
  928|       |    secp256k1_gej out;
  929|       |    int i;
  930|       |    SECP256K1_GE_VERIFY(ge);
  931|       |
  932|       |    /* A very simple EC multiplication ladder that avoids a dependency on ecmult. */
  933|       |    secp256k1_gej_set_infinity(&out);
  934|       |    for (i = 0; i < 32; ++i) {
  935|       |        secp256k1_gej_double_var(&out, &out, NULL);
  936|       |        if ((((uint32_t)EXHAUSTIVE_TEST_ORDER) >> (31 - i)) & 1) {
  937|       |            secp256k1_gej_add_ge_var(&out, &out, ge, NULL);
  938|       |        }
  939|       |    }
  940|       |    return secp256k1_gej_is_infinity(&out);
  941|       |#else
  942|  47.7k|    SECP256K1_GE_VERIFY(ge);
  ------------------
  |  |  212|  47.7k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  943|       |
  944|  47.7k|    (void)ge;
  945|       |    /* The real secp256k1 group has cofactor 1, so the subgroup is the entire curve. */
  946|  47.7k|    return 1;
  947|  47.7k|#endif
  948|  47.7k|}
secp256k1.c:secp256k1_ge_clear:
  343|   255k|static void secp256k1_ge_clear(secp256k1_ge *r) {
  344|   255k|    secp256k1_memclear_explicit(r, sizeof(secp256k1_ge));
  345|   255k|}
secp256k1.c:secp256k1_gej_eq_x_var:
  417|  76.7k|static int secp256k1_gej_eq_x_var(const secp256k1_fe *x, const secp256k1_gej *a) {
  418|  76.7k|    secp256k1_fe r;
  419|  76.7k|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  345|  76.7k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  420|  76.7k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  76.7k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  421|  76.7k|    VERIFY_CHECK(!a->infinity);
  422|       |
  423|  76.7k|    secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
  ------------------
  |  |   94|  76.7k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
                  secp256k1_fe_sqr(&r, &a->z); secp256k1_fe_mul(&r, &r, x);
  ------------------
  |  |   93|  76.7k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  424|  76.7k|    return secp256k1_fe_equal(&r, &a->x);
  425|  76.7k|}
secp256k1.c:secp256k1_gej_verify:
   87|  63.4M|static void secp256k1_gej_verify(const secp256k1_gej *a) {
   88|  63.4M|    SECP256K1_FE_VERIFY(&a->x);
  ------------------
  |  |  345|  63.4M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   89|  63.4M|    SECP256K1_FE_VERIFY(&a->y);
  ------------------
  |  |  345|  63.4M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   90|  63.4M|    SECP256K1_FE_VERIFY(&a->z);
  ------------------
  |  |  345|  63.4M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
   91|  63.4M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->x, SECP256K1_GEJ_X_MAGNITUDE_MAX);
  ------------------
  |  |  349|  63.4M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   92|  63.4M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->y, SECP256K1_GEJ_Y_MAGNITUDE_MAX);
  ------------------
  |  |  349|  63.4M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   93|  63.4M|    SECP256K1_FE_VERIFY_MAGNITUDE(&a->z, SECP256K1_GEJ_Z_MAGNITUDE_MAX);
  ------------------
  |  |  349|  63.4M|#define SECP256K1_FE_VERIFY_MAGNITUDE(a, m) secp256k1_fe_verify_magnitude(a, m)
  ------------------
   94|  63.4M|    VERIFY_CHECK(a->infinity == 0 || a->infinity == 1);
   95|  63.4M|    (void)a;
   96|  63.4M|}
secp256k1.c:secp256k1_gej_set_infinity:
  322|   154k|static void secp256k1_gej_set_infinity(secp256k1_gej *r) {
  323|   154k|    r->infinity = 1;
  324|   154k|    secp256k1_fe_set_int(&r->x, 0);
  ------------------
  |  |   83|   154k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  325|   154k|    secp256k1_fe_set_int(&r->y, 0);
  ------------------
  |  |   83|   154k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  326|   154k|    secp256k1_fe_set_int(&r->z, 0);
  ------------------
  |  |   83|   154k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  327|       |
  328|   154k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|   154k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  329|   154k|}
secp256k1.c:secp256k1_gej_add_ge:
  724|  6.09M|static void secp256k1_gej_add_ge(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b) {
  725|       |    /* Operations: 7 mul, 5 sqr, 21 add/cmov/half/mul_int/negate/normalizes_to_zero */
  726|  6.09M|    secp256k1_fe zz, u1, u2, s1, s2, t, tt, m, n, q, rr;
  727|  6.09M|    secp256k1_fe m_alt, rr_alt;
  728|  6.09M|    int degenerate;
  729|  6.09M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  6.09M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  730|  6.09M|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  212|  6.09M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  731|  6.09M|    VERIFY_CHECK(!b->infinity);
  732|       |
  733|       |    /*  In:
  734|       |     *    Eric Brier and Marc Joye, Weierstrass Elliptic Curves and Side-Channel Attacks.
  735|       |     *    In D. Naccache and P. Paillier, Eds., Public Key Cryptography, vol. 2274 of Lecture Notes in Computer Science, pages 335-345. Springer-Verlag, 2002.
  736|       |     *  we find as solution for a unified addition/doubling formula:
  737|       |     *    lambda = ((x1 + x2)^2 - x1 * x2 + a) / (y1 + y2), with a = 0 for secp256k1's curve equation.
  738|       |     *    x3 = lambda^2 - (x1 + x2)
  739|       |     *    2*y3 = lambda * (x1 + x2 - 2 * x3) - (y1 + y2).
  740|       |     *
  741|       |     *  Substituting x_i = Xi / Zi^2 and yi = Yi / Zi^3, for i=1,2,3, gives:
  742|       |     *    U1 = X1*Z2^2, U2 = X2*Z1^2
  743|       |     *    S1 = Y1*Z2^3, S2 = Y2*Z1^3
  744|       |     *    Z = Z1*Z2
  745|       |     *    T = U1+U2
  746|       |     *    M = S1+S2
  747|       |     *    Q = -T*M^2
  748|       |     *    R = T^2-U1*U2
  749|       |     *    X3 = R^2+Q
  750|       |     *    Y3 = -(R*(2*X3+Q)+M^4)/2
  751|       |     *    Z3 = M*Z
  752|       |     *  (Note that the paper uses xi = Xi / Zi and yi = Yi / Zi instead.)
  753|       |     *
  754|       |     *  This formula has the benefit of being the same for both addition
  755|       |     *  of distinct points and doubling. However, it breaks down in the
  756|       |     *  case that either point is infinity, or that y1 = -y2. We handle
  757|       |     *  these cases in the following ways:
  758|       |     *
  759|       |     *    - If b is infinity we simply bail by means of a VERIFY_CHECK.
  760|       |     *
  761|       |     *    - If a is infinity, we detect this, and at the end of the
  762|       |     *      computation replace the result (which will be meaningless,
  763|       |     *      but we compute to be constant-time) with b.x : b.y : 1.
  764|       |     *
  765|       |     *    - If a = -b, we have y1 = -y2, which is a degenerate case.
  766|       |     *      But here the answer is infinity, so we simply set the
  767|       |     *      infinity flag of the result, overriding the computed values
  768|       |     *      without even needing to cmov.
  769|       |     *
  770|       |     *    - If y1 = -y2 but x1 != x2, which does occur thanks to certain
  771|       |     *      properties of our curve (specifically, 1 has nontrivial cube
  772|       |     *      roots in our field, and the curve equation has no x coefficient)
  773|       |     *      then the answer is not infinity but also not given by the above
  774|       |     *      equation. In this case, we cmov in place an alternate expression
  775|       |     *      for lambda. Specifically (y1 - y2)/(x1 - x2). Where both these
  776|       |     *      expressions for lambda are defined, they are equal, and can be
  777|       |     *      obtained from each other by multiplication by (y1 + y2)/(y1 + y2)
  778|       |     *      then substitution of x^3 + 7 for y^2 (using the curve equation).
  779|       |     *      For all pairs of nonzero points (a, b) at least one is defined,
  780|       |     *      so this covers everything.
  781|       |     */
  782|       |
  783|  6.09M|    secp256k1_fe_sqr(&zz, &a->z);                       /* z = Z1^2 */
  ------------------
  |  |   94|  6.09M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  784|  6.09M|    u1 = a->x;                                          /* u1 = U1 = X1*Z2^2 (GEJ_X_M) */
  785|  6.09M|    secp256k1_fe_mul(&u2, &b->x, &zz);                  /* u2 = U2 = X2*Z1^2 (1) */
  ------------------
  |  |   93|  6.09M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  786|  6.09M|    s1 = a->y;                                          /* s1 = S1 = Y1*Z2^3 (GEJ_Y_M) */
  787|  6.09M|    secp256k1_fe_mul(&s2, &b->y, &zz);                  /* s2 = Y2*Z1^2 (1) */
  ------------------
  |  |   93|  6.09M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  788|  6.09M|    secp256k1_fe_mul(&s2, &s2, &a->z);                  /* s2 = S2 = Y2*Z1^3 (1) */
  ------------------
  |  |   93|  6.09M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  789|  6.09M|    t = u1; secp256k1_fe_add(&t, &u2);                  /* t = T = U1+U2 (GEJ_X_M+1) */
  ------------------
  |  |   92|  6.09M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  790|  6.09M|    m = s1; secp256k1_fe_add(&m, &s2);                  /* m = M = S1+S2 (GEJ_Y_M+1) */
  ------------------
  |  |   92|  6.09M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  791|  6.09M|    secp256k1_fe_sqr(&rr, &t);                          /* rr = T^2 (1) */
  ------------------
  |  |   94|  6.09M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  792|  6.09M|    secp256k1_fe_negate(&m_alt, &u2, 1);                /* Malt = -X2*Z1^2 (2) */
  ------------------
  |  |  211|  6.09M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  6.09M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  6.09M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 6.09M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  6.09M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 6.09M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  6.09M|    } \
  |  |  |  |   94|  6.09M|    stmt; \
  |  |  |  |   95|  6.09M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 6.09M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  793|  6.09M|    secp256k1_fe_mul(&tt, &u1, &m_alt);                 /* tt = -U1*U2 (1) */
  ------------------
  |  |   93|  6.09M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  794|  6.09M|    secp256k1_fe_add(&rr, &tt);                         /* rr = R = T^2-U1*U2 (2) */
  ------------------
  |  |   92|  6.09M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  795|       |    /* If lambda = R/M = R/0 we have a problem (except in the "trivial"
  796|       |     * case that Z = z1z2 = 0, and this is special-cased later on). */
  797|  6.09M|    degenerate = secp256k1_fe_normalizes_to_zero(&m);
  ------------------
  |  |   81|  6.09M|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
  798|       |    /* This only occurs when y1 == -y2 and x1^3 == x2^3, but x1 != x2.
  799|       |     * This means either x1 == beta*x2 or beta*x1 == x2, where beta is
  800|       |     * a nontrivial cube root of one. In either case, an alternate
  801|       |     * non-indeterminate expression for lambda is (y1 - y2)/(x1 - x2),
  802|       |     * so we set R/M equal to this. */
  803|  6.09M|    rr_alt = s1;
  804|  6.09M|    secp256k1_fe_mul_int(&rr_alt, 2);       /* rr_alt = Y1*Z2^3 - Y2*Z1^3 (GEJ_Y_M*2) */
  ------------------
  |  |  233|  6.09M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   87|  6.09M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  6.09M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 6.09M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  6.09M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 6.09M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  6.09M|    } \
  |  |  |  |   94|  6.09M|    stmt; \
  |  |  |  |   95|  6.09M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 6.09M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  805|  6.09M|    secp256k1_fe_add(&m_alt, &u1);          /* Malt = X1*Z2^2 - X2*Z1^2 (GEJ_X_M+2) */
  ------------------
  |  |   92|  6.09M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  806|       |
  807|  6.09M|    secp256k1_fe_cmov(&rr_alt, &rr, !degenerate);       /* rr_alt (GEJ_Y_M*2) */
  ------------------
  |  |   95|  6.09M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  808|  6.09M|    secp256k1_fe_cmov(&m_alt, &m, !degenerate);         /* m_alt (GEJ_X_M+2) */
  ------------------
  |  |   95|  6.09M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  809|       |    /* Now Ralt / Malt = lambda and is guaranteed not to be Ralt / 0.
  810|       |     * From here on out Ralt and Malt represent the numerator
  811|       |     * and denominator of lambda; R and M represent the explicit
  812|       |     * expressions x1^2 + x2^2 + x1x2 and y1 + y2. */
  813|  6.09M|    secp256k1_fe_sqr(&n, &m_alt);                       /* n = Malt^2 (1) */
  ------------------
  |  |   94|  6.09M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  814|  6.09M|    secp256k1_fe_negate(&q, &t,
  ------------------
  |  |  211|  6.09M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  6.09M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  6.09M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 6.09M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  6.09M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 6.09M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  6.09M|    } \
  |  |  |  |   94|  6.09M|    stmt; \
  |  |  |  |   95|  6.09M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 6.09M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  815|  6.09M|        SECP256K1_GEJ_X_MAGNITUDE_MAX + 1);             /* q = -T (GEJ_X_M+2) */
  816|  6.09M|    secp256k1_fe_mul(&q, &q, &n);                       /* q = Q = -T*Malt^2 (1) */
  ------------------
  |  |   93|  6.09M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  817|       |    /* These two lines use the observation that either M == Malt or M == 0,
  818|       |     * so M^3 * Malt is either Malt^4 (which is computed by squaring), or
  819|       |     * zero (which is "computed" by cmov). So the cost is one squaring
  820|       |     * versus two multiplications. */
  821|  6.09M|    secp256k1_fe_sqr(&n, &n);                           /* n = Malt^4 (1) */
  ------------------
  |  |   94|  6.09M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  822|  6.09M|    secp256k1_fe_cmov(&n, &m, degenerate);              /* n = M^3 * Malt (GEJ_Y_M+1) */
  ------------------
  |  |   95|  6.09M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  823|  6.09M|    secp256k1_fe_sqr(&t, &rr_alt);                      /* t = Ralt^2 (1) */
  ------------------
  |  |   94|  6.09M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  824|  6.09M|    secp256k1_fe_mul(&r->z, &a->z, &m_alt);             /* r->z = Z3 = Malt*Z (1) */
  ------------------
  |  |   93|  6.09M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  825|  6.09M|    secp256k1_fe_add(&t, &q);                           /* t = Ralt^2 + Q (2) */
  ------------------
  |  |   92|  6.09M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  826|  6.09M|    r->x = t;                                           /* r->x = X3 = Ralt^2 + Q (2) */
  827|  6.09M|    secp256k1_fe_mul_int(&t, 2);                        /* t = 2*X3 (4) */
  ------------------
  |  |  233|  6.09M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   87|  6.09M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  6.09M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 6.09M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  6.09M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 6.09M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  6.09M|    } \
  |  |  |  |   94|  6.09M|    stmt; \
  |  |  |  |   95|  6.09M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 6.09M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  828|  6.09M|    secp256k1_fe_add(&t, &q);                           /* t = 2*X3 + Q (5) */
  ------------------
  |  |   92|  6.09M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  829|  6.09M|    secp256k1_fe_mul(&t, &t, &rr_alt);                  /* t = Ralt*(2*X3 + Q) (1) */
  ------------------
  |  |   93|  6.09M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  830|  6.09M|    secp256k1_fe_add(&t, &n);                           /* t = Ralt*(2*X3 + Q) + M^3*Malt (GEJ_Y_M+2) */
  ------------------
  |  |   92|  6.09M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  831|  6.09M|    secp256k1_fe_negate(&r->y, &t,
  ------------------
  |  |  211|  6.09M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  6.09M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  6.09M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 6.09M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  6.09M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 6.09M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  6.09M|    } \
  |  |  |  |   94|  6.09M|    stmt; \
  |  |  |  |   95|  6.09M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 6.09M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  832|  6.09M|        SECP256K1_GEJ_Y_MAGNITUDE_MAX + 2);             /* r->y = -(Ralt*(2*X3 + Q) + M^3*Malt) (GEJ_Y_M+3) */
  833|  6.09M|    secp256k1_fe_half(&r->y);                           /* r->y = Y3 = -(Ralt*(2*X3 + Q) + M^3*Malt)/2 ((GEJ_Y_M+3)/2 + 1) */
  ------------------
  |  |  101|  6.09M|#  define secp256k1_fe_half secp256k1_fe_impl_half
  ------------------
  834|       |
  835|       |    /* In case a->infinity == 1, replace r with (b->x, b->y, 1). */
  836|  6.09M|    secp256k1_fe_cmov(&r->x, &b->x, a->infinity);
  ------------------
  |  |   95|  6.09M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  837|  6.09M|    secp256k1_fe_cmov(&r->y, &b->y, a->infinity);
  ------------------
  |  |   95|  6.09M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  838|  6.09M|    secp256k1_fe_cmov(&r->z, &secp256k1_fe_one, a->infinity);
  ------------------
  |  |   95|  6.09M|#  define secp256k1_fe_cmov secp256k1_fe_impl_cmov
  ------------------
  839|       |
  840|       |    /* Set r->infinity if r->z is 0.
  841|       |     *
  842|       |     * If a->infinity is set, then r->infinity = (r->z == 0) = (1 == 0) = false,
  843|       |     * which is correct because the function assumes that b is not infinity.
  844|       |     *
  845|       |     * Now assume !a->infinity. This implies Z = Z1 != 0.
  846|       |     *
  847|       |     * Case y1 = -y2:
  848|       |     * In this case we could have a = -b, namely if x1 = x2.
  849|       |     * We have degenerate = true, r->z = (x1 - x2) * Z.
  850|       |     * Then r->infinity = ((x1 - x2)Z == 0) = (x1 == x2) = (a == -b).
  851|       |     *
  852|       |     * Case y1 != -y2:
  853|       |     * In this case, we can't have a = -b.
  854|       |     * We have degenerate = false, r->z = (y1 + y2) * Z.
  855|       |     * Then r->infinity = ((y1 + y2)Z == 0) = (y1 == -y2) = false. */
  856|  6.09M|    r->infinity = secp256k1_fe_normalizes_to_zero(&r->z);
  ------------------
  |  |   81|  6.09M|#  define secp256k1_fe_normalizes_to_zero secp256k1_fe_impl_normalizes_to_zero
  ------------------
  857|       |
  858|  6.09M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  6.09M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  859|  6.09M|}
secp256k1.c:secp256k1_gej_is_infinity:
  440|   232k|static int secp256k1_gej_is_infinity(const secp256k1_gej *a) {
  441|   232k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|   232k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  442|       |
  443|   232k|    return a->infinity;
  444|   232k|}
secp256k1.c:secp256k1_ge_set_gej:
  159|   142k|static void secp256k1_ge_set_gej(secp256k1_ge *r, secp256k1_gej *a) {
  160|   142k|    secp256k1_fe z2, z3;
  161|   142k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|   142k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  162|       |
  163|   142k|    r->infinity = a->infinity;
  164|   142k|    secp256k1_fe_inv(&a->z, &a->z);
  ------------------
  |  |   98|   142k|#  define secp256k1_fe_inv secp256k1_fe_impl_inv
  ------------------
  165|   142k|    secp256k1_fe_sqr(&z2, &a->z);
  ------------------
  |  |   94|   142k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  166|   142k|    secp256k1_fe_mul(&z3, &a->z, &z2);
  ------------------
  |  |   93|   142k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  167|   142k|    secp256k1_fe_mul(&a->x, &a->x, &z2);
  ------------------
  |  |   93|   142k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  168|   142k|    secp256k1_fe_mul(&a->y, &a->y, &z3);
  ------------------
  |  |   93|   142k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  169|   142k|    secp256k1_fe_set_int(&a->z, 1);
  ------------------
  |  |   83|   142k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  170|   142k|    r->x = a->x;
  171|   142k|    r->y = a->y;
  172|       |
  173|   142k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|   142k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  174|   142k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|   142k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  175|   142k|}
secp256k1.c:secp256k1_ge_set_xo_var:
  347|  46.5k|static int secp256k1_ge_set_xo_var(secp256k1_ge *r, const secp256k1_fe *x, int odd) {
  348|  46.5k|    secp256k1_fe x2, x3;
  349|  46.5k|    int ret;
  350|  46.5k|    SECP256K1_FE_VERIFY(x);
  ------------------
  |  |  345|  46.5k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  351|       |
  352|  46.5k|    r->x = *x;
  353|  46.5k|    secp256k1_fe_sqr(&x2, x);
  ------------------
  |  |   94|  46.5k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  354|  46.5k|    secp256k1_fe_mul(&x3, x, &x2);
  ------------------
  |  |   93|  46.5k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  355|  46.5k|    r->infinity = 0;
  356|  46.5k|    secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |  102|  46.5k|#  define secp256k1_fe_add_int secp256k1_fe_impl_add_int
  ------------------
                  secp256k1_fe_add_int(&x3, SECP256K1_B);
  ------------------
  |  |   73|  46.5k|#define SECP256K1_B 7
  ------------------
  357|  46.5k|    ret = secp256k1_fe_sqrt(&r->y, &x3);
  358|  46.5k|    secp256k1_fe_normalize_var(&r->y);
  ------------------
  |  |   80|  46.5k|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  359|  46.5k|    if (secp256k1_fe_is_odd(&r->y) != odd) {
  ------------------
  |  |   85|  46.5k|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  |  Branch (359:9): [True: 5.39k, False: 41.1k]
  ------------------
  360|  5.39k|        secp256k1_fe_negate(&r->y, &r->y, 1);
  ------------------
  |  |  211|  5.39k|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  5.39k|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  5.39k|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 5.39k]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  5.39k|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 5.39k, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  5.39k|    } \
  |  |  |  |   94|  5.39k|    stmt; \
  |  |  |  |   95|  5.39k|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 5.39k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  361|  5.39k|    }
  362|       |
  363|  46.5k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  46.5k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  364|  46.5k|    return ret;
  365|  46.5k|}
secp256k1.c:secp256k1_gej_set_ge:
  367|   343k|static void secp256k1_gej_set_ge(secp256k1_gej *r, const secp256k1_ge *a) {
  368|   343k|   SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|   343k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  369|       |
  370|   343k|   r->infinity = a->infinity;
  371|   343k|   r->x = a->x;
  372|   343k|   r->y = a->y;
  373|   343k|   secp256k1_fe_set_int(&r->z, 1);
  ------------------
  |  |   83|   343k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  374|       |
  375|   343k|   SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|   343k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  376|   343k|}
secp256k1.c:secp256k1_gej_rescale:
  861|   141k|static void secp256k1_gej_rescale(secp256k1_gej *r, const secp256k1_fe *s) {
  862|       |    /* Operations: 4 mul, 1 sqr */
  863|   141k|    secp256k1_fe zz;
  864|   141k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|   141k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  865|   141k|    SECP256K1_FE_VERIFY(s);
  ------------------
  |  |  345|   141k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  866|   141k|    VERIFY_CHECK(!secp256k1_fe_normalizes_to_zero_var(s));
  867|       |
  868|   141k|    secp256k1_fe_sqr(&zz, s);
  ------------------
  |  |   94|   141k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  869|   141k|    secp256k1_fe_mul(&r->x, &r->x, &zz);                /* r->x *= s^2 */
  ------------------
  |  |   93|   141k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  870|   141k|    secp256k1_fe_mul(&r->y, &r->y, &zz);
  ------------------
  |  |   93|   141k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  871|   141k|    secp256k1_fe_mul(&r->y, &r->y, s);                  /* r->y *= s^3 */
  ------------------
  |  |   93|   141k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  872|   141k|    secp256k1_fe_mul(&r->z, &r->z, s);                  /* r->z *= s   */
  ------------------
  |  |   93|   141k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  873|       |
  874|   141k|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|   141k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  875|   141k|}
secp256k1.c:secp256k1_ge_set_gej_zinv:
   99|  77.3k|static void secp256k1_ge_set_gej_zinv(secp256k1_ge *r, const secp256k1_gej *a, const secp256k1_fe *zi) {
  100|  77.3k|    secp256k1_fe zi2;
  101|  77.3k|    secp256k1_fe zi3;
  102|  77.3k|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  77.3k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  103|  77.3k|    SECP256K1_FE_VERIFY(zi);
  ------------------
  |  |  345|  77.3k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  104|  77.3k|    VERIFY_CHECK(!a->infinity);
  105|       |
  106|  77.3k|    secp256k1_fe_sqr(&zi2, zi);
  ------------------
  |  |   94|  77.3k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  107|  77.3k|    secp256k1_fe_mul(&zi3, &zi2, zi);
  ------------------
  |  |   93|  77.3k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  108|  77.3k|    secp256k1_fe_mul(&r->x, &a->x, &zi2);
  ------------------
  |  |   93|  77.3k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  109|  77.3k|    secp256k1_fe_mul(&r->y, &a->y, &zi3);
  ------------------
  |  |   93|  77.3k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  110|  77.3k|    r->infinity = a->infinity;
  111|       |
  112|  77.3k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  77.3k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  113|  77.3k|}
secp256k1.c:secp256k1_ge_table_set_globalz:
  289|  77.3k|static void secp256k1_ge_table_set_globalz(size_t len, secp256k1_ge *a, const secp256k1_fe *zr) {
  290|  77.3k|    size_t i;
  291|  77.3k|    secp256k1_fe zs;
  292|       |#ifdef VERIFY
  293|       |    for (i = 0; i < len; i++) {
  294|       |        SECP256K1_GE_VERIFY(&a[i]);
  295|       |        SECP256K1_FE_VERIFY(&zr[i]);
  296|       |    }
  297|       |#endif
  298|       |
  299|  77.3k|    if (len > 0) {
  ------------------
  |  Branch (299:9): [True: 77.3k, False: 0]
  ------------------
  300|  77.3k|        i = len - 1;
  301|       |        /* Ensure all y values are in weak normal form for fast negation of points */
  302|  77.3k|        secp256k1_fe_normalize_weak(&a[i].y);
  ------------------
  |  |   79|  77.3k|#  define secp256k1_fe_normalize_weak secp256k1_fe_impl_normalize_weak
  ------------------
  303|  77.3k|        zs = zr[i];
  304|       |
  305|       |        /* Work our way backwards, using the z-ratios to scale the x/y values. */
  306|   618k|        while (i > 0) {
  ------------------
  |  Branch (306:16): [True: 541k, False: 77.3k]
  ------------------
  307|   541k|            if (i != len - 1) {
  ------------------
  |  Branch (307:17): [True: 464k, False: 77.3k]
  ------------------
  308|   464k|                secp256k1_fe_mul(&zs, &zs, &zr[i]);
  ------------------
  |  |   93|   464k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  309|   464k|            }
  310|   541k|            i--;
  311|   541k|            secp256k1_ge_set_ge_zinv(&a[i], &a[i], &zs);
  312|   541k|        }
  313|  77.3k|    }
  314|       |
  315|       |#ifdef VERIFY
  316|       |    for (i = 0; i < len; i++) {
  317|       |        SECP256K1_GE_VERIFY(&a[i]);
  318|       |    }
  319|       |#endif
  320|  77.3k|}
secp256k1.c:secp256k1_ge_set_ge_zinv:
  116|   541k|static void secp256k1_ge_set_ge_zinv(secp256k1_ge *r, const secp256k1_ge *a, const secp256k1_fe *zi) {
  117|   541k|    secp256k1_fe zi2;
  118|   541k|    secp256k1_fe zi3;
  119|   541k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|   541k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  120|   541k|    SECP256K1_FE_VERIFY(zi);
  ------------------
  |  |  345|   541k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  121|   541k|    VERIFY_CHECK(!a->infinity);
  122|       |
  123|   541k|    secp256k1_fe_sqr(&zi2, zi);
  ------------------
  |  |   94|   541k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  124|   541k|    secp256k1_fe_mul(&zi3, &zi2, zi);
  ------------------
  |  |   93|   541k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  125|   541k|    secp256k1_fe_mul(&r->x, &a->x, &zi2);
  ------------------
  |  |   93|   541k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  126|   541k|    secp256k1_fe_mul(&r->y, &a->y, &zi3);
  ------------------
  |  |   93|   541k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  127|   541k|    r->infinity = a->infinity;
  128|       |
  129|   541k|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|   541k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  130|   541k|}
secp256k1.c:secp256k1_gej_double_var:
  495|  9.93M|static void secp256k1_gej_double_var(secp256k1_gej *r, const secp256k1_gej *a, secp256k1_fe *rzr) {
  496|  9.93M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  9.93M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  497|       |
  498|       |    /** For secp256k1, 2Q is infinity if and only if Q is infinity. This is because if 2Q = infinity,
  499|       |     *  Q must equal -Q, or that Q.y == -(Q.y), or Q.y is 0. For a point on y^2 = x^3 + 7 to have
  500|       |     *  y=0, x^3 must be -7 mod p. However, -7 has no cube root mod p.
  501|       |     *
  502|       |     *  Having said this, if this function receives a point on a sextic twist, e.g. by
  503|       |     *  a fault attack, it is possible for y to be 0. This happens for y^2 = x^3 + 6,
  504|       |     *  since -6 does have a cube root mod p. For this point, this function will not set
  505|       |     *  the infinity flag even though the point doubles to infinity, and the result
  506|       |     *  point will be gibberish (z = 0 but infinity = 0).
  507|       |     */
  508|  9.93M|    if (a->infinity) {
  ------------------
  |  Branch (508:9): [True: 77.3k, False: 9.85M]
  ------------------
  509|  77.3k|        secp256k1_gej_set_infinity(r);
  510|  77.3k|        if (rzr != NULL) {
  ------------------
  |  Branch (510:13): [True: 0, False: 77.3k]
  ------------------
  511|      0|            secp256k1_fe_set_int(rzr, 1);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  512|      0|        }
  513|  77.3k|        return;
  514|  77.3k|    }
  515|       |
  516|  9.85M|    if (rzr != NULL) {
  ------------------
  |  Branch (516:9): [True: 0, False: 9.85M]
  ------------------
  517|      0|        *rzr = a->y;
  518|      0|        secp256k1_fe_normalize_weak(rzr);
  ------------------
  |  |   79|      0|#  define secp256k1_fe_normalize_weak secp256k1_fe_impl_normalize_weak
  ------------------
  519|      0|    }
  520|       |
  521|  9.85M|    secp256k1_gej_double(r, a);
  522|       |
  523|  9.85M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  9.85M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  524|  9.85M|}
secp256k1.c:secp256k1_gej_double:
  460|  9.85M|static SECP256K1_INLINE void secp256k1_gej_double(secp256k1_gej *r, const secp256k1_gej *a) {
  461|       |    /* Operations: 3 mul, 4 sqr, 8 add/half/mul_int/negate */
  462|  9.85M|    secp256k1_fe l, s, t;
  463|  9.85M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  9.85M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  464|       |
  465|  9.85M|    r->infinity = a->infinity;
  466|       |
  467|       |    /* Formula used:
  468|       |     * L = (3/2) * X1^2
  469|       |     * S = Y1^2
  470|       |     * T = -X1*S
  471|       |     * X3 = L^2 + 2*T
  472|       |     * Y3 = -(L*(X3 + T) + S^2)
  473|       |     * Z3 = Y1*Z1
  474|       |     */
  475|       |
  476|  9.85M|    secp256k1_fe_mul(&r->z, &a->z, &a->y); /* Z3 = Y1*Z1 (1) */
  ------------------
  |  |   93|  9.85M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  477|  9.85M|    secp256k1_fe_sqr(&s, &a->y);           /* S = Y1^2 (1) */
  ------------------
  |  |   94|  9.85M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  478|  9.85M|    secp256k1_fe_sqr(&l, &a->x);           /* L = X1^2 (1) */
  ------------------
  |  |   94|  9.85M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  479|  9.85M|    secp256k1_fe_mul_int(&l, 3);           /* L = 3*X1^2 (3) */
  ------------------
  |  |  233|  9.85M|#define secp256k1_fe_mul_int(r, a) ASSERT_INT_CONST_AND_DO(a, secp256k1_fe_mul_int_unchecked(r, a))
  |  |  ------------------
  |  |  |  |   87|  9.85M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  9.85M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 9.85M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  9.85M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 9.85M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  9.85M|    } \
  |  |  |  |   94|  9.85M|    stmt; \
  |  |  |  |   95|  9.85M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 9.85M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  480|  9.85M|    secp256k1_fe_half(&l);                 /* L = 3/2*X1^2 (2) */
  ------------------
  |  |  101|  9.85M|#  define secp256k1_fe_half secp256k1_fe_impl_half
  ------------------
  481|  9.85M|    secp256k1_fe_negate(&t, &s, 1);        /* T = -S (2) */
  ------------------
  |  |  211|  9.85M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  9.85M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  9.85M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 9.85M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  9.85M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 9.85M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  9.85M|    } \
  |  |  |  |   94|  9.85M|    stmt; \
  |  |  |  |   95|  9.85M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 9.85M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  482|  9.85M|    secp256k1_fe_mul(&t, &t, &a->x);       /* T = -X1*S (1) */
  ------------------
  |  |   93|  9.85M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  483|  9.85M|    secp256k1_fe_sqr(&r->x, &l);           /* X3 = L^2 (1) */
  ------------------
  |  |   94|  9.85M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  484|  9.85M|    secp256k1_fe_add(&r->x, &t);           /* X3 = L^2 + T (2) */
  ------------------
  |  |   92|  9.85M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  485|  9.85M|    secp256k1_fe_add(&r->x, &t);           /* X3 = L^2 + 2*T (3) */
  ------------------
  |  |   92|  9.85M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  486|  9.85M|    secp256k1_fe_sqr(&s, &s);              /* S' = S^2 (1) */
  ------------------
  |  |   94|  9.85M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  487|  9.85M|    secp256k1_fe_add(&t, &r->x);           /* T' = X3 + T (4) */
  ------------------
  |  |   92|  9.85M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  488|  9.85M|    secp256k1_fe_mul(&r->y, &t, &l);       /* Y3 = L*(X3 + T) (1) */
  ------------------
  |  |   93|  9.85M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  489|  9.85M|    secp256k1_fe_add(&r->y, &s);           /* Y3 = L*(X3 + T) + S^2 (2) */
  ------------------
  |  |   92|  9.85M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  490|  9.85M|    secp256k1_fe_negate(&r->y, &r->y, 2);  /* Y3 = -(L*(X3 + T) + S^2) (3) */
  ------------------
  |  |  211|  9.85M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  9.85M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  9.85M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 9.85M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  9.85M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 9.85M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  9.85M|    } \
  |  |  |  |   94|  9.85M|    stmt; \
  |  |  |  |   95|  9.85M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 9.85M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  491|       |
  492|  9.85M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  9.85M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  493|  9.85M|}
secp256k1.c:secp256k1_ge_from_storage:
  890|  7.52M|static void secp256k1_ge_from_storage(secp256k1_ge *r, const secp256k1_ge_storage *a) {
  891|  7.52M|    secp256k1_fe_from_storage(&r->x, &a->x);
  ------------------
  |  |   97|  7.52M|#  define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
  ------------------
  892|  7.52M|    secp256k1_fe_from_storage(&r->y, &a->y);
  ------------------
  |  |   97|  7.52M|#  define secp256k1_fe_from_storage secp256k1_fe_impl_from_storage
  ------------------
  893|  7.52M|    r->infinity = 0;
  894|       |
  895|  7.52M|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|  7.52M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  896|  7.52M|}
secp256k1.c:secp256k1_gej_add_zinv_var:
  653|  1.31M|static void secp256k1_gej_add_zinv_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, const secp256k1_fe *bzinv) {
  654|       |    /* Operations: 9 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
  655|  1.31M|    secp256k1_fe az, z12, u1, u2, s1, s2, h, i, h2, h3, t;
  656|  1.31M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  1.31M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  657|  1.31M|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  212|  1.31M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  658|  1.31M|    SECP256K1_FE_VERIFY(bzinv);
  ------------------
  |  |  345|  1.31M|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  659|       |
  660|  1.31M|    if (a->infinity) {
  ------------------
  |  Branch (660:9): [True: 30.1k, False: 1.28M]
  ------------------
  661|  30.1k|        secp256k1_fe bzinv2, bzinv3;
  662|  30.1k|        r->infinity = b->infinity;
  663|  30.1k|        secp256k1_fe_sqr(&bzinv2, bzinv);
  ------------------
  |  |   94|  30.1k|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  664|  30.1k|        secp256k1_fe_mul(&bzinv3, &bzinv2, bzinv);
  ------------------
  |  |   93|  30.1k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  665|  30.1k|        secp256k1_fe_mul(&r->x, &b->x, &bzinv2);
  ------------------
  |  |   93|  30.1k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  666|  30.1k|        secp256k1_fe_mul(&r->y, &b->y, &bzinv3);
  ------------------
  |  |   93|  30.1k|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  667|  30.1k|        secp256k1_fe_set_int(&r->z, 1);
  ------------------
  |  |   83|  30.1k|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  668|  30.1k|        SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  30.1k|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  669|  30.1k|        return;
  670|  30.1k|    }
  671|  1.28M|    if (b->infinity) {
  ------------------
  |  Branch (671:9): [True: 0, False: 1.28M]
  ------------------
  672|      0|        *r = *a;
  673|      0|        return;
  674|      0|    }
  675|       |
  676|       |    /** We need to calculate (rx,ry,rz) = (ax,ay,az) + (bx,by,1/bzinv). Due to
  677|       |     *  secp256k1's isomorphism we can multiply the Z coordinates on both sides
  678|       |     *  by bzinv, and get: (rx,ry,rz*bzinv) = (ax,ay,az*bzinv) + (bx,by,1).
  679|       |     *  This means that (rx,ry,rz) can be calculated as
  680|       |     *  (ax,ay,az*bzinv) + (bx,by,1), when not applying the bzinv factor to rz.
  681|       |     *  The variable az below holds the modified Z coordinate for a, which is used
  682|       |     *  for the computation of rx and ry, but not for rz.
  683|       |     */
  684|  1.28M|    secp256k1_fe_mul(&az, &a->z, bzinv);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  685|       |
  686|  1.28M|    secp256k1_fe_sqr(&z12, &az);
  ------------------
  |  |   94|  1.28M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  687|  1.28M|    u1 = a->x;
  688|  1.28M|    secp256k1_fe_mul(&u2, &b->x, &z12);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  689|  1.28M|    s1 = a->y;
  690|  1.28M|    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                  secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &az);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  691|  1.28M|    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |  211|  1.28M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  1.28M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.28M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.28M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.28M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.28M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.28M|    } \
  |  |  |  |   94|  1.28M|    stmt; \
  |  |  |  |   95|  1.28M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.28M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |   92|  1.28M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  692|  1.28M|    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |  211|  1.28M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  1.28M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.28M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.28M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.28M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.28M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.28M|    } \
  |  |  |  |   94|  1.28M|    stmt; \
  |  |  |  |   95|  1.28M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.28M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |   92|  1.28M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  693|  1.28M|    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
  ------------------
  |  |   82|  1.28M|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (693:9): [True: 7, False: 1.28M]
  ------------------
  694|      7|        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
  ------------------
  |  |   82|      7|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (694:13): [True: 1, False: 6]
  ------------------
  695|      1|            secp256k1_gej_double_var(r, a, NULL);
  696|      6|        } else {
  697|      6|            secp256k1_gej_set_infinity(r);
  698|      6|        }
  699|      7|        return;
  700|      7|    }
  701|       |
  702|  1.28M|    r->infinity = 0;
  703|  1.28M|    secp256k1_fe_mul(&r->z, &a->z, &h);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  704|       |
  705|  1.28M|    secp256k1_fe_sqr(&h2, &h);
  ------------------
  |  |   94|  1.28M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  706|  1.28M|    secp256k1_fe_negate(&h2, &h2, 1);
  ------------------
  |  |  211|  1.28M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  1.28M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  1.28M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 1.28M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  1.28M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 1.28M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  1.28M|    } \
  |  |  |  |   94|  1.28M|    stmt; \
  |  |  |  |   95|  1.28M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 1.28M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  707|  1.28M|    secp256k1_fe_mul(&h3, &h2, &h);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  708|  1.28M|    secp256k1_fe_mul(&t, &u1, &h2);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  709|       |
  710|  1.28M|    secp256k1_fe_sqr(&r->x, &i);
  ------------------
  |  |   94|  1.28M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  711|  1.28M|    secp256k1_fe_add(&r->x, &h3);
  ------------------
  |  |   92|  1.28M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  712|  1.28M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  1.28M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  713|  1.28M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  1.28M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  714|       |
  715|  1.28M|    secp256k1_fe_add(&t, &r->x);
  ------------------
  |  |   92|  1.28M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  716|  1.28M|    secp256k1_fe_mul(&r->y, &t, &i);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  717|  1.28M|    secp256k1_fe_mul(&h3, &h3, &s1);
  ------------------
  |  |   93|  1.28M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  718|  1.28M|    secp256k1_fe_add(&r->y, &h3);
  ------------------
  |  |   92|  1.28M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  719|       |
  720|  1.28M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  1.28M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  721|  1.28M|}
secp256k1.c:secp256k1_ge_set_gej_var:
  177|    262|static void secp256k1_ge_set_gej_var(secp256k1_ge *r, secp256k1_gej *a) {
  178|    262|    secp256k1_fe z2, z3;
  179|    262|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|    262|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  180|       |
  181|    262|    if (secp256k1_gej_is_infinity(a)) {
  ------------------
  |  Branch (181:9): [True: 0, False: 262]
  ------------------
  182|      0|        secp256k1_ge_set_infinity(r);
  183|      0|        return;
  184|      0|    }
  185|    262|    r->infinity = 0;
  186|    262|    secp256k1_fe_inv_var(&a->z, &a->z);
  ------------------
  |  |   99|    262|#  define secp256k1_fe_inv_var secp256k1_fe_impl_inv_var
  ------------------
  187|    262|    secp256k1_fe_sqr(&z2, &a->z);
  ------------------
  |  |   94|    262|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  188|    262|    secp256k1_fe_mul(&z3, &a->z, &z2);
  ------------------
  |  |   93|    262|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  189|    262|    secp256k1_fe_mul(&a->x, &a->x, &z2);
  ------------------
  |  |   93|    262|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  190|    262|    secp256k1_fe_mul(&a->y, &a->y, &z3);
  ------------------
  |  |   93|    262|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  191|    262|    secp256k1_fe_set_int(&a->z, 1);
  ------------------
  |  |   83|    262|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  192|    262|    secp256k1_ge_set_xy(r, &a->x, &a->y);
  193|       |
  194|    262|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|    262|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  195|    262|    SECP256K1_GE_VERIFY(r);
  ------------------
  |  |  212|    262|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  196|    262|}
secp256k1.c:secp256k1_ge_is_infinity:
  143|    262|static int secp256k1_ge_is_infinity(const secp256k1_ge *a) {
  144|    262|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|    262|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  145|       |
  146|    262|    return a->infinity;
  147|    262|}
secp256k1.c:secp256k1_ge_storage_cmov:
  911|   194M|static SECP256K1_INLINE void secp256k1_ge_storage_cmov(secp256k1_ge_storage *r, const secp256k1_ge_storage *a, int flag) {
  912|   194M|    VERIFY_CHECK(flag == 0 || flag == 1);
  913|   194M|    secp256k1_fe_storage_cmov(&r->x, &a->x, flag);
  914|   194M|    secp256k1_fe_storage_cmov(&r->y, &a->y, flag);
  915|   194M|}
secp256k1.c:secp256k1_gej_clear:
  339|   141k|static void secp256k1_gej_clear(secp256k1_gej *r) {
  340|   141k|    secp256k1_memclear_explicit(r, sizeof(secp256k1_gej));
  341|   141k|}
secp256k1.c:secp256k1_gej_add_ge_var:
  590|  3.86M|static void secp256k1_gej_add_ge_var(secp256k1_gej *r, const secp256k1_gej *a, const secp256k1_ge *b, secp256k1_fe *rzr) {
  591|       |    /* Operations: 8 mul, 3 sqr, 11 add/negate/normalizes_to_zero (ignoring special cases) */
  592|  3.86M|    secp256k1_fe z12, u1, u2, s1, s2, h, i, h2, h3, t;
  593|  3.86M|    SECP256K1_GEJ_VERIFY(a);
  ------------------
  |  |  216|  3.86M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  594|  3.86M|    SECP256K1_GE_VERIFY(b);
  ------------------
  |  |  212|  3.86M|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  595|       |
  596|  3.86M|    if (a->infinity) {
  ------------------
  |  Branch (596:9): [True: 47.2k, False: 3.81M]
  ------------------
  597|  47.2k|        VERIFY_CHECK(rzr == NULL);
  598|  47.2k|        secp256k1_gej_set_ge(r, b);
  599|  47.2k|        return;
  600|  47.2k|    }
  601|  3.81M|    if (b->infinity) {
  ------------------
  |  Branch (601:9): [True: 0, False: 3.81M]
  ------------------
  602|      0|        if (rzr != NULL) {
  ------------------
  |  Branch (602:13): [True: 0, False: 0]
  ------------------
  603|      0|            secp256k1_fe_set_int(rzr, 1);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  604|      0|        }
  605|      0|        *r = *a;
  606|      0|        return;
  607|      0|    }
  608|       |
  609|  3.81M|    secp256k1_fe_sqr(&z12, &a->z);
  ------------------
  |  |   94|  3.81M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  610|  3.81M|    u1 = a->x;
  611|  3.81M|    secp256k1_fe_mul(&u2, &b->x, &z12);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  612|  3.81M|    s1 = a->y;
  613|  3.81M|    secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
                  secp256k1_fe_mul(&s2, &b->y, &z12); secp256k1_fe_mul(&s2, &s2, &a->z);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  614|  3.81M|    secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |  211|  3.81M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  3.81M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  3.81M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 3.81M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  3.81M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 3.81M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  3.81M|    } \
  |  |  |  |   94|  3.81M|    stmt; \
  |  |  |  |   95|  3.81M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 3.81M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&h, &u1, SECP256K1_GEJ_X_MAGNITUDE_MAX); secp256k1_fe_add(&h, &u2);
  ------------------
  |  |   92|  3.81M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  615|  3.81M|    secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |  211|  3.81M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  3.81M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  3.81M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 3.81M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  3.81M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 3.81M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  3.81M|    } \
  |  |  |  |   94|  3.81M|    stmt; \
  |  |  |  |   95|  3.81M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 3.81M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
                  secp256k1_fe_negate(&i, &s2, 1); secp256k1_fe_add(&i, &s1);
  ------------------
  |  |   92|  3.81M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  616|  3.81M|    if (secp256k1_fe_normalizes_to_zero_var(&h)) {
  ------------------
  |  |   82|  3.81M|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (616:9): [True: 6, False: 3.81M]
  ------------------
  617|      6|        if (secp256k1_fe_normalizes_to_zero_var(&i)) {
  ------------------
  |  |   82|      6|#  define secp256k1_fe_normalizes_to_zero_var secp256k1_fe_impl_normalizes_to_zero_var
  ------------------
  |  Branch (617:13): [True: 1, False: 5]
  ------------------
  618|      1|            secp256k1_gej_double_var(r, a, rzr);
  619|      5|        } else {
  620|      5|            if (rzr != NULL) {
  ------------------
  |  Branch (620:17): [True: 0, False: 5]
  ------------------
  621|      0|                secp256k1_fe_set_int(rzr, 0);
  ------------------
  |  |   83|      0|#  define secp256k1_fe_set_int secp256k1_fe_impl_set_int
  ------------------
  622|      0|            }
  623|      5|            secp256k1_gej_set_infinity(r);
  624|      5|        }
  625|      6|        return;
  626|      6|    }
  627|       |
  628|  3.81M|    r->infinity = 0;
  629|  3.81M|    if (rzr != NULL) {
  ------------------
  |  Branch (629:9): [True: 541k, False: 3.27M]
  ------------------
  630|   541k|        *rzr = h;
  631|   541k|    }
  632|  3.81M|    secp256k1_fe_mul(&r->z, &a->z, &h);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  633|       |
  634|  3.81M|    secp256k1_fe_sqr(&h2, &h);
  ------------------
  |  |   94|  3.81M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  635|  3.81M|    secp256k1_fe_negate(&h2, &h2, 1);
  ------------------
  |  |  211|  3.81M|#define secp256k1_fe_negate(r, a, m) ASSERT_INT_CONST_AND_DO(m, secp256k1_fe_negate_unchecked(r, a, m))
  |  |  ------------------
  |  |  |  |   87|  3.81M|#define ASSERT_INT_CONST_AND_DO(expr, stmt) do { \
  |  |  |  |   88|  3.81M|    switch(42) { \
  |  |  |  |   89|      0|        /* C allows only integer constant expressions as case labels. */ \
  |  |  |  |   90|      0|        case /* ERROR: integer argument is not constant */ (expr): \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (90:9): [True: 0, False: 3.81M]
  |  |  |  |  ------------------
  |  |  |  |   91|      0|            break; \
  |  |  |  |   92|  3.81M|        default: ; \
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (92:9): [True: 3.81M, False: 0]
  |  |  |  |  ------------------
  |  |  |  |   93|  3.81M|    } \
  |  |  |  |   94|  3.81M|    stmt; \
  |  |  |  |   95|  3.81M|} while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (95:9): [Folded, False: 3.81M]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  636|  3.81M|    secp256k1_fe_mul(&h3, &h2, &h);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  637|  3.81M|    secp256k1_fe_mul(&t, &u1, &h2);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  638|       |
  639|  3.81M|    secp256k1_fe_sqr(&r->x, &i);
  ------------------
  |  |   94|  3.81M|#  define secp256k1_fe_sqr secp256k1_fe_impl_sqr
  ------------------
  640|  3.81M|    secp256k1_fe_add(&r->x, &h3);
  ------------------
  |  |   92|  3.81M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  641|  3.81M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  3.81M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  642|  3.81M|    secp256k1_fe_add(&r->x, &t);
  ------------------
  |  |   92|  3.81M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  643|       |
  644|  3.81M|    secp256k1_fe_add(&t, &r->x);
  ------------------
  |  |   92|  3.81M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  645|  3.81M|    secp256k1_fe_mul(&r->y, &t, &i);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  646|  3.81M|    secp256k1_fe_mul(&h3, &h3, &s1);
  ------------------
  |  |   93|  3.81M|#  define secp256k1_fe_mul secp256k1_fe_impl_mul
  ------------------
  647|  3.81M|    secp256k1_fe_add(&r->y, &h3);
  ------------------
  |  |   92|  3.81M|#  define secp256k1_fe_add secp256k1_fe_impl_add
  ------------------
  648|       |
  649|  3.81M|    SECP256K1_GEJ_VERIFY(r);
  ------------------
  |  |  216|  3.81M|#define SECP256K1_GEJ_VERIFY(a) secp256k1_gej_verify(a)
  ------------------
  650|  3.81M|    if (rzr != NULL) SECP256K1_FE_VERIFY(rzr);
  ------------------
  |  |  345|   541k|#define SECP256K1_FE_VERIFY(a) secp256k1_fe_verify(a)
  ------------------
  |  Branch (650:9): [True: 541k, False: 3.27M]
  ------------------
  651|  3.81M|}
secp256k1.c:secp256k1_ge_to_bytes:
  977|   122k|static void secp256k1_ge_to_bytes(unsigned char *buf, const secp256k1_ge *a) {
  978|   122k|    secp256k1_ge_storage s;
  979|       |
  980|       |    /* We require that the secp256k1_ge_storage type is exactly 64 bytes.
  981|       |     * This is formally not guaranteed by the C standard, but should hold on any
  982|       |     * sane compiler in the real world. */
  983|   122k|    STATIC_ASSERT(sizeof(secp256k1_ge_storage) == 64);
  ------------------
  |  |   74|   122k|#define STATIC_ASSERT(expr) do { \
  |  |   75|   122k|    switch(0) { \
  |  |  ------------------
  |  |  |  Branch (75:12): [Folded, False: 0]
  |  |  ------------------
  |  |   76|   122k|        case 0: \
  |  |  ------------------
  |  |  |  Branch (76:9): [True: 122k, False: 0]
  |  |  ------------------
  |  |   77|   122k|        /* If expr evaluates to 0, we have two case labels "0", which is illegal. */ \
  |  |   78|   122k|        case /* ERROR: static assertion failed */ (expr): \
  |  |  ------------------
  |  |  |  Branch (78:9): [True: 0, False: 122k]
  |  |  ------------------
  |  |   79|   122k|        ; \
  |  |   80|   122k|    } \
  |  |   81|   122k|} while(0)
  |  |  ------------------
  |  |  |  Branch (81:9): [Folded, False: 122k]
  |  |  ------------------
  ------------------
  984|   122k|    VERIFY_CHECK(!secp256k1_ge_is_infinity(a));
  985|   122k|    secp256k1_ge_to_storage(&s, a);
  986|   122k|    memcpy(buf, &s, 64);
  987|   122k|}
secp256k1.c:secp256k1_ge_to_storage:
  877|   122k|static void secp256k1_ge_to_storage(secp256k1_ge_storage *r, const secp256k1_ge *a) {
  878|   122k|    secp256k1_fe x, y;
  879|   122k|    SECP256K1_GE_VERIFY(a);
  ------------------
  |  |  212|   122k|#define SECP256K1_GE_VERIFY(a) secp256k1_ge_verify(a)
  ------------------
  880|   122k|    VERIFY_CHECK(!a->infinity);
  881|       |
  882|   122k|    x = a->x;
  883|   122k|    secp256k1_fe_normalize(&x);
  ------------------
  |  |   78|   122k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  884|   122k|    y = a->y;
  885|   122k|    secp256k1_fe_normalize(&y);
  ------------------
  |  |   78|   122k|#  define secp256k1_fe_normalize secp256k1_fe_impl_normalize
  ------------------
  886|   122k|    secp256k1_fe_to_storage(&r->x, &x);
  ------------------
  |  |   96|   122k|#  define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
  ------------------
  887|   122k|    secp256k1_fe_to_storage(&r->y, &y);
  ------------------
  |  |   96|   122k|#  define secp256k1_fe_to_storage secp256k1_fe_impl_to_storage
  ------------------
  888|   122k|}
secp256k1.c:secp256k1_ge_from_bytes:
  989|   121k|static void secp256k1_ge_from_bytes(secp256k1_ge *r, const unsigned char *buf) {
  990|   121k|    secp256k1_ge_storage s;
  991|       |
  992|   121k|    STATIC_ASSERT(sizeof(secp256k1_ge_storage) == 64);
  ------------------
  |  |   74|   121k|#define STATIC_ASSERT(expr) do { \
  |  |   75|   121k|    switch(0) { \
  |  |  ------------------
  |  |  |  Branch (75:12): [Folded, False: 0]
  |  |  ------------------
  |  |   76|   121k|        case 0: \
  |  |  ------------------
  |  |  |  Branch (76:9): [True: 121k, False: 0]
  |  |  ------------------
  |  |   77|   121k|        /* If expr evaluates to 0, we have two case labels "0", which is illegal. */ \
  |  |   78|   121k|        case /* ERROR: static assertion failed */ (expr): \
  |  |  ------------------
  |  |  |  Branch (78:9): [True: 0, False: 121k]
  |  |  ------------------
  |  |   79|   121k|        ; \
  |  |   80|   121k|    } \
  |  |   81|   121k|} while(0)
  |  |  ------------------
  |  |  |  Branch (81:9): [Folded, False: 121k]
  |  |  ------------------
  ------------------
  993|   121k|    memcpy(&s, buf, 64);
  994|   121k|    secp256k1_ge_from_storage(r, &s);
  995|   121k|}

secp256k1.c:secp256k1_sha256_transform:
  133|  1.54M|static void secp256k1_sha256_transform(uint32_t *state, const unsigned char *blocks64, size_t n_blocks) {
  134|  3.09M|    while (n_blocks--) {
  ------------------
  |  Branch (134:12): [True: 1.54M, False: 1.54M]
  ------------------
  135|  1.54M|        secp256k1_sha256_transform_impl(state, blocks64);
  136|  1.54M|        blocks64 += 64;
  137|  1.54M|    }
  138|  1.54M|}
secp256k1.c:secp256k1_sha256_transform_impl:
   51|  1.54M|static void secp256k1_sha256_transform_impl(uint32_t* s, const unsigned char* buf) {
   52|  1.54M|    uint32_t a = s[0], b = s[1], c = s[2], d = s[3], e = s[4], f = s[5], g = s[6], h = s[7];
   53|  1.54M|    uint32_t w0, w1, w2, w3, w4, w5, w6, w7, w8, w9, w10, w11, w12, w13, w14, w15;
   54|       |
   55|  1.54M|    Round(a, b, c, d, e, f, g, h, 0x428a2f98,  w0 = secp256k1_read_be32(&buf[0]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   56|  1.54M|    Round(h, a, b, c, d, e, f, g, 0x71374491,  w1 = secp256k1_read_be32(&buf[4]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   57|  1.54M|    Round(g, h, a, b, c, d, e, f, 0xb5c0fbcf,  w2 = secp256k1_read_be32(&buf[8]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   58|  1.54M|    Round(f, g, h, a, b, c, d, e, 0xe9b5dba5,  w3 = secp256k1_read_be32(&buf[12]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   59|  1.54M|    Round(e, f, g, h, a, b, c, d, 0x3956c25b,  w4 = secp256k1_read_be32(&buf[16]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   60|  1.54M|    Round(d, e, f, g, h, a, b, c, 0x59f111f1,  w5 = secp256k1_read_be32(&buf[20]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   61|  1.54M|    Round(c, d, e, f, g, h, a, b, 0x923f82a4,  w6 = secp256k1_read_be32(&buf[24]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   62|  1.54M|    Round(b, c, d, e, f, g, h, a, 0xab1c5ed5,  w7 = secp256k1_read_be32(&buf[28]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   63|  1.54M|    Round(a, b, c, d, e, f, g, h, 0xd807aa98,  w8 = secp256k1_read_be32(&buf[32]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   64|  1.54M|    Round(h, a, b, c, d, e, f, g, 0x12835b01,  w9 = secp256k1_read_be32(&buf[36]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   65|  1.54M|    Round(g, h, a, b, c, d, e, f, 0x243185be, w10 = secp256k1_read_be32(&buf[40]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   66|  1.54M|    Round(f, g, h, a, b, c, d, e, 0x550c7dc3, w11 = secp256k1_read_be32(&buf[44]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   67|  1.54M|    Round(e, f, g, h, a, b, c, d, 0x72be5d74, w12 = secp256k1_read_be32(&buf[48]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   68|  1.54M|    Round(d, e, f, g, h, a, b, c, 0x80deb1fe, w13 = secp256k1_read_be32(&buf[52]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   69|  1.54M|    Round(c, d, e, f, g, h, a, b, 0x9bdc06a7, w14 = secp256k1_read_be32(&buf[56]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   70|  1.54M|    Round(b, c, d, e, f, g, h, a, 0xc19bf174, w15 = secp256k1_read_be32(&buf[60]));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   71|       |
   72|  1.54M|    Round(a, b, c, d, e, f, g, h, 0xe49b69c1, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   73|  1.54M|    Round(h, a, b, c, d, e, f, g, 0xefbe4786, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   74|  1.54M|    Round(g, h, a, b, c, d, e, f, 0x0fc19dc6, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   75|  1.54M|    Round(f, g, h, a, b, c, d, e, 0x240ca1cc, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   76|  1.54M|    Round(e, f, g, h, a, b, c, d, 0x2de92c6f, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   77|  1.54M|    Round(d, e, f, g, h, a, b, c, 0x4a7484aa, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   78|  1.54M|    Round(c, d, e, f, g, h, a, b, 0x5cb0a9dc, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   79|  1.54M|    Round(b, c, d, e, f, g, h, a, 0x76f988da, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   80|  1.54M|    Round(a, b, c, d, e, f, g, h, 0x983e5152, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   81|  1.54M|    Round(h, a, b, c, d, e, f, g, 0xa831c66d, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   82|  1.54M|    Round(g, h, a, b, c, d, e, f, 0xb00327c8, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   83|  1.54M|    Round(f, g, h, a, b, c, d, e, 0xbf597fc7, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   84|  1.54M|    Round(e, f, g, h, a, b, c, d, 0xc6e00bf3, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   85|  1.54M|    Round(d, e, f, g, h, a, b, c, 0xd5a79147, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   86|  1.54M|    Round(c, d, e, f, g, h, a, b, 0x06ca6351, w14 += sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   87|  1.54M|    Round(b, c, d, e, f, g, h, a, 0x14292967, w15 += sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   88|       |
   89|  1.54M|    Round(a, b, c, d, e, f, g, h, 0x27b70a85, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   90|  1.54M|    Round(h, a, b, c, d, e, f, g, 0x2e1b2138, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   91|  1.54M|    Round(g, h, a, b, c, d, e, f, 0x4d2c6dfc, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   92|  1.54M|    Round(f, g, h, a, b, c, d, e, 0x53380d13, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   93|  1.54M|    Round(e, f, g, h, a, b, c, d, 0x650a7354, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   94|  1.54M|    Round(d, e, f, g, h, a, b, c, 0x766a0abb, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   95|  1.54M|    Round(c, d, e, f, g, h, a, b, 0x81c2c92e, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   96|  1.54M|    Round(b, c, d, e, f, g, h, a, 0x92722c85, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   97|  1.54M|    Round(a, b, c, d, e, f, g, h, 0xa2bfe8a1, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   98|  1.54M|    Round(h, a, b, c, d, e, f, g, 0xa81a664b, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
   99|  1.54M|    Round(g, h, a, b, c, d, e, f, 0xc24b8b70, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  100|  1.54M|    Round(f, g, h, a, b, c, d, e, 0xc76c51a3, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  101|  1.54M|    Round(e, f, g, h, a, b, c, d, 0xd192e819, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  102|  1.54M|    Round(d, e, f, g, h, a, b, c, 0xd6990624, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  103|  1.54M|    Round(c, d, e, f, g, h, a, b, 0xf40e3585, w14 += sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  104|  1.54M|    Round(b, c, d, e, f, g, h, a, 0x106aa070, w15 += sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  105|       |
  106|  1.54M|    Round(a, b, c, d, e, f, g, h, 0x19a4c116, w0 += sigma1(w14) + w9 + sigma0(w1));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  107|  1.54M|    Round(h, a, b, c, d, e, f, g, 0x1e376c08, w1 += sigma1(w15) + w10 + sigma0(w2));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  108|  1.54M|    Round(g, h, a, b, c, d, e, f, 0x2748774c, w2 += sigma1(w0) + w11 + sigma0(w3));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  109|  1.54M|    Round(f, g, h, a, b, c, d, e, 0x34b0bcb5, w3 += sigma1(w1) + w12 + sigma0(w4));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  110|  1.54M|    Round(e, f, g, h, a, b, c, d, 0x391c0cb3, w4 += sigma1(w2) + w13 + sigma0(w5));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  111|  1.54M|    Round(d, e, f, g, h, a, b, c, 0x4ed8aa4a, w5 += sigma1(w3) + w14 + sigma0(w6));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  112|  1.54M|    Round(c, d, e, f, g, h, a, b, 0x5b9cca4f, w6 += sigma1(w4) + w15 + sigma0(w7));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  113|  1.54M|    Round(b, c, d, e, f, g, h, a, 0x682e6ff3, w7 += sigma1(w5) + w0 + sigma0(w8));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  114|  1.54M|    Round(a, b, c, d, e, f, g, h, 0x748f82ee, w8 += sigma1(w6) + w1 + sigma0(w9));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  115|  1.54M|    Round(h, a, b, c, d, e, f, g, 0x78a5636f, w9 += sigma1(w7) + w2 + sigma0(w10));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  116|  1.54M|    Round(g, h, a, b, c, d, e, f, 0x84c87814, w10 += sigma1(w8) + w3 + sigma0(w11));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  117|  1.54M|    Round(f, g, h, a, b, c, d, e, 0x8cc70208, w11 += sigma1(w9) + w4 + sigma0(w12));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  118|  1.54M|    Round(e, f, g, h, a, b, c, d, 0x90befffa, w12 += sigma1(w10) + w5 + sigma0(w13));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  119|  1.54M|    Round(d, e, f, g, h, a, b, c, 0xa4506ceb, w13 += sigma1(w11) + w6 + sigma0(w14));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  120|  1.54M|    Round(c, d, e, f, g, h, a, b, 0xbef9a3f7, w14 + sigma1(w12) + w7 + sigma0(w15));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  121|  1.54M|    Round(b, c, d, e, f, g, h, a, 0xc67178f2, w15 + sigma1(w13) + w8 + sigma0(w0));
  ------------------
  |  |   24|  1.54M|#define Round(a,b,c,d,e,f,g,h,k,w) do { \
  |  |   25|  1.54M|    uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   20|  1.54M|#define Sigma1(x) (((x) >> 6 | (x) << 26) ^ ((x) >> 11 | (x) << 21) ^ ((x) >> 25 | (x) << 7))
  |  |  ------------------
  |  |                   uint32_t t1 = (h) + Sigma1(e) + Ch((e), (f), (g)) + (k) + (w); \
  |  |  ------------------
  |  |  |  |   17|  1.54M|#define Ch(x,y,z) ((z) ^ ((x) & ((y) ^ (z))))
  |  |  ------------------
  |  |   26|  1.54M|    uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   19|  1.54M|#define Sigma0(x) (((x) >> 2 | (x) << 30) ^ ((x) >> 13 | (x) << 19) ^ ((x) >> 22 | (x) << 10))
  |  |  ------------------
  |  |                   uint32_t t2 = Sigma0(a) + Maj((a), (b), (c)); \
  |  |  ------------------
  |  |  |  |   18|  1.54M|#define Maj(x,y,z) (((x) & (y)) | ((z) & ((x) | (y))))
  |  |  ------------------
  |  |   27|  1.54M|    (d) += t1; \
  |  |   28|  1.54M|    (h) = t1 + t2; \
  |  |   29|  1.54M|} while(0)
  |  |  ------------------
  |  |  |  Branch (29:9): [Folded, False: 1.54M]
  |  |  ------------------
  ------------------
  122|       |
  123|  1.54M|    s[0] += a;
  124|  1.54M|    s[1] += b;
  125|  1.54M|    s[2] += c;
  126|  1.54M|    s[3] += d;
  127|  1.54M|    s[4] += e;
  128|  1.54M|    s[5] += f;
  129|  1.54M|    s[6] += g;
  130|  1.54M|    s[7] += h;
  131|  1.54M|}
secp256k1.c:secp256k1_sha256_initialize:
   31|   670k|static void secp256k1_sha256_initialize(secp256k1_sha256 *hash) {
   32|   670k|    hash->s[0] = 0x6a09e667ul;
   33|   670k|    hash->s[1] = 0xbb67ae85ul;
   34|   670k|    hash->s[2] = 0x3c6ef372ul;
   35|   670k|    hash->s[3] = 0xa54ff53aul;
   36|   670k|    hash->s[4] = 0x510e527ful;
   37|   670k|    hash->s[5] = 0x9b05688cul;
   38|   670k|    hash->s[6] = 0x1f83d9abul;
   39|   670k|    hash->s[7] = 0x5be0cd19ul;
   40|   670k|    hash->bytes = 0;
   41|   670k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_initialize:
  320|  67.0k|static void secp256k1_rfc6979_hmac_sha256_initialize(const secp256k1_hash_ctx *hash_ctx, secp256k1_rfc6979_hmac_sha256 *rng, const unsigned char *key, size_t keylen) {
  321|  67.0k|    secp256k1_hmac_sha256 hmac;
  322|  67.0k|    static const unsigned char zero[1] = {0x00};
  323|  67.0k|    static const unsigned char one[1] = {0x01};
  324|       |
  325|  67.0k|    memset(rng->v, 0x01, 32); /* RFC6979 3.2.b. */
  326|  67.0k|    memset(rng->k, 0x00, 32); /* RFC6979 3.2.c. */
  327|       |
  328|       |    /* RFC6979 3.2.d. */
  329|  67.0k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  330|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  331|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, zero, 1);
  332|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, key, keylen);
  333|  67.0k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->k);
  334|  67.0k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  335|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  336|  67.0k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  337|       |
  338|       |    /* RFC6979 3.2.f. */
  339|  67.0k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  340|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  341|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, one, 1);
  342|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, key, keylen);
  343|  67.0k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->k);
  344|  67.0k|    secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  345|  67.0k|    secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  346|  67.0k|    secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  347|  67.0k|    rng->retry = 0;
  348|  67.0k|}
secp256k1.c:secp256k1_hmac_sha256_initialize:
  276|   335k|static void secp256k1_hmac_sha256_initialize(const secp256k1_hash_ctx *hash_ctx, secp256k1_hmac_sha256 *hash, const unsigned char *key, size_t keylen) {
  277|   335k|    size_t n;
  278|   335k|    unsigned char rkey[64];
  279|   335k|    if (keylen <= sizeof(rkey)) {
  ------------------
  |  Branch (279:9): [True: 335k, False: 0]
  ------------------
  280|   335k|        memcpy(rkey, key, keylen);
  281|   335k|        memset(rkey + keylen, 0, sizeof(rkey) - keylen);
  282|   335k|    } else {
  283|      0|        secp256k1_sha256 sha256;
  284|      0|        secp256k1_sha256_initialize(&sha256);
  285|      0|        secp256k1_sha256_write(hash_ctx, &sha256, key, keylen);
  286|      0|        secp256k1_sha256_finalize(hash_ctx, &sha256, rkey);
  287|      0|        memset(rkey + 32, 0, 32);
  288|      0|    }
  289|       |
  290|   335k|    secp256k1_sha256_initialize(&hash->outer);
  291|  21.7M|    for (n = 0; n < sizeof(rkey); n++) {
  ------------------
  |  Branch (291:17): [True: 21.4M, False: 335k]
  ------------------
  292|  21.4M|        rkey[n] ^= 0x5c;
  293|  21.4M|    }
  294|   335k|    secp256k1_sha256_write(hash_ctx, &hash->outer, rkey, sizeof(rkey));
  295|       |
  296|   335k|    secp256k1_sha256_initialize(&hash->inner);
  297|  21.7M|    for (n = 0; n < sizeof(rkey); n++) {
  ------------------
  |  Branch (297:17): [True: 21.4M, False: 335k]
  ------------------
  298|  21.4M|        rkey[n] ^= 0x5c ^ 0x36;
  299|  21.4M|    }
  300|   335k|    secp256k1_sha256_write(hash_ctx, &hash->inner, rkey, sizeof(rkey));
  301|   335k|    secp256k1_memclear_explicit(rkey, sizeof(rkey));
  302|   335k|}
secp256k1.c:secp256k1_hmac_sha256_write:
  304|   603k|static void secp256k1_hmac_sha256_write(const secp256k1_hash_ctx *hash_ctx, secp256k1_hmac_sha256 *hash, const unsigned char *data, size_t size) {
  305|   603k|    secp256k1_sha256_write(hash_ctx, &hash->inner, data, size);
  306|   603k|}
secp256k1.c:secp256k1_hmac_sha256_finalize:
  308|   335k|static void secp256k1_hmac_sha256_finalize(const secp256k1_hash_ctx *hash_ctx, secp256k1_hmac_sha256 *hash, unsigned char *out32) {
  309|   335k|    unsigned char temp[32];
  310|   335k|    secp256k1_sha256_finalize(hash_ctx, &hash->inner, temp);
  311|   335k|    secp256k1_sha256_write(hash_ctx, &hash->outer, temp, 32);
  312|   335k|    secp256k1_memclear_explicit(temp, sizeof(temp));
  313|   335k|    secp256k1_sha256_finalize(hash_ctx, &hash->outer, out32);
  314|   335k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_generate:
  350|  67.0k|static void secp256k1_rfc6979_hmac_sha256_generate(const secp256k1_hash_ctx *hash_ctx, secp256k1_rfc6979_hmac_sha256 *rng, unsigned char *out, size_t outlen) {
  351|       |    /* RFC6979 3.2.h. */
  352|  67.0k|    static const unsigned char zero[1] = {0x00};
  353|  67.0k|    if (rng->retry) {
  ------------------
  |  Branch (353:9): [True: 0, False: 67.0k]
  ------------------
  354|      0|        secp256k1_hmac_sha256 hmac;
  355|      0|        secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  356|      0|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  357|      0|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, zero, 1);
  358|      0|        secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->k);
  359|      0|        secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  360|      0|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  361|      0|        secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  362|      0|    }
  363|       |
  364|   134k|    while (outlen > 0) {
  ------------------
  |  Branch (364:12): [True: 67.0k, False: 67.0k]
  ------------------
  365|  67.0k|        secp256k1_hmac_sha256 hmac;
  366|  67.0k|        size_t now = outlen;
  367|  67.0k|        secp256k1_hmac_sha256_initialize(hash_ctx, &hmac, rng->k, 32);
  368|  67.0k|        secp256k1_hmac_sha256_write(hash_ctx, &hmac, rng->v, 32);
  369|  67.0k|        secp256k1_hmac_sha256_finalize(hash_ctx, &hmac, rng->v);
  370|  67.0k|        if (now > 32) {
  ------------------
  |  Branch (370:13): [True: 0, False: 67.0k]
  ------------------
  371|      0|            now = 32;
  372|      0|        }
  373|  67.0k|        memcpy(out, rng->v, now);
  374|  67.0k|        out += now;
  375|  67.0k|        outlen -= now;
  376|  67.0k|    }
  377|       |
  378|  67.0k|    rng->retry = 1;
  379|  67.0k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_finalize:
  381|  67.0k|static void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256 *rng) {
  382|  67.0k|    (void) rng;
  383|  67.0k|}
secp256k1.c:secp256k1_rfc6979_hmac_sha256_clear:
  385|  67.0k|static void secp256k1_rfc6979_hmac_sha256_clear(secp256k1_rfc6979_hmac_sha256 *rng) {
  386|  67.0k|    secp256k1_memclear_explicit(rng, sizeof(*rng));
  387|  67.0k|}
secp256k1.c:secp256k1_sha256_write:
  210|  2.95M|static void secp256k1_sha256_write(const secp256k1_hash_ctx *hash_ctx, secp256k1_sha256 *hash, const unsigned char *data, size_t len) {
  211|  2.95M|    size_t chunk_len;
  212|  2.95M|    size_t bufsize = hash->bytes & 0x3F;
  213|  2.95M|    hash->bytes += len;
  214|  2.95M|    VERIFY_CHECK(hash->bytes >= len);
  215|  2.95M|    VERIFY_CHECK(hash_ctx != NULL);
  216|  2.95M|    VERIFY_CHECK(hash_ctx->fn_sha256_compression != NULL);
  217|       |
  218|       |    /* If we exceed the 64-byte block size with this input, process it and wipe the buffer */
  219|  2.95M|    chunk_len = 64 - bufsize;
  220|  2.95M|    if (bufsize && len >= chunk_len) {
  ------------------
  |  Branch (220:9): [True: 1.60M, False: 1.34M]
  |  Branch (220:20): [True: 804k, False: 804k]
  ------------------
  221|   804k|        memcpy(hash->buf + bufsize, data, chunk_len);
  222|   804k|        data += chunk_len;
  223|   804k|        len -= chunk_len;
  224|   804k|        hash_ctx->fn_sha256_compression(hash->s, hash->buf, 1);
  225|   804k|        bufsize = 0;
  226|   804k|    }
  227|       |
  228|       |    /* If we still have data to process, invoke compression directly on the input */
  229|  2.95M|    if (len >= 64) {
  ------------------
  |  Branch (229:9): [True: 740k, False: 2.21M]
  ------------------
  230|   740k|        const size_t n_blocks = len / 64;
  231|   740k|        const size_t advance = n_blocks * 64;
  232|   740k|        hash_ctx->fn_sha256_compression(hash->s, data, n_blocks);
  233|   740k|        data += advance;
  234|   740k|        len -= advance;
  235|   740k|    }
  236|       |
  237|       |    /* Fill the buffer with what remains */
  238|  2.95M|    if (len) {
  ------------------
  |  Branch (238:9): [True: 1.60M, False: 1.34M]
  ------------------
  239|  1.60M|        memcpy(hash->buf + bufsize, data, len);
  240|  1.60M|    }
  241|  2.95M|}
secp256k1.c:secp256k1_sha256_finalize:
  243|   670k|static void secp256k1_sha256_finalize(const secp256k1_hash_ctx *hash_ctx, secp256k1_sha256 *hash, unsigned char *out32) {
  244|   670k|    static const unsigned char pad[64] = {0x80};
  245|   670k|    unsigned char sizedesc[8];
  246|   670k|    int i;
  247|       |    /* The maximum message size of SHA256 is 2^64-1 bits. */
  248|   670k|    VERIFY_CHECK(hash->bytes < ((uint64_t)1 << 61));
  249|   670k|    secp256k1_write_be32(&sizedesc[0], hash->bytes >> 29);
  250|   670k|    secp256k1_write_be32(&sizedesc[4], hash->bytes << 3);
  251|   670k|    secp256k1_sha256_write(hash_ctx, hash, pad, 1 + ((119 - (hash->bytes % 64)) % 64));
  252|   670k|    secp256k1_sha256_write(hash_ctx, hash, sizedesc, 8);
  253|  6.03M|    for (i = 0; i < 8; i++) {
  ------------------
  |  Branch (253:17): [True: 5.36M, False: 670k]
  ------------------
  254|  5.36M|        secp256k1_write_be32(&out32[4*i], hash->s[i]);
  255|  5.36M|        hash->s[i] = 0;
  256|  5.36M|    }
  257|   670k|}
secp256k1.c:secp256k1_sha256_initialize_midstate:
   43|    262|static void secp256k1_sha256_initialize_midstate(secp256k1_sha256 *hash, uint64_t bytes, const uint32_t state[8]) {
   44|    262|    VERIFY_CHECK((bytes & 0x3F) == 0);
   45|    262|    VERIFY_CHECK(state != NULL);
   46|    262|    memcpy(hash->s, state, sizeof(hash->s));
   47|    262|    hash->bytes = bytes;
   48|    262|}

secp256k1.c:secp256k1_u128_mul:
   11|   651M|static SECP256K1_INLINE void secp256k1_u128_mul(secp256k1_uint128 *r, uint64_t a, uint64_t b) {
   12|   651M|   *r = (uint128_t)a * b;
   13|   651M|}
secp256k1.c:secp256k1_u128_accum_mul:
   15|  5.10G|static SECP256K1_INLINE void secp256k1_u128_accum_mul(secp256k1_uint128 *r, uint64_t a, uint64_t b) {
   16|  5.10G|   *r += (uint128_t)a * b;
   17|  5.10G|}
secp256k1.c:secp256k1_u128_to_u64:
   28|  2.83G|static SECP256K1_INLINE uint64_t secp256k1_u128_to_u64(const secp256k1_uint128 *a) {
   29|  2.83G|   return (uint64_t)(*a);
   30|  2.83G|}
secp256k1.c:secp256k1_u128_rshift:
   23|  2.18G|static SECP256K1_INLINE void secp256k1_u128_rshift(secp256k1_uint128 *r, unsigned int n) {
   24|  2.18G|   VERIFY_CHECK(n < 128);
   25|  2.18G|   *r >>= n;
   26|  2.18G|}
secp256k1.c:secp256k1_u128_accum_u64:
   19|   233M|static SECP256K1_INLINE void secp256k1_u128_accum_u64(secp256k1_uint128 *r, uint64_t a) {
   20|   233M|   *r += a;
   21|   233M|}
secp256k1.c:secp256k1_u128_from_u64:
   36|  2.54M|static SECP256K1_INLINE void secp256k1_u128_from_u64(secp256k1_uint128 *r, uint64_t a) {
   37|  2.54M|   *r = a;
   38|  2.54M|}
secp256k1.c:secp256k1_i128_mul:
   49|  11.1M|static SECP256K1_INLINE void secp256k1_i128_mul(secp256k1_int128 *r, int64_t a, int64_t b) {
   50|  11.1M|   *r = (int128_t)a * b;
   51|  11.1M|}
secp256k1.c:secp256k1_i128_accum_mul:
   53|   110M|static SECP256K1_INLINE void secp256k1_i128_accum_mul(secp256k1_int128 *r, int64_t a, int64_t b) {
   54|   110M|   int128_t ab = (int128_t)a * b;
   55|   110M|   VERIFY_CHECK(0 <= ab ? *r <= INT128_MAX - ab : INT128_MIN - ab <= *r);
   56|   110M|   *r += ab;
   57|   110M|}
secp256k1.c:secp256k1_i128_to_u64:
   71|  47.0M|static SECP256K1_INLINE uint64_t secp256k1_i128_to_u64(const secp256k1_int128 *a) {
   72|  47.0M|   return (uint64_t)*a;
   73|  47.0M|}
secp256k1.c:secp256k1_i128_rshift:
   66|  52.5M|static SECP256K1_INLINE void secp256k1_i128_rshift(secp256k1_int128 *r, unsigned int n) {
   67|  52.5M|   VERIFY_CHECK(n < 128);
   68|  52.5M|   *r >>= n;
   69|  52.5M|}
secp256k1.c:secp256k1_i128_to_i64:
   75|  11.1M|static SECP256K1_INLINE int64_t secp256k1_i128_to_i64(const secp256k1_int128 *a) {
   76|  11.1M|   VERIFY_CHECK(INT64_MIN <= *a && *a <= INT64_MAX);
   77|  11.1M|   return *a;
   78|  11.1M|}

secp256k1.c:secp256k1_modinv64_var:
  637|  76.9k|static void secp256k1_modinv64_var(secp256k1_modinv64_signed62 *x, const secp256k1_modinv64_modinfo *modinfo) {
  638|       |    /* Start with d=0, e=1, f=modulus, g=x, eta=-1. */
  639|  76.9k|    secp256k1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
  640|  76.9k|    secp256k1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
  641|  76.9k|    secp256k1_modinv64_signed62 f = modinfo->modulus;
  642|  76.9k|    secp256k1_modinv64_signed62 g = *x;
  643|       |#ifdef VERIFY
  644|       |    int i = 0;
  645|       |#endif
  646|  76.9k|    int j, len = 5;
  647|  76.9k|    int64_t eta = -1; /* eta = -delta; delta is initially 1 */
  648|  76.9k|    int64_t cond, fn, gn;
  649|       |
  650|       |    /* Do iterations of 62 divsteps each until g=0. */
  651|   692k|    while (1) {
  ------------------
  |  Branch (651:12): [True: 692k, Folded]
  ------------------
  652|       |        /* Compute transition matrix and new eta after 62 divsteps. */
  653|   692k|        secp256k1_modinv64_trans2x2 t;
  654|   692k|        eta = secp256k1_modinv64_divsteps_62_var(eta, f.v[0], g.v[0], &t);
  655|       |        /* Update d,e using that transition matrix. */
  656|   692k|        secp256k1_modinv64_update_de_62(&d, &e, &t, modinfo);
  657|       |        /* Update f,g using that transition matrix. */
  658|   692k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
  659|   692k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  660|   692k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
  661|   692k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  662|       |
  663|   692k|        secp256k1_modinv64_update_fg_62_var(len, &f, &g, &t);
  664|       |        /* If the bottom limb of g is zero, there is a chance that g=0. */
  665|   692k|        if (g.v[0] == 0) {
  ------------------
  |  Branch (665:13): [True: 76.9k, False: 615k]
  ------------------
  666|  76.9k|            cond = 0;
  667|       |            /* Check if the other limbs are also 0. */
  668|  76.9k|            for (j = 1; j < len; ++j) {
  ------------------
  |  Branch (668:25): [True: 0, False: 76.9k]
  ------------------
  669|      0|                cond |= g.v[j];
  670|      0|            }
  671|       |            /* If so, we're done. */
  672|  76.9k|            if (cond == 0) break;
  ------------------
  |  Branch (672:17): [True: 76.9k, False: 0]
  ------------------
  673|  76.9k|        }
  674|       |
  675|       |        /* Determine if len>1 and limb (len-1) of both f and g is 0 or -1. */
  676|   615k|        fn = f.v[len - 1];
  677|   615k|        gn = g.v[len - 1];
  678|   615k|        cond = ((int64_t)len - 2) >> 63;
  679|   615k|        cond |= fn ^ (fn >> 63);
  680|   615k|        cond |= gn ^ (gn >> 63);
  681|       |        /* If so, reduce length, propagating the sign of f and g's top limb into the one below. */
  682|   615k|        if (cond == 0) {
  ------------------
  |  Branch (682:13): [True: 307k, False: 308k]
  ------------------
  683|   307k|            f.v[len - 2] |= (uint64_t)fn << 62;
  684|   307k|            g.v[len - 2] |= (uint64_t)gn << 62;
  685|   307k|            --len;
  686|   307k|        }
  687|       |
  688|   615k|        VERIFY_CHECK(++i < 12); /* We should never need more than 12*62 = 744 divsteps */
  689|   615k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, -1) > 0); /* f > -modulus */
  690|   615k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  691|   615k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, -1) > 0); /* g > -modulus */
  692|   615k|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  693|   615k|    }
  694|       |
  695|       |    /* At this point g is 0 and (if g was not originally 0) f must now equal +/- GCD of
  696|       |     * the initial f, g values i.e. +/- 1, and d now contains +/- the modular inverse. */
  697|       |
  698|       |    /* g == 0 */
  699|  76.9k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, len, &SECP256K1_SIGNED62_ONE, 0) == 0);
  700|       |    /* |f| == 1, or (x == 0 and d == 0 and f == modulus) */
  701|  76.9k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
  702|  76.9k|                 secp256k1_modinv64_mul_cmp_62(&f, len, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
  703|  76.9k|                 (secp256k1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  704|  76.9k|                  secp256k1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  705|  76.9k|                  secp256k1_modinv64_mul_cmp_62(&f, len, &modinfo->modulus, 1) == 0));
  706|       |
  707|       |    /* Optionally negate d, normalize to [0,modulus), and return it. */
  708|  76.9k|    secp256k1_modinv64_normalize_62(&d, f.v[len - 1], modinfo);
  709|  76.9k|    *x = d;
  710|  76.9k|}
secp256k1.c:secp256k1_modinv64_divsteps_62_var:
  239|   692k|static int64_t secp256k1_modinv64_divsteps_62_var(int64_t eta, uint64_t f0, uint64_t g0, secp256k1_modinv64_trans2x2 *t) {
  240|       |    /* Transformation matrix; see comments in secp256k1_modinv64_divsteps_62. */
  241|   692k|    uint64_t u = 1, v = 0, q = 0, r = 1;
  242|   692k|    uint64_t f = f0, g = g0, m;
  243|   692k|    uint32_t w;
  244|   692k|    int i = 62, limit, zeros;
  245|       |
  246|  11.3M|    for (;;) {
  247|       |        /* Use a sentinel bit to count zeros only up to i. */
  248|  11.3M|        zeros = secp256k1_ctz64_var(g | (UINT64_MAX << i));
  249|       |        /* Perform zeros divsteps at once; they all just divide g by two. */
  250|  11.3M|        g >>= zeros;
  251|  11.3M|        u <<= zeros;
  252|  11.3M|        v <<= zeros;
  253|  11.3M|        eta -= zeros;
  254|  11.3M|        i -= zeros;
  255|       |        /* We're done once we've done 62 divsteps. */
  256|  11.3M|        if (i == 0) break;
  ------------------
  |  Branch (256:13): [True: 692k, False: 10.6M]
  ------------------
  257|  10.6M|        VERIFY_CHECK((f & 1) == 1);
  258|  10.6M|        VERIFY_CHECK((g & 1) == 1);
  259|  10.6M|        VERIFY_CHECK((u * f0 + v * g0) == f << (62 - i));
  260|  10.6M|        VERIFY_CHECK((q * f0 + r * g0) == g << (62 - i));
  261|       |        /* Bounds on eta that follow from the bounds on iteration count (max 12*62 divsteps). */
  262|  10.6M|        VERIFY_CHECK(eta >= -745 && eta <= 745);
  263|       |        /* If eta is negative, negate it and replace f,g with g,-f. */
  264|  10.6M|        if (eta < 0) {
  ------------------
  |  Branch (264:13): [True: 10.2M, False: 365k]
  ------------------
  265|  10.2M|            uint64_t tmp;
  266|  10.2M|            eta = -eta;
  267|  10.2M|            tmp = f; f = g; g = -tmp;
  268|  10.2M|            tmp = u; u = q; q = -tmp;
  269|  10.2M|            tmp = v; v = r; r = -tmp;
  270|       |            /* Use a formula to cancel out up to 6 bits of g. Also, no more than i can be cancelled
  271|       |             * out (as we'd be done before that point), and no more than eta+1 can be done as its
  272|       |             * sign will flip again once that happens. */
  273|  10.2M|            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
  ------------------
  |  Branch (273:21): [True: 206k, False: 10.0M]
  ------------------
  274|  10.2M|            VERIFY_CHECK(limit > 0 && limit <= 62);
  275|       |            /* m is a mask for the bottom min(limit, 6) bits. */
  276|  10.2M|            m = (UINT64_MAX >> (64 - limit)) & 63U;
  277|       |            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 6)
  278|       |             * bits. */
  279|  10.2M|            w = (f * g * (f * f - 2)) & m;
  280|  10.2M|        } else {
  281|       |            /* In this branch, use a simpler formula that only lets us cancel up to 4 bits of g, as
  282|       |             * eta tends to be smaller here. */
  283|   365k|            limit = ((int)eta + 1) > i ? i : ((int)eta + 1);
  ------------------
  |  Branch (283:21): [True: 2.73k, False: 362k]
  ------------------
  284|   365k|            VERIFY_CHECK(limit > 0 && limit <= 62);
  285|       |            /* m is a mask for the bottom min(limit, 4) bits. */
  286|   365k|            m = (UINT64_MAX >> (64 - limit)) & 15U;
  287|       |            /* Find what multiple of f must be added to g to cancel its bottom min(limit, 4)
  288|       |             * bits. */
  289|   365k|            w = f + (((f + 1) & 4) << 1);
  290|   365k|            w = (-w * g) & m;
  291|   365k|        }
  292|  10.6M|        g += f * w;
  293|  10.6M|        q += u * w;
  294|  10.6M|        r += v * w;
  295|  10.6M|        VERIFY_CHECK((g & m) == 0);
  296|  10.6M|    }
  297|       |    /* Return data in t and return value. */
  298|   692k|    t->u = (int64_t)u;
  299|   692k|    t->v = (int64_t)v;
  300|   692k|    t->q = (int64_t)q;
  301|   692k|    t->r = (int64_t)r;
  302|       |
  303|       |    /* The determinant of t must be a power of two. This guarantees that multiplication with t
  304|       |     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
  305|       |     * will be divided out again). As each divstep's individual matrix has determinant 2, the
  306|       |     * aggregate of 62 of them will have determinant 2^62. */
  307|   692k|    VERIFY_CHECK(secp256k1_modinv64_det_check_pow2(t, 62, 0));
  308|       |
  309|   692k|    return eta;
  310|   692k|}
secp256k1.c:secp256k1_modinv64_update_de_62:
  411|  2.78M|static void secp256k1_modinv64_update_de_62(secp256k1_modinv64_signed62 *d, secp256k1_modinv64_signed62 *e, const secp256k1_modinv64_trans2x2 *t, const secp256k1_modinv64_modinfo* modinfo) {
  412|  2.78M|    const uint64_t M62 = UINT64_MAX >> 2;
  413|  2.78M|    const int64_t d0 = d->v[0], d1 = d->v[1], d2 = d->v[2], d3 = d->v[3], d4 = d->v[4];
  414|  2.78M|    const int64_t e0 = e->v[0], e1 = e->v[1], e2 = e->v[2], e3 = e->v[3], e4 = e->v[4];
  415|  2.78M|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  416|  2.78M|    int64_t md, me, sd, se;
  417|  2.78M|    secp256k1_int128 cd, ce;
  418|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
  419|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
  420|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
  421|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
  422|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_abs(u) <= (((int64_t)1 << 62) - secp256k1_modinv64_abs(v))); /* |u|+|v| <= 2^62 */
  423|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_abs(q) <= (((int64_t)1 << 62) - secp256k1_modinv64_abs(r))); /* |q|+|r| <= 2^62 */
  424|       |
  425|       |    /* [md,me] start as zero; plus [u,q] if d is negative; plus [v,r] if e is negative. */
  426|  2.78M|    sd = d4 >> 63;
  427|  2.78M|    se = e4 >> 63;
  428|  2.78M|    md = (u & sd) + (v & se);
  429|  2.78M|    me = (q & sd) + (r & se);
  430|       |    /* Begin computing t*[d,e]. */
  431|  2.78M|    secp256k1_i128_mul(&cd, u, d0);
  432|  2.78M|    secp256k1_i128_accum_mul(&cd, v, e0);
  433|  2.78M|    secp256k1_i128_mul(&ce, q, d0);
  434|  2.78M|    secp256k1_i128_accum_mul(&ce, r, e0);
  435|       |    /* Correct md,me so that t*[d,e]+modulus*[md,me] has 62 zero bottom bits. */
  436|  2.78M|    md -= (modinfo->modulus_inv62 * secp256k1_i128_to_u64(&cd) + md) & M62;
  437|  2.78M|    me -= (modinfo->modulus_inv62 * secp256k1_i128_to_u64(&ce) + me) & M62;
  438|       |    /* Update the beginning of computation for t*[d,e]+modulus*[md,me] now md,me are known. */
  439|  2.78M|    secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[0], md);
  440|  2.78M|    secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[0], me);
  441|       |    /* Verify that the low 62 bits of the computation are indeed zero, and then throw them away. */
  442|  2.78M|    VERIFY_CHECK((secp256k1_i128_to_u64(&cd) & M62) == 0); secp256k1_i128_rshift(&cd, 62);
  443|  2.78M|    VERIFY_CHECK((secp256k1_i128_to_u64(&ce) & M62) == 0); secp256k1_i128_rshift(&ce, 62);
  444|       |    /* Compute limb 1 of t*[d,e]+modulus*[md,me], and store it as output limb 0 (= down shift). */
  445|  2.78M|    secp256k1_i128_accum_mul(&cd, u, d1);
  446|  2.78M|    secp256k1_i128_accum_mul(&cd, v, e1);
  447|  2.78M|    secp256k1_i128_accum_mul(&ce, q, d1);
  448|  2.78M|    secp256k1_i128_accum_mul(&ce, r, e1);
  449|  2.78M|    if (modinfo->modulus.v[1]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (449:9): [True: 1.36M, False: 1.42M]
  ------------------
  450|  1.36M|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[1], md);
  451|  1.36M|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[1], me);
  452|  1.36M|    }
  453|  2.78M|    d->v[0] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  454|  2.78M|    e->v[0] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  455|       |    /* Compute limb 2 of t*[d,e]+modulus*[md,me], and store it as output limb 1. */
  456|  2.78M|    secp256k1_i128_accum_mul(&cd, u, d2);
  457|  2.78M|    secp256k1_i128_accum_mul(&cd, v, e2);
  458|  2.78M|    secp256k1_i128_accum_mul(&ce, q, d2);
  459|  2.78M|    secp256k1_i128_accum_mul(&ce, r, e2);
  460|  2.78M|    if (modinfo->modulus.v[2]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (460:9): [True: 1.36M, False: 1.42M]
  ------------------
  461|  1.36M|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[2], md);
  462|  1.36M|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[2], me);
  463|  1.36M|    }
  464|  2.78M|    d->v[1] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  465|  2.78M|    e->v[1] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  466|       |    /* Compute limb 3 of t*[d,e]+modulus*[md,me], and store it as output limb 2. */
  467|  2.78M|    secp256k1_i128_accum_mul(&cd, u, d3);
  468|  2.78M|    secp256k1_i128_accum_mul(&cd, v, e3);
  469|  2.78M|    secp256k1_i128_accum_mul(&ce, q, d3);
  470|  2.78M|    secp256k1_i128_accum_mul(&ce, r, e3);
  471|  2.78M|    if (modinfo->modulus.v[3]) { /* Optimize for the case where limb of modulus is zero. */
  ------------------
  |  Branch (471:9): [True: 0, False: 2.78M]
  ------------------
  472|      0|        secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[3], md);
  473|      0|        secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[3], me);
  474|      0|    }
  475|  2.78M|    d->v[2] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  476|  2.78M|    e->v[2] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  477|       |    /* Compute limb 4 of t*[d,e]+modulus*[md,me], and store it as output limb 3. */
  478|  2.78M|    secp256k1_i128_accum_mul(&cd, u, d4);
  479|  2.78M|    secp256k1_i128_accum_mul(&cd, v, e4);
  480|  2.78M|    secp256k1_i128_accum_mul(&ce, q, d4);
  481|  2.78M|    secp256k1_i128_accum_mul(&ce, r, e4);
  482|  2.78M|    secp256k1_i128_accum_mul(&cd, modinfo->modulus.v[4], md);
  483|  2.78M|    secp256k1_i128_accum_mul(&ce, modinfo->modulus.v[4], me);
  484|  2.78M|    d->v[3] = secp256k1_i128_to_u64(&cd) & M62; secp256k1_i128_rshift(&cd, 62);
  485|  2.78M|    e->v[3] = secp256k1_i128_to_u64(&ce) & M62; secp256k1_i128_rshift(&ce, 62);
  486|       |    /* What remains is limb 5 of t*[d,e]+modulus*[md,me]; store it as output limb 4. */
  487|  2.78M|    d->v[4] = secp256k1_i128_to_i64(&cd);
  488|  2.78M|    e->v[4] = secp256k1_i128_to_i64(&ce);
  489|       |
  490|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, -2) > 0); /* d > -2*modulus */
  491|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(d, 5, &modinfo->modulus, 1) < 0);  /* d <    modulus */
  492|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, -2) > 0); /* e > -2*modulus */
  493|  2.78M|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(e, 5, &modinfo->modulus, 1) < 0);  /* e <    modulus */
  494|  2.78M|}
secp256k1.c:secp256k1_modinv64_update_fg_62_var:
  553|   692k|static void secp256k1_modinv64_update_fg_62_var(int len, secp256k1_modinv64_signed62 *f, secp256k1_modinv64_signed62 *g, const secp256k1_modinv64_trans2x2 *t) {
  554|   692k|    const uint64_t M62 = UINT64_MAX >> 2;
  555|   692k|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  556|   692k|    int64_t fi, gi;
  557|   692k|    secp256k1_int128 cf, cg;
  558|   692k|    int i;
  559|   692k|    VERIFY_CHECK(len > 0);
  560|       |    /* Start computing t*[f,g]. */
  561|   692k|    fi = f->v[0];
  562|   692k|    gi = g->v[0];
  563|   692k|    secp256k1_i128_mul(&cf, u, fi);
  564|   692k|    secp256k1_i128_accum_mul(&cf, v, gi);
  565|   692k|    secp256k1_i128_mul(&cg, q, fi);
  566|   692k|    secp256k1_i128_accum_mul(&cg, r, gi);
  567|       |    /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
  568|   692k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cf) & M62) == 0); secp256k1_i128_rshift(&cf, 62);
  569|   692k|    VERIFY_CHECK((secp256k1_i128_to_u64(&cg) & M62) == 0); secp256k1_i128_rshift(&cg, 62);
  570|       |    /* Now iteratively compute limb i=1..len of t*[f,g], and store them in output limb i-1 (shifting
  571|       |     * down by 62 bits). */
  572|  1.92M|    for (i = 1; i < len; ++i) {
  ------------------
  |  Branch (572:17): [True: 1.23M, False: 692k]
  ------------------
  573|  1.23M|        fi = f->v[i];
  574|  1.23M|        gi = g->v[i];
  575|  1.23M|        secp256k1_i128_accum_mul(&cf, u, fi);
  576|  1.23M|        secp256k1_i128_accum_mul(&cf, v, gi);
  577|  1.23M|        secp256k1_i128_accum_mul(&cg, q, fi);
  578|  1.23M|        secp256k1_i128_accum_mul(&cg, r, gi);
  579|  1.23M|        f->v[i - 1] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  580|  1.23M|        g->v[i - 1] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  581|  1.23M|    }
  582|       |    /* What remains is limb (len) of t*[f,g]; store it as output limb (len-1). */
  583|   692k|    f->v[len - 1] = secp256k1_i128_to_i64(&cf);
  584|   692k|    g->v[len - 1] = secp256k1_i128_to_i64(&cg);
  585|   692k|}
secp256k1.c:secp256k1_modinv64_normalize_62:
   88|   286k|static void secp256k1_modinv64_normalize_62(secp256k1_modinv64_signed62 *r, int64_t sign, const secp256k1_modinv64_modinfo *modinfo) {
   89|   286k|    const int64_t M62 = (int64_t)(UINT64_MAX >> 2);
   90|   286k|    int64_t r0 = r->v[0], r1 = r->v[1], r2 = r->v[2], r3 = r->v[3], r4 = r->v[4];
   91|   286k|    volatile int64_t cond_add, cond_negate;
   92|       |
   93|       |#ifdef VERIFY
   94|       |    /* Verify that all limbs are in range (-2^62,2^62). */
   95|       |    int i;
   96|       |    for (i = 0; i < 5; ++i) {
   97|       |        VERIFY_CHECK(r->v[i] >= -M62);
   98|       |        VERIFY_CHECK(r->v[i] <= M62);
   99|       |    }
  100|       |    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, -2) > 0); /* r > -2*modulus */
  101|       |    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
  102|       |#endif
  103|       |
  104|       |    /* In a first step, add the modulus if the input is negative, and then negate if requested.
  105|       |     * This brings r from range (-2*modulus,modulus) to range (-modulus,modulus). As all input
  106|       |     * limbs are in range (-2^62,2^62), this cannot overflow an int64_t. Note that the right
  107|       |     * shifts below are signed sign-extending shifts (see assumptions.h for tests that that is
  108|       |     * indeed the behavior of the right shift operator). */
  109|   286k|    cond_add = r4 >> 63;
  110|   286k|    r0 += modinfo->modulus.v[0] & cond_add;
  111|   286k|    r1 += modinfo->modulus.v[1] & cond_add;
  112|   286k|    r2 += modinfo->modulus.v[2] & cond_add;
  113|   286k|    r3 += modinfo->modulus.v[3] & cond_add;
  114|   286k|    r4 += modinfo->modulus.v[4] & cond_add;
  115|   286k|    cond_negate = sign >> 63;
  116|   286k|    r0 = (r0 ^ cond_negate) - cond_negate;
  117|   286k|    r1 = (r1 ^ cond_negate) - cond_negate;
  118|   286k|    r2 = (r2 ^ cond_negate) - cond_negate;
  119|   286k|    r3 = (r3 ^ cond_negate) - cond_negate;
  120|   286k|    r4 = (r4 ^ cond_negate) - cond_negate;
  121|       |    /* Propagate the top bits, to bring limbs back to range (-2^62,2^62). */
  122|   286k|    r1 += r0 >> 62; r0 &= M62;
  123|   286k|    r2 += r1 >> 62; r1 &= M62;
  124|   286k|    r3 += r2 >> 62; r2 &= M62;
  125|   286k|    r4 += r3 >> 62; r3 &= M62;
  126|       |
  127|       |    /* In a second step add the modulus again if the result is still negative, bringing
  128|       |     * r to range [0,modulus). */
  129|   286k|    cond_add = r4 >> 63;
  130|   286k|    r0 += modinfo->modulus.v[0] & cond_add;
  131|   286k|    r1 += modinfo->modulus.v[1] & cond_add;
  132|   286k|    r2 += modinfo->modulus.v[2] & cond_add;
  133|   286k|    r3 += modinfo->modulus.v[3] & cond_add;
  134|   286k|    r4 += modinfo->modulus.v[4] & cond_add;
  135|       |    /* And propagate again. */
  136|   286k|    r1 += r0 >> 62; r0 &= M62;
  137|   286k|    r2 += r1 >> 62; r1 &= M62;
  138|   286k|    r3 += r2 >> 62; r2 &= M62;
  139|   286k|    r4 += r3 >> 62; r3 &= M62;
  140|       |
  141|   286k|    r->v[0] = r0;
  142|   286k|    r->v[1] = r1;
  143|   286k|    r->v[2] = r2;
  144|   286k|    r->v[3] = r3;
  145|   286k|    r->v[4] = r4;
  146|       |
  147|   286k|    VERIFY_CHECK(r0 >> 62 == 0);
  148|   286k|    VERIFY_CHECK(r1 >> 62 == 0);
  149|   286k|    VERIFY_CHECK(r2 >> 62 == 0);
  150|   286k|    VERIFY_CHECK(r3 >> 62 == 0);
  151|   286k|    VERIFY_CHECK(r4 >> 62 == 0);
  152|   286k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 0) >= 0); /* r >= 0 */
  153|   286k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(r, 5, &modinfo->modulus, 1) < 0); /* r < modulus */
  154|   286k|}
secp256k1.c:secp256k1_modinv64:
  588|   209k|static void secp256k1_modinv64(secp256k1_modinv64_signed62 *x, const secp256k1_modinv64_modinfo *modinfo) {
  589|       |    /* Start with d=0, e=1, f=modulus, g=x, zeta=-1. */
  590|   209k|    secp256k1_modinv64_signed62 d = {{0, 0, 0, 0, 0}};
  591|   209k|    secp256k1_modinv64_signed62 e = {{1, 0, 0, 0, 0}};
  592|   209k|    secp256k1_modinv64_signed62 f = modinfo->modulus;
  593|   209k|    secp256k1_modinv64_signed62 g = *x;
  594|   209k|    int i;
  595|   209k|    int64_t zeta = -1; /* zeta = -(delta+1/2); delta starts at 1/2. */
  596|       |
  597|       |    /* Do 10 iterations of 59 divsteps each = 590 divsteps. This suffices for 256-bit inputs. */
  598|  2.29M|    for (i = 0; i < 10; ++i) {
  ------------------
  |  Branch (598:17): [True: 2.09M, False: 209k]
  ------------------
  599|       |        /* Compute transition matrix and new zeta after 59 divsteps. */
  600|  2.09M|        secp256k1_modinv64_trans2x2 t;
  601|  2.09M|        zeta = secp256k1_modinv64_divsteps_59(zeta, f.v[0], g.v[0], &t);
  602|       |        /* Update d,e using that transition matrix. */
  603|  2.09M|        secp256k1_modinv64_update_de_62(&d, &e, &t, modinfo);
  604|       |        /* Update f,g using that transition matrix. */
  605|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
  606|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  607|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
  608|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  609|       |
  610|  2.09M|        secp256k1_modinv64_update_fg_62(&f, &g, &t);
  611|       |
  612|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, -1) > 0); /* f > -modulus */
  613|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) <= 0); /* f <= modulus */
  614|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, -1) > 0); /* g > -modulus */
  615|  2.09M|        VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &modinfo->modulus, 1) < 0);  /* g <  modulus */
  616|  2.09M|    }
  617|       |
  618|       |    /* At this point sufficient iterations have been performed that g must have reached 0
  619|       |     * and (if g was not originally 0) f must now equal +/- GCD of the initial f, g
  620|       |     * values i.e. +/- 1, and d now contains +/- the modular inverse. */
  621|       |
  622|       |    /* g == 0 */
  623|   209k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&g, 5, &SECP256K1_SIGNED62_ONE, 0) == 0);
  624|       |    /* |f| == 1, or (x == 0 and d == 0 and f == modulus) */
  625|   209k|    VERIFY_CHECK(secp256k1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, -1) == 0 ||
  626|   209k|                 secp256k1_modinv64_mul_cmp_62(&f, 5, &SECP256K1_SIGNED62_ONE, 1) == 0 ||
  627|   209k|                 (secp256k1_modinv64_mul_cmp_62(x, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  628|   209k|                  secp256k1_modinv64_mul_cmp_62(&d, 5, &SECP256K1_SIGNED62_ONE, 0) == 0 &&
  629|   209k|                  secp256k1_modinv64_mul_cmp_62(&f, 5, &modinfo->modulus, 1) == 0));
  630|       |
  631|       |    /* Optionally negate d, normalize to [0,modulus), and return it. */
  632|   209k|    secp256k1_modinv64_normalize_62(&d, f.v[4], modinfo);
  633|   209k|    *x = d;
  634|   209k|}
secp256k1.c:secp256k1_modinv64_divsteps_59:
  167|  2.09M|static int64_t secp256k1_modinv64_divsteps_59(int64_t zeta, uint64_t f0, uint64_t g0, secp256k1_modinv64_trans2x2 *t) {
  168|       |    /* u,v,q,r are the elements of the transformation matrix being built up,
  169|       |     * starting with the identity matrix times 8 (because the caller expects
  170|       |     * a result scaled by 2^62). Semantically they are signed integers
  171|       |     * in range [-2^62,2^62], but here represented as unsigned mod 2^64. This
  172|       |     * permits left shifting (which is UB for negative numbers). The range
  173|       |     * being inside [-2^63,2^63) means that casting to signed works correctly.
  174|       |     */
  175|  2.09M|    uint64_t u = 8, v = 0, q = 0, r = 8;
  176|  2.09M|    volatile uint64_t c1, c2;
  177|  2.09M|    uint64_t mask1, mask2, f = f0, g = g0, x, y, z;
  178|  2.09M|    int i;
  179|       |
  180|   125M|    for (i = 3; i < 62; ++i) {
  ------------------
  |  Branch (180:17): [True: 123M, False: 2.09M]
  ------------------
  181|   123M|        VERIFY_CHECK((f & 1) == 1); /* f must always be odd */
  182|   123M|        VERIFY_CHECK((u * f0 + v * g0) == f << i);
  183|   123M|        VERIFY_CHECK((q * f0 + r * g0) == g << i);
  184|       |        /* Compute conditional masks for (zeta < 0) and for (g & 1). */
  185|   123M|        c1 = zeta >> 63;
  186|   123M|        mask1 = c1;
  187|   123M|        c2 = g & 1;
  188|   123M|        mask2 = -c2;
  189|       |        /* Compute x,y,z, conditionally negated versions of f,u,v. */
  190|   123M|        x = (f ^ mask1) - mask1;
  191|   123M|        y = (u ^ mask1) - mask1;
  192|   123M|        z = (v ^ mask1) - mask1;
  193|       |        /* Conditionally add x,y,z to g,q,r. */
  194|   123M|        g += x & mask2;
  195|   123M|        q += y & mask2;
  196|   123M|        r += z & mask2;
  197|       |        /* In what follows, c1 is a condition mask for (zeta < 0) and (g & 1). */
  198|   123M|        mask1 &= mask2;
  199|       |        /* Conditionally change zeta into -zeta-2 or zeta-1. */
  200|   123M|        zeta = (zeta ^ mask1) - 1;
  201|       |        /* Conditionally add g,q,r to f,u,v. */
  202|   123M|        f += g & mask1;
  203|   123M|        u += q & mask1;
  204|   123M|        v += r & mask1;
  205|       |        /* Shifts */
  206|   123M|        g >>= 1;
  207|   123M|        u <<= 1;
  208|   123M|        v <<= 1;
  209|       |        /* Bounds on zeta that follow from the bounds on iteration count (max 10*59 divsteps). */
  210|   123M|        VERIFY_CHECK(zeta >= -591 && zeta <= 591);
  211|   123M|    }
  212|       |    /* Return data in t and return value. */
  213|  2.09M|    t->u = (int64_t)u;
  214|  2.09M|    t->v = (int64_t)v;
  215|  2.09M|    t->q = (int64_t)q;
  216|  2.09M|    t->r = (int64_t)r;
  217|       |
  218|       |    /* The determinant of t must be a power of two. This guarantees that multiplication with t
  219|       |     * does not change the gcd of f and g, apart from adding a power-of-2 factor to it (which
  220|       |     * will be divided out again). As each divstep's individual matrix has determinant 2, the
  221|       |     * aggregate of 59 of them will have determinant 2^59. Multiplying with the initial
  222|       |     * 8*identity (which has determinant 2^6) means the overall outputs has determinant
  223|       |     * 2^65. */
  224|  2.09M|    VERIFY_CHECK(secp256k1_modinv64_det_check_pow2(t, 65, 0));
  225|       |
  226|  2.09M|    return zeta;
  227|  2.09M|}
secp256k1.c:secp256k1_modinv64_update_fg_62:
  500|  2.09M|static void secp256k1_modinv64_update_fg_62(secp256k1_modinv64_signed62 *f, secp256k1_modinv64_signed62 *g, const secp256k1_modinv64_trans2x2 *t) {
  501|  2.09M|    const uint64_t M62 = UINT64_MAX >> 2;
  502|  2.09M|    const int64_t f0 = f->v[0], f1 = f->v[1], f2 = f->v[2], f3 = f->v[3], f4 = f->v[4];
  503|  2.09M|    const int64_t g0 = g->v[0], g1 = g->v[1], g2 = g->v[2], g3 = g->v[3], g4 = g->v[4];
  504|  2.09M|    const int64_t u = t->u, v = t->v, q = t->q, r = t->r;
  505|  2.09M|    secp256k1_int128 cf, cg;
  506|       |    /* Start computing t*[f,g]. */
  507|  2.09M|    secp256k1_i128_mul(&cf, u, f0);
  508|  2.09M|    secp256k1_i128_accum_mul(&cf, v, g0);
  509|  2.09M|    secp256k1_i128_mul(&cg, q, f0);
  510|  2.09M|    secp256k1_i128_accum_mul(&cg, r, g0);
  511|       |    /* Verify that the bottom 62 bits of the result are zero, and then throw them away. */
  512|  2.09M|    VERIFY_CHECK((secp256k1_i128_to_u64(&cf) & M62) == 0); secp256k1_i128_rshift(&cf, 62);
  513|  2.09M|    VERIFY_CHECK((secp256k1_i128_to_u64(&cg) & M62) == 0); secp256k1_i128_rshift(&cg, 62);
  514|       |    /* Compute limb 1 of t*[f,g], and store it as output limb 0 (= down shift). */
  515|  2.09M|    secp256k1_i128_accum_mul(&cf, u, f1);
  516|  2.09M|    secp256k1_i128_accum_mul(&cf, v, g1);
  517|  2.09M|    secp256k1_i128_accum_mul(&cg, q, f1);
  518|  2.09M|    secp256k1_i128_accum_mul(&cg, r, g1);
  519|  2.09M|    f->v[0] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  520|  2.09M|    g->v[0] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  521|       |    /* Compute limb 2 of t*[f,g], and store it as output limb 1. */
  522|  2.09M|    secp256k1_i128_accum_mul(&cf, u, f2);
  523|  2.09M|    secp256k1_i128_accum_mul(&cf, v, g2);
  524|  2.09M|    secp256k1_i128_accum_mul(&cg, q, f2);
  525|  2.09M|    secp256k1_i128_accum_mul(&cg, r, g2);
  526|  2.09M|    f->v[1] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  527|  2.09M|    g->v[1] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  528|       |    /* Compute limb 3 of t*[f,g], and store it as output limb 2. */
  529|  2.09M|    secp256k1_i128_accum_mul(&cf, u, f3);
  530|  2.09M|    secp256k1_i128_accum_mul(&cf, v, g3);
  531|  2.09M|    secp256k1_i128_accum_mul(&cg, q, f3);
  532|  2.09M|    secp256k1_i128_accum_mul(&cg, r, g3);
  533|  2.09M|    f->v[2] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  534|  2.09M|    g->v[2] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  535|       |    /* Compute limb 4 of t*[f,g], and store it as output limb 3. */
  536|  2.09M|    secp256k1_i128_accum_mul(&cf, u, f4);
  537|  2.09M|    secp256k1_i128_accum_mul(&cf, v, g4);
  538|  2.09M|    secp256k1_i128_accum_mul(&cg, q, f4);
  539|  2.09M|    secp256k1_i128_accum_mul(&cg, r, g4);
  540|  2.09M|    f->v[3] = secp256k1_i128_to_u64(&cf) & M62; secp256k1_i128_rshift(&cf, 62);
  541|  2.09M|    g->v[3] = secp256k1_i128_to_u64(&cg) & M62; secp256k1_i128_rshift(&cg, 62);
  542|       |    /* What remains is limb 5 of t*[f,g]; store it as output limb 4. */
  543|  2.09M|    f->v[4] = secp256k1_i128_to_i64(&cf);
  544|  2.09M|    g->v[4] = secp256k1_i128_to_i64(&cg);
  545|  2.09M|}

secp256k1_xonly_pubkey_parse:
   29|  1.67k|int secp256k1_xonly_pubkey_parse(const secp256k1_context* ctx, secp256k1_xonly_pubkey *pubkey, const unsigned char *input32) {
   30|  1.67k|    secp256k1_ge pk;
   31|  1.67k|    secp256k1_fe x;
   32|       |
   33|  1.67k|    VERIFY_CHECK(ctx != NULL);
   34|  1.67k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  1.67k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.67k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.67k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.67k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.67k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.67k]
  |  |  ------------------
  ------------------
   35|  1.67k|    memset(pubkey, 0, sizeof(*pubkey));
   36|  1.67k|    ARG_CHECK(input32 != NULL);
  ------------------
  |  |   45|  1.67k|#define ARG_CHECK(cond) do { \
  |  |   46|  1.67k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  1.67k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 1.67k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  1.67k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 1.67k]
  |  |  ------------------
  ------------------
   37|       |
   38|  1.67k|    if (!secp256k1_fe_set_b32_limit(&x, input32)) {
  ------------------
  |  |   88|  1.67k|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  |  Branch (38:9): [True: 15, False: 1.65k]
  ------------------
   39|     15|        return 0;
   40|     15|    }
   41|  1.65k|    if (!secp256k1_ge_set_xo_var(&pk, &x, 0)) {
  ------------------
  |  Branch (41:9): [True: 991, False: 668]
  ------------------
   42|    991|        return 0;
   43|    991|    }
   44|    668|    if (!secp256k1_ge_is_in_correct_subgroup(&pk)) {
  ------------------
  |  Branch (44:9): [True: 0, False: 668]
  ------------------
   45|      0|        return 0;
   46|      0|    }
   47|    668|    secp256k1_xonly_pubkey_save(pubkey, &pk);
   48|    668|    return 1;
   49|    668|}
secp256k1_xonly_pubkey_tweak_add_check:
  142|    387|int secp256k1_xonly_pubkey_tweak_add_check(const secp256k1_context* ctx, const unsigned char *tweaked_pubkey32, int tweaked_pk_parity, const secp256k1_xonly_pubkey *internal_pubkey, const unsigned char *tweak32) {
  143|    387|    secp256k1_ge pk;
  144|    387|    unsigned char pk_expected32[32];
  145|       |
  146|    387|    VERIFY_CHECK(ctx != NULL);
  147|    387|    ARG_CHECK(internal_pubkey != NULL);
  ------------------
  |  |   45|    387|#define ARG_CHECK(cond) do { \
  |  |   46|    387|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|    387|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 387]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    387|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 387]
  |  |  ------------------
  ------------------
  148|    387|    ARG_CHECK(tweaked_pubkey32 != NULL);
  ------------------
  |  |   45|    387|#define ARG_CHECK(cond) do { \
  |  |   46|    387|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|    387|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 387]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    387|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 387]
  |  |  ------------------
  ------------------
  149|    387|    ARG_CHECK(tweak32 != NULL);
  ------------------
  |  |   45|    387|#define ARG_CHECK(cond) do { \
  |  |   46|    387|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|    387|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 387]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    387|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 387]
  |  |  ------------------
  ------------------
  150|       |
  151|    387|    if (!secp256k1_xonly_pubkey_load(ctx, &pk, internal_pubkey)
  ------------------
  |  Branch (151:9): [True: 0, False: 387]
  ------------------
  152|    387|        || !secp256k1_ec_pubkey_tweak_add_helper(&pk, tweak32)) {
  ------------------
  |  Branch (152:12): [True: 0, False: 387]
  ------------------
  153|      0|        return 0;
  154|      0|    }
  155|    387|    secp256k1_fe_normalize_var(&pk.x);
  ------------------
  |  |   80|    387|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  156|    387|    secp256k1_fe_normalize_var(&pk.y);
  ------------------
  |  |   80|    387|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  157|    387|    secp256k1_fe_get_b32(pk_expected32, &pk.x);
  ------------------
  |  |   89|    387|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
  158|       |
  159|    387|    return secp256k1_memcmp_var(&pk_expected32, tweaked_pubkey32, 32) == 0
  ------------------
  |  Branch (159:12): [True: 0, False: 387]
  ------------------
  160|      0|            && secp256k1_fe_is_odd(&pk.y) == tweaked_pk_parity;
  ------------------
  |  |   85|      0|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  |  Branch (160:16): [True: 0, False: 0]
  ------------------
  161|    387|}
secp256k1.c:secp256k1_xonly_pubkey_save:
   18|    668|static SECP256K1_INLINE void secp256k1_xonly_pubkey_save(secp256k1_xonly_pubkey *pubkey, secp256k1_ge *ge) {
   19|       |#ifdef VERIFY
   20|       |    /* ensure that the group element's Y coordinate is even, as per definition of x-only public keys */
   21|       |    secp256k1_fe y = ge->y;
   22|       |    secp256k1_fe_normalize_var(&y);
   23|       |    VERIFY_CHECK(!secp256k1_fe_is_odd(&y));
   24|       |#endif
   25|       |
   26|    668|    secp256k1_pubkey_save((secp256k1_pubkey *) pubkey, ge);
   27|    668|}
secp256k1.c:secp256k1_xonly_pubkey_load:
   14|    649|static SECP256K1_INLINE int secp256k1_xonly_pubkey_load(const secp256k1_context* ctx, secp256k1_ge *ge, const secp256k1_xonly_pubkey *pubkey) {
   15|    649|    return secp256k1_pubkey_load(ctx, ge, (const secp256k1_pubkey *) pubkey);
   16|    649|}

secp256k1_schnorrsig_verify:
  208|    281|int secp256k1_schnorrsig_verify(const secp256k1_context* ctx, const unsigned char *sig64, const unsigned char *msg, size_t msglen, const secp256k1_xonly_pubkey *pubkey) {
  209|    281|    secp256k1_scalar s;
  210|    281|    secp256k1_scalar e;
  211|    281|    secp256k1_gej rj;
  212|    281|    secp256k1_ge pk;
  213|    281|    secp256k1_gej pkj;
  214|    281|    secp256k1_fe rx;
  215|    281|    secp256k1_ge r;
  216|    281|    unsigned char buf[32];
  217|    281|    int overflow;
  218|       |
  219|    281|    VERIFY_CHECK(ctx != NULL);
  220|    281|    ARG_CHECK(sig64 != NULL);
  ------------------
  |  |   45|    281|#define ARG_CHECK(cond) do { \
  |  |   46|    281|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|    281|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 281]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    281|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 281]
  |  |  ------------------
  ------------------
  221|    281|    ARG_CHECK(msg != NULL || msglen == 0);
  ------------------
  |  |   45|    281|#define ARG_CHECK(cond) do { \
  |  |   46|    281|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|    281|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 281]
  |  |  |  |  |  Branch (146:39): [True: 281, False: 0]
  |  |  |  |  |  Branch (146:39): [True: 0, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    281|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 281]
  |  |  ------------------
  ------------------
  222|    281|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|    281|#define ARG_CHECK(cond) do { \
  |  |   46|    281|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|    281|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 281]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|    281|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 281]
  |  |  ------------------
  ------------------
  223|       |
  224|    281|    if (!secp256k1_fe_set_b32_limit(&rx, &sig64[0])) {
  ------------------
  |  |   88|    281|#  define secp256k1_fe_set_b32_limit secp256k1_fe_impl_set_b32_limit
  ------------------
  |  Branch (224:9): [True: 6, False: 275]
  ------------------
  225|      6|        return 0;
  226|      6|    }
  227|       |
  228|    275|    secp256k1_scalar_set_b32(&s, &sig64[32], &overflow);
  229|    275|    if (overflow) {
  ------------------
  |  Branch (229:9): [True: 13, False: 262]
  ------------------
  230|     13|        return 0;
  231|     13|    }
  232|       |
  233|    262|    if (!secp256k1_xonly_pubkey_load(ctx, &pk, pubkey)) {
  ------------------
  |  Branch (233:9): [True: 0, False: 262]
  ------------------
  234|      0|        return 0;
  235|      0|    }
  236|       |
  237|       |    /* Compute e. */
  238|    262|    secp256k1_fe_get_b32(buf, &pk.x);
  ------------------
  |  |   89|    262|#  define secp256k1_fe_get_b32 secp256k1_fe_impl_get_b32
  ------------------
  239|    262|    secp256k1_schnorrsig_challenge(secp256k1_get_hash_context(ctx), &e, &sig64[0], msg, msglen, buf);
  240|       |
  241|       |    /* Compute rj =  s*G + (-e)*pkj */
  242|    262|    secp256k1_scalar_negate(&e, &e);
  243|    262|    secp256k1_gej_set_ge(&pkj, &pk);
  244|    262|    secp256k1_ecmult(&rj, &pkj, &e, &s);
  245|       |
  246|    262|    secp256k1_ge_set_gej_var(&r, &rj);
  247|    262|    if (secp256k1_ge_is_infinity(&r)) {
  ------------------
  |  Branch (247:9): [True: 0, False: 262]
  ------------------
  248|      0|        return 0;
  249|      0|    }
  250|       |
  251|    262|    secp256k1_fe_normalize_var(&r.y);
  ------------------
  |  |   80|    262|#  define secp256k1_fe_normalize_var secp256k1_fe_impl_normalize_var
  ------------------
  252|    262|    return !secp256k1_fe_is_odd(&r.y) &&
  ------------------
  |  |   85|    262|#  define secp256k1_fe_is_odd secp256k1_fe_impl_is_odd
  ------------------
  |  Branch (252:12): [True: 130, False: 132]
  ------------------
  253|    130|           secp256k1_fe_equal(&rx, &r.x);
  ------------------
  |  Branch (253:12): [True: 0, False: 130]
  ------------------
  254|    262|}
secp256k1.c:secp256k1_schnorrsig_challenge:
  107|    262|{
  108|    262|    unsigned char buf[32];
  109|    262|    secp256k1_sha256 sha;
  110|       |
  111|       |    /* tagged hash(r.x, pk.x, msg) */
  112|    262|    secp256k1_schnorrsig_sha256_tagged(&sha);
  113|    262|    secp256k1_sha256_write(hash_ctx, &sha, r32, 32);
  114|    262|    secp256k1_sha256_write(hash_ctx, &sha, pubkey32, 32);
  115|    262|    secp256k1_sha256_write(hash_ctx, &sha, msg, msglen);
  116|    262|    secp256k1_sha256_finalize(hash_ctx, &sha, buf);
  117|       |    /* Set scalar e to the challenge hash modulo the curve order as per
  118|       |     * BIP340. */
  119|       |    secp256k1_scalar_set_b32(e, buf, NULL);
  120|    262|}
secp256k1.c:secp256k1_schnorrsig_sha256_tagged:
   98|    262|static void secp256k1_schnorrsig_sha256_tagged(secp256k1_sha256 *sha) {
   99|    262|    static const uint32_t midstate[8] = {
  100|    262|        0x9cecba11ul, 0x23925381ul, 0x11679112ul, 0xd1627e0ful,
  101|    262|        0x97c87550ul, 0x003cc765ul, 0x90f61164ul, 0x33e9b66aul
  102|    262|    };
  103|    262|    secp256k1_sha256_initialize_midstate(sha, 64, midstate);
  104|    262|}

secp256k1.c:secp256k1_scalar_set_b32:
  147|   927k|static void secp256k1_scalar_set_b32(secp256k1_scalar *r, const unsigned char *b32, int *overflow) {
  148|   927k|    int over;
  149|   927k|    r->d[0] = secp256k1_read_be64(&b32[24]);
  150|   927k|    r->d[1] = secp256k1_read_be64(&b32[16]);
  151|   927k|    r->d[2] = secp256k1_read_be64(&b32[8]);
  152|   927k|    r->d[3] = secp256k1_read_be64(&b32[0]);
  153|   927k|    over = secp256k1_scalar_reduce(r, secp256k1_scalar_check_overflow(r));
  154|   927k|    if (overflow) {
  ------------------
  |  Branch (154:9): [True: 716k, False: 211k]
  ------------------
  155|   716k|        *overflow = over;
  156|   716k|    }
  157|       |
  158|   927k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   927k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  159|   927k|}
secp256k1.c:secp256k1_scalar_reduce:
   76|  1.81M|SECP256K1_INLINE static int secp256k1_scalar_reduce(secp256k1_scalar *r, unsigned int overflow) {
   77|  1.81M|    secp256k1_uint128 t;
   78|  1.81M|    VERIFY_CHECK(overflow <= 1);
   79|       |
   80|  1.81M|    secp256k1_u128_from_u64(&t, r->d[0]);
   81|  1.81M|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_0);
  ------------------
  |  |   22|  1.81M|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|  1.81M|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
   82|  1.81M|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   83|  1.81M|    secp256k1_u128_accum_u64(&t, r->d[1]);
   84|  1.81M|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_1);
  ------------------
  |  |   23|  1.81M|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|  1.81M|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
   85|  1.81M|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   86|  1.81M|    secp256k1_u128_accum_u64(&t, r->d[2]);
   87|  1.81M|    secp256k1_u128_accum_u64(&t, overflow * SECP256K1_N_C_2);
  ------------------
  |  |   24|  1.81M|#define SECP256K1_N_C_2 (1)
  ------------------
   88|  1.81M|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
   89|  1.81M|    secp256k1_u128_accum_u64(&t, r->d[3]);
   90|  1.81M|    r->d[3] = secp256k1_u128_to_u64(&t);
   91|       |
   92|  1.81M|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  1.81M|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   93|  1.81M|    return overflow;
   94|  1.81M|}
secp256k1.c:secp256k1_scalar_check_overflow:
   64|  1.81M|SECP256K1_INLINE static int secp256k1_scalar_check_overflow(const secp256k1_scalar *a) {
   65|  1.81M|    int yes = 0;
   66|  1.81M|    int no = 0;
   67|  1.81M|    no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */
  ------------------
  |  |   19|  1.81M|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
   68|  1.81M|    no |= (a->d[2] < SECP256K1_N_2);
  ------------------
  |  |   18|  1.81M|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
   69|  1.81M|    yes |= (a->d[2] > SECP256K1_N_2) & ~no;
  ------------------
  |  |   18|  1.81M|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
   70|  1.81M|    no |= (a->d[1] < SECP256K1_N_1);
  ------------------
  |  |   17|  1.81M|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
   71|  1.81M|    yes |= (a->d[1] > SECP256K1_N_1) & ~no;
  ------------------
  |  |   17|  1.81M|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
   72|  1.81M|    yes |= (a->d[0] >= SECP256K1_N_0) & ~no;
  ------------------
  |  |   16|  1.81M|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
   73|  1.81M|    return yes;
   74|  1.81M|}
secp256k1.c:secp256k1_scalar_get_b32:
  161|   341k|static void secp256k1_scalar_get_b32(unsigned char *bin, const secp256k1_scalar* a) {
  162|   341k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   341k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  163|       |
  164|   341k|    secp256k1_write_be64(&bin[0],  a->d[3]);
  165|   341k|    secp256k1_write_be64(&bin[8],  a->d[2]);
  166|   341k|    secp256k1_write_be64(&bin[16], a->d[1]);
  167|   341k|    secp256k1_write_be64(&bin[24], a->d[0]);
  168|   341k|}
secp256k1.c:secp256k1_scalar_is_high:
  244|   250k|static int secp256k1_scalar_is_high(const secp256k1_scalar *a) {
  245|   250k|    int yes = 0;
  246|   250k|    int no = 0;
  247|   250k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   250k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  248|       |
  249|   250k|    no |= (a->d[3] < SECP256K1_N_H_3);
  ------------------
  |  |   30|   250k|#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
  ------------------
  250|   250k|    yes |= (a->d[3] > SECP256K1_N_H_3) & ~no;
  ------------------
  |  |   30|   250k|#define SECP256K1_N_H_3 ((uint64_t)0x7FFFFFFFFFFFFFFFULL)
  ------------------
  251|   250k|    no |= (a->d[2] < SECP256K1_N_H_2) & ~yes; /* No need for a > check. */
  ------------------
  |  |   29|   250k|#define SECP256K1_N_H_2 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  252|   250k|    no |= (a->d[1] < SECP256K1_N_H_1) & ~yes;
  ------------------
  |  |   28|   250k|#define SECP256K1_N_H_1 ((uint64_t)0x5D576E7357A4501DULL)
  ------------------
  253|   250k|    yes |= (a->d[1] > SECP256K1_N_H_1) & ~no;
  ------------------
  |  |   28|   250k|#define SECP256K1_N_H_1 ((uint64_t)0x5D576E7357A4501DULL)
  ------------------
  254|   250k|    yes |= (a->d[0] > SECP256K1_N_H_0) & ~no;
  ------------------
  |  |   27|   250k|#define SECP256K1_N_H_0 ((uint64_t)0xDFE92F46681B20A0ULL)
  ------------------
  255|   250k|    return yes;
  256|   250k|}
secp256k1.c:secp256k1_scalar_negate:
  176|   154k|static void secp256k1_scalar_negate(secp256k1_scalar *r, const secp256k1_scalar *a) {
  177|   154k|    uint64_t nonzero = 0xFFFFFFFFFFFFFFFFULL * (secp256k1_scalar_is_zero(a) == 0);
  178|   154k|    secp256k1_uint128 t;
  179|   154k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   154k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  180|       |
  181|   154k|    secp256k1_u128_from_u64(&t, ~a->d[0]);
  182|   154k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_0 + 1);
  ------------------
  |  |   16|   154k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
  183|   154k|    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  184|   154k|    secp256k1_u128_accum_u64(&t, ~a->d[1]);
  185|   154k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_1);
  ------------------
  |  |   17|   154k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
  186|   154k|    r->d[1] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  187|   154k|    secp256k1_u128_accum_u64(&t, ~a->d[2]);
  188|   154k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_2);
  ------------------
  |  |   18|   154k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
  189|   154k|    r->d[2] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  190|   154k|    secp256k1_u128_accum_u64(&t, ~a->d[3]);
  191|   154k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_3);
  ------------------
  |  |   19|   154k|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  192|   154k|    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
  193|       |
  194|   154k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   154k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  195|   154k|}
secp256k1.c:secp256k1_scalar_inverse_var:
  984|  76.7k|static void secp256k1_scalar_inverse_var(secp256k1_scalar *r, const secp256k1_scalar *x) {
  985|  76.7k|    secp256k1_modinv64_signed62 s;
  986|       |#ifdef VERIFY
  987|       |    int zero_in = secp256k1_scalar_is_zero(x);
  988|       |#endif
  989|  76.7k|    SECP256K1_SCALAR_VERIFY(x);
  ------------------
  |  |  103|  76.7k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  990|       |
  991|  76.7k|    secp256k1_scalar_to_signed62(&s, x);
  992|  76.7k|    secp256k1_modinv64_var(&s, &secp256k1_const_modinfo_scalar);
  993|  76.7k|    secp256k1_scalar_from_signed62(r, &s);
  994|       |
  995|  76.7k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  76.7k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  996|  76.7k|    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
  997|  76.7k|}
secp256k1.c:secp256k1_scalar_to_signed62:
  952|   143k|static void secp256k1_scalar_to_signed62(secp256k1_modinv64_signed62 *r, const secp256k1_scalar *a) {
  953|   143k|    const uint64_t M62 = UINT64_MAX >> 2;
  954|   143k|    const uint64_t a0 = a->d[0], a1 = a->d[1], a2 = a->d[2], a3 = a->d[3];
  955|   143k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   143k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  956|       |
  957|   143k|    r->v[0] =  a0                   & M62;
  958|   143k|    r->v[1] = (a0 >> 62 | a1 <<  2) & M62;
  959|   143k|    r->v[2] = (a1 >> 60 | a2 <<  4) & M62;
  960|   143k|    r->v[3] = (a2 >> 58 | a3 <<  6) & M62;
  961|   143k|    r->v[4] =  a3 >> 56;
  962|   143k|}
secp256k1.c:secp256k1_scalar_from_signed62:
  932|   143k|static void secp256k1_scalar_from_signed62(secp256k1_scalar *r, const secp256k1_modinv64_signed62 *a) {
  933|   143k|    const uint64_t a0 = a->v[0], a1 = a->v[1], a2 = a->v[2], a3 = a->v[3], a4 = a->v[4];
  934|       |
  935|       |    /* The output from secp256k1_modinv64{_var} should be normalized to range [0,modulus), and
  936|       |     * have limbs in [0,2^62). The modulus is < 2^256, so the top limb must be below 2^(256-62*4).
  937|       |     */
  938|   143k|    VERIFY_CHECK(a0 >> 62 == 0);
  939|   143k|    VERIFY_CHECK(a1 >> 62 == 0);
  940|   143k|    VERIFY_CHECK(a2 >> 62 == 0);
  941|   143k|    VERIFY_CHECK(a3 >> 62 == 0);
  942|   143k|    VERIFY_CHECK(a4 >> 8 == 0);
  943|       |
  944|   143k|    r->d[0] = a0      | a1 << 62;
  945|   143k|    r->d[1] = a1 >> 2 | a2 << 60;
  946|   143k|    r->d[2] = a2 >> 4 | a3 << 58;
  947|   143k|    r->d[3] = a3 >> 6 | a4 << 56;
  948|       |
  949|   143k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   143k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  950|   143k|}
secp256k1.c:secp256k1_scalar_inverse:
  969|  67.0k|static void secp256k1_scalar_inverse(secp256k1_scalar *r, const secp256k1_scalar *x) {
  970|  67.0k|    secp256k1_modinv64_signed62 s;
  971|       |#ifdef VERIFY
  972|       |    int zero_in = secp256k1_scalar_is_zero(x);
  973|       |#endif
  974|  67.0k|    SECP256K1_SCALAR_VERIFY(x);
  ------------------
  |  |  103|  67.0k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  975|       |
  976|  67.0k|    secp256k1_scalar_to_signed62(&s, x);
  977|  67.0k|    secp256k1_modinv64(&s, &secp256k1_const_modinfo_scalar);
  978|  67.0k|    secp256k1_scalar_from_signed62(r, &s);
  979|       |
  980|  67.0k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  67.0k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  981|  67.0k|    VERIFY_CHECK(secp256k1_scalar_is_zero(r) == zero_in);
  982|  67.0k|}
secp256k1.c:secp256k1_scalar_cond_negate:
  258|  67.0k|static int secp256k1_scalar_cond_negate(secp256k1_scalar *r, int flag) {
  259|       |    /* If we are flag = 0, mask = 00...00 and this is a no-op;
  260|       |     * if we are flag = 1, mask = 11...11 and this is identical to secp256k1_scalar_negate */
  261|  67.0k|    volatile int vflag = flag;
  262|  67.0k|    uint64_t mask = -vflag;
  263|  67.0k|    uint64_t nonzero = (secp256k1_scalar_is_zero(r) != 0) - 1;
  264|  67.0k|    secp256k1_uint128 t;
  265|  67.0k|    VERIFY_CHECK(flag == 0 || flag == 1);
  266|  67.0k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  67.0k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  267|       |
  268|  67.0k|    secp256k1_u128_from_u64(&t, r->d[0] ^ mask);
  269|  67.0k|    secp256k1_u128_accum_u64(&t, (SECP256K1_N_0 + 1) & mask);
  ------------------
  |  |   16|  67.0k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  ------------------
  270|  67.0k|    r->d[0] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  271|  67.0k|    secp256k1_u128_accum_u64(&t, r->d[1] ^ mask);
  272|  67.0k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_1 & mask);
  ------------------
  |  |   17|  67.0k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  ------------------
  273|  67.0k|    r->d[1] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  274|  67.0k|    secp256k1_u128_accum_u64(&t, r->d[2] ^ mask);
  275|  67.0k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_2 & mask);
  ------------------
  |  |   18|  67.0k|#define SECP256K1_N_2 ((uint64_t)0xFFFFFFFFFFFFFFFEULL)
  ------------------
  276|  67.0k|    r->d[2] = secp256k1_u128_to_u64(&t) & nonzero; secp256k1_u128_rshift(&t, 64);
  277|  67.0k|    secp256k1_u128_accum_u64(&t, r->d[3] ^ mask);
  278|  67.0k|    secp256k1_u128_accum_u64(&t, SECP256K1_N_3 & mask);
  ------------------
  |  |   19|  67.0k|#define SECP256K1_N_3 ((uint64_t)0xFFFFFFFFFFFFFFFFULL)
  ------------------
  279|  67.0k|    r->d[3] = secp256k1_u128_to_u64(&t) & nonzero;
  280|       |
  281|  67.0k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|  67.0k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  282|  67.0k|    return 2 * (mask == 0) - 1;
  283|  67.0k|}
secp256k1.c:secp256k1_scalar_cmov:
  915|   275k|static SECP256K1_INLINE void secp256k1_scalar_cmov(secp256k1_scalar *r, const secp256k1_scalar *a, int flag) {
  916|   275k|    uint64_t mask0, mask1;
  917|   275k|    volatile int vflag = flag;
  918|   275k|    VERIFY_CHECK(flag == 0 || flag == 1);
  919|   275k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   275k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  920|   275k|    SECP256K1_CHECKMEM_CHECK_VERIFY(r->d, sizeof(r->d));
  ------------------
  |  |  114|   275k|#define SECP256K1_CHECKMEM_CHECK_VERIFY(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   275k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 275k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  921|       |
  922|   275k|    mask0 = vflag + ~((uint64_t)0);
  923|   275k|    mask1 = ~mask0;
  924|   275k|    r->d[0] = (r->d[0] & mask0) | (a->d[0] & mask1);
  925|   275k|    r->d[1] = (r->d[1] & mask0) | (a->d[1] & mask1);
  926|   275k|    r->d[2] = (r->d[2] & mask0) | (a->d[2] & mask1);
  927|   275k|    r->d[3] = (r->d[3] & mask0) | (a->d[3] & mask1);
  928|       |
  929|   275k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   275k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  930|   275k|}
secp256k1.c:secp256k1_scalar_mul_shift_var:
  893|   154k|SECP256K1_INLINE static void secp256k1_scalar_mul_shift_var(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b, unsigned int shift) {
  894|   154k|    uint64_t l[8];
  895|   154k|    unsigned int shiftlimbs;
  896|   154k|    unsigned int shiftlow;
  897|   154k|    unsigned int shifthigh;
  898|   154k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   154k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  899|   154k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|   154k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  900|   154k|    VERIFY_CHECK(shift >= 256);
  901|       |
  902|   154k|    secp256k1_scalar_mul_512(l, a, b);
  903|   154k|    shiftlimbs = shift >> 6;
  904|   154k|    shiftlow = shift & 0x3F;
  905|   154k|    shifthigh = 64 - shiftlow;
  906|   154k|    r->d[0] = shift < 512 ? (l[0 + shiftlimbs] >> shiftlow | (shift < 448 && shiftlow ? (l[1 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (906:15): [True: 154k, False: 0]
  |  Branch (906:63): [True: 154k, False: 0]
  |  Branch (906:78): [True: 0, False: 154k]
  ------------------
  907|   154k|    r->d[1] = shift < 448 ? (l[1 + shiftlimbs] >> shiftlow | (shift < 384 && shiftlow ? (l[2 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (907:15): [True: 154k, False: 0]
  |  Branch (907:63): [True: 0, False: 154k]
  |  Branch (907:78): [True: 0, False: 0]
  ------------------
  908|   154k|    r->d[2] = shift < 384 ? (l[2 + shiftlimbs] >> shiftlow | (shift < 320 && shiftlow ? (l[3 + shiftlimbs] << shifthigh) : 0)) : 0;
  ------------------
  |  Branch (908:15): [True: 0, False: 154k]
  |  Branch (908:63): [True: 0, False: 0]
  |  Branch (908:78): [True: 0, False: 0]
  ------------------
  909|   154k|    r->d[3] = shift < 320 ? (l[3 + shiftlimbs] >> shiftlow) : 0;
  ------------------
  |  Branch (909:15): [True: 0, False: 154k]
  ------------------
  910|   154k|    secp256k1_scalar_cadd_bit(r, 0, (l[(shift - 1) >> 6] >> ((shift - 1) & 0x3f)) & 1);
  911|       |
  912|   154k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   154k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  913|   154k|}
secp256k1.c:secp256k1_scalar_mul_512:
  682|   674k|static void secp256k1_scalar_mul_512(uint64_t *l8, const secp256k1_scalar *a, const secp256k1_scalar *b) {
  683|   674k|#ifdef USE_ASM_X86_64
  684|   674k|    const uint64_t *pb = b->d;
  685|   674k|    __asm__ __volatile__(
  686|       |    /* Preload */
  687|   674k|    "movq 0(%%rdi), %%r15\n"
  688|   674k|    "movq 8(%%rdi), %%rbx\n"
  689|   674k|    "movq 16(%%rdi), %%rcx\n"
  690|   674k|    "movq 0(%%rdx), %%r11\n"
  691|   674k|    "movq 8(%%rdx), %%r12\n"
  692|   674k|    "movq 16(%%rdx), %%r13\n"
  693|   674k|    "movq 24(%%rdx), %%r14\n"
  694|       |    /* (rax,rdx) = a0 * b0 */
  695|   674k|    "movq %%r15, %%rax\n"
  696|   674k|    "mulq %%r11\n"
  697|       |    /* Extract l8[0] */
  698|   674k|    "movq %%rax, 0(%%rsi)\n"
  699|       |    /* (r8,r9,r10) = (rdx) */
  700|   674k|    "movq %%rdx, %%r8\n"
  701|   674k|    "xorq %%r9, %%r9\n"
  702|   674k|    "xorq %%r10, %%r10\n"
  703|       |    /* (r8,r9,r10) += a0 * b1 */
  704|   674k|    "movq %%r15, %%rax\n"
  705|   674k|    "mulq %%r12\n"
  706|   674k|    "addq %%rax, %%r8\n"
  707|   674k|    "adcq %%rdx, %%r9\n"
  708|   674k|    "adcq $0, %%r10\n"
  709|       |    /* (r8,r9,r10) += a1 * b0 */
  710|   674k|    "movq %%rbx, %%rax\n"
  711|   674k|    "mulq %%r11\n"
  712|   674k|    "addq %%rax, %%r8\n"
  713|   674k|    "adcq %%rdx, %%r9\n"
  714|   674k|    "adcq $0, %%r10\n"
  715|       |    /* Extract l8[1] */
  716|   674k|    "movq %%r8, 8(%%rsi)\n"
  717|   674k|    "xorq %%r8, %%r8\n"
  718|       |    /* (r9,r10,r8) += a0 * b2 */
  719|   674k|    "movq %%r15, %%rax\n"
  720|   674k|    "mulq %%r13\n"
  721|   674k|    "addq %%rax, %%r9\n"
  722|   674k|    "adcq %%rdx, %%r10\n"
  723|   674k|    "adcq $0, %%r8\n"
  724|       |    /* (r9,r10,r8) += a1 * b1 */
  725|   674k|    "movq %%rbx, %%rax\n"
  726|   674k|    "mulq %%r12\n"
  727|   674k|    "addq %%rax, %%r9\n"
  728|   674k|    "adcq %%rdx, %%r10\n"
  729|   674k|    "adcq $0, %%r8\n"
  730|       |    /* (r9,r10,r8) += a2 * b0 */
  731|   674k|    "movq %%rcx, %%rax\n"
  732|   674k|    "mulq %%r11\n"
  733|   674k|    "addq %%rax, %%r9\n"
  734|   674k|    "adcq %%rdx, %%r10\n"
  735|   674k|    "adcq $0, %%r8\n"
  736|       |    /* Extract l8[2] */
  737|   674k|    "movq %%r9, 16(%%rsi)\n"
  738|   674k|    "xorq %%r9, %%r9\n"
  739|       |    /* (r10,r8,r9) += a0 * b3 */
  740|   674k|    "movq %%r15, %%rax\n"
  741|   674k|    "mulq %%r14\n"
  742|   674k|    "addq %%rax, %%r10\n"
  743|   674k|    "adcq %%rdx, %%r8\n"
  744|   674k|    "adcq $0, %%r9\n"
  745|       |    /* Preload a3 */
  746|   674k|    "movq 24(%%rdi), %%r15\n"
  747|       |    /* (r10,r8,r9) += a1 * b2 */
  748|   674k|    "movq %%rbx, %%rax\n"
  749|   674k|    "mulq %%r13\n"
  750|   674k|    "addq %%rax, %%r10\n"
  751|   674k|    "adcq %%rdx, %%r8\n"
  752|   674k|    "adcq $0, %%r9\n"
  753|       |    /* (r10,r8,r9) += a2 * b1 */
  754|   674k|    "movq %%rcx, %%rax\n"
  755|   674k|    "mulq %%r12\n"
  756|   674k|    "addq %%rax, %%r10\n"
  757|   674k|    "adcq %%rdx, %%r8\n"
  758|   674k|    "adcq $0, %%r9\n"
  759|       |    /* (r10,r8,r9) += a3 * b0 */
  760|   674k|    "movq %%r15, %%rax\n"
  761|   674k|    "mulq %%r11\n"
  762|   674k|    "addq %%rax, %%r10\n"
  763|   674k|    "adcq %%rdx, %%r8\n"
  764|   674k|    "adcq $0, %%r9\n"
  765|       |    /* Extract l8[3] */
  766|   674k|    "movq %%r10, 24(%%rsi)\n"
  767|   674k|    "xorq %%r10, %%r10\n"
  768|       |    /* (r8,r9,r10) += a1 * b3 */
  769|   674k|    "movq %%rbx, %%rax\n"
  770|   674k|    "mulq %%r14\n"
  771|   674k|    "addq %%rax, %%r8\n"
  772|   674k|    "adcq %%rdx, %%r9\n"
  773|   674k|    "adcq $0, %%r10\n"
  774|       |    /* (r8,r9,r10) += a2 * b2 */
  775|   674k|    "movq %%rcx, %%rax\n"
  776|   674k|    "mulq %%r13\n"
  777|   674k|    "addq %%rax, %%r8\n"
  778|   674k|    "adcq %%rdx, %%r9\n"
  779|   674k|    "adcq $0, %%r10\n"
  780|       |    /* (r8,r9,r10) += a3 * b1 */
  781|   674k|    "movq %%r15, %%rax\n"
  782|   674k|    "mulq %%r12\n"
  783|   674k|    "addq %%rax, %%r8\n"
  784|   674k|    "adcq %%rdx, %%r9\n"
  785|   674k|    "adcq $0, %%r10\n"
  786|       |    /* Extract l8[4] */
  787|   674k|    "movq %%r8, 32(%%rsi)\n"
  788|   674k|    "xorq %%r8, %%r8\n"
  789|       |    /* (r9,r10,r8) += a2 * b3 */
  790|   674k|    "movq %%rcx, %%rax\n"
  791|   674k|    "mulq %%r14\n"
  792|   674k|    "addq %%rax, %%r9\n"
  793|   674k|    "adcq %%rdx, %%r10\n"
  794|   674k|    "adcq $0, %%r8\n"
  795|       |    /* (r9,r10,r8) += a3 * b2 */
  796|   674k|    "movq %%r15, %%rax\n"
  797|   674k|    "mulq %%r13\n"
  798|   674k|    "addq %%rax, %%r9\n"
  799|   674k|    "adcq %%rdx, %%r10\n"
  800|   674k|    "adcq $0, %%r8\n"
  801|       |    /* Extract l8[5] */
  802|   674k|    "movq %%r9, 40(%%rsi)\n"
  803|       |    /* (r10,r8) += a3 * b3 */
  804|   674k|    "movq %%r15, %%rax\n"
  805|   674k|    "mulq %%r14\n"
  806|   674k|    "addq %%rax, %%r10\n"
  807|   674k|    "adcq %%rdx, %%r8\n"
  808|       |    /* Extract l8[6] */
  809|   674k|    "movq %%r10, 48(%%rsi)\n"
  810|       |    /* Extract l8[7] */
  811|   674k|    "movq %%r8, 56(%%rsi)\n"
  812|   674k|    : "+d"(pb)
  813|   674k|    : "S"(l8), "D"(a->d)
  814|   674k|    : "rax", "rbx", "rcx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", "cc", "memory");
  815|       |
  816|   674k|    SECP256K1_CHECKMEM_MSAN_DEFINE(l8, sizeof(*l8) * 8);
  ------------------
  |  |   70|   674k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   674k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 674k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  817|       |
  818|       |#else
  819|       |    /* 160 bit accumulator. */
  820|       |    uint64_t c0 = 0, c1 = 0;
  821|       |    uint32_t c2 = 0;
  822|       |
  823|       |    /* l8[0..7] = a[0..3] * b[0..3]. */
  824|       |    muladd_fast(a->d[0], b->d[0]);
  825|       |    extract_fast(l8[0]);
  826|       |    muladd(a->d[0], b->d[1]);
  827|       |    muladd(a->d[1], b->d[0]);
  828|       |    extract(l8[1]);
  829|       |    muladd(a->d[0], b->d[2]);
  830|       |    muladd(a->d[1], b->d[1]);
  831|       |    muladd(a->d[2], b->d[0]);
  832|       |    extract(l8[2]);
  833|       |    muladd(a->d[0], b->d[3]);
  834|       |    muladd(a->d[1], b->d[2]);
  835|       |    muladd(a->d[2], b->d[1]);
  836|       |    muladd(a->d[3], b->d[0]);
  837|       |    extract(l8[3]);
  838|       |    muladd(a->d[1], b->d[3]);
  839|       |    muladd(a->d[2], b->d[2]);
  840|       |    muladd(a->d[3], b->d[1]);
  841|       |    extract(l8[4]);
  842|       |    muladd(a->d[2], b->d[3]);
  843|       |    muladd(a->d[3], b->d[2]);
  844|       |    extract(l8[5]);
  845|       |    muladd_fast(a->d[3], b->d[3]);
  846|       |    extract_fast(l8[6]);
  847|       |    VERIFY_CHECK(c1 == 0);
  848|       |    l8[7] = c0;
  849|       |#endif
  850|   674k|}
secp256k1.c:secp256k1_scalar_cadd_bit:
  122|   154k|static void secp256k1_scalar_cadd_bit(secp256k1_scalar *r, unsigned int bit, int flag) {
  123|   154k|    secp256k1_uint128 t;
  124|   154k|    volatile int vflag = flag;
  125|   154k|    VERIFY_CHECK(flag == 0 || flag == 1);
  126|   154k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   154k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  127|   154k|    VERIFY_CHECK(bit < 256);
  128|       |
  129|   154k|    bit += ((uint32_t) vflag - 1) & 0x100;  /* forcing (bit >> 6) > 3 makes this a noop */
  130|   154k|    secp256k1_u128_from_u64(&t, r->d[0]);
  131|   154k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 0)) << (bit & 0x3F));
  132|   154k|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  133|   154k|    secp256k1_u128_accum_u64(&t, r->d[1]);
  134|   154k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 1)) << (bit & 0x3F));
  135|   154k|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  136|   154k|    secp256k1_u128_accum_u64(&t, r->d[2]);
  137|   154k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 2)) << (bit & 0x3F));
  138|   154k|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  139|   154k|    secp256k1_u128_accum_u64(&t, r->d[3]);
  140|   154k|    secp256k1_u128_accum_u64(&t, ((uint64_t)((bit >> 6) == 3)) << (bit & 0x3F));
  141|   154k|    r->d[3] = secp256k1_u128_to_u64(&t);
  142|       |
  143|   154k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   154k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  144|   154k|    VERIFY_CHECK(secp256k1_u128_hi_u64(&t) == 0);
  145|   154k|}
secp256k1.c:secp256k1_scalar_split_128:
  870|  77.3k|static void secp256k1_scalar_split_128(secp256k1_scalar *r1, secp256k1_scalar *r2, const secp256k1_scalar *k) {
  871|  77.3k|    SECP256K1_SCALAR_VERIFY(k);
  ------------------
  |  |  103|  77.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  872|       |
  873|  77.3k|    r1->d[0] = k->d[0];
  874|  77.3k|    r1->d[1] = k->d[1];
  875|  77.3k|    r1->d[2] = 0;
  876|  77.3k|    r1->d[3] = 0;
  877|  77.3k|    r2->d[0] = k->d[2];
  878|  77.3k|    r2->d[1] = k->d[3];
  879|  77.3k|    r2->d[2] = 0;
  880|  77.3k|    r2->d[3] = 0;
  881|       |
  882|  77.3k|    SECP256K1_SCALAR_VERIFY(r1);
  ------------------
  |  |  103|  77.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  883|  77.3k|    SECP256K1_SCALAR_VERIFY(r2);
  ------------------
  |  |  103|  77.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  884|  77.3k|}
secp256k1.c:secp256k1_scalar_get_bits_limb32:
   41|  10.9M|SECP256K1_INLINE static uint32_t secp256k1_scalar_get_bits_limb32(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
   42|  10.9M|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  10.9M|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   43|  10.9M|    VERIFY_CHECK(count > 0 && count <= 32);
   44|  10.9M|    VERIFY_CHECK(offset <= 256 - count);
   45|  10.9M|    VERIFY_CHECK((offset + count - 1) >> 5 == offset >> 5);
   46|       |
   47|  10.9M|    return (a->d[offset >> 6] >> (offset & 0x3F)) & (0xFFFFFFFF >> (32 - count));
   48|  10.9M|}
secp256k1.c:secp256k1_scalar_get_bits_var:
   50|  4.63M|SECP256K1_INLINE static uint32_t secp256k1_scalar_get_bits_var(const secp256k1_scalar *a, unsigned int offset, unsigned int count) {
   51|  4.63M|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|  4.63M|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   52|  4.63M|    VERIFY_CHECK(count > 0 && count <= 32);
   53|  4.63M|    VERIFY_CHECK(offset <= 256 - count);
   54|       |
   55|  4.63M|    if ((offset + count - 1) >> 6 == offset >> 6) {
  ------------------
  |  Branch (55:9): [True: 4.19M, False: 442k]
  ------------------
   56|  4.19M|        return (a->d[offset >> 6] >> (offset & 0x3F)) & (0xFFFFFFFF >> (32 - count));
   57|  4.19M|    } else {
   58|   442k|        VERIFY_CHECK((offset >> 6) + 1 < 4);
   59|   442k|        VERIFY_CHECK((offset & 0x3F) > 0);
   60|   442k|        return ((a->d[offset >> 6] >> (offset & 0x3F)) | (a->d[(offset >> 6) + 1] << (64 - (offset & 0x3F)))) & (0xFFFFFFFF >> (32 - count));
   61|   442k|    }
   62|  4.63M|}
secp256k1.c:secp256k1_scalar_is_zero:
  170|   806k|SECP256K1_INLINE static int secp256k1_scalar_is_zero(const secp256k1_scalar *a) {
  171|   806k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   806k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  172|       |
  173|   806k|    return (a->d[0] | a->d[1] | a->d[2] | a->d[3]) == 0;
  174|   806k|}
secp256k1.c:secp256k1_scalar_mul:
  859|   519k|static void secp256k1_scalar_mul(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
  860|   519k|    uint64_t l[8];
  861|   519k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   519k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  862|   519k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|   519k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  863|       |
  864|   519k|    secp256k1_scalar_mul_512(l, a, b);
  865|   519k|    secp256k1_scalar_reduce_512(r, l);
  866|       |
  867|   519k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   519k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  868|   519k|}
secp256k1.c:secp256k1_scalar_reduce_512:
  351|   519k|static void secp256k1_scalar_reduce_512(secp256k1_scalar *r, const uint64_t *l) {
  352|   519k|#ifdef USE_ASM_X86_64
  353|       |    /* Reduce 512 bits into 385. */
  354|   519k|    uint64_t m0, m1, m2, m3, m4, m5, m6;
  355|   519k|    uint64_t p0, p1, p2, p3, p4;
  356|   519k|    uint64_t c;
  357|       |
  358|   519k|    __asm__ __volatile__(
  359|       |    /* Preload. */
  360|   519k|    "movq 32(%%rsi), %%r11\n"
  361|   519k|    "movq 40(%%rsi), %%r12\n"
  362|   519k|    "movq 48(%%rsi), %%r13\n"
  363|   519k|    "movq 56(%%rsi), %%r14\n"
  364|       |    /* Initialize r8,r9,r10 */
  365|   519k|    "movq 0(%%rsi), %%r8\n"
  366|   519k|    "xorq %%r9, %%r9\n"
  367|   519k|    "xorq %%r10, %%r10\n"
  368|       |    /* (r8,r9) += n0 * c0 */
  369|   519k|    "movq %8, %%rax\n"
  370|   519k|    "mulq %%r11\n"
  371|   519k|    "addq %%rax, %%r8\n"
  372|   519k|    "adcq %%rdx, %%r9\n"
  373|       |    /* extract m0 */
  374|   519k|    "movq %%r8, %q0\n"
  375|   519k|    "xorq %%r8, %%r8\n"
  376|       |    /* (r9,r10) += l1 */
  377|   519k|    "addq 8(%%rsi), %%r9\n"
  378|   519k|    "adcq $0, %%r10\n"
  379|       |    /* (r9,r10,r8) += n1 * c0 */
  380|   519k|    "movq %8, %%rax\n"
  381|   519k|    "mulq %%r12\n"
  382|   519k|    "addq %%rax, %%r9\n"
  383|   519k|    "adcq %%rdx, %%r10\n"
  384|   519k|    "adcq $0, %%r8\n"
  385|       |    /* (r9,r10,r8) += n0 * c1 */
  386|   519k|    "movq %9, %%rax\n"
  387|   519k|    "mulq %%r11\n"
  388|   519k|    "addq %%rax, %%r9\n"
  389|   519k|    "adcq %%rdx, %%r10\n"
  390|   519k|    "adcq $0, %%r8\n"
  391|       |    /* extract m1 */
  392|   519k|    "movq %%r9, %q1\n"
  393|   519k|    "xorq %%r9, %%r9\n"
  394|       |    /* (r10,r8,r9) += l2 */
  395|   519k|    "addq 16(%%rsi), %%r10\n"
  396|   519k|    "adcq $0, %%r8\n"
  397|   519k|    "adcq $0, %%r9\n"
  398|       |    /* (r10,r8,r9) += n2 * c0 */
  399|   519k|    "movq %8, %%rax\n"
  400|   519k|    "mulq %%r13\n"
  401|   519k|    "addq %%rax, %%r10\n"
  402|   519k|    "adcq %%rdx, %%r8\n"
  403|   519k|    "adcq $0, %%r9\n"
  404|       |    /* (r10,r8,r9) += n1 * c1 */
  405|   519k|    "movq %9, %%rax\n"
  406|   519k|    "mulq %%r12\n"
  407|   519k|    "addq %%rax, %%r10\n"
  408|   519k|    "adcq %%rdx, %%r8\n"
  409|   519k|    "adcq $0, %%r9\n"
  410|       |    /* (r10,r8,r9) += n0 */
  411|   519k|    "addq %%r11, %%r10\n"
  412|   519k|    "adcq $0, %%r8\n"
  413|   519k|    "adcq $0, %%r9\n"
  414|       |    /* extract m2 */
  415|   519k|    "movq %%r10, %q2\n"
  416|   519k|    "xorq %%r10, %%r10\n"
  417|       |    /* (r8,r9,r10) += l3 */
  418|   519k|    "addq 24(%%rsi), %%r8\n"
  419|   519k|    "adcq $0, %%r9\n"
  420|   519k|    "adcq $0, %%r10\n"
  421|       |    /* (r8,r9,r10) += n3 * c0 */
  422|   519k|    "movq %8, %%rax\n"
  423|   519k|    "mulq %%r14\n"
  424|   519k|    "addq %%rax, %%r8\n"
  425|   519k|    "adcq %%rdx, %%r9\n"
  426|   519k|    "adcq $0, %%r10\n"
  427|       |    /* (r8,r9,r10) += n2 * c1 */
  428|   519k|    "movq %9, %%rax\n"
  429|   519k|    "mulq %%r13\n"
  430|   519k|    "addq %%rax, %%r8\n"
  431|   519k|    "adcq %%rdx, %%r9\n"
  432|   519k|    "adcq $0, %%r10\n"
  433|       |    /* (r8,r9,r10) += n1 */
  434|   519k|    "addq %%r12, %%r8\n"
  435|   519k|    "adcq $0, %%r9\n"
  436|   519k|    "adcq $0, %%r10\n"
  437|       |    /* extract m3 */
  438|   519k|    "movq %%r8, %q3\n"
  439|   519k|    "xorq %%r8, %%r8\n"
  440|       |    /* (r9,r10,r8) += n3 * c1 */
  441|   519k|    "movq %9, %%rax\n"
  442|   519k|    "mulq %%r14\n"
  443|   519k|    "addq %%rax, %%r9\n"
  444|   519k|    "adcq %%rdx, %%r10\n"
  445|   519k|    "adcq $0, %%r8\n"
  446|       |    /* (r9,r10,r8) += n2 */
  447|   519k|    "addq %%r13, %%r9\n"
  448|   519k|    "adcq $0, %%r10\n"
  449|   519k|    "adcq $0, %%r8\n"
  450|       |    /* extract m4 */
  451|   519k|    "movq %%r9, %q4\n"
  452|       |    /* (r10,r8) += n3 */
  453|   519k|    "addq %%r14, %%r10\n"
  454|   519k|    "adcq $0, %%r8\n"
  455|       |    /* extract m5 */
  456|   519k|    "movq %%r10, %q5\n"
  457|       |    /* extract m6 */
  458|   519k|    "movq %%r8, %q6\n"
  459|   519k|    : "=&g"(m0), "=&g"(m1), "=&g"(m2), "=g"(m3), "=g"(m4), "=g"(m5), "=g"(m6)
  460|   519k|    : "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   519k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   519k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "S"(l), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   519k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   519k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  461|   519k|    : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "r14", "cc");
  462|       |
  463|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m0, sizeof(m0));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  464|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m1, sizeof(m1));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  465|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m2, sizeof(m2));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  466|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m3, sizeof(m3));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  467|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m4, sizeof(m4));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  468|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m5, sizeof(m5));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  469|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&m6, sizeof(m6));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  470|       |
  471|       |    /* Reduce 385 bits into 258. */
  472|   519k|    __asm__ __volatile__(
  473|       |    /* Preload */
  474|   519k|    "movq %q9, %%r11\n"
  475|   519k|    "movq %q10, %%r12\n"
  476|   519k|    "movq %q11, %%r13\n"
  477|       |    /* Initialize (r8,r9,r10) */
  478|   519k|    "movq %q5, %%r8\n"
  479|   519k|    "xorq %%r9, %%r9\n"
  480|   519k|    "xorq %%r10, %%r10\n"
  481|       |    /* (r8,r9) += m4 * c0 */
  482|   519k|    "movq %12, %%rax\n"
  483|   519k|    "mulq %%r11\n"
  484|   519k|    "addq %%rax, %%r8\n"
  485|   519k|    "adcq %%rdx, %%r9\n"
  486|       |    /* extract p0 */
  487|   519k|    "movq %%r8, %q0\n"
  488|   519k|    "xorq %%r8, %%r8\n"
  489|       |    /* (r9,r10) += m1 */
  490|   519k|    "addq %q6, %%r9\n"
  491|   519k|    "adcq $0, %%r10\n"
  492|       |    /* (r9,r10,r8) += m5 * c0 */
  493|   519k|    "movq %12, %%rax\n"
  494|   519k|    "mulq %%r12\n"
  495|   519k|    "addq %%rax, %%r9\n"
  496|   519k|    "adcq %%rdx, %%r10\n"
  497|   519k|    "adcq $0, %%r8\n"
  498|       |    /* (r9,r10,r8) += m4 * c1 */
  499|   519k|    "movq %13, %%rax\n"
  500|   519k|    "mulq %%r11\n"
  501|   519k|    "addq %%rax, %%r9\n"
  502|   519k|    "adcq %%rdx, %%r10\n"
  503|   519k|    "adcq $0, %%r8\n"
  504|       |    /* extract p1 */
  505|   519k|    "movq %%r9, %q1\n"
  506|   519k|    "xorq %%r9, %%r9\n"
  507|       |    /* (r10,r8,r9) += m2 */
  508|   519k|    "addq %q7, %%r10\n"
  509|   519k|    "adcq $0, %%r8\n"
  510|   519k|    "adcq $0, %%r9\n"
  511|       |    /* (r10,r8,r9) += m6 * c0 */
  512|   519k|    "movq %12, %%rax\n"
  513|   519k|    "mulq %%r13\n"
  514|   519k|    "addq %%rax, %%r10\n"
  515|   519k|    "adcq %%rdx, %%r8\n"
  516|   519k|    "adcq $0, %%r9\n"
  517|       |    /* (r10,r8,r9) += m5 * c1 */
  518|   519k|    "movq %13, %%rax\n"
  519|   519k|    "mulq %%r12\n"
  520|   519k|    "addq %%rax, %%r10\n"
  521|   519k|    "adcq %%rdx, %%r8\n"
  522|   519k|    "adcq $0, %%r9\n"
  523|       |    /* (r10,r8,r9) += m4 */
  524|   519k|    "addq %%r11, %%r10\n"
  525|   519k|    "adcq $0, %%r8\n"
  526|   519k|    "adcq $0, %%r9\n"
  527|       |    /* extract p2 */
  528|   519k|    "movq %%r10, %q2\n"
  529|       |    /* (r8,r9) += m3 */
  530|   519k|    "addq %q8, %%r8\n"
  531|   519k|    "adcq $0, %%r9\n"
  532|       |    /* (r8,r9) += m6 * c1 */
  533|   519k|    "movq %13, %%rax\n"
  534|   519k|    "mulq %%r13\n"
  535|   519k|    "addq %%rax, %%r8\n"
  536|   519k|    "adcq %%rdx, %%r9\n"
  537|       |    /* (r8,r9) += m5 */
  538|   519k|    "addq %%r12, %%r8\n"
  539|   519k|    "adcq $0, %%r9\n"
  540|       |    /* extract p3 */
  541|   519k|    "movq %%r8, %q3\n"
  542|       |    /* (r9) += m6 */
  543|   519k|    "addq %%r13, %%r9\n"
  544|       |    /* extract p4 */
  545|   519k|    "movq %%r9, %q4\n"
  546|   519k|    : "=&g"(p0), "=&g"(p1), "=&g"(p2), "=g"(p3), "=g"(p4)
  547|   519k|    : "g"(m0), "g"(m1), "g"(m2), "g"(m3), "g"(m4), "g"(m5), "g"(m6), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   519k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   519k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "g"(m0), "g"(m1), "g"(m2), "g"(m3), "g"(m4), "g"(m5), "g"(m6), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   519k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   519k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  548|   519k|    : "rax", "rdx", "r8", "r9", "r10", "r11", "r12", "r13", "cc");
  549|       |
  550|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p0, sizeof(p0));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  551|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p1, sizeof(p1));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  552|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p2, sizeof(p2));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  553|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p3, sizeof(p3));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  554|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&p4, sizeof(p4));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  555|       |
  556|       |    /* Reduce 258 bits into 256. */
  557|   519k|    __asm__ __volatile__(
  558|       |    /* Preload */
  559|   519k|    "movq %q5, %%r10\n"
  560|       |    /* (rax,rdx) = p4 * c0 */
  561|   519k|    "movq %7, %%rax\n"
  562|   519k|    "mulq %%r10\n"
  563|       |    /* (rax,rdx) += p0 */
  564|   519k|    "addq %q1, %%rax\n"
  565|   519k|    "adcq $0, %%rdx\n"
  566|       |    /* extract r0 */
  567|   519k|    "movq %%rax, 0(%q6)\n"
  568|       |    /* Move to (r8,r9) */
  569|   519k|    "movq %%rdx, %%r8\n"
  570|   519k|    "xorq %%r9, %%r9\n"
  571|       |    /* (r8,r9) += p1 */
  572|   519k|    "addq %q2, %%r8\n"
  573|   519k|    "adcq $0, %%r9\n"
  574|       |    /* (r8,r9) += p4 * c1 */
  575|   519k|    "movq %8, %%rax\n"
  576|   519k|    "mulq %%r10\n"
  577|   519k|    "addq %%rax, %%r8\n"
  578|   519k|    "adcq %%rdx, %%r9\n"
  579|       |    /* Extract r1 */
  580|   519k|    "movq %%r8, 8(%q6)\n"
  581|   519k|    "xorq %%r8, %%r8\n"
  582|       |    /* (r9,r8) += p4 */
  583|   519k|    "addq %%r10, %%r9\n"
  584|   519k|    "adcq $0, %%r8\n"
  585|       |    /* (r9,r8) += p2 */
  586|   519k|    "addq %q3, %%r9\n"
  587|   519k|    "adcq $0, %%r8\n"
  588|       |    /* Extract r2 */
  589|   519k|    "movq %%r9, 16(%q6)\n"
  590|   519k|    "xorq %%r9, %%r9\n"
  591|       |    /* (r8,r9) += p3 */
  592|   519k|    "addq %q4, %%r8\n"
  593|   519k|    "adcq $0, %%r9\n"
  594|       |    /* Extract r3 */
  595|   519k|    "movq %%r8, 24(%q6)\n"
  596|       |    /* Extract c */
  597|   519k|    "movq %%r9, %q0\n"
  598|   519k|    : "=g"(c)
  599|   519k|    : "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   22|   519k|#define SECP256K1_N_C_0 (~SECP256K1_N_0 + 1)
  |  |  ------------------
  |  |  |  |   16|   519k|#define SECP256K1_N_0 ((uint64_t)0xBFD25E8CD0364141ULL)
  |  |  ------------------
  ------------------
                  : "g"(p0), "g"(p1), "g"(p2), "g"(p3), "g"(p4), "D"(r), "i"(SECP256K1_N_C_0), "i"(SECP256K1_N_C_1)
  ------------------
  |  |   23|   519k|#define SECP256K1_N_C_1 (~SECP256K1_N_1)
  |  |  ------------------
  |  |  |  |   17|   519k|#define SECP256K1_N_1 ((uint64_t)0xBAAEDCE6AF48A03BULL)
  |  |  ------------------
  ------------------
  600|   519k|    : "rax", "rdx", "r8", "r9", "r10", "cc", "memory");
  601|       |
  602|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(r, sizeof(*r));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  603|   519k|    SECP256K1_CHECKMEM_MSAN_DEFINE(&c, sizeof(c));
  ------------------
  |  |   70|   519k|#  define SECP256K1_CHECKMEM_MSAN_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|   519k|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 519k]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  604|       |
  605|       |#else
  606|       |    secp256k1_uint128 c128;
  607|       |    uint64_t c, c0, c1, c2;
  608|       |    uint64_t n0 = l[4], n1 = l[5], n2 = l[6], n3 = l[7];
  609|       |    uint64_t m0, m1, m2, m3, m4, m5;
  610|       |    uint32_t m6;
  611|       |    uint64_t p0, p1, p2, p3;
  612|       |    uint32_t p4;
  613|       |
  614|       |    /* Reduce 512 bits into 385. */
  615|       |    /* m[0..6] = l[0..3] + n[0..3] * SECP256K1_N_C. */
  616|       |    c0 = l[0]; c1 = 0; c2 = 0;
  617|       |    muladd_fast(n0, SECP256K1_N_C_0);
  618|       |    extract_fast(m0);
  619|       |    sumadd_fast(l[1]);
  620|       |    muladd(n1, SECP256K1_N_C_0);
  621|       |    muladd(n0, SECP256K1_N_C_1);
  622|       |    extract(m1);
  623|       |    sumadd(l[2]);
  624|       |    muladd(n2, SECP256K1_N_C_0);
  625|       |    muladd(n1, SECP256K1_N_C_1);
  626|       |    sumadd(n0);
  627|       |    extract(m2);
  628|       |    sumadd(l[3]);
  629|       |    muladd(n3, SECP256K1_N_C_0);
  630|       |    muladd(n2, SECP256K1_N_C_1);
  631|       |    sumadd(n1);
  632|       |    extract(m3);
  633|       |    muladd(n3, SECP256K1_N_C_1);
  634|       |    sumadd(n2);
  635|       |    extract(m4);
  636|       |    sumadd_fast(n3);
  637|       |    extract_fast(m5);
  638|       |    VERIFY_CHECK(c0 <= 1);
  639|       |    m6 = c0;
  640|       |
  641|       |    /* Reduce 385 bits into 258. */
  642|       |    /* p[0..4] = m[0..3] + m[4..6] * SECP256K1_N_C. */
  643|       |    c0 = m0; c1 = 0; c2 = 0;
  644|       |    muladd_fast(m4, SECP256K1_N_C_0);
  645|       |    extract_fast(p0);
  646|       |    sumadd_fast(m1);
  647|       |    muladd(m5, SECP256K1_N_C_0);
  648|       |    muladd(m4, SECP256K1_N_C_1);
  649|       |    extract(p1);
  650|       |    sumadd(m2);
  651|       |    muladd(m6, SECP256K1_N_C_0);
  652|       |    muladd(m5, SECP256K1_N_C_1);
  653|       |    sumadd(m4);
  654|       |    extract(p2);
  655|       |    sumadd_fast(m3);
  656|       |    muladd_fast(m6, SECP256K1_N_C_1);
  657|       |    sumadd_fast(m5);
  658|       |    extract_fast(p3);
  659|       |    p4 = c0 + m6;
  660|       |    VERIFY_CHECK(p4 <= 2);
  661|       |
  662|       |    /* Reduce 258 bits into 256. */
  663|       |    /* r[0..3] = p[0..3] + p[4] * SECP256K1_N_C. */
  664|       |    secp256k1_u128_from_u64(&c128, p0);
  665|       |    secp256k1_u128_accum_mul(&c128, SECP256K1_N_C_0, p4);
  666|       |    r->d[0] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  667|       |    secp256k1_u128_accum_u64(&c128, p1);
  668|       |    secp256k1_u128_accum_mul(&c128, SECP256K1_N_C_1, p4);
  669|       |    r->d[1] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  670|       |    secp256k1_u128_accum_u64(&c128, p2);
  671|       |    secp256k1_u128_accum_u64(&c128, p4);
  672|       |    r->d[2] = secp256k1_u128_to_u64(&c128); secp256k1_u128_rshift(&c128, 64);
  673|       |    secp256k1_u128_accum_u64(&c128, p3);
  674|       |    r->d[3] = secp256k1_u128_to_u64(&c128);
  675|       |    c = secp256k1_u128_hi_u64(&c128);
  676|       |#endif
  677|       |
  678|       |    /* Final reduction of r. */
  679|   519k|    secp256k1_scalar_reduce(r, c + secp256k1_scalar_check_overflow(r));
  680|   519k|}
secp256k1.c:secp256k1_scalar_add:
   96|   363k|static int secp256k1_scalar_add(secp256k1_scalar *r, const secp256k1_scalar *a, const secp256k1_scalar *b) {
   97|   363k|    int overflow;
   98|   363k|    secp256k1_uint128 t;
   99|   363k|    SECP256K1_SCALAR_VERIFY(a);
  ------------------
  |  |  103|   363k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  100|   363k|    SECP256K1_SCALAR_VERIFY(b);
  ------------------
  |  |  103|   363k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  101|       |
  102|   363k|    secp256k1_u128_from_u64(&t, a->d[0]);
  103|   363k|    secp256k1_u128_accum_u64(&t, b->d[0]);
  104|   363k|    r->d[0] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  105|   363k|    secp256k1_u128_accum_u64(&t, a->d[1]);
  106|   363k|    secp256k1_u128_accum_u64(&t, b->d[1]);
  107|   363k|    r->d[1] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  108|   363k|    secp256k1_u128_accum_u64(&t, a->d[2]);
  109|   363k|    secp256k1_u128_accum_u64(&t, b->d[2]);
  110|   363k|    r->d[2] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  111|   363k|    secp256k1_u128_accum_u64(&t, a->d[3]);
  112|   363k|    secp256k1_u128_accum_u64(&t, b->d[3]);
  113|   363k|    r->d[3] = secp256k1_u128_to_u64(&t); secp256k1_u128_rshift(&t, 64);
  114|   363k|    overflow = secp256k1_u128_to_u64(&t) + secp256k1_scalar_check_overflow(r);
  115|   363k|    VERIFY_CHECK(overflow == 0 || overflow == 1);
  116|   363k|    secp256k1_scalar_reduce(r, overflow);
  117|       |
  118|   363k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   363k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  119|   363k|    return overflow;
  120|   363k|}

secp256k1.c:secp256k1_scalar_verify:
   42|  25.3M|static void secp256k1_scalar_verify(const secp256k1_scalar *r) {
   43|  25.3M|    VERIFY_CHECK(secp256k1_scalar_check_overflow(r) == 0);
   44|       |
   45|  25.3M|    (void)r;
   46|  25.3M|}
secp256k1.c:secp256k1_scalar_set_b32_seckey:
   34|   220k|static int secp256k1_scalar_set_b32_seckey(secp256k1_scalar *r, const unsigned char *bin) {
   35|   220k|    int overflow;
   36|   220k|    secp256k1_scalar_set_b32(r, bin, &overflow);
   37|       |
   38|   220k|    SECP256K1_SCALAR_VERIFY(r);
  ------------------
  |  |  103|   220k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
   39|   220k|    return (!overflow) & (!secp256k1_scalar_is_zero(r));
   40|   220k|}
secp256k1.c:secp256k1_scalar_clear:
   30|   496k|SECP256K1_INLINE static void secp256k1_scalar_clear(secp256k1_scalar *r) {
   31|   496k|    secp256k1_memclear_explicit(r, sizeof(secp256k1_scalar));
   32|   496k|}
secp256k1.c:secp256k1_scalar_split_lambda:
  142|  77.3k|static void secp256k1_scalar_split_lambda(secp256k1_scalar * SECP256K1_RESTRICT r1, secp256k1_scalar * SECP256K1_RESTRICT r2, const secp256k1_scalar * SECP256K1_RESTRICT k) {
  143|  77.3k|    secp256k1_scalar c1, c2;
  144|  77.3k|    static const secp256k1_scalar minus_b1 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  77.3k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  145|  77.3k|        0x00000000UL, 0x00000000UL, 0x00000000UL, 0x00000000UL,
  146|  77.3k|        0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C3UL
  147|  77.3k|    );
  148|  77.3k|    static const secp256k1_scalar minus_b2 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  77.3k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  149|  77.3k|        0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFFUL, 0xFFFFFFFEUL,
  150|  77.3k|        0x8A280AC5UL, 0x0774346DUL, 0xD765CDA8UL, 0x3DB1562CUL
  151|  77.3k|    );
  152|  77.3k|    static const secp256k1_scalar g1 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  77.3k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  153|  77.3k|        0x3086D221UL, 0xA7D46BCDUL, 0xE86C90E4UL, 0x9284EB15UL,
  154|  77.3k|        0x3DAA8A14UL, 0x71E8CA7FUL, 0xE893209AUL, 0x45DBB031UL
  155|  77.3k|    );
  156|  77.3k|    static const secp256k1_scalar g2 = SECP256K1_SCALAR_CONST(
  ------------------
  |  |   17|  77.3k|#define SECP256K1_SCALAR_CONST(d7, d6, d5, d4, d3, d2, d1, d0) {{((uint64_t)(d1)) << 32 | (d0), ((uint64_t)(d3)) << 32 | (d2), ((uint64_t)(d5)) << 32 | (d4), ((uint64_t)(d7)) << 32 | (d6)}}
  ------------------
  157|  77.3k|        0xE4437ED6UL, 0x010E8828UL, 0x6F547FA9UL, 0x0ABFE4C4UL,
  158|  77.3k|        0x221208ACUL, 0x9DF506C6UL, 0x1571B4AEUL, 0x8AC47F71UL
  159|  77.3k|    );
  160|  77.3k|    SECP256K1_SCALAR_VERIFY(k);
  ------------------
  |  |  103|  77.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  161|  77.3k|    VERIFY_CHECK(r1 != k);
  162|  77.3k|    VERIFY_CHECK(r2 != k);
  163|  77.3k|    VERIFY_CHECK(r1 != r2);
  164|       |
  165|       |    /* these _var calls are constant time since the shift amount is constant */
  166|  77.3k|    secp256k1_scalar_mul_shift_var(&c1, k, &g1, 384);
  167|  77.3k|    secp256k1_scalar_mul_shift_var(&c2, k, &g2, 384);
  168|  77.3k|    secp256k1_scalar_mul(&c1, &c1, &minus_b1);
  169|  77.3k|    secp256k1_scalar_mul(&c2, &c2, &minus_b2);
  170|  77.3k|    secp256k1_scalar_add(r2, &c1, &c2);
  171|  77.3k|    secp256k1_scalar_mul(r1, r2, &secp256k1_const_lambda);
  172|  77.3k|    secp256k1_scalar_negate(r1, r1);
  173|  77.3k|    secp256k1_scalar_add(r1, r1, k);
  174|       |
  175|  77.3k|    SECP256K1_SCALAR_VERIFY(r1);
  ------------------
  |  |  103|  77.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  176|  77.3k|    SECP256K1_SCALAR_VERIFY(r2);
  ------------------
  |  |  103|  77.3k|#define SECP256K1_SCALAR_VERIFY(r) secp256k1_scalar_verify(r)
  ------------------
  177|       |#ifdef VERIFY
  178|       |    secp256k1_scalar_split_lambda_verify(r1, r2, k);
  179|       |#endif
  180|  77.3k|}

secp256k1_context_preallocated_destroy:
  178|      2|void secp256k1_context_preallocated_destroy(secp256k1_context* ctx) {
  179|      2|    ARG_CHECK_VOID(ctx == NULL || secp256k1_context_is_proper(ctx));
  ------------------
  |  |   52|      2|#define ARG_CHECK_VOID(cond) do { \
  |  |   53|      2|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|      4|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 2, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   54|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   55|      0|        return; \
  |  |   56|      0|    } \
  |  |   57|      2|} while(0)
  |  |  ------------------
  |  |  |  Branch (57:9): [Folded, False: 2]
  |  |  ------------------
  ------------------
  180|       |
  181|       |    /* Defined as noop */
  182|      2|    if (ctx == NULL) {
  ------------------
  |  Branch (182:9): [True: 0, False: 2]
  ------------------
  183|      0|        return;
  184|      0|    }
  185|       |
  186|      2|    secp256k1_ecmult_gen_context_clear(&ctx->ecmult_gen_ctx);
  187|      2|}
secp256k1_context_destroy:
  189|      2|void secp256k1_context_destroy(secp256k1_context* ctx) {
  190|      2|    ARG_CHECK_VOID(ctx == NULL || secp256k1_context_is_proper(ctx));
  ------------------
  |  |   52|      2|#define ARG_CHECK_VOID(cond) do { \
  |  |   53|      2|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|      4|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 0, False: 2]
  |  |  |  |  |  Branch (146:39): [True: 2, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   54|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   55|      0|        return; \
  |  |   56|      0|    } \
  |  |   57|      2|} while(0)
  |  |  ------------------
  |  |  |  Branch (57:9): [Folded, False: 2]
  |  |  ------------------
  ------------------
  191|       |
  192|       |    /* Defined as noop */
  193|      2|    if (ctx == NULL) {
  ------------------
  |  Branch (193:9): [True: 0, False: 2]
  ------------------
  194|      0|        return;
  195|      0|    }
  196|       |
  197|      2|    secp256k1_context_preallocated_destroy(ctx);
  198|      2|    free(ctx);
  199|      2|}
secp256k1_ec_pubkey_parse:
  268|  48.9k|int secp256k1_ec_pubkey_parse(const secp256k1_context* ctx, secp256k1_pubkey* pubkey, const unsigned char *input, size_t inputlen) {
  269|  48.9k|    secp256k1_ge Q;
  270|       |
  271|  48.9k|    VERIFY_CHECK(ctx != NULL);
  272|  48.9k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  48.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  48.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  48.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 48.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  48.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 48.9k]
  |  |  ------------------
  ------------------
  273|  48.9k|    memset(pubkey, 0, sizeof(*pubkey));
  274|  48.9k|    ARG_CHECK(input != NULL);
  ------------------
  |  |   45|  48.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  48.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  48.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 48.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  48.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 48.9k]
  |  |  ------------------
  ------------------
  275|  48.9k|    if (!secp256k1_eckey_pubkey_parse(&Q, input, inputlen)) {
  ------------------
  |  Branch (275:9): [True: 1.87k, False: 47.1k]
  ------------------
  276|  1.87k|        return 0;
  277|  1.87k|    }
  278|  47.1k|    if (!secp256k1_ge_is_in_correct_subgroup(&Q)) {
  ------------------
  |  Branch (278:9): [True: 0, False: 47.1k]
  ------------------
  279|      0|        return 0;
  280|      0|    }
  281|  47.1k|    secp256k1_pubkey_save(pubkey, &Q);
  282|  47.1k|    secp256k1_ge_clear(&Q);
  283|  47.1k|    return 1;
  284|  47.1k|}
secp256k1_ec_pubkey_serialize:
  286|  44.2k|int secp256k1_ec_pubkey_serialize(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_pubkey* pubkey, unsigned int flags) {
  287|  44.2k|    secp256k1_ge Q;
  288|  44.2k|    size_t len;
  289|       |
  290|  44.2k|    VERIFY_CHECK(ctx != NULL);
  291|  44.2k|    ARG_CHECK(outputlen != NULL);
  ------------------
  |  |   45|  44.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  44.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  44.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 44.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  44.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 44.2k]
  |  |  ------------------
  ------------------
  292|  44.2k|    ARG_CHECK(*outputlen >= ((flags & SECP256K1_FLAGS_BIT_COMPRESSION) ? 33u : 65u));
  ------------------
  |  |   45|  44.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  44.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  88.5k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 44.2k]
  |  |  |  |  |  Branch (146:39): [True: 30.3k, False: 13.8k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  44.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 44.2k]
  |  |  ------------------
  ------------------
  293|  44.2k|    len = *outputlen;
  294|  44.2k|    *outputlen = 0;
  295|  44.2k|    ARG_CHECK(output != NULL);
  ------------------
  |  |   45|  44.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  44.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  44.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 44.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  44.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 44.2k]
  |  |  ------------------
  ------------------
  296|  44.2k|    memset(output, 0, len);
  297|  44.2k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  44.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  44.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  44.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 44.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  44.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 44.2k]
  |  |  ------------------
  ------------------
  298|  44.2k|    ARG_CHECK((flags & SECP256K1_FLAGS_TYPE_MASK) == SECP256K1_FLAGS_TYPE_COMPRESSION);
  ------------------
  |  |   45|  44.2k|#define ARG_CHECK(cond) do { \
  |  |   46|  44.2k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  44.2k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 44.2k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  44.2k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 44.2k]
  |  |  ------------------
  ------------------
  299|  44.2k|    if (secp256k1_pubkey_load(ctx, &Q, pubkey)) {
  ------------------
  |  Branch (299:9): [True: 44.2k, False: 0]
  ------------------
  300|  44.2k|        if (flags & SECP256K1_FLAGS_BIT_COMPRESSION) {
  ------------------
  |  |  202|  44.2k|#define SECP256K1_FLAGS_BIT_COMPRESSION (1 << 8)
  ------------------
  |  Branch (300:13): [True: 30.3k, False: 13.8k]
  ------------------
  301|  30.3k|            secp256k1_eckey_pubkey_serialize33(&Q, output);
  302|  30.3k|            *outputlen = 33;
  303|  30.3k|        } else {
  304|  13.8k|            secp256k1_eckey_pubkey_serialize65(&Q, output);
  305|  13.8k|            *outputlen = 65;
  306|  13.8k|        }
  307|  44.2k|        return 1;
  308|  44.2k|    }
  309|      0|    return 0;
  310|  44.2k|}
secp256k1_ecdsa_signature_parse_compact:
  411|   213k|int secp256k1_ecdsa_signature_parse_compact(const secp256k1_context* ctx, secp256k1_ecdsa_signature* sig, const unsigned char *input64) {
  412|   213k|    secp256k1_scalar r, s;
  413|   213k|    int ret = 1;
  414|   213k|    int overflow = 0;
  415|       |
  416|   213k|    VERIFY_CHECK(ctx != NULL);
  417|   213k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|   213k|#define ARG_CHECK(cond) do { \
  |  |   46|   213k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|   213k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 213k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   213k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 213k]
  |  |  ------------------
  ------------------
  418|   213k|    ARG_CHECK(input64 != NULL);
  ------------------
  |  |   45|   213k|#define ARG_CHECK(cond) do { \
  |  |   46|   213k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|   213k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 213k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   213k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 213k]
  |  |  ------------------
  ------------------
  419|       |
  420|   213k|    secp256k1_scalar_set_b32(&r, &input64[0], &overflow);
  421|   213k|    ret &= !overflow;
  422|   213k|    secp256k1_scalar_set_b32(&s, &input64[32], &overflow);
  423|   213k|    ret &= !overflow;
  424|   213k|    if (ret) {
  ------------------
  |  Branch (424:9): [True: 213k, False: 0]
  ------------------
  425|   213k|        secp256k1_ecdsa_signature_save(sig, &r, &s);
  426|   213k|    } else {
  427|      0|        memset(sig, 0, sizeof(*sig));
  428|      0|    }
  429|   213k|    return ret;
  430|   213k|}
secp256k1_ecdsa_signature_serialize_der:
  432|  31.9k|int secp256k1_ecdsa_signature_serialize_der(const secp256k1_context* ctx, unsigned char *output, size_t *outputlen, const secp256k1_ecdsa_signature* sig) {
  433|  31.9k|    secp256k1_scalar r, s;
  434|       |
  435|  31.9k|    VERIFY_CHECK(ctx != NULL);
  436|  31.9k|    ARG_CHECK(output != NULL);
  ------------------
  |  |   45|  31.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  31.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  31.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 31.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  31.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 31.9k]
  |  |  ------------------
  ------------------
  437|  31.9k|    ARG_CHECK(outputlen != NULL);
  ------------------
  |  |   45|  31.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  31.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  31.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 31.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  31.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 31.9k]
  |  |  ------------------
  ------------------
  438|  31.9k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  31.9k|#define ARG_CHECK(cond) do { \
  |  |   46|  31.9k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  31.9k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 31.9k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  31.9k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 31.9k]
  |  |  ------------------
  ------------------
  439|       |
  440|  31.9k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  441|  31.9k|    return secp256k1_ecdsa_sig_serialize(output, outputlen, &r, &s);
  442|  31.9k|}
secp256k1_ecdsa_signature_serialize_compact:
  444|  67.0k|int secp256k1_ecdsa_signature_serialize_compact(const secp256k1_context* ctx, unsigned char *output64, const secp256k1_ecdsa_signature* sig) {
  445|  67.0k|    secp256k1_scalar r, s;
  446|       |
  447|  67.0k|    VERIFY_CHECK(ctx != NULL);
  448|  67.0k|    ARG_CHECK(output64 != NULL);
  ------------------
  |  |   45|  67.0k|#define ARG_CHECK(cond) do { \
  |  |   46|  67.0k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  67.0k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 67.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  67.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 67.0k]
  |  |  ------------------
  ------------------
  449|  67.0k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  67.0k|#define ARG_CHECK(cond) do { \
  |  |   46|  67.0k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  67.0k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 67.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  67.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 67.0k]
  |  |  ------------------
  ------------------
  450|       |
  451|  67.0k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  452|  67.0k|    secp256k1_scalar_get_b32(&output64[0], &r);
  453|  67.0k|    secp256k1_scalar_get_b32(&output64[32], &s);
  454|  67.0k|    return 1;
  455|  67.0k|}
secp256k1_ecdsa_signature_normalize:
  457|   106k|int secp256k1_ecdsa_signature_normalize(const secp256k1_context* ctx, secp256k1_ecdsa_signature *sigout, const secp256k1_ecdsa_signature *sigin) {
  458|   106k|    secp256k1_scalar r, s;
  459|   106k|    int ret = 0;
  460|       |
  461|   106k|    VERIFY_CHECK(ctx != NULL);
  462|   106k|    ARG_CHECK(sigin != NULL);
  ------------------
  |  |   45|   106k|#define ARG_CHECK(cond) do { \
  |  |   46|   106k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|   106k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 106k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   106k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 106k]
  |  |  ------------------
  ------------------
  463|       |
  464|   106k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sigin);
  465|   106k|    ret = secp256k1_scalar_is_high(&s);
  466|   106k|    if (sigout != NULL) {
  ------------------
  |  Branch (466:9): [True: 44.7k, False: 62.2k]
  ------------------
  467|  44.7k|        if (ret) {
  ------------------
  |  Branch (467:13): [True: 0, False: 44.7k]
  ------------------
  468|      0|            secp256k1_scalar_negate(&s, &s);
  469|      0|        }
  470|  44.7k|        secp256k1_ecdsa_signature_save(sigout, &r, &s);
  471|  44.7k|    }
  472|       |
  473|   106k|    return ret;
  474|   106k|}
secp256k1_ecdsa_verify:
  476|  76.7k|int secp256k1_ecdsa_verify(const secp256k1_context* ctx, const secp256k1_ecdsa_signature *sig, const unsigned char *msghash32, const secp256k1_pubkey *pubkey) {
  477|  76.7k|    secp256k1_ge q;
  478|  76.7k|    secp256k1_scalar r, s;
  479|  76.7k|    secp256k1_scalar m;
  480|  76.7k|    VERIFY_CHECK(ctx != NULL);
  481|  76.7k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  76.7k|#define ARG_CHECK(cond) do { \
  |  |   46|  76.7k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  76.7k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 76.7k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  76.7k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 76.7k]
  |  |  ------------------
  ------------------
  482|  76.7k|    ARG_CHECK(sig != NULL);
  ------------------
  |  |   45|  76.7k|#define ARG_CHECK(cond) do { \
  |  |   46|  76.7k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  76.7k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 76.7k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  76.7k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 76.7k]
  |  |  ------------------
  ------------------
  483|  76.7k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  76.7k|#define ARG_CHECK(cond) do { \
  |  |   46|  76.7k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  76.7k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 76.7k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  76.7k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 76.7k]
  |  |  ------------------
  ------------------
  484|       |
  485|  76.7k|    secp256k1_scalar_set_b32(&m, msghash32, NULL);
  486|  76.7k|    secp256k1_ecdsa_signature_load(ctx, &r, &s, sig);
  487|  76.7k|    return (!secp256k1_scalar_is_high(&s) &&
  ------------------
  |  Branch (487:13): [True: 76.7k, False: 0]
  ------------------
  488|  76.7k|            secp256k1_pubkey_load(ctx, &q, pubkey) &&
  ------------------
  |  Branch (488:13): [True: 76.7k, False: 0]
  ------------------
  489|  76.7k|            secp256k1_ecdsa_sig_verify(&r, &s, &q, &m));
  ------------------
  |  Branch (489:13): [True: 32.9k, False: 43.7k]
  ------------------
  490|  76.7k|}
secp256k1_ecdsa_sign:
  601|  67.0k|int secp256k1_ecdsa_sign(const secp256k1_context* ctx, secp256k1_ecdsa_signature *signature, const unsigned char *msghash32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
  602|  67.0k|    secp256k1_scalar r, s;
  603|  67.0k|    int ret;
  604|  67.0k|    VERIFY_CHECK(ctx != NULL);
  605|  67.0k|    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
  ------------------
  |  |   45|  67.0k|#define ARG_CHECK(cond) do { \
  |  |   46|  67.0k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  67.0k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 67.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  67.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 67.0k]
  |  |  ------------------
  ------------------
  606|  67.0k|    ARG_CHECK(msghash32 != NULL);
  ------------------
  |  |   45|  67.0k|#define ARG_CHECK(cond) do { \
  |  |   46|  67.0k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  67.0k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 67.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  67.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 67.0k]
  |  |  ------------------
  ------------------
  607|  67.0k|    ARG_CHECK(signature != NULL);
  ------------------
  |  |   45|  67.0k|#define ARG_CHECK(cond) do { \
  |  |   46|  67.0k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  67.0k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 67.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  67.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 67.0k]
  |  |  ------------------
  ------------------
  608|  67.0k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  67.0k|#define ARG_CHECK(cond) do { \
  |  |   46|  67.0k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  67.0k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 67.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  67.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 67.0k]
  |  |  ------------------
  ------------------
  609|       |
  610|  67.0k|    ret = secp256k1_ecdsa_sign_inner(ctx, &r, &s, NULL, msghash32, seckey, noncefp, noncedata);
  611|  67.0k|    secp256k1_ecdsa_signature_save(signature, &r, &s);
  612|  67.0k|    return ret;
  613|  67.0k|}
secp256k1_ec_seckey_verify:
  615|  12.0k|int secp256k1_ec_seckey_verify(const secp256k1_context* ctx, const unsigned char *seckey) {
  616|  12.0k|    secp256k1_scalar sec;
  617|  12.0k|    int ret;
  618|  12.0k|    VERIFY_CHECK(ctx != NULL);
  619|  12.0k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  12.0k|#define ARG_CHECK(cond) do { \
  |  |   46|  12.0k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  12.0k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 12.0k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  12.0k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 12.0k]
  |  |  ------------------
  ------------------
  620|       |
  621|  12.0k|    ret = secp256k1_scalar_set_b32_seckey(&sec, seckey);
  622|  12.0k|    secp256k1_scalar_clear(&sec);
  623|  12.0k|    return ret;
  624|  12.0k|}
secp256k1_ec_pubkey_create:
  636|  74.6k|int secp256k1_ec_pubkey_create(const secp256k1_context* ctx, secp256k1_pubkey *pubkey, const unsigned char *seckey) {
  637|  74.6k|    secp256k1_ge p;
  638|  74.6k|    secp256k1_scalar seckey_scalar;
  639|  74.6k|    int ret = 0;
  640|  74.6k|    VERIFY_CHECK(ctx != NULL);
  641|  74.6k|    ARG_CHECK(pubkey != NULL);
  ------------------
  |  |   45|  74.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  74.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  74.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 74.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  74.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 74.6k]
  |  |  ------------------
  ------------------
  642|  74.6k|    memset(pubkey, 0, sizeof(*pubkey));
  643|  74.6k|    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
  ------------------
  |  |   45|  74.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  74.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  74.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 74.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  74.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 74.6k]
  |  |  ------------------
  ------------------
  644|  74.6k|    ARG_CHECK(seckey != NULL);
  ------------------
  |  |   45|  74.6k|#define ARG_CHECK(cond) do { \
  |  |   46|  74.6k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|  74.6k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 74.6k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|  74.6k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 74.6k]
  |  |  ------------------
  ------------------
  645|       |
  646|  74.6k|    ret = secp256k1_ec_pubkey_create_helper(&ctx->ecmult_gen_ctx, &seckey_scalar, &p, seckey);
  647|  74.6k|    secp256k1_pubkey_save(pubkey, &p);
  648|  74.6k|    secp256k1_memczero(pubkey, sizeof(*pubkey), !ret);
  649|       |
  650|  74.6k|    secp256k1_scalar_clear(&seckey_scalar);
  651|  74.6k|    return ret;
  652|  74.6k|}
secp256k1.c:secp256k1_context_is_proper:
   83|      4|static int secp256k1_context_is_proper(const secp256k1_context* ctx) {
   84|      4|    return secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx);
   85|      4|}
secp256k1.c:secp256k1_pubkey_save:
  264|   122k|static void secp256k1_pubkey_save(secp256k1_pubkey* pubkey, secp256k1_ge* ge) {
  265|   122k|    secp256k1_ge_to_bytes(pubkey->data, ge);
  266|   122k|}
secp256k1.c:secp256k1_pubkey_load:
  258|   121k|static int secp256k1_pubkey_load(const secp256k1_context* ctx, secp256k1_ge* ge, const secp256k1_pubkey* pubkey) {
  259|   121k|    secp256k1_ge_from_bytes(ge, pubkey->data);
  260|   121k|    ARG_CHECK(!secp256k1_fe_is_zero(&ge->x));
  ------------------
  |  |   45|   121k|#define ARG_CHECK(cond) do { \
  |  |   46|   121k|    if (EXPECT(!(cond), 0)) { \
  |  |  ------------------
  |  |  |  |  146|   121k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (146:21): [True: 0, False: 121k]
  |  |  |  |  ------------------
  |  |  ------------------
  |  |   47|      0|        secp256k1_callback_call(&ctx->illegal_callback, #cond); \
  |  |   48|      0|        return 0; \
  |  |   49|      0|    } \
  |  |   50|   121k|} while(0)
  |  |  ------------------
  |  |  |  Branch (50:9): [Folded, False: 121k]
  |  |  ------------------
  ------------------
  261|   121k|    return 1;
  262|   121k|}
secp256k1.c:secp256k1_ecdsa_signature_save:
  385|   325k|static void secp256k1_ecdsa_signature_save(secp256k1_ecdsa_signature* sig, const secp256k1_scalar* r, const secp256k1_scalar* s) {
  386|   325k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (386:9): [True: 325k, Folded]
  ------------------
  387|   325k|        memcpy(&sig->data[0], r, 32);
  388|   325k|        memcpy(&sig->data[32], s, 32);
  389|   325k|    } else {
  390|      0|        secp256k1_scalar_get_b32(&sig->data[0], r);
  391|      0|        secp256k1_scalar_get_b32(&sig->data[32], s);
  392|      0|    }
  393|   325k|}
secp256k1.c:secp256k1_ecdsa_signature_load:
  371|   282k|static void secp256k1_ecdsa_signature_load(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, const secp256k1_ecdsa_signature* sig) {
  372|   282k|    (void)ctx;
  373|   282k|    if (sizeof(secp256k1_scalar) == 32) {
  ------------------
  |  Branch (373:9): [True: 282k, Folded]
  ------------------
  374|       |        /* When the secp256k1_scalar type is exactly 32 byte, use its
  375|       |         * representation inside secp256k1_ecdsa_signature, as conversion is very fast.
  376|       |         * Note that secp256k1_ecdsa_signature_save must use the same representation. */
  377|   282k|        memcpy(r, &sig->data[0], 32);
  378|   282k|        memcpy(s, &sig->data[32], 32);
  379|   282k|    } else {
  380|      0|        secp256k1_scalar_set_b32(r, &sig->data[0], NULL);
  381|       |        secp256k1_scalar_set_b32(s, &sig->data[32], NULL);
  382|      0|    }
  383|   282k|}
secp256k1.c:nonce_function_rfc6979_impl:
  497|  67.0k|static int nonce_function_rfc6979_impl(const secp256k1_hash_ctx *hash_ctx, unsigned char *nonce32, const unsigned char *msg32, const unsigned char *key32, const unsigned char *algo16, void *data, unsigned int counter) {
  498|  67.0k|   unsigned char keydata[112];
  499|  67.0k|   unsigned int offset = 0;
  500|  67.0k|   secp256k1_rfc6979_hmac_sha256 rng;
  501|  67.0k|   unsigned int i;
  502|  67.0k|   secp256k1_scalar msg;
  503|  67.0k|   unsigned char msgmod32[32];
  504|  67.0k|   secp256k1_scalar_set_b32(&msg, msg32, NULL);
  505|  67.0k|   secp256k1_scalar_get_b32(msgmod32, &msg);
  506|       |   /* We feed a byte array to the PRNG as input, consisting of:
  507|       |    * - the private key (32 bytes) and reduced message (32 bytes), see RFC 6979 3.2d.
  508|       |    * - optionally 32 extra bytes of data, see RFC 6979 3.6 Additional Data.
  509|       |    * - optionally 16 extra bytes with the algorithm name.
  510|       |    * Because the arguments have distinct fixed lengths it is not possible for
  511|       |    *  different argument mixtures to emulate each other and result in the same
  512|       |    *  nonces.
  513|       |    */
  514|  67.0k|   buffer_append(keydata, &offset, key32, 32);
  515|  67.0k|   buffer_append(keydata, &offset, msgmod32, 32);
  516|  67.0k|   if (data != NULL) {
  ------------------
  |  Branch (516:8): [True: 35.0k, False: 31.9k]
  ------------------
  517|  35.0k|       buffer_append(keydata, &offset, data, 32);
  518|  35.0k|   }
  519|  67.0k|   if (algo16 != NULL) {
  ------------------
  |  Branch (519:8): [True: 0, False: 67.0k]
  ------------------
  520|      0|       buffer_append(keydata, &offset, algo16, 16);
  521|      0|   }
  522|  67.0k|   secp256k1_rfc6979_hmac_sha256_initialize(hash_ctx, &rng, keydata, offset);
  523|  67.0k|   for (i = 0; ; i++) {
  524|  67.0k|       secp256k1_rfc6979_hmac_sha256_generate(hash_ctx, &rng, nonce32, 32);
  525|  67.0k|       if (i == counter) break;
  ------------------
  |  Branch (525:12): [True: 67.0k, False: 0]
  ------------------
  526|  67.0k|   }
  527|  67.0k|   secp256k1_rfc6979_hmac_sha256_finalize(&rng);
  528|       |
  529|  67.0k|   secp256k1_memclear_explicit(keydata, sizeof(keydata));
  530|  67.0k|   secp256k1_rfc6979_hmac_sha256_clear(&rng);
  531|  67.0k|   return 1;
  532|  67.0k|}
secp256k1.c:buffer_append:
  492|   169k|static SECP256K1_INLINE void buffer_append(unsigned char *buf, unsigned int *offset, const void *data, unsigned int len) {
  493|   169k|    memcpy(buf + *offset, data, len);
  494|   169k|    *offset += len;
  495|   169k|}
secp256k1.c:secp256k1_ecdsa_sign_inner:
  541|  67.0k|static int secp256k1_ecdsa_sign_inner(const secp256k1_context* ctx, secp256k1_scalar* r, secp256k1_scalar* s, int* recid, const unsigned char *msg32, const unsigned char *seckey, secp256k1_nonce_function noncefp, const void* noncedata) {
  542|  67.0k|    secp256k1_scalar sec, non, msg;
  543|  67.0k|    int ret = 0;
  544|  67.0k|    int is_sec_valid;
  545|  67.0k|    unsigned char nonce32[32];
  546|  67.0k|    unsigned int count = 0;
  547|       |    /* Default initialization here is important so we won't pass uninit values to the cmov in the end */
  548|  67.0k|    *r = secp256k1_scalar_zero;
  549|  67.0k|    *s = secp256k1_scalar_zero;
  550|  67.0k|    if (recid) {
  ------------------
  |  Branch (550:9): [True: 0, False: 67.0k]
  ------------------
  551|      0|        *recid = 0;
  552|      0|    }
  553|       |
  554|       |    /* Fail if the secret key is invalid. */
  555|  67.0k|    is_sec_valid = secp256k1_scalar_set_b32_seckey(&sec, seckey);
  556|  67.0k|    secp256k1_scalar_cmov(&sec, &secp256k1_scalar_one, !is_sec_valid);
  557|  67.0k|    secp256k1_scalar_set_b32(&msg, msg32, NULL);
  558|  67.0k|    while (1) {
  ------------------
  |  Branch (558:12): [True: 67.0k, Folded]
  ------------------
  559|  67.0k|        int is_nonce_valid;
  560|       |
  561|  67.0k|        if (noncefp == NULL || noncefp == secp256k1_nonce_function_rfc6979) {
  ------------------
  |  Branch (561:13): [True: 0, False: 67.0k]
  |  Branch (561:32): [True: 67.0k, False: 0]
  ------------------
  562|       |            /* Use ctx-aware function by default */
  563|  67.0k|            ret = nonce_function_rfc6979_impl(secp256k1_get_hash_context(ctx), nonce32, msg32, seckey, NULL, (void*)noncedata, count);
  564|  67.0k|        } else {
  565|      0|            ret = !!noncefp(nonce32, msg32, seckey, NULL, (void*)noncedata, count);
  566|      0|        }
  567|       |
  568|  67.0k|        if (!ret) {
  ------------------
  |  Branch (568:13): [True: 0, False: 67.0k]
  ------------------
  569|      0|            break;
  570|      0|        }
  571|  67.0k|        is_nonce_valid = secp256k1_scalar_set_b32_seckey(&non, nonce32);
  572|       |        /* The nonce is still secret here, but it being invalid is less likely than 1:2^255. */
  573|  67.0k|        secp256k1_declassify(ctx, &is_nonce_valid, sizeof(is_nonce_valid));
  574|  67.0k|        if (is_nonce_valid) {
  ------------------
  |  Branch (574:13): [True: 67.0k, False: 0]
  ------------------
  575|  67.0k|            ret = secp256k1_ecdsa_sig_sign(&ctx->ecmult_gen_ctx, r, s, &sec, &msg, &non, recid);
  576|       |            /* The final signature is no longer a secret, nor is the fact that we were successful or not. */
  577|  67.0k|            secp256k1_declassify(ctx, &ret, sizeof(ret));
  578|  67.0k|            if (ret) {
  ------------------
  |  Branch (578:17): [True: 67.0k, False: 0]
  ------------------
  579|  67.0k|                break;
  580|  67.0k|            }
  581|  67.0k|        }
  582|      0|        count++;
  583|      0|    }
  584|       |    /* We don't want to declassify is_sec_valid and therefore the range of
  585|       |     * seckey. As a result is_sec_valid is included in ret only after ret was
  586|       |     * used as a branching variable. */
  587|  67.0k|    ret &= is_sec_valid;
  588|  67.0k|    secp256k1_memclear_explicit(nonce32, sizeof(nonce32));
  589|  67.0k|    secp256k1_scalar_clear(&msg);
  590|  67.0k|    secp256k1_scalar_clear(&non);
  591|  67.0k|    secp256k1_scalar_clear(&sec);
  592|  67.0k|    secp256k1_scalar_cmov(r, &secp256k1_scalar_zero, !ret);
  593|  67.0k|    secp256k1_scalar_cmov(s, &secp256k1_scalar_zero, !ret);
  594|  67.0k|    if (recid) {
  ------------------
  |  Branch (594:9): [True: 0, False: 67.0k]
  ------------------
  595|      0|        const int zero = 0;
  596|      0|        secp256k1_int_cmov(recid, &zero, !ret);
  597|      0|    }
  598|  67.0k|    return ret;
  599|  67.0k|}
secp256k1.c:secp256k1_ec_pubkey_create_helper:
  626|  74.6k|static int secp256k1_ec_pubkey_create_helper(const secp256k1_ecmult_gen_context *ecmult_gen_ctx, secp256k1_scalar *seckey_scalar, secp256k1_ge *p, const unsigned char *seckey) {
  627|  74.6k|    int ret;
  628|       |
  629|  74.6k|    ret = secp256k1_scalar_set_b32_seckey(seckey_scalar, seckey);
  630|  74.6k|    secp256k1_scalar_cmov(seckey_scalar, &secp256k1_scalar_one, !ret);
  631|       |
  632|  74.6k|    secp256k1_ecmult_gen_ge(ecmult_gen_ctx, p, seckey_scalar);
  633|  74.6k|    return ret;
  634|  74.6k|}
secp256k1.c:secp256k1_ec_pubkey_tweak_add_helper:
  712|    387|static int secp256k1_ec_pubkey_tweak_add_helper(secp256k1_ge *p, const unsigned char *tweak32) {
  713|    387|    secp256k1_scalar term;
  714|    387|    int overflow = 0;
  715|    387|    secp256k1_scalar_set_b32(&term, tweak32, &overflow);
  716|    387|    return !overflow && secp256k1_eckey_pubkey_tweak_add(p, &term);
  ------------------
  |  Branch (716:12): [True: 387, False: 0]
  |  Branch (716:25): [True: 387, False: 0]
  ------------------
  717|    387|}
secp256k1.c:secp256k1_get_hash_context:
  237|  67.2k|static SECP256K1_INLINE const secp256k1_hash_ctx* secp256k1_get_hash_context(const secp256k1_context *ctx) {
  238|  67.2k|    return &ctx->hash_ctx;
  239|  67.2k|}
secp256k1.c:secp256k1_declassify:
  254|   134k|static SECP256K1_INLINE void secp256k1_declassify(const secp256k1_context* ctx, const void *p, size_t len) {
  255|   134k|    if (EXPECT(ctx->declassify, 0)) SECP256K1_CHECKMEM_DEFINE(p, len);
  ------------------
  |  |  146|   134k|#define EXPECT(x,c) __builtin_expect((x),(c))
  |  |  ------------------
  |  |  |  Branch (146:21): [True: 0, False: 134k]
  |  |  ------------------
  ------------------
                  if (EXPECT(ctx->declassify, 0)) SECP256K1_CHECKMEM_DEFINE(p, len);
  ------------------
  |  |  106|      0|#  define SECP256K1_CHECKMEM_DEFINE(p, len) SECP256K1_CHECKMEM_NOOP((p), (len))
  |  |  ------------------
  |  |  |  |   42|      0|#define SECP256K1_CHECKMEM_NOOP(p, len) do { (void)(p); (void)(len); } while(0)
  |  |  |  |  ------------------
  |  |  |  |  |  Branch (42:78): [Folded, False: 0]
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  256|   134k|}

secp256k1.c:secp256k1_read_be32:
  428|  24.7M|SECP256K1_INLINE static uint32_t secp256k1_read_be32(const unsigned char* p) {
  429|  24.7M|    return (uint32_t)p[0] << 24 |
  430|  24.7M|           (uint32_t)p[1] << 16 |
  431|  24.7M|           (uint32_t)p[2] << 8  |
  432|  24.7M|           (uint32_t)p[3];
  433|  24.7M|}
secp256k1.c:secp256k1_memcmp_var:
  281|    387|static SECP256K1_INLINE int secp256k1_memcmp_var(const void *s1, const void *s2, size_t n) {
  282|    387|    const unsigned char *p1 = s1, *p2 = s2;
  283|    387|    size_t i;
  284|       |
  285|    422|    for (i = 0; i < n; i++) {
  ------------------
  |  Branch (285:17): [True: 422, False: 0]
  ------------------
  286|    422|        int diff = p1[i] - p2[i];
  287|    422|        if (diff != 0) {
  ------------------
  |  Branch (287:13): [True: 387, False: 35]
  ------------------
  288|    387|            return diff;
  289|    387|        }
  290|    422|    }
  291|      0|    return 0;
  292|    387|}
secp256k1.c:secp256k1_read_be64:
  444|  3.70M|SECP256K1_INLINE static uint64_t secp256k1_read_be64(const unsigned char* p) {
  445|  3.70M|    return (uint64_t)p[0] << 56 |
  446|  3.70M|           (uint64_t)p[1] << 48 |
  447|  3.70M|           (uint64_t)p[2] << 40 |
  448|  3.70M|           (uint64_t)p[3] << 32 |
  449|  3.70M|           (uint64_t)p[4] << 24 |
  450|  3.70M|           (uint64_t)p[5] << 16 |
  451|  3.70M|           (uint64_t)p[6] << 8  |
  452|  3.70M|           (uint64_t)p[7];
  453|  3.70M|}
secp256k1.c:secp256k1_ctz64_var:
  410|  11.3M|static SECP256K1_INLINE int secp256k1_ctz64_var(uint64_t x) {
  411|  11.3M|    VERIFY_CHECK(x != 0);
  412|  11.3M|#if (__has_builtin(__builtin_ctzl) || defined(__GNUC__))
  413|       |    /* If the unsigned long type is sufficient to represent the largest uint64_t, consider __builtin_ctzl. */
  414|  11.3M|    if (((unsigned long)UINT64_MAX) == UINT64_MAX) {
  ------------------
  |  Branch (414:9): [True: 11.3M, Folded]
  ------------------
  415|  11.3M|        return __builtin_ctzl(x);
  416|  11.3M|    }
  417|      0|#endif
  418|      0|#if (__has_builtin(__builtin_ctzll) || defined(__GNUC__))
  419|       |    /* Otherwise consider __builtin_ctzll (the unsigned long long type is always at least 64 bits). */
  420|      0|    return __builtin_ctzll(x);
  421|       |#else
  422|       |    /* If no suitable CTZ builtin is available, use a (variable time) software emulation. */
  423|       |    return secp256k1_ctz64_var_debruijn(x);
  424|       |#endif
  425|  11.3M|}
secp256k1.c:secp256k1_memczero:
  220|  74.6k|static SECP256K1_INLINE void secp256k1_memczero(void *s, size_t len, int flag) {
  221|  74.6k|    unsigned char *p = (unsigned char *)s;
  222|       |    /* Access flag with a volatile-qualified lvalue.
  223|       |       This prevents clang from figuring out (after inlining) that flag can
  224|       |       take only be 0 or 1, which leads to variable time code. */
  225|  74.6k|    volatile int vflag = flag;
  226|  74.6k|    unsigned char mask = -(unsigned char) vflag;
  227|  74.6k|    VERIFY_CHECK(flag == 0 || flag == 1);
  228|  4.84M|    while (len) {
  ------------------
  |  Branch (228:12): [True: 4.77M, False: 74.6k]
  ------------------
  229|  4.77M|        *p &= ~mask;
  230|  4.77M|        p++;
  231|  4.77M|        len--;
  232|  4.77M|    }
  233|  74.6k|}
secp256k1.c:secp256k1_rotr32:
  468|  36.5M|SECP256K1_INLINE static uint32_t secp256k1_rotr32(const uint32_t x, const unsigned int by) {
  469|       |#if defined(_MSC_VER)
  470|       |    return _rotr(x, by);  /* needs <stdlib.h> */
  471|       |#else
  472|       |    /* Reduce rotation amount to avoid UB when shifting. */
  473|  36.5M|    const unsigned int mask = CHAR_BIT * sizeof(x) - 1;
  474|       |    /* Turned into a rot instruction by GCC and clang. */
  475|  36.5M|    return (x >> (by & mask)) | (x << ((-by) & mask));
  476|  36.5M|#endif
  477|  36.5M|}
secp256k1.c:secp256k1_write_be64:
  456|  1.87M|SECP256K1_INLINE static void secp256k1_write_be64(unsigned char* p, uint64_t x) {
  457|  1.87M|    p[7] = x;
  458|  1.87M|    p[6] = x >>  8;
  459|  1.87M|    p[5] = x >> 16;
  460|  1.87M|    p[4] = x >> 24;
  461|  1.87M|    p[3] = x >> 32;
  462|  1.87M|    p[2] = x >> 40;
  463|  1.87M|    p[1] = x >> 48;
  464|  1.87M|    p[0] = x >> 56;
  465|  1.87M|}
secp256k1.c:secp256k1_memclear_explicit:
  268|  2.19M|static SECP256K1_INLINE void secp256k1_memclear_explicit(void *ptr, size_t len) {
  269|       |    /* The current implementation zeroes, but callers must not rely on this */
  270|  2.19M|    secp256k1_memzero_explicit(ptr, len);
  271|       |#ifdef VERIFY
  272|       |    SECP256K1_CHECKMEM_UNDEFINE(ptr, len);
  273|       |#endif
  274|  2.19M|}
secp256k1.c:secp256k1_memzero_explicit:
  236|  2.19M|static SECP256K1_INLINE void secp256k1_memzero_explicit(void *ptr, size_t len) {
  237|       |#if defined(_MSC_VER)
  238|       |    /* SecureZeroMemory is guaranteed not to be optimized out by MSVC. */
  239|       |    SecureZeroMemory(ptr, len);
  240|       |#elif defined(__GNUC__)
  241|       |    /* We use a memory barrier that scares the compiler away from optimizing out the memset.
  242|       |     *
  243|       |     * Quoting Adam Langley <agl@google.com> in commit ad1907fe73334d6c696c8539646c21b11178f20f
  244|       |     * in BoringSSL (ISC License):
  245|       |     *    As best as we can tell, this is sufficient to break any optimisations that
  246|       |     *    might try to eliminate "superfluous" memsets.
  247|       |     * This method is used in memzero_explicit() the Linux kernel, too. Its advantage is that it
  248|       |     * is pretty efficient, because the compiler can still implement the memset() efficiently,
  249|       |     * just not remove it entirely. See "Dead Store Elimination (Still) Considered Harmful" by
  250|       |     * Yang et al. (USENIX Security 2017) for more background.
  251|       |     */
  252|  2.19M|    memset(ptr, 0, len);
  253|  2.19M|    __asm__ __volatile__("" : : "r"(ptr) : "memory");
  254|       |#else
  255|       |    void *(*volatile const volatile_memset)(void *, int, size_t) = memset;
  256|       |    volatile_memset(ptr, 0, len);
  257|       |#endif
  258|  2.19M|}
secp256k1.c:secp256k1_write_be32:
  436|  6.70M|SECP256K1_INLINE static void secp256k1_write_be32(unsigned char* p, uint32_t x) {
  437|  6.70M|    p[3] = x;
  438|  6.70M|    p[2] = x >>  8;
  439|  6.70M|    p[1] = x >> 16;
  440|  6.70M|    p[0] = x >> 24;
  441|  6.70M|}

block.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSC_:
  491|  14.7k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
block.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSC_:
  491|  7.44k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
block.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE7WrapperIT_RT0_EOSD_:
  491|  23.7k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
coins_view.cpp:_ZL5UsingI15VarIntFormatterIL10VarIntMode0EERjE7WrapperIT_RT0_EOS6_:
  491|  24.0k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
coins_view.cpp:_ZL5UsingI15VarIntFormatterIL10VarIntMode0EERmE7WrapperIT_RT0_EOS6_:
  491|  12.0k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
coins_view.cpp:_ZL5UsingI17AmountCompressionRlE7WrapperIT_RT0_EOS4_:
  491|  12.0k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
coins_view.cpp:_ZL5UsingI17ScriptCompressionR7CScriptE7WrapperIT_RT0_EOS5_:
  491|  12.0k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
coins_view.cpp:_ZL5UsingI16TxOutCompressionR6CTxOutE7WrapperIT_RT0_EOS5_:
  491|  12.0k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_Z11UnserializeI10SpanReaderR13KeyOriginInfoQ14UnserializableIT0_T_EEvRS4_OS3_:
  776|  16.9k|{
  777|  16.9k|    a.Unserialize(is);
  778|  16.9k|}
_ZN13KeyOriginInfo11UnserializeI10SpanReaderEEvRT_:
  220|  16.9k|    {                                                                                               \
  221|  16.9k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|  16.9k|        Unser(s, *this);                                                                            \
  223|  16.9k|    }
_ZN13KeyOriginInfo5UnserI10SpanReaderEEvRT_RS_:
  172|  16.9k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10SpanReaderJRNSt3__15arrayIhLm4EEERNS2_6vectorIjNS2_9allocatorIjEEEEEEEvRT_DpOT0_:
 1086|  16.9k|    {
 1087|  16.9k|        ::UnserializeMany(s, args...);
 1088|  16.9k|    }
_Z15UnserializeManyI10SpanReaderJRNSt3__15arrayIhLm4EEERNS1_6vectorIjNS1_9allocatorIjEEEEEEvRT_DpOT0_:
 1054|  16.9k|{
 1055|  16.9k|    (::Unserialize(s, args), ...);
 1056|  16.9k|}
_Z11UnserializeI10SpanReaderjNSt3__19allocatorIjEEEvRT_RNS1_6vectorIT0_T1_EE:
  919|  16.6k|{
  920|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  921|       |        // Limit size per read so bogus size value won't cause out of memory
  922|       |        v.clear();
  923|       |        unsigned int nSize = ReadCompactSize(is);
  924|       |        unsigned int i = 0;
  925|       |        while (i < nSize) {
  926|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  927|       |            v.resize(i + blk);
  928|       |            is.read(std::as_writable_bytes(std::span{&v[i], blk}));
  929|       |            i += blk;
  930|       |        }
  931|  16.6k|    } else {
  932|  16.6k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  933|  16.6k|    }
  934|  16.6k|}
_Z11UnserializeI10SpanReader7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS5_9allocatorIjEEEEEQ14UnserializableIT0_T_EEvRSD_OSC_:
  776|  16.6k|{
  777|  16.6k|    a.Unserialize(is);
  778|  16.6k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS3_9allocatorIjEEEEE11UnserializeI10SpanReaderEEvRT_:
  477|  16.6k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI10SpanReaderNSt3__16vectorIjNS4_9allocatorIjEEEEEEvRT_RT0_:
  680|  16.6k|    {
  681|  16.6k|        Formatter formatter;
  682|  16.6k|        v.clear();
  683|  16.6k|        size_t size = ReadCompactSize(s);
  684|  16.6k|        size_t allocated = 0;
  685|  20.2k|        while (allocated < size) {
  ------------------
  |  Branch (685:16): [True: 3.60k, False: 16.6k]
  ------------------
  686|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  687|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  688|       |            // X MiB of data to make us allocate X+5 Mib.
  689|  3.60k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  690|  3.60k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  691|  3.60k|            v.reserve(allocated);
  692|   232k|            while (v.size() < allocated) {
  ------------------
  |  Branch (692:20): [True: 228k, False: 3.60k]
  ------------------
  693|   228k|                v.emplace_back();
  694|   228k|                formatter.Unser(s, v.back());
  695|   228k|            }
  696|  3.60k|        }
  697|  16.6k|    };
_ZN16DefaultFormatter5UnserI10SpanReaderjEEvRT_RT0_:
  791|   228k|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
script_sign.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS3_9allocatorIjEEEEE7WrapperIT_RT0_EOSB_:
  491|  16.6k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_Z11UnserializeI10SpanReaderR7CPubKeyQ14UnserializableIT0_T_EEvRS4_OS3_:
  776|  19.5k|{
  777|  19.5k|    a.Unserialize(is);
  778|  19.5k|}
_Z11UnserializeI10SpanReaderR9COutPointQ14UnserializableIT0_T_EEvRS4_OS3_:
  776|  12.7k|{
  777|  12.7k|    a.Unserialize(is);
  778|  12.7k|}
_ZN9COutPoint11UnserializeI10SpanReaderEEvRT_:
  220|  12.7k|    {                                                                                               \
  221|  12.7k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|  12.7k|        Unser(s, *this);                                                                            \
  223|  12.7k|    }
_ZN9COutPoint5UnserI10SpanReaderEEvRT_RS_:
  172|  12.7k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10SpanReaderJR22transaction_identifierILb0EERjEEEvRT_DpOT0_:
 1086|  12.7k|    {
 1087|  12.7k|        ::UnserializeMany(s, args...);
 1088|  12.7k|    }
_Z15UnserializeManyI10SpanReaderJR22transaction_identifierILb0EERjEEvRT_DpOT0_:
 1054|  12.7k|{
 1055|  12.7k|    (::Unserialize(s, args), ...);
 1056|  12.7k|}
_Z11UnserializeI10SpanReaderR13ParamsWrapperI20TransactionSerParams19CMutableTransactionEQ14UnserializableIT0_T_EEvRS7_OS6_:
  776|  19.8k|{
  777|  19.8k|    a.Unserialize(is);
  778|  19.8k|}
_ZN13ParamsWrapperI20TransactionSerParams19CMutableTransactionE11UnserializeI10SpanReaderEEvRT_:
 1259|  19.8k|    {
 1260|  19.8k|        ParamsStream ss{s, m_params};
 1261|  19.8k|        ::Unserialize(ss, m_object);
 1262|  19.8k|    }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsER19CMutableTransactionQ14UnserializableIT0_T_EEvRS8_OS7_:
  776|  19.8k|{
  777|  19.8k|    a.Unserialize(is);
  778|  19.8k|}
_Z11UnserializeI10SpanReaderTk9BasicBytehLm4EEvRT_RNSt3__15arrayIT0_XT1_EEE:
  275|  16.9k|template <typename Stream, BasicByte B, size_t N> void Unserialize(Stream& s, std::array<B, N>& a)  { s.read(MakeWritableByteSpan(a)); }
_Z11UnserializeI10SpanReaderR6CTxOutQ14UnserializableIT0_T_EEvRS4_OS3_:
  776|  12.0k|{
  777|  12.0k|    a.Unserialize(is);
  778|  12.0k|}
_ZN6CTxOut11UnserializeI10SpanReaderEEvRT_:
  220|  12.0k|    {                                                                                               \
  221|  12.0k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|  12.0k|        Unser(s, *this);                                                                            \
  223|  12.0k|    }
_ZN6CTxOut5UnserI10SpanReaderEEvRT_RS_:
  172|  12.0k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10SpanReaderJRlR7CScriptEEEvRT_DpOT0_:
 1086|  12.0k|    {
 1087|  12.0k|        ::UnserializeMany(s, args...);
 1088|  12.0k|    }
_Z15UnserializeManyI10SpanReaderJRlR7CScriptEEvRT_DpOT0_:
 1054|  12.0k|{
 1055|  12.0k|    (::Unserialize(s, args), ...);
 1056|  12.0k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorIjNS3_9allocatorIjEEEEEC2ES8_:
  475|  16.6k|    explicit Wrapper(T obj) : m_object(obj) {}
_Z11UnserializeI10SpanReaderEvRT_Rl:
  271|  12.0k|template <typename Stream> void Unserialize(Stream& s, int64_t& a)   { a = int64_t(ser_readdata64(s)); }
_Z11UnserializeI10DataStreamTk9BasicBytehLm4EEvRT_RNSt3__15arrayIT0_XT1_EEE:
  275|    167|template <typename Stream, BasicByte B, size_t N> void Unserialize(Stream& s, std::array<B, N>& a)  { s.read(MakeWritableByteSpan(a)); }
transaction.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSD_:
  491|  17.5k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
transaction.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE7WrapperIT_RT0_EOSD_:
  491|  16.5k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
transaction.cpp:_ZL5UsingI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE7WrapperIT_RT0_EOSE_:
  491|  23.0k|static inline Wrapper<Formatter, T&> Using(T&& t) { return Wrapper<Formatter, T&>(t); }
_Z15ReadCompactSizeI10DataStreamEmRT_b:
  334|    746|{
  335|    746|    uint8_t chSize = ser_readdata8(is);
  336|    746|    uint64_t nSizeRet = 0;
  337|    746|    if (chSize < 253)
  ------------------
  |  Branch (337:9): [True: 114, False: 632]
  ------------------
  338|    114|    {
  339|    114|        nSizeRet = chSize;
  340|    114|    }
  341|    632|    else if (chSize == 253)
  ------------------
  |  Branch (341:14): [True: 43, False: 589]
  ------------------
  342|     43|    {
  343|     43|        nSizeRet = ser_readdata16(is);
  344|     43|        if (nSizeRet < 253)
  ------------------
  |  Branch (344:13): [True: 4, False: 39]
  ------------------
  345|      4|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  346|     43|    }
  347|    589|    else if (chSize == 254)
  ------------------
  |  Branch (347:14): [True: 70, False: 519]
  ------------------
  348|     70|    {
  349|     70|        nSizeRet = ser_readdata32(is);
  350|     70|        if (nSizeRet < 0x10000u)
  ------------------
  |  Branch (350:13): [True: 10, False: 60]
  ------------------
  351|     10|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  352|     70|    }
  353|    519|    else
  354|    519|    {
  355|    519|        nSizeRet = ser_readdata64(is);
  356|    519|        if (nSizeRet < 0x100000000ULL)
  ------------------
  |  Branch (356:13): [True: 21, False: 498]
  ------------------
  357|     21|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  358|    519|    }
  359|    711|    if (range_check && nSizeRet > MAX_SIZE) {
  ------------------
  |  Branch (359:9): [True: 274, False: 437]
  |  Branch (359:24): [True: 82, False: 192]
  ------------------
  360|     82|        throw std::ios_base::failure("ReadCompactSize(): size too large");
  361|     82|    }
  362|    629|    return nSizeRet;
  363|    711|}
_Z14ser_readdata16I10DataStreamEtRT_:
   88|     43|{
   89|     43|    uint16_t obj;
   90|     43|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   91|     43|    return le16toh_internal(obj);
   92|     43|}
_Z14ser_readdata32I10DataStreamEjRT_:
   94|  1.71M|{
   95|  1.71M|    uint32_t obj;
   96|  1.71M|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   97|  1.71M|    return le32toh_internal(obj);
   98|  1.71M|}
_Z14ser_readdata64I10DataStreamEmRT_:
  106|     85|{
  107|     85|    uint64_t obj;
  108|     85|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
  109|     85|    return le64toh_internal(obj);
  110|     85|}
_Z11UnserializeI10DataStreamEvRT_Rj:
  270|  1.71M|template <typename Stream> void Unserialize(Stream& s, uint32_t& a)  { a = ser_readdata32(s); }
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsEC2ES1_RKS2_:
 1181|  19.8k|    ParamsStream(SubStream&& substream, const Params& params LIFETIMEBOUND) : m_params{params}, m_substream{std::forward<SubStream>(substream)} {}
_Z14ser_readdata32I12ParamsStreamIR10SpanReader20TransactionSerParamsEEjRT_:
   94|   651k|{
   95|   651k|    uint32_t obj;
   96|   651k|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   97|   651k|    return le32toh_internal(obj);
   98|   651k|}
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsE4readENSt3__14spanISt4byteLm18446744073709551615EEE:
 1190|  3.97M|    void read(std::span<std::byte> dst) { GetStream().read(dst); }
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsE9GetStreamEv:
 1208|  3.97M|    {
 1209|       |        if constexpr (ContainsStream<SubStream>) {
 1210|       |            return m_substream.GetStream();
 1211|  3.97M|        } else {
 1212|  3.97M|            return m_substream;
 1213|  3.97M|        }
 1214|  3.97M|    }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEvRT_Rj:
  270|   651k|template <typename Stream> void Unserialize(Stream& s, uint32_t& a)  { a = ser_readdata32(s); }
_Z15ReadCompactSizeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEmRT_b:
  334|  2.24M|{
  335|  2.24M|    uint8_t chSize = ser_readdata8(is);
  336|  2.24M|    uint64_t nSizeRet = 0;
  337|  2.24M|    if (chSize < 253)
  ------------------
  |  Branch (337:9): [True: 2.24M, False: 865]
  ------------------
  338|  2.24M|    {
  339|  2.24M|        nSizeRet = chSize;
  340|  2.24M|    }
  341|    865|    else if (chSize == 253)
  ------------------
  |  Branch (341:14): [True: 427, False: 438]
  ------------------
  342|    427|    {
  343|    427|        nSizeRet = ser_readdata16(is);
  344|    427|        if (nSizeRet < 253)
  ------------------
  |  Branch (344:13): [True: 1, False: 426]
  ------------------
  345|      1|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  346|    427|    }
  347|    438|    else if (chSize == 254)
  ------------------
  |  Branch (347:14): [True: 198, False: 240]
  ------------------
  348|    198|    {
  349|    198|        nSizeRet = ser_readdata32(is);
  350|    198|        if (nSizeRet < 0x10000u)
  ------------------
  |  Branch (350:13): [True: 14, False: 184]
  ------------------
  351|     14|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  352|    198|    }
  353|    240|    else
  354|    240|    {
  355|    240|        nSizeRet = ser_readdata64(is);
  356|    240|        if (nSizeRet < 0x100000000ULL)
  ------------------
  |  Branch (356:13): [True: 35, False: 205]
  ------------------
  357|     35|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  358|    240|    }
  359|  2.24M|    if (range_check && nSizeRet > MAX_SIZE) {
  ------------------
  |  Branch (359:9): [True: 2.24M, False: 100]
  |  Branch (359:24): [True: 128, False: 2.24M]
  ------------------
  360|    128|        throw std::ios_base::failure("ReadCompactSize(): size too large");
  361|    128|    }
  362|  2.24M|    return nSizeRet;
  363|  2.24M|}
_Z13ser_readdata8I12ParamsStreamIR10SpanReader20TransactionSerParamsEEhRT_:
   82|  2.25M|{
   83|  2.25M|    uint8_t obj;
   84|  2.25M|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   85|  2.25M|    return obj;
   86|  2.25M|}
_Z14ser_readdata16I12ParamsStreamIR10SpanReader20TransactionSerParamsEEtRT_:
   88|    427|{
   89|    427|    uint16_t obj;
   90|    427|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   91|    427|    return le16toh_internal(obj);
   92|    427|}
_Z14ser_readdata64I12ParamsStreamIR10SpanReader20TransactionSerParamsEEmRT_:
  106|   590k|{
  107|   590k|    uint64_t obj;
  108|   590k|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
  109|   590k|    return le64toh_internal(obj);
  110|   590k|}
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsErsIRjEERS3_OT_:
 1188|  32.4k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsErsIRNSt3__16vectorI5CTxInNS5_9allocatorIS7_EEEEEERS3_OT_:
 1188|  14.7k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsE5CTxInNSt3__19allocatorIS5_EEEvRT_RNS6_6vectorIT0_T1_EE:
  919|  14.7k|{
  920|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  921|       |        // Limit size per read so bogus size value won't cause out of memory
  922|       |        v.clear();
  923|       |        unsigned int nSize = ReadCompactSize(is);
  924|       |        unsigned int i = 0;
  925|       |        while (i < nSize) {
  926|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  927|       |            v.resize(i + blk);
  928|       |            is.read(std::as_writable_bytes(std::span{&v[i], blk}));
  929|       |            i += blk;
  930|       |        }
  931|  14.7k|    } else {
  932|  14.7k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  933|  14.7k|    }
  934|  14.7k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS9_9allocatorISB_EEEEEQ14UnserializableIT0_T_EEvRSI_OSH_:
  776|  14.7k|{
  777|  14.7k|    a.Unserialize(is);
  778|  14.7k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  477|  14.7k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsENSt3__16vectorI5CTxInNS8_9allocatorISA_EEEEEEvRT_RT0_:
  680|  14.7k|    {
  681|  14.7k|        Formatter formatter;
  682|  14.7k|        v.clear();
  683|  14.7k|        size_t size = ReadCompactSize(s);
  684|  14.7k|        size_t allocated = 0;
  685|  22.4k|        while (allocated < size) {
  ------------------
  |  Branch (685:16): [True: 7.65k, False: 14.7k]
  ------------------
  686|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  687|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  688|       |            // X MiB of data to make us allocate X+5 Mib.
  689|  7.65k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  690|  7.65k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  691|  7.65k|            v.reserve(allocated);
  692|   317k|            while (v.size() < allocated) {
  ------------------
  |  Branch (692:20): [True: 309k, False: 7.65k]
  ------------------
  693|   309k|                v.emplace_back();
  694|   309k|                formatter.Unser(s, v.back());
  695|   309k|            }
  696|  7.65k|        }
  697|  14.7k|    };
_ZN16DefaultFormatter5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsE5CTxInEEvRT_RT0_:
  791|   309k|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsER5CTxInQ14UnserializableIT0_T_EEvRS8_OS7_:
  776|   309k|{
  777|   309k|    a.Unserialize(is);
  778|   309k|}
_ZN5CTxIn11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  220|   309k|    {                                                                                               \
  221|   309k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|   309k|        Unser(s, *this);                                                                            \
  223|   309k|    }
_ZN5CTxIn5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_RS_:
  172|   309k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJR9COutPointR7CScriptRjEEEvRT_DpOT0_:
 1086|   309k|    {
 1087|   309k|        ::UnserializeMany(s, args...);
 1088|   309k|    }
_Z15UnserializeManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJR9COutPointR7CScriptRjEEvRT_DpOT0_:
 1054|   309k|{
 1055|   309k|    (::Unserialize(s, args), ...);
 1056|   309k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsER9COutPointQ14UnserializableIT0_T_EEvRS8_OS7_:
  776|   309k|{
  777|   309k|    a.Unserialize(is);
  778|   309k|}
_ZN9COutPoint11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  220|   309k|    {                                                                                               \
  221|   309k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|   309k|        Unser(s, *this);                                                                            \
  223|   309k|    }
_ZN9COutPoint5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_RS_:
  172|   309k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJR22transaction_identifierILb0EERjEEEvRT_DpOT0_:
 1086|   309k|    {
 1087|   309k|        ::UnserializeMany(s, args...);
 1088|   309k|    }
_Z15UnserializeManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJR22transaction_identifierILb0EERjEEvRT_DpOT0_:
 1054|   309k|{
 1055|   309k|    (::Unserialize(s, args), ...);
 1056|   309k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsER22transaction_identifierILb0EEQ14UnserializableIT0_T_EEvRS9_OS8_:
  776|   309k|{
  777|   309k|    a.Unserialize(is);
  778|   309k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsER7CScriptQ14UnserializableIT0_T_EEvRS8_OS7_:
  776|   899k|{
  777|   899k|    a.Unserialize(is);
  778|   899k|}
_ZN7CScript11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  220|   899k|    {                                                                                               \
  221|   899k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|   899k|        Unser(s, *this);                                                                            \
  223|   899k|    }
_ZN7CScript5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_RS_:
  172|   899k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJR9prevectorILj36EhjiEEEEvRT_DpOT0_:
 1086|   899k|    {
 1087|   899k|        ::UnserializeMany(s, args...);
 1088|   899k|    }
_Z15UnserializeManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJR9prevectorILj36EhjiEEEvRT_DpOT0_:
 1054|   899k|{
 1055|   899k|    (::Unserialize(s, args), ...);
 1056|   899k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsELj36EhEvRT_R9prevectorIXT0_ET1_jiE:
  876|   899k|{
  877|   899k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  878|       |        // Limit size per read so bogus size value won't cause out of memory
  879|   899k|        v.clear();
  880|   899k|        unsigned int nSize = ReadCompactSize(is);
  881|   899k|        unsigned int i = 0;
  882|   935k|        while (i < nSize) {
  ------------------
  |  Branch (882:16): [True: 35.1k, False: 899k]
  ------------------
  883|  35.1k|            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  884|  35.1k|            v.resize_uninitialized(i + blk);
  885|  35.1k|            is.read(std::as_writable_bytes(std::span{&v[i], blk}));
  886|  35.1k|            i += blk;
  887|  35.1k|        }
  888|       |    } else {
  889|       |        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  890|       |    }
  891|   899k|}
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsErsIRhEERS3_OT_:
 1188|  6.79k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEvRT_Rh:
  266|  6.79k|template <typename Stream> void Unserialize(Stream& s, uint8_t& a)   { a = ser_readdata8(s); }
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsErsIRNSt3__16vectorI6CTxOutNS5_9allocatorIS7_EEEEEERS3_OT_:
 1188|  7.44k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsE6CTxOutNSt3__19allocatorIS5_EEEvRT_RNS6_6vectorIT0_T1_EE:
  919|  7.44k|{
  920|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  921|       |        // Limit size per read so bogus size value won't cause out of memory
  922|       |        v.clear();
  923|       |        unsigned int nSize = ReadCompactSize(is);
  924|       |        unsigned int i = 0;
  925|       |        while (i < nSize) {
  926|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  927|       |            v.resize(i + blk);
  928|       |            is.read(std::as_writable_bytes(std::span{&v[i], blk}));
  929|       |            i += blk;
  930|       |        }
  931|  7.44k|    } else {
  932|  7.44k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  933|  7.44k|    }
  934|  7.44k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS9_9allocatorISB_EEEEEQ14UnserializableIT0_T_EEvRSI_OSH_:
  776|  7.44k|{
  777|  7.44k|    a.Unserialize(is);
  778|  7.44k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  477|  7.44k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsENSt3__16vectorI6CTxOutNS8_9allocatorISA_EEEEEEvRT_RT0_:
  680|  7.44k|    {
  681|  7.44k|        Formatter formatter;
  682|  7.44k|        v.clear();
  683|  7.44k|        size_t size = ReadCompactSize(s);
  684|  7.44k|        size_t allocated = 0;
  685|  8.51k|        while (allocated < size) {
  ------------------
  |  Branch (685:16): [True: 1.07k, False: 7.44k]
  ------------------
  686|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  687|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  688|       |            // X MiB of data to make us allocate X+5 Mib.
  689|  1.07k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  690|  1.07k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  691|  1.07k|            v.reserve(allocated);
  692|   591k|            while (v.size() < allocated) {
  ------------------
  |  Branch (692:20): [True: 590k, False: 1.07k]
  ------------------
  693|   590k|                v.emplace_back();
  694|   590k|                formatter.Unser(s, v.back());
  695|   590k|            }
  696|  1.07k|        }
  697|  7.44k|    };
_ZN16DefaultFormatter5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsE6CTxOutEEvRT_RT0_:
  791|   590k|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsER6CTxOutQ14UnserializableIT0_T_EEvRS8_OS7_:
  776|   590k|{
  777|   590k|    a.Unserialize(is);
  778|   590k|}
_ZN6CTxOut11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  220|   590k|    {                                                                                               \
  221|   590k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|   590k|        Unser(s, *this);                                                                            \
  223|   590k|    }
_ZN6CTxOut5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_RS_:
  172|   590k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJRlR7CScriptEEEvRT_DpOT0_:
 1086|   590k|    {
 1087|   590k|        ::UnserializeMany(s, args...);
 1088|   590k|    }
_Z15UnserializeManyI12ParamsStreamIR10SpanReader20TransactionSerParamsEJRlR7CScriptEEvRT_DpOT0_:
 1054|   590k|{
 1055|   590k|    (::Unserialize(s, args), ...);
 1056|   590k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEvRT_Rl:
  271|   590k|template <typename Stream> void Unserialize(Stream& s, int64_t& a)   { a = int64_t(ser_readdata64(s)); }
_ZN12ParamsStreamIR10SpanReader20TransactionSerParamsErsIRNSt3__16vectorINS6_IhNS5_9allocatorIhEEEENS7_IS9_EEEEEERS3_OT_:
 1188|  23.7k|    template <typename U> ParamsStream& operator>>(U&& obj) { ::Unserialize(*this, obj); return *this; }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsENSt3__16vectorIhNS5_9allocatorIhEEEENS7_IS9_EEEvRT_RNS6_IT0_T1_EE:
  919|  23.7k|{
  920|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  921|       |        // Limit size per read so bogus size value won't cause out of memory
  922|       |        v.clear();
  923|       |        unsigned int nSize = ReadCompactSize(is);
  924|       |        unsigned int i = 0;
  925|       |        while (i < nSize) {
  926|       |            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  927|       |            v.resize(i + blk);
  928|       |            is.read(std::as_writable_bytes(std::span{&v[i], blk}));
  929|       |            i += blk;
  930|       |        }
  931|  23.7k|    } else {
  932|  23.7k|        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  933|  23.7k|    }
  934|  23.7k|}
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINSA_IhNS9_9allocatorIhEEEENSB_ISD_EEEEEQ14UnserializableIT0_T_EEvRSJ_OSI_:
  776|  23.7k|{
  777|  23.7k|    a.Unserialize(is);
  778|  23.7k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  477|  23.7k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsENSt3__16vectorINS9_IhNS8_9allocatorIhEEEENSA_ISC_EEEEEEvRT_RT0_:
  680|  23.7k|    {
  681|  23.7k|        Formatter formatter;
  682|  23.7k|        v.clear();
  683|  23.7k|        size_t size = ReadCompactSize(s);
  684|  23.7k|        size_t allocated = 0;
  685|  33.4k|        while (allocated < size) {
  ------------------
  |  Branch (685:16): [True: 9.73k, False: 23.7k]
  ------------------
  686|       |            // For DoS prevention, do not blindly allocate as much as the stream claims to contain.
  687|       |            // Instead, allocate in 5MiB batches, so that an attacker actually needs to provide
  688|       |            // X MiB of data to make us allocate X+5 Mib.
  689|  9.73k|            static_assert(sizeof(typename V::value_type) <= MAX_VECTOR_ALLOCATE, "Vector element size too large");
  690|  9.73k|            allocated = std::min(size, allocated + MAX_VECTOR_ALLOCATE / sizeof(typename V::value_type));
  691|  9.73k|            v.reserve(allocated);
  692|  1.30M|            while (v.size() < allocated) {
  ------------------
  |  Branch (692:20): [True: 1.29M, False: 9.73k]
  ------------------
  693|  1.29M|                v.emplace_back();
  694|  1.29M|                formatter.Unser(s, v.back());
  695|  1.29M|            }
  696|  9.73k|        }
  697|  23.7k|    };
_ZN16DefaultFormatter5UnserI12ParamsStreamIR10SpanReader20TransactionSerParamsENSt3__16vectorIhNS6_9allocatorIhEEEEEEvRT_RT0_:
  791|  1.29M|    static void Unser(Stream& s, T& t) { Unserialize(s, t); }
_Z11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEhNSt3__19allocatorIhEEEvRT_RNS5_6vectorIT0_T1_EE:
  919|  1.29M|{
  920|  1.29M|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  921|       |        // Limit size per read so bogus size value won't cause out of memory
  922|  1.29M|        v.clear();
  923|  1.29M|        unsigned int nSize = ReadCompactSize(is);
  924|  1.29M|        unsigned int i = 0;
  925|  1.43M|        while (i < nSize) {
  ------------------
  |  Branch (925:16): [True: 137k, False: 1.29M]
  ------------------
  926|   137k|            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  927|   137k|            v.resize(i + blk);
  928|   137k|            is.read(std::as_writable_bytes(std::span{&v[i], blk}));
  929|   137k|            i += blk;
  930|   137k|        }
  931|       |    } else {
  932|       |        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  933|       |    }
  934|  1.29M|}
_ZNK12ParamsStreamIR10SpanReader20TransactionSerParamsE9GetParamsIS2_EERKDav:
 1198|  19.8k|    {
 1199|  19.8k|        if constexpr (std::is_convertible_v<Params, P>) {
 1200|  19.8k|            return m_params;
 1201|       |        } else {
 1202|       |            return m_substream.template GetParams<P>();
 1203|       |        }
 1204|  19.8k|    }
_Z9SerializeI12SizeComputer17CompactSizeWriterQ12SerializableIT0_T_EEvRS3_RKS2_:
  767|  7.48k|{
  768|  7.48k|    a.Serialize(os);
  769|  7.48k|}
_ZNK17CompactSizeWriter9SerializeI12SizeComputerEEvRT_:
  626|  7.48k|    void Serialize(Stream &s) const {
  627|  7.48k|        WriteCompactSize<Stream>(s, n);
  628|  7.48k|    }
_Z16WriteCompactSizeI12SizeComputerEvRT_m:
  303|  7.48k|{
  304|  7.48k|    if (nSize < 253)
  ------------------
  |  Branch (304:9): [True: 6.88k, False: 608]
  ------------------
  305|  6.88k|    {
  306|  6.88k|        ser_writedata8(os, nSize);
  307|  6.88k|    }
  308|    608|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (308:14): [True: 608, False: 0]
  ------------------
  309|    608|    {
  310|    608|        ser_writedata8(os, 253);
  311|    608|        ser_writedata16(os, nSize);
  312|    608|    }
  313|      0|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (313:14): [True: 0, False: 0]
  ------------------
  314|      0|    {
  315|      0|        ser_writedata8(os, 254);
  316|      0|        ser_writedata32(os, nSize);
  317|      0|    }
  318|      0|    else
  319|      0|    {
  320|      0|        ser_writedata8(os, 255);
  321|      0|        ser_writedata64(os, nSize);
  322|      0|    }
  323|  7.48k|    return;
  324|  7.48k|}
_Z14ser_writedata8I12SizeComputerEvRT_h:
   58|  7.48k|{
   59|  7.48k|    s.write(std::as_bytes(std::span{&obj, 1}));
   60|  7.48k|}
_Z15ser_writedata16I12SizeComputerEvRT_t:
   62|    608|{
   63|    608|    obj = htole16_internal(obj);
   64|    608|    s.write(std::as_bytes(std::span{&obj, 1}));
   65|    608|}
_Z9SerializeI10DataStream17CompactSizeWriterQ12SerializableIT0_T_EEvRS3_RKS2_:
  767|  7.48k|{
  768|  7.48k|    a.Serialize(os);
  769|  7.48k|}
_ZNK17CompactSizeWriter9SerializeI10DataStreamEEvRT_:
  626|  7.48k|    void Serialize(Stream &s) const {
  627|  7.48k|        WriteCompactSize<Stream>(s, n);
  628|  7.48k|    }
_ZN13ParamsWrapperI20TransactionSerParams19CMutableTransactionEC2ERKS0_RS1_:
 1249|  19.8k|    explicit ParamsWrapper(const Params& params, T& obj) : m_params{params}, m_object{obj} {}
_Z9SerializeI10DataStreamTk9BasicBytehLm4EEvRT_RKNSt3__15arrayIT0_XT1_EEE:
  259|  7.48k|template <typename Stream, BasicByte B, size_t N> void Serialize(Stream& s, const std::array<B, N>& a) { s.write(MakeByteSpan(a)); }
_Z13SerializeManyI12SizeComputerJ17CompactSizeWriterNSt3__14spanIKhLm18446744073709551615EEEEEvRT_DpRKT0_:
 1048|  7.48k|{
 1049|  7.48k|    (::Serialize(s, args), ...);
 1050|  7.48k|}
_Z9SerializeI12SizeComputerTk9BasicByteKhEvRT_NSt3__14spanIT0_Lm18446744073709551615EEE:
  261|  7.48k|template <typename Stream, BasicByte B>           void Serialize(Stream& s, std::span<B> span)         { s.write(std::as_bytes(span)); }
_Z13SerializeManyI10DataStreamJ17CompactSizeWriterNSt3__14spanIKhLm18446744073709551615EEEEEvRT_DpRKT0_:
 1048|  7.48k|{
 1049|  7.48k|    (::Serialize(s, args), ...);
 1050|  7.48k|}
_ZNK20TransactionSerParamsclIR19CMutableTransactionEEDaOT_:
 1282|  19.8k|    {                                                                                    \
 1283|  19.8k|        return ParamsWrapper{*this, t};                                                  \
 1284|  19.8k|    }
_Z9SerializeI10DataStreamEvRT_j:
  254|   387k|template <typename Stream> void Serialize(Stream& s, uint32_t a)  { ser_writedata32(s, a); }
_Z11UnserializeI10SpanReaderEvRT_Rj:
  270|   240k|template <typename Stream> void Unserialize(Stream& s, uint32_t& a)  { a = ser_readdata32(s); }
_Z11UnserializeI10SpanReaderR7CScriptQ14UnserializableIT0_T_EEvRS4_OS3_:
  776|  3.16k|{
  777|  3.16k|    a.Unserialize(is);
  778|  3.16k|}
_ZN7CScript11UnserializeI10SpanReaderEEvRT_:
  220|  3.16k|    {                                                                                               \
  221|  3.16k|        static_assert(std::is_same_v<cls&, decltype(*this)>, "Unserialize type mismatch");          \
  222|  3.16k|        Unser(s, *this);                                                                            \
  223|  3.16k|    }
_ZN7CScript5UnserI10SpanReaderEEvRT_RS_:
  172|  3.16k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10SpanReaderJR9prevectorILj36EhjiEEEEvRT_DpOT0_:
 1086|  3.16k|    {
 1087|  3.16k|        ::UnserializeMany(s, args...);
 1088|  3.16k|    }
_Z15UnserializeManyI10SpanReaderJR9prevectorILj36EhjiEEEvRT_DpOT0_:
 1054|  3.16k|{
 1055|  3.16k|    (::Unserialize(s, args), ...);
 1056|  3.16k|}
_Z11UnserializeI10SpanReaderLj36EhEvRT_R9prevectorIXT0_ET1_jiE:
  876|  3.16k|{
  877|  3.16k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  878|       |        // Limit size per read so bogus size value won't cause out of memory
  879|  3.16k|        v.clear();
  880|  3.16k|        unsigned int nSize = ReadCompactSize(is);
  881|  3.16k|        unsigned int i = 0;
  882|  4.44k|        while (i < nSize) {
  ------------------
  |  Branch (882:16): [True: 1.28k, False: 3.16k]
  ------------------
  883|  1.28k|            unsigned int blk = std::min(nSize - i, (unsigned int)(1 + 4999999 / sizeof(T)));
  884|  1.28k|            v.resize_uninitialized(i + blk);
  885|  1.28k|            is.read(std::as_writable_bytes(std::span{&v[i], blk}));
  886|  1.28k|            i += blk;
  887|  1.28k|        }
  888|       |    } else {
  889|       |        Unserialize(is, Using<VectorFormatter<DefaultFormatter>>(v));
  890|       |    }
  891|  3.16k|}
_Z14ser_writedata8I10DataStreamEvRT_h:
   58|  22.4k|{
   59|  22.4k|    s.write(std::as_bytes(std::span{&obj, 1}));
   60|  22.4k|}
_Z11UnserializeI10SpanReaderR4CoinQ14UnserializableIT0_T_EEvRS4_OS3_:
  776|  12.1k|{
  777|  12.1k|    a.Unserialize(is);
  778|  12.1k|}
_Z11UnserializeI10SpanReader7WrapperI15VarIntFormatterIL10VarIntMode0EERjEQ14UnserializableIT0_T_EEvRS8_OS7_:
  776|  12.1k|{
  777|  12.1k|    a.Unserialize(is);
  778|  12.1k|}
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERjE11UnserializeI10SpanReaderEEvRT_:
  477|  24.0k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VarIntFormatterIL10VarIntMode0EE5UnserI10SpanReaderjEEvRT_RT0_:
  509|  24.0k|    {
  510|  24.0k|        v = ReadVarInt<Stream,Mode, std::remove_cv_t<I>>(s);
  511|  24.0k|    }
_Z10ReadVarIntI10SpanReaderL10VarIntMode0EjET1_RT_:
  447|  24.0k|{
  448|  24.0k|    CheckVarIntMode<Mode, I>();
  449|  24.0k|    I n = 0;
  450|  27.7k|    while(true) {
  ------------------
  |  Branch (450:11): [True: 27.7k, Folded]
  ------------------
  451|  27.7k|        unsigned char chData = ser_readdata8(is);
  452|  27.7k|        if (n > (std::numeric_limits<I>::max() >> 7)) {
  ------------------
  |  Branch (452:13): [True: 20, False: 27.7k]
  ------------------
  453|     20|           throw std::ios_base::failure("ReadVarInt(): size too large");
  454|     20|        }
  455|  27.7k|        n = (n << 7) | (chData & 0x7F);
  456|  27.7k|        if (chData & 0x80) {
  ------------------
  |  Branch (456:13): [True: 3.67k, False: 24.0k]
  ------------------
  457|  3.67k|            if (n == std::numeric_limits<I>::max()) {
  ------------------
  |  Branch (457:17): [True: 1, False: 3.67k]
  ------------------
  458|      1|                throw std::ios_base::failure("ReadVarInt(): size too large");
  459|      1|            }
  460|  3.67k|            n++;
  461|  24.0k|        } else {
  462|  24.0k|            return n;
  463|  24.0k|        }
  464|  27.7k|    }
  465|  24.0k|}
_Z13ser_readdata8I10SpanReaderEhRT_:
   82|  83.9k|{
   83|  83.9k|    uint8_t obj;
   84|  83.9k|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   85|  83.9k|    return obj;
   86|  83.9k|}
_Z11UnserializeI10SpanReader7WrapperI16TxOutCompressionR6CTxOutEQ14UnserializableIT0_T_EEvRS7_OS6_:
  776|  12.0k|{
  777|  12.0k|    a.Unserialize(is);
  778|  12.0k|}
_ZN7WrapperI16TxOutCompressionR6CTxOutE11UnserializeI10SpanReaderEEvRT_:
  477|  12.0k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN16TxOutCompression5UnserI10SpanReaderEEvRT_R6CTxOut:
  172|  12.0k|    static void Unser(Stream& s, cls& obj) { SerializationOps(obj, s, ActionUnserialize{}); } \
_ZN17ActionUnserialize16SerReadWriteManyI10SpanReaderJ7WrapperI17AmountCompressionRlES2_I17ScriptCompressionR7CScriptEEEEvRT_DpOT0_:
 1086|  12.0k|    {
 1087|  12.0k|        ::UnserializeMany(s, args...);
 1088|  12.0k|    }
_Z15UnserializeManyI10SpanReaderJR7WrapperI17AmountCompressionRlERS1_I17ScriptCompressionR7CScriptEEEvRT_DpOT0_:
 1054|  12.0k|{
 1055|  12.0k|    (::Unserialize(s, args), ...);
 1056|  12.0k|}
_Z11UnserializeI10SpanReaderR7WrapperI17AmountCompressionRlEQ14UnserializableIT0_T_EEvRS7_OS6_:
  776|  12.0k|{
  777|  12.0k|    a.Unserialize(is);
  778|  12.0k|}
_ZN7WrapperI17AmountCompressionRlE11UnserializeI10SpanReaderEEvRT_:
  477|  12.0k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_Z11UnserializeI10SpanReaderR7WrapperI15VarIntFormatterIL10VarIntMode0EERmEQ14UnserializableIT0_T_EEvRS9_OS8_:
  776|  12.0k|{
  777|  12.0k|    a.Unserialize(is);
  778|  12.0k|}
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERmE11UnserializeI10SpanReaderEEvRT_:
  477|  12.0k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_ZN15VarIntFormatterIL10VarIntMode0EE5UnserI10SpanReadermEEvRT_RT0_:
  509|  12.0k|    {
  510|  12.0k|        v = ReadVarInt<Stream,Mode, std::remove_cv_t<I>>(s);
  511|  12.0k|    }
_Z10ReadVarIntI10SpanReaderL10VarIntMode0EmET1_RT_:
  447|  12.0k|{
  448|  12.0k|    CheckVarIntMode<Mode, I>();
  449|  12.0k|    I n = 0;
  450|  16.8k|    while(true) {
  ------------------
  |  Branch (450:11): [True: 16.8k, Folded]
  ------------------
  451|  16.8k|        unsigned char chData = ser_readdata8(is);
  452|  16.8k|        if (n > (std::numeric_limits<I>::max() >> 7)) {
  ------------------
  |  Branch (452:13): [True: 34, False: 16.8k]
  ------------------
  453|     34|           throw std::ios_base::failure("ReadVarInt(): size too large");
  454|     34|        }
  455|  16.8k|        n = (n << 7) | (chData & 0x7F);
  456|  16.8k|        if (chData & 0x80) {
  ------------------
  |  Branch (456:13): [True: 4.82k, False: 11.9k]
  ------------------
  457|  4.82k|            if (n == std::numeric_limits<I>::max()) {
  ------------------
  |  Branch (457:17): [True: 1, False: 4.82k]
  ------------------
  458|      1|                throw std::ios_base::failure("ReadVarInt(): size too large");
  459|      1|            }
  460|  4.82k|            n++;
  461|  11.9k|        } else {
  462|  11.9k|            return n;
  463|  11.9k|        }
  464|  16.8k|    }
  465|  12.0k|}
_Z11UnserializeI10SpanReaderR7WrapperI17ScriptCompressionR7CScriptEQ14UnserializableIT0_T_EEvRS8_OS7_:
  776|  11.9k|{
  777|  11.9k|    a.Unserialize(is);
  778|  11.9k|}
_ZN7WrapperI17ScriptCompressionR7CScriptE11UnserializeI10SpanReaderEEvRT_:
  477|  11.9k|    template<typename Stream> void Unserialize(Stream &s) { Formatter().Unser(s, m_object); }
_Z11UnserializeI10SpanReaderR7WrapperI15VarIntFormatterIL10VarIntMode0EERjEQ14UnserializableIT0_T_EEvRS9_OS8_:
  776|  11.9k|{
  777|  11.9k|    a.Unserialize(is);
  778|  11.9k|}
_Z11UnserializeI10SpanReaderTk9BasicBytehEvRT_NSt3__14spanIT0_Lm18446744073709551615EEE:
  277|  27.7k|template <typename Stream, BasicByte B>           void Unserialize(Stream& s, std::span<B> span)    { s.read(std::as_writable_bytes(span)); }
_Z15ReadCompactSizeI10SpanReaderEmRT_b:
  334|  39.3k|{
  335|  39.3k|    uint8_t chSize = ser_readdata8(is);
  336|  39.3k|    uint64_t nSizeRet = 0;
  337|  39.3k|    if (chSize < 253)
  ------------------
  |  Branch (337:9): [True: 37.6k, False: 1.71k]
  ------------------
  338|  37.6k|    {
  339|  37.6k|        nSizeRet = chSize;
  340|  37.6k|    }
  341|  1.71k|    else if (chSize == 253)
  ------------------
  |  Branch (341:14): [True: 266, False: 1.44k]
  ------------------
  342|    266|    {
  343|    266|        nSizeRet = ser_readdata16(is);
  344|    266|        if (nSizeRet < 253)
  ------------------
  |  Branch (344:13): [True: 8, False: 258]
  ------------------
  345|      8|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  346|    266|    }
  347|  1.44k|    else if (chSize == 254)
  ------------------
  |  Branch (347:14): [True: 125, False: 1.32k]
  ------------------
  348|    125|    {
  349|    125|        nSizeRet = ser_readdata32(is);
  350|    125|        if (nSizeRet < 0x10000u)
  ------------------
  |  Branch (350:13): [True: 18, False: 107]
  ------------------
  351|     18|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  352|    125|    }
  353|  1.32k|    else
  354|  1.32k|    {
  355|  1.32k|        nSizeRet = ser_readdata64(is);
  356|  1.32k|        if (nSizeRet < 0x100000000ULL)
  ------------------
  |  Branch (356:13): [True: 30, False: 1.29k]
  ------------------
  357|     30|            throw std::ios_base::failure("non-canonical ReadCompactSize()");
  358|  1.32k|    }
  359|  39.3k|    if (range_check && nSizeRet > MAX_SIZE) {
  ------------------
  |  Branch (359:9): [True: 38.2k, False: 1.04k]
  |  Branch (359:24): [True: 271, False: 37.9k]
  ------------------
  360|    271|        throw std::ios_base::failure("ReadCompactSize(): size too large");
  361|    271|    }
  362|  39.0k|    return nSizeRet;
  363|  39.3k|}
_Z14ser_readdata16I10SpanReaderEtRT_:
   88|    266|{
   89|    266|    uint16_t obj;
   90|    266|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   91|    266|    return le16toh_internal(obj);
   92|    266|}
_Z14ser_readdata32I10SpanReaderEjRT_:
   94|   240k|{
   95|   240k|    uint32_t obj;
   96|   240k|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   97|   240k|    return le32toh_internal(obj);
   98|   240k|}
_Z14ser_readdata64I10SpanReaderEmRT_:
  106|  12.4k|{
  107|  12.4k|    uint64_t obj;
  108|  12.4k|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
  109|  12.4k|    return le64toh_internal(obj);
  110|  12.4k|}
_Z16WriteCompactSizeI10DataStreamEvRT_m:
  303|  22.4k|{
  304|  22.4k|    if (nSize < 253)
  ------------------
  |  Branch (304:9): [True: 21.8k, False: 631]
  ------------------
  305|  21.8k|    {
  306|  21.8k|        ser_writedata8(os, nSize);
  307|  21.8k|    }
  308|    631|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (308:14): [True: 624, False: 7]
  ------------------
  309|    624|    {
  310|    624|        ser_writedata8(os, 253);
  311|    624|        ser_writedata16(os, nSize);
  312|    624|    }
  313|      7|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (313:14): [True: 7, False: 0]
  ------------------
  314|      7|    {
  315|      7|        ser_writedata8(os, 254);
  316|      7|        ser_writedata32(os, nSize);
  317|      7|    }
  318|      0|    else
  319|      0|    {
  320|      0|        ser_writedata8(os, 255);
  321|      0|        ser_writedata64(os, nSize);
  322|      0|    }
  323|  22.4k|    return;
  324|  22.4k|}
_Z15ser_writedata16I10DataStreamEvRT_t:
   62|    624|{
   63|    624|    obj = htole16_internal(obj);
   64|    624|    s.write(std::as_bytes(std::span{&obj, 1}));
   65|    624|}
_Z15ser_writedata32I10DataStreamEvRT_j:
   67|   387k|{
   68|   387k|    obj = htole32_internal(obj);
   69|   387k|    s.write(std::as_bytes(std::span{&obj, 1}));
   70|   387k|}
_Z9SerializeI10DataStreamTk9BasicByteKhEvRT_NSt3__14spanIT0_Lm18446744073709551615EEE:
  261|  7.48k|template <typename Stream, BasicByte B>           void Serialize(Stream& s, std::span<B> span)         { s.write(std::as_bytes(span)); }
_Z11UnserializeI10SpanReaderR22transaction_identifierILb0EEQ14UnserializableIT0_T_EEvRS5_OS4_:
  776|  12.7k|{
  777|  12.7k|    a.Unserialize(is);
  778|  12.7k|}
_Z13ser_readdata8I10DataStreamEhRT_:
   82|    746|{
   83|    746|    uint8_t obj;
   84|    746|    s.read(std::as_writable_bytes(std::span{&obj, 1}));
   85|    746|    return obj;
   86|    746|}
_Z6AsBaseI9prevectorILj36EhjiE7CScriptERT_RT0_:
  137|   903k|{
  138|   903k|    static_assert(std::is_base_of_v<Out, In>);
  139|   903k|    return x;
  140|   903k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEEC2ES9_:
  475|  14.7k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEEC2ES9_:
  475|  7.44k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEEC2ESA_:
  475|  23.7k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN15CheckVarIntModeIL10VarIntMode0EjEC2Ev:
  404|  24.0k|    {
  405|  24.0k|        static_assert(Mode != VarIntMode::DEFAULT || std::is_unsigned_v<I>, "Unsigned type required with mode DEFAULT.");
  406|  24.0k|        static_assert(Mode != VarIntMode::NONNEGATIVE_SIGNED || std::is_signed_v<I>, "Signed type required with mode NONNEGATIVE_SIGNED.");
  407|  24.0k|    }
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERjEC2ES3_:
  475|  24.0k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN15CheckVarIntModeIL10VarIntMode0EmEC2Ev:
  404|  12.0k|    {
  405|  12.0k|        static_assert(Mode != VarIntMode::DEFAULT || std::is_unsigned_v<I>, "Unsigned type required with mode DEFAULT.");
  406|  12.0k|        static_assert(Mode != VarIntMode::NONNEGATIVE_SIGNED || std::is_signed_v<I>, "Signed type required with mode NONNEGATIVE_SIGNED.");
  407|  12.0k|    }
_ZN7WrapperI15VarIntFormatterIL10VarIntMode0EERmEC2ES3_:
  475|  12.0k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN7WrapperI17AmountCompressionRlEC2ES1_:
  475|  12.0k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN7WrapperI17ScriptCompressionR7CScriptEC2ES2_:
  475|  12.0k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN7WrapperI16TxOutCompressionR6CTxOutEC2ES2_:
  475|  12.0k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZNK20TransactionSerParamsclIRK12CTransactionEEDaOT_:
 1282|  16.5k|    {                                                                                    \
 1283|  16.5k|        return ParamsWrapper{*this, t};                                                  \
 1284|  16.5k|    }
_Z6AsBaseI9prevectorILj36EhjiE7CScriptERKT_RKT0_:
  143|  7.15M|{
  144|  7.15M|    static_assert(std::is_base_of_v<Out, In>);
  145|  7.15M|    return x;
  146|  7.15M|}
_ZN13ParamsWrapperI20TransactionSerParamsK12CTransactionEC2ERKS0_RS2_:
 1249|  16.5k|    explicit ParamsWrapper(const Params& params, T& obj) : m_params{params}, m_object{obj} {}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsEC2ES1_RKS2_:
 1181|  16.5k|    ParamsStream(SubStream&& substream, const Params& params LIFETIMEBOUND) : m_params{params}, m_substream{std::forward<SubStream>(substream)} {}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsIjEERS3_RKT_:
 1187|  33.0k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_j:
  254|   363k|template <typename Stream> void Serialize(Stream& s, uint32_t a)  { ser_writedata32(s, a); }
_Z15ser_writedata32I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_j:
   67|   363k|{
   68|   363k|    obj = htole32_internal(obj);
   69|   363k|    s.write(std::as_bytes(std::span{&obj, 1}));
   70|   363k|}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsE5writeENSt3__14spanIKSt4byteLm18446744073709551615EEE:
 1189|  1.27M|    void write(std::span<const std::byte> src) { GetStream().write(src); }
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsE9GetStreamEv:
 1208|  1.27M|    {
 1209|       |        if constexpr (ContainsStream<SubStream>) {
 1210|       |            return m_substream.GetStream();
 1211|  1.27M|        } else {
 1212|  1.27M|            return m_substream;
 1213|  1.27M|        }
 1214|  1.27M|    }
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsINSt3__16vectorI5CTxInNS5_9allocatorIS7_EEEEEERS3_RKT_:
 1187|  17.5k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE5CTxInNSt3__19allocatorIS5_EEEvRT_RKNS6_6vectorIT0_T1_EE:
  899|  17.5k|{
  900|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  901|       |        WriteCompactSize(os, v.size());
  902|       |        if (!v.empty()) os.write(MakeByteSpan(v));
  903|       |    } else if constexpr (std::is_same_v<T, bool>) {
  904|       |        // A special case for std::vector<bool>, as dereferencing
  905|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  906|       |        // due to std::vector's special casing for bool arguments.
  907|       |        WriteCompactSize(os, v.size());
  908|       |        for (bool elem : v) {
  909|       |            ::Serialize(os, elem);
  910|       |        }
  911|  17.5k|    } else {
  912|  17.5k|        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  913|  17.5k|    }
  914|  17.5k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS9_9allocatorISB_EEEEEQ12SerializableIT0_T_EEvRSJ_RKSI_:
  767|  17.5k|{
  768|  17.5k|    a.Serialize(os);
  769|  17.5k|}
_ZNK7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  476|  17.5k|    template<typename Stream> void Serialize(Stream &s) const { Formatter().Ser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorI5CTxInNS8_9allocatorISA_EEEEEEvRT_RKT0_:
  670|  17.5k|    {
  671|  17.5k|        Formatter formatter;
  672|  17.5k|        WriteCompactSize(s, v.size());
  673|   165k|        for (const typename V::value_type& elem : v) {
  ------------------
  |  Branch (673:49): [True: 165k, False: 17.5k]
  ------------------
  674|   165k|            formatter.Ser(s, elem);
  675|   165k|        }
  676|  17.5k|    }
_Z16WriteCompactSizeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_m:
  303|   519k|{
  304|   519k|    if (nSize < 253)
  ------------------
  |  Branch (304:9): [True: 518k, False: 342]
  ------------------
  305|   518k|    {
  306|   518k|        ser_writedata8(os, nSize);
  307|   518k|    }
  308|    342|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (308:14): [True: 304, False: 38]
  ------------------
  309|    304|    {
  310|    304|        ser_writedata8(os, 253);
  311|    304|        ser_writedata16(os, nSize);
  312|    304|    }
  313|     38|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (313:14): [True: 38, False: 0]
  ------------------
  314|     38|    {
  315|     38|        ser_writedata8(os, 254);
  316|     38|        ser_writedata32(os, nSize);
  317|     38|    }
  318|      0|    else
  319|      0|    {
  320|      0|        ser_writedata8(os, 255);
  321|      0|        ser_writedata64(os, nSize);
  322|      0|    }
  323|   519k|    return;
  324|   519k|}
_Z14ser_writedata8I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_h:
   58|   520k|{
   59|   520k|    s.write(std::as_bytes(std::span{&obj, 1}));
   60|   520k|}
_Z15ser_writedata16I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_t:
   62|    304|{
   63|    304|    obj = htole16_internal(obj);
   64|    304|    s.write(std::as_bytes(std::span{&obj, 1}));
   65|    304|}
_Z15ser_writedata64I12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_m:
   77|  61.5k|{
   78|  61.5k|    obj = htole64_internal(obj);
   79|  61.5k|    s.write(std::as_bytes(std::span{&obj, 1}));
   80|  61.5k|}
_ZN16DefaultFormatter3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsE5CTxInEEvRT_RKT0_:
  788|   165k|    static void Ser(Stream& s, const T& t) { Serialize(s, t); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE5CTxInQ12SerializableIT0_T_EEvRS7_RKS6_:
  767|   165k|{
  768|   165k|    a.Serialize(os);
  769|   165k|}
_ZNK5CTxIn9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  214|   165k|    {                                                                                               \
  215|   165k|        static_assert(std::is_same_v<const cls&, decltype(*this)>, "Serialize type mismatch");      \
  216|   165k|        Ser(s, *this);                                                                              \
  217|   165k|    }                                                                                               \
_ZN5CTxIn3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  170|   165k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9COutPoint7CScriptjEEEvRT_DpRKT0_:
 1066|   165k|    {
 1067|   165k|        ::SerializeMany(s, args...);
 1068|   165k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9COutPoint7CScriptjEEvRT_DpRKT0_:
 1048|   165k|{
 1049|   165k|    (::Serialize(s, args), ...);
 1050|   165k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE9COutPointQ12SerializableIT0_T_EEvRS7_RKS6_:
  767|   165k|{
  768|   165k|    a.Serialize(os);
  769|   165k|}
_ZNK9COutPoint9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  214|   165k|    {                                                                                               \
  215|   165k|        static_assert(std::is_same_v<const cls&, decltype(*this)>, "Serialize type mismatch");      \
  216|   165k|        Ser(s, *this);                                                                              \
  217|   165k|    }                                                                                               \
_ZN9COutPoint3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  170|   165k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ22transaction_identifierILb0EEjEEEvRT_DpRKT0_:
 1066|   165k|    {
 1067|   165k|        ::SerializeMany(s, args...);
 1068|   165k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ22transaction_identifierILb0EEjEEvRT_DpRKT0_:
 1048|   165k|{
 1049|   165k|    (::Serialize(s, args), ...);
 1050|   165k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE22transaction_identifierILb0EEQ12SerializableIT0_T_EEvRS8_RKS7_:
  767|   165k|{
  768|   165k|    a.Serialize(os);
  769|   165k|}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsINSt3__14spanIKhLm32EEEEERS3_RKT_:
 1187|   165k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsETk9BasicByteKhLm32EEvRT_NSt3__14spanIT0_XT1_EEE:
  260|   165k|template <typename Stream, BasicByte B, size_t N> void Serialize(Stream& s, std::span<B, N> span)      { s.write(std::as_bytes(span)); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7CScriptQ12SerializableIT0_T_EEvRS7_RKS6_:
  767|   226k|{
  768|   226k|    a.Serialize(os);
  769|   226k|}
_ZNK7CScript9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  214|   226k|    {                                                                                               \
  215|   226k|        static_assert(std::is_same_v<const cls&, decltype(*this)>, "Serialize type mismatch");      \
  216|   226k|        Ser(s, *this);                                                                              \
  217|   226k|    }                                                                                               \
_ZN7CScript3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  170|   226k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9prevectorILj36EhjiEEEEvRT_DpRKT0_:
 1066|   226k|    {
 1067|   226k|        ::SerializeMany(s, args...);
 1068|   226k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJ9prevectorILj36EhjiEEEvRT_DpRKT0_:
 1048|   226k|{
 1049|   226k|    (::Serialize(s, args), ...);
 1050|   226k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsELj36EhEvRT_RK9prevectorIXT0_ET1_jiE:
  864|   226k|{
  865|   226k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  866|   226k|        WriteCompactSize(os, v.size());
  867|   226k|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (867:13): [True: 41.7k, False: 185k]
  ------------------
  868|       |    } else {
  869|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  870|       |    }
  871|   226k|}
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI5CTxInNS3_9allocatorIS5_EEEEEC2ESA_:
  475|  17.5k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsIhEERS3_RKT_:
 1187|  1.06k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_h:
  250|  1.06k|template <typename Stream> void Serialize(Stream& s, uint8_t a)   { ser_writedata8(s, a); }
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsINSt3__16vectorI6CTxOutNS5_9allocatorIS7_EEEEEERS3_RKT_:
 1187|  16.5k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE6CTxOutNSt3__19allocatorIS5_EEEvRT_RKNS6_6vectorIT0_T1_EE:
  899|  16.5k|{
  900|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  901|       |        WriteCompactSize(os, v.size());
  902|       |        if (!v.empty()) os.write(MakeByteSpan(v));
  903|       |    } else if constexpr (std::is_same_v<T, bool>) {
  904|       |        // A special case for std::vector<bool>, as dereferencing
  905|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  906|       |        // due to std::vector's special casing for bool arguments.
  907|       |        WriteCompactSize(os, v.size());
  908|       |        for (bool elem : v) {
  909|       |            ::Serialize(os, elem);
  910|       |        }
  911|  16.5k|    } else {
  912|  16.5k|        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  913|  16.5k|    }
  914|  16.5k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS9_9allocatorISB_EEEEEQ12SerializableIT0_T_EEvRSJ_RKSI_:
  767|  16.5k|{
  768|  16.5k|    a.Serialize(os);
  769|  16.5k|}
_ZNK7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  476|  16.5k|    template<typename Stream> void Serialize(Stream &s) const { Formatter().Ser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorI6CTxOutNS8_9allocatorISA_EEEEEEvRT_RKT0_:
  670|  16.5k|    {
  671|  16.5k|        Formatter formatter;
  672|  16.5k|        WriteCompactSize(s, v.size());
  673|  61.5k|        for (const typename V::value_type& elem : v) {
  ------------------
  |  Branch (673:49): [True: 61.5k, False: 16.5k]
  ------------------
  674|  61.5k|            formatter.Ser(s, elem);
  675|  61.5k|        }
  676|  16.5k|    }
_ZN16DefaultFormatter3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsE6CTxOutEEvRT_RKT0_:
  788|  61.5k|    static void Ser(Stream& s, const T& t) { Serialize(s, t); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE6CTxOutQ12SerializableIT0_T_EEvRS7_RKS6_:
  767|  61.5k|{
  768|  61.5k|    a.Serialize(os);
  769|  61.5k|}
_ZNK6CTxOut9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  214|  61.5k|    {                                                                                               \
  215|  61.5k|        static_assert(std::is_same_v<const cls&, decltype(*this)>, "Serialize type mismatch");      \
  216|  61.5k|        Ser(s, *this);                                                                              \
  217|  61.5k|    }                                                                                               \
_ZN6CTxOut3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_RKS_:
  170|  61.5k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJl7CScriptEEEvRT_DpRKT0_:
 1066|  61.5k|    {
 1067|  61.5k|        ::SerializeMany(s, args...);
 1068|  61.5k|    }
_Z13SerializeManyI12ParamsStreamIR10HashWriter20TransactionSerParamsEJl7CScriptEEvRT_DpRKT0_:
 1048|  61.5k|{
 1049|  61.5k|    (::Serialize(s, args), ...);
 1050|  61.5k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEvRT_l:
  255|  61.5k|template <typename Stream> void Serialize(Stream& s, int64_t a)   { ser_writedata64(s, uint64_t(a)); }
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorI6CTxOutNS3_9allocatorIS5_EEEEEC2ESA_:
  475|  16.5k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZN12ParamsStreamIR10HashWriter20TransactionSerParamsElsINSt3__16vectorINS6_IhNS5_9allocatorIhEEEENS7_IS9_EEEEEERS3_RKT_:
 1187|  23.0k|    template <typename U> ParamsStream& operator<<(const U& obj) { ::Serialize(*this, obj); return *this; }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorIhNS5_9allocatorIhEEEENS7_IS9_EEEvRT_RKNS6_IT0_T1_EE:
  899|  23.0k|{
  900|       |    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  901|       |        WriteCompactSize(os, v.size());
  902|       |        if (!v.empty()) os.write(MakeByteSpan(v));
  903|       |    } else if constexpr (std::is_same_v<T, bool>) {
  904|       |        // A special case for std::vector<bool>, as dereferencing
  905|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  906|       |        // due to std::vector's special casing for bool arguments.
  907|       |        WriteCompactSize(os, v.size());
  908|       |        for (bool elem : v) {
  909|       |            ::Serialize(os, elem);
  910|       |        }
  911|  23.0k|    } else {
  912|  23.0k|        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  913|  23.0k|    }
  914|  23.0k|}
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINSA_IhNS9_9allocatorIhEEEENSB_ISD_EEEEEQ12SerializableIT0_T_EEvRSK_RKSJ_:
  767|  23.0k|{
  768|  23.0k|    a.Serialize(os);
  769|  23.0k|}
_ZNK7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  476|  23.0k|    template<typename Stream> void Serialize(Stream &s) const { Formatter().Ser(s, m_object); }
_ZN15VectorFormatterI16DefaultFormatterE3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorINS9_IhNS8_9allocatorIhEEEENSA_ISC_EEEEEEvRT_RKT0_:
  670|  23.0k|    {
  671|  23.0k|        Formatter formatter;
  672|  23.0k|        WriteCompactSize(s, v.size());
  673|   235k|        for (const typename V::value_type& elem : v) {
  ------------------
  |  Branch (673:49): [True: 235k, False: 23.0k]
  ------------------
  674|   235k|            formatter.Ser(s, elem);
  675|   235k|        }
  676|  23.0k|    }
_ZN16DefaultFormatter3SerI12ParamsStreamIR10HashWriter20TransactionSerParamsENSt3__16vectorIhNS6_9allocatorIhEEEEEEvRT_RKT0_:
  788|   235k|    static void Ser(Stream& s, const T& t) { Serialize(s, t); }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEhNSt3__19allocatorIhEEEvRT_RKNS5_6vectorIT0_T1_EE:
  899|   235k|{
  900|   235k|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  901|   235k|        WriteCompactSize(os, v.size());
  902|   235k|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (902:13): [True: 121k, False: 113k]
  ------------------
  903|       |    } else if constexpr (std::is_same_v<T, bool>) {
  904|       |        // A special case for std::vector<bool>, as dereferencing
  905|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  906|       |        // due to std::vector's special casing for bool arguments.
  907|       |        WriteCompactSize(os, v.size());
  908|       |        for (bool elem : v) {
  909|       |            ::Serialize(os, elem);
  910|       |        }
  911|       |    } else {
  912|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  913|       |    }
  914|   235k|}
_ZNK12ParamsStreamIR10HashWriter20TransactionSerParamsE9GetParamsIS2_EERKDav:
 1198|  16.5k|    {
 1199|  16.5k|        if constexpr (std::is_convertible_v<Params, P>) {
 1200|  16.5k|            return m_params;
 1201|       |        } else {
 1202|       |            return m_substream.template GetParams<P>();
 1203|       |        }
 1204|  16.5k|    }
_Z9SerializeI10HashWriter13ParamsWrapperI20TransactionSerParamsK12CTransactionEQ12SerializableIT0_T_EEvRS7_RKS6_:
  767|  16.5k|{
  768|  16.5k|    a.Serialize(os);
  769|  16.5k|}
_ZNK13ParamsWrapperI20TransactionSerParamsK12CTransactionE9SerializeI10HashWriterEEvRT_:
 1253|  16.5k|    {
 1254|  16.5k|        ParamsStream ss{s, m_params};
 1255|  16.5k|        ::Serialize(ss, m_object);
 1256|  16.5k|    }
_Z9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsE12CTransactionQ12SerializableIT0_T_EEvRS7_RKS6_:
  767|  16.5k|{
  768|  16.5k|    a.Serialize(os);
  769|  16.5k|}
_Z9SerializeI10HashWriterEvRT_l:
  255|   224k|template <typename Stream> void Serialize(Stream& s, int64_t a)   { ser_writedata64(s, uint64_t(a)); }
_Z15ser_writedata64I10HashWriterEvRT_m:
   77|   224k|{
   78|   224k|    obj = htole64_internal(obj);
   79|   224k|    s.write(std::as_bytes(std::span{&obj, 1}));
   80|   224k|}
_Z9SerializeI10HashWriter7CScriptQ12SerializableIT0_T_EEvRS3_RKS2_:
  767|  6.92M|{
  768|  6.92M|    a.Serialize(os);
  769|  6.92M|}
_ZNK7CScript9SerializeI10HashWriterEEvRT_:
  214|  6.92M|    {                                                                                               \
  215|  6.92M|        static_assert(std::is_same_v<const cls&, decltype(*this)>, "Serialize type mismatch");      \
  216|  6.92M|        Ser(s, *this);                                                                              \
  217|  6.92M|    }                                                                                               \
_ZN7CScript3SerI10HashWriterEEvRT_RKS_:
  170|  6.92M|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI10HashWriterJ9prevectorILj36EhjiEEEEvRT_DpRKT0_:
 1066|  6.92M|    {
 1067|  6.92M|        ::SerializeMany(s, args...);
 1068|  6.92M|    }
_Z13SerializeManyI10HashWriterJ9prevectorILj36EhjiEEEvRT_DpRKT0_:
 1048|  6.92M|{
 1049|  6.92M|    (::Serialize(s, args), ...);
 1050|  6.92M|}
_Z9SerializeI10HashWriterLj36EhEvRT_RK9prevectorIXT0_ET1_jiE:
  864|  6.92M|{
  865|  6.92M|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  866|  6.92M|        WriteCompactSize(os, v.size());
  867|  6.92M|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (867:13): [True: 126k, False: 6.80M]
  ------------------
  868|       |    } else {
  869|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  870|       |    }
  871|  6.92M|}
_Z16WriteCompactSizeI10HashWriterEvRT_m:
  303|  7.11M|{
  304|  7.11M|    if (nSize < 253)
  ------------------
  |  Branch (304:9): [True: 7.11M, False: 1.18k]
  ------------------
  305|  7.11M|    {
  306|  7.11M|        ser_writedata8(os, nSize);
  307|  7.11M|    }
  308|  1.18k|    else if (nSize <= std::numeric_limits<uint16_t>::max())
  ------------------
  |  Branch (308:14): [True: 652, False: 531]
  ------------------
  309|    652|    {
  310|    652|        ser_writedata8(os, 253);
  311|    652|        ser_writedata16(os, nSize);
  312|    652|    }
  313|    531|    else if (nSize <= std::numeric_limits<unsigned int>::max())
  ------------------
  |  Branch (313:14): [True: 531, False: 0]
  ------------------
  314|    531|    {
  315|    531|        ser_writedata8(os, 254);
  316|    531|        ser_writedata32(os, nSize);
  317|    531|    }
  318|      0|    else
  319|      0|    {
  320|      0|        ser_writedata8(os, 255);
  321|      0|        ser_writedata64(os, nSize);
  322|      0|    }
  323|  7.11M|    return;
  324|  7.11M|}
_Z14ser_writedata8I10HashWriterEvRT_h:
   58|  7.11M|{
   59|  7.11M|    s.write(std::as_bytes(std::span{&obj, 1}));
   60|  7.11M|}
_Z15ser_writedata16I10HashWriterEvRT_t:
   62|    652|{
   63|    652|    obj = htole16_internal(obj);
   64|    652|    s.write(std::as_bytes(std::span{&obj, 1}));
   65|    652|}
_Z15ser_writedata32I10HashWriterEvRT_j:
   67|  14.0M|{
   68|  14.0M|    obj = htole32_internal(obj);
   69|  14.0M|    s.write(std::as_bytes(std::span{&obj, 1}));
   70|  14.0M|}
_ZN17CompactSizeWriterC2Em:
  623|  25.5k|    explicit CompactSizeWriter(uint64_t n_in) : n(n_in) { }
_Z9SerializeI10HashWriterhNSt3__19allocatorIhEEEvRT_RKNS1_6vectorIT0_T1_EE:
  899|    267|{
  900|    267|    if constexpr (BasicByte<T>) { // Use optimized version for unformatted basic bytes
  901|    267|        WriteCompactSize(os, v.size());
  902|    267|        if (!v.empty()) os.write(MakeByteSpan(v));
  ------------------
  |  Branch (902:13): [True: 267, False: 0]
  ------------------
  903|       |    } else if constexpr (std::is_same_v<T, bool>) {
  904|       |        // A special case for std::vector<bool>, as dereferencing
  905|       |        // std::vector<bool>::const_iterator does not result in a const bool&
  906|       |        // due to std::vector's special casing for bool arguments.
  907|       |        WriteCompactSize(os, v.size());
  908|       |        for (bool elem : v) {
  909|       |            ::Serialize(os, elem);
  910|       |        }
  911|       |    } else {
  912|       |        Serialize(os, Using<VectorFormatter<DefaultFormatter>>(v));
  913|       |    }
  914|    267|}
_ZN12SizeComputerC2Ev:
 1119|  7.48k|    SizeComputer() = default;
_ZN12SizeComputer5writeENSt3__14spanIKSt4byteLm18446744073709551615EEE:
 1122|  15.5k|    {
 1123|  15.5k|        m_size += src.size();
 1124|  15.5k|    }
_ZN7WrapperI15VectorFormatterI16DefaultFormatterERKNSt3__16vectorINS4_IhNS3_9allocatorIhEEEENS5_IS7_EEEEEC2ESB_:
  475|  23.0k|    explicit Wrapper(T obj) : m_object(obj) {}
_ZNK12SizeComputer4sizeEv:
 1140|  7.48k|    {
 1141|  7.48k|        return m_size;
 1142|  7.48k|    }
_Z9SerializeI10HashWriter9COutPointQ12SerializableIT0_T_EEvRS3_RKS2_:
  767|  6.91M|{
  768|  6.91M|    a.Serialize(os);
  769|  6.91M|}
_ZNK9COutPoint9SerializeI10HashWriterEEvRT_:
  214|  6.91M|    {                                                                                               \
  215|  6.91M|        static_assert(std::is_same_v<const cls&, decltype(*this)>, "Serialize type mismatch");      \
  216|  6.91M|        Ser(s, *this);                                                                              \
  217|  6.91M|    }                                                                                               \
_ZN9COutPoint3SerI10HashWriterEEvRT_RKS_:
  170|  6.91M|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI10HashWriterJ22transaction_identifierILb0EEjEEEvRT_DpRKT0_:
 1066|  6.91M|    {
 1067|  6.91M|        ::SerializeMany(s, args...);
 1068|  6.91M|    }
_Z13SerializeManyI10HashWriterJ22transaction_identifierILb0EEjEEvRT_DpRKT0_:
 1048|  6.91M|{
 1049|  6.91M|    (::Serialize(s, args), ...);
 1050|  6.91M|}
_Z9SerializeI10HashWriter22transaction_identifierILb0EEQ12SerializableIT0_T_EEvRS4_RKS3_:
  767|  6.91M|{
  768|  6.91M|    a.Serialize(os);
  769|  6.91M|}
_Z9SerializeI10HashWriterTk9BasicByteKhLm32EEvRT_NSt3__14spanIT0_XT1_EEE:
  260|  6.96M|template <typename Stream, BasicByte B, size_t N> void Serialize(Stream& s, std::span<B, N> span)      { s.write(std::as_bytes(span)); }
_Z9SerializeI10HashWriterEvRT_j:
  254|  9.34M|template <typename Stream> void Serialize(Stream& s, uint32_t a)  { ser_writedata32(s, a); }
_Z9SerializeI10HashWriter6CTxOutQ12SerializableIT0_T_EEvRS3_RKS2_:
  767|   202k|{
  768|   202k|    a.Serialize(os);
  769|   202k|}
_ZNK6CTxOut9SerializeI10HashWriterEEvRT_:
  214|   202k|    {                                                                                               \
  215|   202k|        static_assert(std::is_same_v<const cls&, decltype(*this)>, "Serialize type mismatch");      \
  216|   202k|        Ser(s, *this);                                                                              \
  217|   202k|    }                                                                                               \
_ZN6CTxOut3SerI10HashWriterEEvRT_RKS_:
  170|   202k|    static void Ser(Stream& s, const cls& obj) { SerializationOps(obj, s, ActionSerialize{}); } \
_ZN15ActionSerialize16SerReadWriteManyI10HashWriterJl7CScriptEEEvRT_DpRKT0_:
 1066|   202k|    {
 1067|   202k|        ::SerializeMany(s, args...);
 1068|   202k|    }
_Z13SerializeManyI10HashWriterJl7CScriptEEvRT_DpRKT0_:
 1048|   202k|{
 1049|   202k|    (::Serialize(s, args), ...);
 1050|   202k|}
_Z9SerializeI10HashWriterEvRT_i:
  253|  4.72M|template <typename Stream> void Serialize(Stream& s, int32_t a)   { ser_writedata32(s, uint32_t(a)); }
_Z9SerializeI10HashWriter7uint256Q12SerializableIT0_T_EEvRS3_RKS2_:
  767|  47.5k|{
  768|  47.5k|    a.Serialize(os);
  769|  47.5k|}
interpreter.cpp:_Z9SerializeI10HashWriterN12_GLOBAL__N_131CTransactionSignatureSerializerI12CTransactionEEQ12SerializableIT0_T_EEvRS6_RKS5_:
  767|  17.7k|{
  768|  17.7k|    a.Serialize(os);
  769|  17.7k|}
interpreter.cpp:_Z9SerializeI10HashWriterN12_GLOBAL__N_131CTransactionSignatureSerializerI19CMutableTransactionEEQ12SerializableIT0_T_EEvRS6_RKS5_:
  767|  43.1k|{
  768|  43.1k|    a.Serialize(os);
  769|  43.1k|}
_Z9SerializeI10HashWriterEvRT_h:
  250|  2.37k|template <typename Stream> void Serialize(Stream& s, uint8_t a)   { ser_writedata8(s, a); }
_Z9SerializeI10HashWriter17CompactSizeWriterQ12SerializableIT0_T_EEvRS3_RKS2_:
  767|  1.35k|{
  768|  1.35k|    a.Serialize(os);
  769|  1.35k|}
_ZNK17CompactSizeWriter9SerializeI10HashWriterEEvRT_:
  626|  1.35k|    void Serialize(Stream &s) const {
  627|  1.35k|        WriteCompactSize<Stream>(s, n);
  628|  1.35k|    }
_Z9SerializeI10HashWriterTk9BasicByteKhEvRT_NSt3__14spanIT0_Lm18446744073709551615EEE:
  261|  4.84k|template <typename Stream, BasicByte B>           void Serialize(Stream& s, std::span<B> span)         { s.write(std::as_bytes(span)); }

_Z9UCharCastPh:
   96|  12.0k|inline unsigned char* UCharCast(unsigned char* c) { return c; }
_Z12MakeByteSpanINSt3__15arrayIhLm4EEEEDaRKT_:
   85|  7.48k|{
   86|  7.48k|    return std::as_bytes(std::span{v});
   87|  7.48k|}
_Z20MakeWritableByteSpanIRNSt3__15arrayIhLm4EEEEDaOT_:
   90|  17.1k|{
   91|  17.1k|    return std::as_writable_bytes(std::span{std::forward<V>(v)});
   92|  17.1k|}
_Z20MakeWritableByteSpanIRNSt3__15arrayIhLm32EEEEDaOT_:
   90|   322k|{
   91|   322k|    return std::as_writable_bytes(std::span{std::forward<V>(v)});
   92|   322k|}
_Z12MakeByteSpanI9prevectorILj36EhjiEEDaRKT_:
   85|   168k|{
   86|   168k|    return std::as_bytes(std::span{v});
   87|   168k|}
_Z12MakeByteSpanINSt3__16vectorIhNS0_9allocatorIhEEEEEDaRKT_:
   85|   121k|{
   86|   121k|    return std::as_bytes(std::span{v});
   87|   121k|}
_Z13MakeUCharSpanINSt3__14spanIKhLm18446744073709551615EEEEDTcl13UCharSpanCasttlS1_fp_EEERKT_:
  111|   106k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z11SpanPopBackIKNSt3__16vectorIhNS0_9allocatorIhEEEEERT_RNS0_4spanIS6_Lm18446744073709551615EEE:
   76|  11.7k|{
   77|  11.7k|    size_t size = span.size();
   78|  11.7k|    T& back = span.back();
   79|  11.7k|    span = span.first(size - 1);
   80|  11.7k|    return back;
   81|  11.7k|}
_Z11SpanPopBackIKhERT_RNSt3__14spanIS1_Lm18446744073709551615EEE:
   76|    487|{
   77|    487|    size_t size = span.size();
   78|    487|    T& back = span.back();
   79|    487|    span = span.first(size - 1);
   80|    487|    return back;
   81|    487|}
_Z13UCharSpanCastIKhLm18446744073709551615EEDaNSt3__14spanIT_XT0_EEE:
  108|   129k|template <typename T, size_t N> constexpr auto UCharSpanCast(std::span<T, N> s) { return std::span<std::remove_pointer_t<decltype(UCharCast(s.data()))>, N>{UCharCast(s.data()), s.size()}; }
_Z13MakeUCharSpanI7CScriptEDTcl13UCharSpanCasttlNSt3__14spanEfp_EEERKT_:
  111|  23.0k|template <typename V> constexpr auto MakeUCharSpan(const V& v) -> decltype(UCharSpanCast(std::span{v})) { return UCharSpanCast(std::span{v}); }
_Z9UCharCastPKh:
  100|   129k|inline const unsigned char* UCharCast(const unsigned char* c) { return c; }
_Z9UCharCastPKSt4byte:
  102|  29.9M|inline const unsigned char* UCharCast(const std::byte* c) { return reinterpret_cast<const unsigned char*>(c); }

_ZN10DataStreamrsIRNSt3__15arrayIhLm4EEEEERS_OT_:
  259|    167|    {
  260|    167|        ::Unserialize(*this, obj);
  261|    167|        return (*this);
  262|    167|    }
_ZN10SpanReaderrsIR13KeyOriginInfoEERS_OT_:
   96|  16.9k|    {
   97|  16.9k|        ::Unserialize(*this, obj);
   98|  16.9k|        return (*this);
   99|  16.9k|    }
_ZN10SpanReaderrsIR6CTxOutEERS_OT_:
   96|  12.0k|    {
   97|  12.0k|        ::Unserialize(*this, obj);
   98|  12.0k|        return (*this);
   99|  12.0k|    }
_ZN10SpanReaderrsIR7CPubKeyEERS_OT_:
   96|  19.5k|    {
   97|  19.5k|        ::Unserialize(*this, obj);
   98|  19.5k|        return (*this);
   99|  19.5k|    }
_ZN10SpanReaderrsIR9COutPointEERS_OT_:
   96|  12.7k|    {
   97|  12.7k|        ::Unserialize(*this, obj);
   98|  12.7k|        return (*this);
   99|  12.7k|    }
_ZN10SpanReaderrsI13ParamsWrapperI20TransactionSerParams19CMutableTransactionEEERS_OT_:
   96|  19.8k|    {
   97|  19.8k|        ::Unserialize(*this, obj);
   98|  19.8k|        return (*this);
   99|  19.8k|    }
_ZN10DataStreamC2ENSt3__14spanIKhLm18446744073709551615EEE:
  183|  12.0k|    explicit DataStream(std::span<const uint8_t> sp) : DataStream{std::as_bytes(sp)} {}
_ZN10DataStreamC2ENSt3__14spanIKSt4byteLm18446744073709551615EEE:
  184|  12.0k|    explicit DataStream(std::span<const value_type> sp) : vch(sp.data(), sp.data() + sp.size()) {}
_ZN10DataStreamrsIRjEERS_OT_:
  259|  1.71M|    {
  260|  1.71M|        ::Unserialize(*this, obj);
  261|  1.71M|        return (*this);
  262|  1.71M|    }
_ZN10DataStreamlsINSt3__15arrayIhLm4EEEEERS_RKT_:
  252|  7.48k|    {
  253|  7.48k|        ::Serialize(*this, obj);
  254|  7.48k|        return (*this);
  255|  7.48k|    }
_ZN10DataStreamlsIjEERS_RKT_:
  252|   387k|    {
  253|   387k|        ::Serialize(*this, obj);
  254|   387k|        return (*this);
  255|   387k|    }
_ZN10SpanReaderC2ENSt3__14spanIKhLm18446744073709551615EEE:
   91|  93.2k|    explicit SpanReader(std::span<const unsigned char> data) : m_data{std::as_bytes(data)} {}
_ZN10DataStream5writeENSt3__14spanIKSt4byteLm18446744073709551615EEE:
  245|   426k|    {
  246|       |        // Write to the end of the buffer
  247|   426k|        vch.insert(vch.end(), src.begin(), src.end());
  248|   426k|    }
_ZN10DataStream5clearEv:
  204|    144|    void clear()                                     { vch.clear(); m_read_pos = 0; }
_ZN10DataStreamC2Ev:
  182|  24.1k|    explicit DataStream() = default;
_ZN10SpanReaderrsIR4CoinEERS_OT_:
   96|  12.1k|    {
   97|  12.1k|        ::Unserialize(*this, obj);
   98|  12.1k|        return (*this);
   99|  12.1k|    }
_ZN10SpanReader4readENSt3__14spanISt4byteLm18446744073709551615EEE:
  105|  4.37M|    {
  106|  4.37M|        if (dst.size() == 0) {
  ------------------
  |  Branch (106:13): [True: 3.58k, False: 4.36M]
  ------------------
  107|  3.58k|            return;
  108|  3.58k|        }
  109|       |
  110|       |        // Read from the beginning of the buffer
  111|  4.36M|        if (dst.size() > m_data.size()) {
  ------------------
  |  Branch (111:13): [True: 19.3k, False: 4.34M]
  ------------------
  112|  19.3k|            throw std::ios_base::failure("SpanReader::read(): end of data");
  113|  19.3k|        }
  114|  4.34M|        memcpy(dst.data(), m_data.data(), dst.size());
  115|  4.34M|        m_data = m_data.subspan(dst.size());
  116|  4.34M|    }
_ZN10SpanReaderrsI7WrapperI15VarIntFormatterIL10VarIntMode0EERmEEERS_OT_:
   96|  12.0k|    {
   97|  12.0k|        ::Unserialize(*this, obj);
   98|  12.0k|        return (*this);
   99|  12.0k|    }
_ZN10SpanReaderrsI7WrapperI15VarIntFormatterIL10VarIntMode0EERjEEERS_OT_:
   96|  11.9k|    {
   97|  11.9k|        ::Unserialize(*this, obj);
   98|  11.9k|        return (*this);
   99|  11.9k|    }
_ZN10SpanReaderrsINSt3__14spanIhLm18446744073709551615EEEEERS_OT_:
   96|  27.7k|    {
   97|  27.7k|        ::Unserialize(*this, obj);
   98|  27.7k|        return (*this);
   99|  27.7k|    }
_ZN10SpanReader6ignoreEm:
  119|  2.68k|    {
  120|  2.68k|        if (n > m_data.size()) {
  ------------------
  |  Branch (120:13): [True: 690, False: 1.99k]
  ------------------
  121|    690|            throw std::ios_base::failure("SpanReader::ignore(): end of data");
  122|    690|        }
  123|  1.99k|        m_data = m_data.subspan(n);
  124|  1.99k|    }
_ZN10DataStream4readENSt3__14spanISt4byteLm18446744073709551615EEE:
  212|  1.71M|    {
  213|  1.71M|        if (dst.size() == 0) return;
  ------------------
  |  Branch (213:13): [True: 0, False: 1.71M]
  ------------------
  214|       |
  215|       |        // Read from the beginning of the buffer
  216|  1.71M|        auto next_read_pos{CheckedAdd(m_read_pos, dst.size())};
  217|  1.71M|        if (!next_read_pos.has_value() || next_read_pos.value() > vch.size()) {
  ------------------
  |  Branch (217:13): [True: 0, False: 1.71M]
  |  Branch (217:43): [True: 522, False: 1.71M]
  ------------------
  218|    522|            throw std::ios_base::failure("DataStream::read(): end of data");
  219|    522|        }
  220|  1.71M|        memcpy(dst.data(), &vch[m_read_pos], dst.size());
  221|  1.71M|        if (next_read_pos.value() == vch.size()) {
  ------------------
  |  Branch (221:13): [True: 144, False: 1.71M]
  ------------------
  222|       |            // If fully consumed, reset to empty state.
  223|    144|            clear();
  224|    144|            return;
  225|    144|        }
  226|  1.71M|        m_read_pos = next_read_pos.value();
  227|  1.71M|    }

random.cpp:_ZN16secure_allocatorIN12_GLOBAL__N_18RNGStateEE10deallocateEPS1_m:
   37|      2|    {
   38|      2|        if (p != nullptr) {
  ------------------
  |  Branch (38:13): [True: 2, False: 0]
  ------------------
   39|      2|            memory_cleanse(p, sizeof(T) * n);
   40|      2|        }
   41|      2|        LockedPoolManager::Instance().free(p);
   42|      2|    }
_Z18make_secure_uniqueINSt3__15arrayIhLm32EEEJEENS0_10unique_ptrIT_19SecureUniqueDeleterIS4_EEEDpOT0_:
   67|  84.1k|{
   68|  84.1k|    T* p = secure_allocator<T>().allocate(1);
   69|       |
   70|       |    // initialize in place, and return as secure_unique_ptr
   71|  84.1k|    try {
   72|  84.1k|        return secure_unique_ptr<T>(new (p) T(std::forward<Args>(as)...));
   73|  84.1k|    } catch (...) {
   74|      0|        secure_allocator<T>().deallocate(p, 1);
   75|      0|        throw;
   76|      0|    }
   77|  84.1k|}
_ZN16secure_allocatorINSt3__15arrayIhLm32EEEE8allocateEm:
   28|  84.1k|    {
   29|  84.1k|        T* allocation = static_cast<T*>(LockedPoolManager::Instance().alloc(sizeof(T) * n));
   30|  84.1k|        if (!allocation) {
  ------------------
  |  Branch (30:13): [True: 0, False: 84.1k]
  ------------------
   31|      0|            throw std::bad_alloc();
   32|      0|        }
   33|  84.1k|        return allocation;
   34|  84.1k|    }
_ZN19SecureUniqueDeleterINSt3__15arrayIhLm32EEEEclEPS2_:
   57|  84.1k|    void operator()(T* t) noexcept {
   58|  84.1k|        secure_allocator<T>().deallocate(t, 1);
   59|  84.1k|    }
_ZN16secure_allocatorINSt3__15arrayIhLm32EEEE10deallocateEPS2_m:
   37|  84.1k|    {
   38|  84.1k|        if (p != nullptr) {
  ------------------
  |  Branch (38:13): [True: 84.1k, False: 0]
  ------------------
   39|  84.1k|            memory_cleanse(p, sizeof(T) * n);
   40|  84.1k|        }
   41|  84.1k|        LockedPoolManager::Instance().free(p);
   42|  84.1k|    }

_ZN25zero_after_free_allocatorISt4byteE8allocateEm:
   25|  6.50k|    {
   26|  6.50k|        return std::allocator<T>{}.allocate(n);
   27|  6.50k|    }
_ZN25zero_after_free_allocatorISt4byteE10deallocateEPS0_m:
   30|  6.50k|    {
   31|  6.50k|        if (p != nullptr)
  ------------------
  |  Branch (31:13): [True: 6.50k, False: 0]
  ------------------
   32|  6.50k|            memory_cleanse(p, sizeof(T) * n);
   33|  6.50k|        std::allocator<T>{}.deallocate(p, n);
   34|  6.50k|    }

_Z14memory_cleansePvm:
   15|  90.7k|{
   16|       |#if defined(WIN32)
   17|       |    /* SecureZeroMemory is guaranteed not to be optimized out. */
   18|       |    SecureZeroMemory(ptr, len);
   19|       |#else
   20|  90.7k|    std::memset(ptr, 0, len);
   21|       |
   22|       |    /* Memory barrier that scares the compiler away from optimizing out the memset.
   23|       |     *
   24|       |     * Quoting Adam Langley <agl@google.com> in commit ad1907fe73334d6c696c8539646c21b11178f20f
   25|       |     * in BoringSSL (ISC License):
   26|       |     *    As best as we can tell, this is sufficient to break any optimisations that
   27|       |     *    might try to eliminate "superfluous" memsets.
   28|       |     * This method is used in memzero_explicit() the Linux kernel, too. Its advantage is that it
   29|       |     * is pretty efficient because the compiler can still implement the memset() efficiently,
   30|       |     * just not remove it entirely. See "Dead Store Elimination (Still) Considered Harmful" by
   31|       |     * Yang et al. (USENIX Security 2017) for more background.
   32|       |     */
   33|  90.7k|    __asm__ __volatile__("" : : "r"(ptr) : "memory");
   34|  90.7k|#endif
   35|  90.7k|}

_ZN5ArenaD2Ev:
   48|      2|Arena::~Arena() = default;
_ZN5Arena5allocEm:
   51|  84.1k|{
   52|       |    // Round to next multiple of alignment
   53|  84.1k|    size = align_up(size, alignment);
   54|       |
   55|       |    // Don't handle zero-sized chunks
   56|  84.1k|    if (size == 0)
  ------------------
  |  Branch (56:9): [True: 0, False: 84.1k]
  ------------------
   57|      0|        return nullptr;
   58|       |
   59|       |    // Pick a large enough free-chunk. Returns an iterator pointing to the first element that is not less than key.
   60|       |    // This allocation strategy is best-fit. According to "Dynamic Storage Allocation: A Survey and Critical Review",
   61|       |    // Wilson et. al. 1995, https://www.scs.stanford.edu/14wi-cs140/sched/readings/wilson.pdf, best-fit and first-fit
   62|       |    // policies seem to work well in practice.
   63|  84.1k|    auto size_ptr_it = size_to_free_chunk.lower_bound(size);
   64|  84.1k|    if (size_ptr_it == size_to_free_chunk.end())
  ------------------
  |  Branch (64:9): [True: 0, False: 84.1k]
  ------------------
   65|      0|        return nullptr;
   66|       |
   67|       |    // Create the used-chunk, taking its space from the end of the free-chunk
   68|  84.1k|    const size_t size_remaining = size_ptr_it->first - size;
   69|  84.1k|    char* const free_chunk = static_cast<char*>(size_ptr_it->second);
   70|  84.1k|    auto allocated = chunks_used.emplace(free_chunk + size_remaining, size).first;
   71|  84.1k|    chunks_free_end.erase(free_chunk + size_ptr_it->first);
   72|  84.1k|    if (size_ptr_it->first == size) {
  ------------------
  |  Branch (72:9): [True: 0, False: 84.1k]
  ------------------
   73|       |        // whole chunk is used up
   74|      0|        chunks_free.erase(size_ptr_it->second);
   75|  84.1k|    } else {
   76|       |        // still some memory left in the chunk
   77|  84.1k|        auto it_remaining = size_to_free_chunk.emplace(size_remaining, size_ptr_it->second);
   78|  84.1k|        chunks_free[size_ptr_it->second] = it_remaining;
   79|  84.1k|        chunks_free_end.emplace(free_chunk + size_remaining, it_remaining);
   80|  84.1k|    }
   81|  84.1k|    size_to_free_chunk.erase(size_ptr_it);
   82|       |
   83|  84.1k|    return allocated->first;
   84|  84.1k|}
_ZN5Arena4freeEPv:
   87|  84.1k|{
   88|       |    // Freeing the nullptr pointer is OK.
   89|  84.1k|    if (ptr == nullptr) {
  ------------------
  |  Branch (89:9): [True: 0, False: 84.1k]
  ------------------
   90|      0|        return;
   91|      0|    }
   92|       |
   93|       |    // Remove chunk from used map
   94|  84.1k|    auto i = chunks_used.find(ptr);
   95|  84.1k|    if (i == chunks_used.end()) {
  ------------------
  |  Branch (95:9): [True: 0, False: 84.1k]
  ------------------
   96|      0|        throw std::runtime_error("Arena: invalid or double free");
   97|      0|    }
   98|  84.1k|    auto freed = std::make_pair(static_cast<char*>(i->first), i->second);
   99|  84.1k|    chunks_used.erase(i);
  100|       |
  101|       |    // coalesce freed with previous chunk
  102|  84.1k|    auto prev = chunks_free_end.find(freed.first);
  103|  84.1k|    if (prev != chunks_free_end.end()) {
  ------------------
  |  Branch (103:9): [True: 74.2k, False: 9.90k]
  ------------------
  104|  74.2k|        freed.first -= prev->second->first;
  105|  74.2k|        freed.second += prev->second->first;
  106|  74.2k|        size_to_free_chunk.erase(prev->second);
  107|  74.2k|        chunks_free_end.erase(prev);
  108|  74.2k|    }
  109|       |
  110|       |    // coalesce freed with chunk after freed
  111|  84.1k|    auto next = chunks_free.find(freed.first + freed.second);
  112|  84.1k|    if (next != chunks_free.end()) {
  ------------------
  |  Branch (112:9): [True: 9.90k, False: 74.2k]
  ------------------
  113|  9.90k|        freed.second += next->second->first;
  114|  9.90k|        size_to_free_chunk.erase(next->second);
  115|  9.90k|        chunks_free.erase(next);
  116|  9.90k|    }
  117|       |
  118|       |    // Add/set space with coalesced free chunk
  119|  84.1k|    auto it = size_to_free_chunk.emplace(freed.second, freed.first);
  120|  84.1k|    chunks_free[freed.first] = it;
  121|  84.1k|    chunks_free_end[freed.first + freed.second] = it;
  122|  84.1k|}
_ZN24PosixLockedPageAllocator10FreeLockedEPvm:
  254|      2|{
  255|      2|    len = align_up(len, page_size);
  256|      2|    memory_cleanse(addr, len);
  257|      2|    munlock(addr, len);
  258|      2|    munmap(addr, len);
  259|      2|}
_ZN10LockedPoolD2Ev:
  283|      2|LockedPool::~LockedPool() = default;
_ZN10LockedPool5allocEm:
  286|  84.1k|{
  287|  84.1k|    std::lock_guard<std::mutex> lock(mutex);
  288|       |
  289|       |    // Don't handle impossible sizes
  290|  84.1k|    if (size == 0 || size > ARENA_SIZE)
  ------------------
  |  Branch (290:9): [True: 0, False: 84.1k]
  |  Branch (290:22): [True: 0, False: 84.1k]
  ------------------
  291|      0|        return nullptr;
  292|       |
  293|       |    // Try allocating from each current arena
  294|  84.1k|    for (auto &arena: arenas) {
  ------------------
  |  Branch (294:21): [True: 84.1k, False: 0]
  ------------------
  295|  84.1k|        void *addr = arena.alloc(size);
  296|  84.1k|        if (addr) {
  ------------------
  |  Branch (296:13): [True: 84.1k, False: 0]
  ------------------
  297|  84.1k|            return addr;
  298|  84.1k|        }
  299|  84.1k|    }
  300|       |    // If that fails, create a new one
  301|      0|    if (new_arena(ARENA_SIZE, ARENA_ALIGN)) {
  ------------------
  |  Branch (301:9): [True: 0, False: 0]
  ------------------
  302|      0|        return arenas.back().alloc(size);
  303|      0|    }
  304|      0|    return nullptr;
  305|      0|}
_ZN10LockedPool4freeEPv:
  308|  84.1k|{
  309|  84.1k|    std::lock_guard<std::mutex> lock(mutex);
  310|       |    // TODO we can do better than this linear search by keeping a map of arena
  311|       |    // extents to arena, and looking up the address.
  312|  84.1k|    for (auto &arena: arenas) {
  ------------------
  |  Branch (312:21): [True: 84.1k, False: 0]
  ------------------
  313|  84.1k|        if (arena.addressInArena(ptr)) {
  ------------------
  |  Branch (313:13): [True: 84.1k, False: 0]
  ------------------
  314|  84.1k|            arena.free(ptr);
  315|  84.1k|            return;
  316|  84.1k|        }
  317|  84.1k|    }
  318|      0|    throw std::runtime_error("LockedPool: invalid address not pointing to any arena");
  319|  84.1k|}
_ZN10LockedPool15LockedPageArenaD2Ev:
  370|      2|{
  371|      2|    allocator->FreeLocked(base, size);
  372|      2|}
_ZN17LockedPoolManager8InstanceEv:
  405|   168k|{
  406|   168k|    static std::once_flag init_flag;
  407|   168k|    std::call_once(init_flag, LockedPoolManager::CreateInstance);
  408|   168k|    return *LockedPoolManager::_instance;
  409|   168k|}
lockedpool.cpp:_ZL8align_upmm:
   32|  84.1k|{
   33|  84.1k|    return (x + align - 1) & ~(align - 1);
   34|  84.1k|}

_ZNK5Arena14addressInArenaEPv:
   90|  84.1k|    bool addressInArena(void *ptr) const { return ptr >= base && ptr < end; }
  ------------------
  |  Branch (90:51): [True: 84.1k, False: 0]
  |  Branch (90:66): [True: 84.1k, False: 0]
  ------------------
_ZN19LockedPageAllocatorD2Ev:
   22|      2|    virtual ~LockedPageAllocator() = default;

_ZN14AnnotatedMixinINSt3__115recursive_mutexEED2Ev:
   96|  12.0k|    ~AnnotatedMixin() {
   97|  12.0k|        DeleteLock((void*)this);
   98|  12.0k|    }
_Z17MaybeCheckNotHeldI14AnnotatedMixinINSt3__115recursive_mutexEEERT_S5_:
  264|   120k|inline MutexType& MaybeCheckNotHeld(MutexType& m) LOCKS_EXCLUDED(m) LOCK_RETURNED(m) { return m; }
_Z13EnterCriticalINSt3__115recursive_mutexEEvPKcS3_iPT_b:
   67|   120k|inline void EnterCritical(const char* pszName, const char* pszFile, int nLine, MutexType* cs, bool fTry = false) {}
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEE5EnterEPKcS6_i:
  159|   120k|    {
  160|   120k|        EnterCritical(pszName, pszFile, nLine, Base::mutex());
  161|       |#ifdef DEBUG_LOCKCONTENTION
  162|       |        if (!Base::try_lock()) {
  163|       |            ContendedLock(pszName, pszFile, nLine, static_cast<Base&>(*this));
  164|       |        }
  165|       |#else
  166|   120k|        Base::lock();
  167|   120k|#endif
  168|   120k|    }
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEEC2ERS3_PKcS7_ib:
  181|   120k|    UniqueLock(MutexType& mutexIn, const char* pszName, const char* pszFile, int nLine, bool fTry = false) EXCLUSIVE_LOCK_FUNCTION(mutexIn) : Base(mutexIn, std::defer_lock)
  182|   120k|    {
  183|   120k|        if (fTry)
  ------------------
  |  Branch (183:13): [True: 0, False: 120k]
  ------------------
  184|      0|            TryEnter(pszName, pszFile, nLine);
  185|   120k|        else
  186|   120k|            Enter(pszName, pszFile, nLine);
  187|   120k|    }
_ZN10UniqueLockI14AnnotatedMixinINSt3__115recursive_mutexEEED2Ev:
  201|   120k|    {
  202|   120k|        if (Base::owns_lock())
  ------------------
  |  Branch (202:13): [True: 120k, False: 0]
  ------------------
  203|   120k|            LeaveCritical();
  204|   120k|    }
_Z22AssertLockHeldInternalI14AnnotatedMixinINSt3__115recursive_mutexEEEvPKcS5_iPT_:
   71|  9.90k|inline void AssertLockHeldInternal(const char* pszName, const char* pszFile, int nLine, MutexType* cs) EXCLUSIVE_LOCKS_REQUIRED(cs) {}
_ZN14AnnotatedMixinINSt3__15mutexEED2Ev:
   96|     64|    ~AnnotatedMixin() {
   97|     64|        DeleteLock((void*)this);
   98|     64|    }
_Z10DeleteLockPv:
   74|  12.1k|inline void DeleteLock(void* cs) {}
_Z17MaybeCheckNotHeldR14AnnotatedMixinINSt3__15mutexEE:
  258|     30|inline Mutex& MaybeCheckNotHeld(Mutex& cs) EXCLUSIVE_LOCKS_REQUIRED(!cs) LOCK_RETURNED(cs) { return cs; }
_ZN10UniqueLockI14AnnotatedMixinINSt3__15mutexEEEC2ERS3_PKcS7_ib:
  181|     30|    UniqueLock(MutexType& mutexIn, const char* pszName, const char* pszFile, int nLine, bool fTry = false) EXCLUSIVE_LOCK_FUNCTION(mutexIn) : Base(mutexIn, std::defer_lock)
  182|     30|    {
  183|     30|        if (fTry)
  ------------------
  |  Branch (183:13): [True: 0, False: 30]
  ------------------
  184|      0|            TryEnter(pszName, pszFile, nLine);
  185|     30|        else
  186|     30|            Enter(pszName, pszFile, nLine);
  187|     30|    }
_Z13EnterCriticalINSt3__15mutexEEvPKcS3_iPT_b:
   67|     30|inline void EnterCritical(const char* pszName, const char* pszFile, int nLine, MutexType* cs, bool fTry = false) {}
_Z13LeaveCriticalv:
   68|   120k|inline void LeaveCritical() {}
_ZN10UniqueLockI14AnnotatedMixinINSt3__15mutexEEE5EnterEPKcS6_i:
  159|     30|    {
  160|     30|        EnterCritical(pszName, pszFile, nLine, Base::mutex());
  161|       |#ifdef DEBUG_LOCKCONTENTION
  162|       |        if (!Base::try_lock()) {
  163|       |            ContendedLock(pszName, pszFile, nLine, static_cast<Base&>(*this));
  164|       |        }
  165|       |#else
  166|     30|        Base::lock();
  167|     30|#endif
  168|     30|    }
_ZN10UniqueLockI14AnnotatedMixinINSt3__15mutexEEED2Ev:
  201|     30|    {
  202|     30|        if (Base::owns_lock())
  ------------------
  |  Branch (202:13): [True: 30, False: 0]
  ------------------
  203|     30|            LeaveCritical();
  204|     30|    }

_ZN18FuzzedDataProvider16PickValueInArrayI10SigVersionEET_St16initializer_listIKS2_E:
  316|  1.20k|T FuzzedDataProvider::PickValueInArray(std::initializer_list<const T> list) {
  317|  1.20k|  if (!list.size())
  ------------------
  |  Branch (317:7): [True: 0, False: 1.20k]
  ------------------
  318|      0|    abort();
  319|       |
  320|  1.20k|  return *(list.begin() + ConsumeIntegralInRange<size_t>(0, list.size() - 1));
  321|  1.20k|}
_ZN18FuzzedDataProvider15ConsumeIntegralIjEET_v:
  195|  12.0k|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  12.0k|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  12.0k|                                std::numeric_limits<T>::max());
  198|  12.0k|}
_ZN18FuzzedDataProvider15ConsumeIntegralIiEET_v:
  195|  10.1k|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  10.1k|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  10.1k|                                std::numeric_limits<T>::max());
  198|  10.1k|}
_ZN18FuzzedDataProviderC2EPKhm:
   37|  12.0k|      : data_ptr_(data), remaining_bytes_(size) {}
_ZN18FuzzedDataProvider11ConsumeBoolEv:
  289|  14.5M|inline bool FuzzedDataProvider::ConsumeBool() {
  290|  14.5M|  return 1 & ConsumeIntegral<uint8_t>();
  291|  14.5M|}
_ZN18FuzzedDataProvider15ConsumeIntegralIhEET_v:
  195|  14.6M|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  14.6M|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  14.6M|                                std::numeric_limits<T>::max());
  198|  14.6M|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIhEET_S1_S1_:
  205|  14.6M|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  14.6M|  static_assert(std::is_integral_v<T>, "An integral type is required.");
  207|  14.6M|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  14.6M|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 14.6M]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  14.6M|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  14.6M|  uint64_t result = 0;
  215|  14.6M|  size_t offset = 0;
  216|       |
  217|  29.1M|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 14.6M, False: 14.5M]
  |  Branch (217:43): [True: 14.6M, False: 0]
  ------------------
  218|  14.6M|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 14.5M, False: 45.5k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  14.5M|    --remaining_bytes_;
  226|  14.5M|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  14.5M|    offset += CHAR_BIT;
  228|  14.5M|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  14.6M|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 14.6M, False: 0]
  ------------------
  232|  14.6M|    result = result % (range + 1);
  233|       |
  234|  14.6M|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  14.6M|}
_ZN18FuzzedDataProvider25ConsumeRandomLengthStringEm:
  153|   130k|FuzzedDataProvider::ConsumeRandomLengthString(size_t max_length) {
  154|       |  // Reads bytes from the start of |data_ptr_|. Maps "\\" to "\", and maps "\"
  155|       |  // followed by anything else to the end of the string. As a result of this
  156|       |  // logic, a fuzzer can insert characters into the string, and the string
  157|       |  // will be lengthened to include those new characters, resulting in a more
  158|       |  // stable fuzzer than picking the length of a string independently from
  159|       |  // picking its contents.
  160|   130k|  std::string result;
  161|       |
  162|       |  // Reserve the anticipated capacity to prevent several reallocations.
  163|   130k|  result.reserve(std::min(max_length, remaining_bytes_));
  164|  65.8M|  for (size_t i = 0; i < max_length && remaining_bytes_ != 0; ++i) {
  ------------------
  |  Branch (164:22): [True: 65.7M, False: 23.6k]
  |  Branch (164:40): [True: 65.7M, False: 760]
  ------------------
  165|  65.7M|    char next = ConvertUnsignedToSigned<char>(data_ptr_[0]);
  166|  65.7M|    Advance(1);
  167|  65.7M|    if (next == '\\' && remaining_bytes_ != 0) {
  ------------------
  |  Branch (167:9): [True: 126k, False: 65.6M]
  |  Branch (167:25): [True: 126k, False: 108]
  ------------------
  168|   126k|      next = ConvertUnsignedToSigned<char>(data_ptr_[0]);
  169|   126k|      Advance(1);
  170|   126k|      if (next != '\\')
  ------------------
  |  Branch (170:11): [True: 106k, False: 19.7k]
  ------------------
  171|   106k|        break;
  172|   126k|    }
  173|  65.6M|    result += next;
  174|  65.6M|  }
  175|       |
  176|   130k|  result.shrink_to_fit();
  177|   130k|  return result;
  178|   130k|}
_ZN18FuzzedDataProvider25ConsumeRandomLengthStringEv:
  181|   105k|inline std::string FuzzedDataProvider::ConsumeRandomLengthString() {
  182|   105k|  return ConsumeRandomLengthString(remaining_bytes_);
  183|   105k|}
_ZN18FuzzedDataProvider14CopyAndAdvanceEPvm:
  338|  10.0k|                                               size_t num_bytes) {
  339|  10.0k|  std::memcpy(destination, data_ptr_, num_bytes);
  340|  10.0k|  Advance(num_bytes);
  341|  10.0k|}
_ZN18FuzzedDataProvider7AdvanceEm:
  343|  65.9M|inline void FuzzedDataProvider::Advance(size_t num_bytes) {
  344|  65.9M|  if (num_bytes > remaining_bytes_)
  ------------------
  |  Branch (344:7): [True: 0, False: 65.9M]
  ------------------
  345|      0|    abort();
  346|       |
  347|  65.9M|  data_ptr_ += num_bytes;
  348|  65.9M|  remaining_bytes_ -= num_bytes;
  349|  65.9M|}
_ZN18FuzzedDataProvider23ConvertUnsignedToSignedIchEET_T0_:
  378|  65.9M|TS FuzzedDataProvider::ConvertUnsignedToSigned(TU value) {
  379|  65.9M|  static_assert(sizeof(TS) == sizeof(TU), "Incompatible data types.");
  380|  65.9M|  static_assert(!std::numeric_limits<TU>::is_signed,
  381|  65.9M|                "Source type must be unsigned.");
  382|       |
  383|       |  if constexpr (std::numeric_limits<TS>::is_modulo)
  384|       |    return static_cast<TS>(value);
  385|       |
  386|       |  // Avoid using implementation-defined unsigned to signed conversions.
  387|       |  // To learn more, see https://stackoverflow.com/questions/13150449.
  388|  65.9M|  constexpr auto TS_max = static_cast<TU>(std::numeric_limits<TS>::max());
  389|  65.9M|  if (value <= TS_max) {
  ------------------
  |  Branch (389:7): [True: 57.5M, False: 8.41M]
  ------------------
  390|  57.5M|    return static_cast<TS>(value);
  391|  57.5M|  } else {
  392|  8.41M|    constexpr auto TS_min = std::numeric_limits<TS>::min();
  393|  8.41M|    return TS_min + static_cast<TS>(value - TS_min);
  394|  8.41M|  }
  395|  65.9M|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeImEET_S1_S1_:
  205|  14.3M|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  14.3M|  static_assert(std::is_integral_v<T>, "An integral type is required.");
  207|  14.3M|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  14.3M|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 14.3M]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  14.3M|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  14.3M|  uint64_t result = 0;
  215|  14.3M|  size_t offset = 0;
  216|       |
  217|  28.7M|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 28.7M, False: 0]
  |  Branch (217:43): [True: 14.3M, False: 14.3M]
  ------------------
  218|  14.3M|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 14.3M, False: 3.19k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  14.3M|    --remaining_bytes_;
  226|  14.3M|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  14.3M|    offset += CHAR_BIT;
  228|  14.3M|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  14.3M|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 14.3M, False: 0]
  ------------------
  232|  14.3M|    result = result % (range + 1);
  233|       |
  234|  14.3M|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  14.3M|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIjEET_S1_S1_:
  205|  14.2M|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  14.2M|  static_assert(std::is_integral_v<T>, "An integral type is required.");
  207|  14.2M|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  14.2M|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 14.2M]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  14.2M|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  14.2M|  uint64_t result = 0;
  215|  14.2M|  size_t offset = 0;
  216|       |
  217|  28.4M|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 28.4M, False: 6.28k]
  |  Branch (217:43): [True: 14.2M, False: 14.2M]
  ------------------
  218|  14.2M|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 14.2M, False: 6.12k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  14.2M|    --remaining_bytes_;
  226|  14.2M|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  14.2M|    offset += CHAR_BIT;
  228|  14.2M|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  14.2M|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 14.2M, False: 0]
  ------------------
  232|  14.2M|    result = result % (range + 1);
  233|       |
  234|  14.2M|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  14.2M|}
_ZN18FuzzedDataProvider15ConsumeIntegralIlEET_v:
  195|  74.0k|template <typename T> T FuzzedDataProvider::ConsumeIntegral() {
  196|  74.0k|  return ConsumeIntegralInRange(std::numeric_limits<T>::min(),
  197|  74.0k|                                std::numeric_limits<T>::max());
  198|  74.0k|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIlEET_S1_S1_:
  205|  92.9k|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  92.9k|  static_assert(std::is_integral_v<T>, "An integral type is required.");
  207|  92.9k|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  92.9k|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 92.9k]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  92.9k|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  92.9k|  uint64_t result = 0;
  215|  92.9k|  size_t offset = 0;
  216|       |
  217|   716k|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 642k, False: 73.8k]
  |  Branch (217:43): [True: 623k, False: 18.4k]
  ------------------
  218|   623k|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 623k, False: 661]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|   623k|    --remaining_bytes_;
  226|   623k|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|   623k|    offset += CHAR_BIT;
  228|   623k|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  92.9k|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 18.9k, False: 74.0k]
  ------------------
  232|  18.9k|    result = result % (range + 1);
  233|       |
  234|  92.9k|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  92.9k|}
_ZN18FuzzedDataProvider12ConsumeBytesIhEENSt3__16vectorIT_NS1_9allocatorIS3_EEEEm:
  109|  12.2k|std::vector<T> FuzzedDataProvider::ConsumeBytes(size_t num_bytes) {
  110|  12.2k|  num_bytes = std::min(num_bytes, remaining_bytes_);
  111|  12.2k|  return ConsumeBytes<T>(num_bytes, num_bytes);
  112|  12.2k|}
_ZN18FuzzedDataProvider12ConsumeBytesIhEENSt3__16vectorIT_NS1_9allocatorIS3_EEEEmm:
  352|  12.2k|std::vector<T> FuzzedDataProvider::ConsumeBytes(size_t size, size_t num_bytes) {
  353|  12.2k|  static_assert(sizeof(T) == sizeof(uint8_t), "Incompatible data type.");
  354|       |
  355|       |  // The point of using the size-based constructor below is to increase the
  356|       |  // odds of having a vector object with capacity being equal to the length.
  357|       |  // That part is always implementation specific, but at least both libc++ and
  358|       |  // libstdc++ allocate the requested number of bytes in that constructor,
  359|       |  // which seems to be a natural choice for other implementations as well.
  360|       |  // To increase the odds even more, we also call |shrink_to_fit| below.
  361|  12.2k|  std::vector<T> result(size);
  362|  12.2k|  if (size == 0) {
  ------------------
  |  Branch (362:7): [True: 2.19k, False: 10.0k]
  ------------------
  363|  2.19k|    if (num_bytes != 0)
  ------------------
  |  Branch (363:9): [True: 0, False: 2.19k]
  ------------------
  364|      0|      abort();
  365|  2.19k|    return result;
  366|  2.19k|  }
  367|       |
  368|  10.0k|  CopyAndAdvance(result.data(), num_bytes);
  369|       |
  370|       |  // Even though |shrink_to_fit| is also implementation specific, we expect it
  371|       |  // to provide an additional assurance in case vector's constructor allocated
  372|       |  // a buffer which is larger than the actual amount of data we put inside it.
  373|  10.0k|  result.shrink_to_fit();
  374|  10.0k|  return result;
  375|  12.2k|}
_ZN18FuzzedDataProvider22ConsumeIntegralInRangeIiEET_S1_S1_:
  205|  18.4k|T FuzzedDataProvider::ConsumeIntegralInRange(T min, T max) {
  206|  18.4k|  static_assert(std::is_integral_v<T>, "An integral type is required.");
  207|  18.4k|  static_assert(sizeof(T) <= sizeof(uint64_t), "Unsupported integral type.");
  208|       |
  209|  18.4k|  if (min > max)
  ------------------
  |  Branch (209:7): [True: 0, False: 18.4k]
  ------------------
  210|      0|    abort();
  211|       |
  212|       |  // Use the biggest type possible to hold the range and the result.
  213|  18.4k|  uint64_t range = static_cast<uint64_t>(max) - static_cast<uint64_t>(min);
  214|  18.4k|  uint64_t result = 0;
  215|  18.4k|  size_t offset = 0;
  216|       |
  217|  40.8k|  while (offset < sizeof(T) * CHAR_BIT && (range >> offset) > 0 &&
  ------------------
  |  Branch (217:10): [True: 37.3k, False: 3.48k]
  |  Branch (217:43): [True: 29.1k, False: 8.21k]
  ------------------
  218|  29.1k|         remaining_bytes_ != 0) {
  ------------------
  |  Branch (218:10): [True: 22.4k, False: 6.72k]
  ------------------
  219|       |    // Pull bytes off the end of the seed data. Experimentally, this seems to
  220|       |    // allow the fuzzer to more easily explore the input space. This makes
  221|       |    // sense, since it works by modifying inputs that caused new code to run,
  222|       |    // and this data is often used to encode length of data read by
  223|       |    // |ConsumeBytes|. Separating out read lengths makes it easier modify the
  224|       |    // contents of the data that is actually read.
  225|  22.4k|    --remaining_bytes_;
  226|  22.4k|    result = (result << CHAR_BIT) | data_ptr_[remaining_bytes_];
  227|  22.4k|    offset += CHAR_BIT;
  228|  22.4k|  }
  229|       |
  230|       |  // Avoid division by 0, in case |range + 1| results in overflow.
  231|  18.4k|  if (range != std::numeric_limits<decltype(range)>::max())
  ------------------
  |  Branch (231:7): [True: 18.4k, False: 0]
  ------------------
  232|  18.4k|    result = result % (range + 1);
  233|       |
  234|  18.4k|  return static_cast<T>(static_cast<uint64_t>(min) + result);
  235|  18.4k|}
_ZN18FuzzedDataProvider16PickValueInArrayIiEET_St16initializer_listIKS1_E:
  316|  74.2k|T FuzzedDataProvider::PickValueInArray(std::initializer_list<const T> list) {
  317|  74.2k|  if (!list.size())
  ------------------
  |  Branch (317:7): [True: 0, False: 74.2k]
  ------------------
  318|      0|    abort();
  319|       |
  320|  74.2k|  return *(list.begin() + ConsumeIntegralInRange<size_t>(0, list.size() - 1));
  321|  74.2k|}

LLVMFuzzerTestOneInput:
  213|  12.0k|{
  214|  12.0k|    test_one_input({data, size});
  215|  12.0k|    return 0;
  216|  12.0k|}
fuzz.cpp:_ZL14test_one_inputNSt3__14spanIKhLm18446744073709551615EEE:
   84|  12.0k|{
   85|  12.0k|    CheckGlobals check{};
   86|  12.0k|    (*Assert(g_test_one_input))(buffer);
  ------------------
  |  |  116|  12.0k|#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
  ------------------
   87|  12.0k|}

_Z23script_sign_fuzz_targetNSt3__14spanIKhLm18446744073709551615EEE:
   35|  12.0k|{
   36|  12.0k|    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
   37|  12.0k|    const std::vector<uint8_t> key = ConsumeRandomLengthByteVector(fuzzed_data_provider, 128);
   38|       |
   39|  12.0k|    {
   40|  12.0k|        DataStream random_data_stream{ConsumeDataStream(fuzzed_data_provider)};
   41|  12.0k|        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
   42|  12.0k|        try {
   43|  12.0k|            DeserializeHDKeypaths(random_data_stream, key, hd_keypaths);
   44|  12.0k|        } catch (const std::ios_base::failure&) {
   45|  12.0k|        }
   46|  12.0k|        DataStream serialized{};
   47|  12.0k|        SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));
   48|  12.0k|    }
   49|       |
   50|  12.0k|    {
   51|  12.0k|        std::map<CPubKey, KeyOriginInfo> hd_keypaths;
   52|  19.5k|        LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 10000) {
  ------------------
  |  |   23|  28.4k|    for (unsigned _count{limit}; (condition) && _count; --_count)
  |  |  ------------------
  |  |  |  Branch (23:34): [True: 19.5k, False: 8.90k]
  |  |  |  Branch (23:49): [True: 19.5k, False: 0]
  |  |  ------------------
  ------------------
   53|  19.5k|            const std::optional<CPubKey> pub_key = ConsumeDeserializable<CPubKey>(fuzzed_data_provider);
   54|  19.5k|            if (!pub_key) {
  ------------------
  |  Branch (54:17): [True: 2.56k, False: 16.9k]
  ------------------
   55|  2.56k|                break;
   56|  2.56k|            }
   57|  16.9k|            const std::optional<KeyOriginInfo> key_origin_info = ConsumeDeserializable<KeyOriginInfo>(fuzzed_data_provider);
   58|  16.9k|            if (!key_origin_info) {
  ------------------
  |  Branch (58:17): [True: 610, False: 16.3k]
  ------------------
   59|    610|                break;
   60|    610|            }
   61|  16.3k|            hd_keypaths[*pub_key] = *key_origin_info;
   62|  16.3k|        }
   63|  12.0k|        DataStream serialized{};
   64|  12.0k|        try {
   65|  12.0k|            SerializeHDKeypaths(serialized, hd_keypaths, CompactSizeWriter(fuzzed_data_provider.ConsumeIntegral<uint8_t>()));
   66|  12.0k|        } catch (const std::ios_base::failure&) {
   67|    317|        }
   68|  12.0k|        std::map<CPubKey, KeyOriginInfo> deserialized_hd_keypaths;
   69|  12.0k|        try {
   70|  12.0k|            DeserializeHDKeypaths(serialized, key, deserialized_hd_keypaths);
   71|  12.0k|        } catch (const std::ios_base::failure&) {
   72|  12.0k|        }
   73|  12.0k|        assert(hd_keypaths.size() >= deserialized_hd_keypaths.size());
  ------------------
  |  Branch (73:9): [True: 12.0k, False: 0]
  ------------------
   74|  12.0k|    }
   75|       |
   76|  12.0k|    {
   77|  12.0k|        SignatureData signature_data_1{ConsumeScript(fuzzed_data_provider)};
   78|  12.0k|        SignatureData signature_data_2{ConsumeScript(fuzzed_data_provider)};
   79|  12.0k|        signature_data_1.MergeSignatureData(signature_data_2);
   80|  12.0k|    }
   81|       |
   82|  12.0k|    FillableSigningProvider provider;
   83|  12.0k|    CKey k = ConsumePrivateKey(fuzzed_data_provider);
   84|  12.0k|    if (k.IsValid()) {
  ------------------
  |  Branch (84:9): [True: 9.90k, False: 2.17k]
  ------------------
   85|  9.90k|        provider.AddKey(k);
   86|  9.90k|    }
   87|       |
   88|  12.0k|    {
   89|  12.0k|        const std::optional<CMutableTransaction> mutable_transaction = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider, TX_WITH_WITNESS);
   90|  12.0k|        const std::optional<CTxOut> tx_out = ConsumeDeserializable<CTxOut>(fuzzed_data_provider);
   91|  12.0k|        const unsigned int n_in = fuzzed_data_provider.ConsumeIntegral<unsigned int>();
   92|  12.0k|        if (mutable_transaction && tx_out && mutable_transaction->vin.size() > n_in) {
  ------------------
  |  Branch (92:13): [True: 7.72k, False: 4.35k]
  |  Branch (92:36): [True: 2.73k, False: 4.98k]
  |  Branch (92:46): [True: 2.13k, False: 602]
  ------------------
   93|  2.13k|            SignatureData signature_data_1 = DataFromTransaction(*mutable_transaction, n_in, *tx_out);
   94|  2.13k|            CTxIn input;
   95|  2.13k|            UpdateInput(input, signature_data_1);
   96|  2.13k|            const CScript script = ConsumeScript(fuzzed_data_provider);
   97|  2.13k|            SignatureData signature_data_2{script};
   98|  2.13k|            signature_data_1.MergeSignatureData(signature_data_2);
   99|  2.13k|        }
  100|  12.0k|        if (mutable_transaction) {
  ------------------
  |  Branch (100:13): [True: 7.72k, False: 4.35k]
  ------------------
  101|  7.72k|            CTransaction tx_from{*mutable_transaction};
  102|  7.72k|            CMutableTransaction tx_to;
  103|  7.72k|            const std::optional<CMutableTransaction> opt_tx_to = ConsumeDeserializable<CMutableTransaction>(fuzzed_data_provider, TX_WITH_WITNESS);
  104|  7.72k|            if (opt_tx_to) {
  ------------------
  |  Branch (104:17): [True: 4.90k, False: 2.82k]
  ------------------
  105|  4.90k|                tx_to = *opt_tx_to;
  106|  4.90k|            }
  107|  7.72k|            CMutableTransaction script_tx_to = tx_to;
  108|  7.72k|            CMutableTransaction sign_transaction_tx_to = tx_to;
  109|  7.72k|            if (n_in < tx_to.vin.size() && tx_to.vin[n_in].prevout.n < tx_from.vout.size()) {
  ------------------
  |  Branch (109:17): [True: 1.20k, False: 6.51k]
  |  Branch (109:44): [True: 20, False: 1.18k]
  ------------------
  110|     20|                SignatureData empty;
  111|     20|                (void)SignSignature(provider, tx_from, tx_to, n_in, fuzzed_data_provider.ConsumeIntegral<int>(), empty);
  112|     20|            }
  113|  7.72k|            if (n_in < script_tx_to.vin.size()) {
  ------------------
  |  Branch (113:17): [True: 1.20k, False: 6.51k]
  ------------------
  114|  1.20k|                SignatureData empty;
  115|  1.20k|                auto from_pub_key = ConsumeScript(fuzzed_data_provider);
  116|  1.20k|                auto amount = ConsumeMoney(fuzzed_data_provider);
  117|  1.20k|                auto n_hash_type = fuzzed_data_provider.ConsumeIntegral<int>();
  118|  1.20k|                (void)SignSignature(provider, from_pub_key, script_tx_to, n_in, amount, n_hash_type, empty);
  119|  1.20k|                MutableTransactionSignatureCreator signature_creator{tx_to, n_in, ConsumeMoney(fuzzed_data_provider), {.sighash_type = fuzzed_data_provider.ConsumeIntegral<int>()}};
  120|  1.20k|                std::vector<unsigned char> vch_sig;
  121|  1.20k|                CKeyID address;
  122|  1.20k|                if (fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (122:21): [True: 1.05k, False: 149]
  ------------------
  123|  1.05k|                    if (k.IsValid()) {
  ------------------
  |  Branch (123:25): [True: 1.05k, False: 1]
  ------------------
  124|  1.05k|                        address = k.GetPubKey().GetID();
  125|  1.05k|                    }
  126|  1.05k|                } else {
  127|    149|                    address = CKeyID{ConsumeUInt160(fuzzed_data_provider)};
  128|    149|                }
  129|  1.20k|                auto script_code = ConsumeScript(fuzzed_data_provider);
  130|  1.20k|                auto sigversion = fuzzed_data_provider.PickValueInArray({SigVersion::BASE, SigVersion::WITNESS_V0});
  131|  1.20k|                (void)signature_creator.CreateSig(provider, vch_sig, address, script_code, sigversion);
  132|  1.20k|            }
  133|  7.72k|            std::map<COutPoint, Coin> coins{ConsumeCoins(fuzzed_data_provider)};
  134|  7.72k|            std::map<int, bilingual_str> input_errors;
  135|  7.72k|            (void)SignTransaction(sign_transaction_tx_to, &provider, coins, {.sighash_type = fuzzed_data_provider.ConsumeIntegral<int>()}, input_errors);
  136|  7.72k|        }
  137|  12.0k|    }
  138|       |
  139|  12.0k|    {
  140|  12.0k|        SignatureData signature_data_1;
  141|  12.0k|        (void)ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_1);
  142|  12.0k|        SignatureData signature_data_2;
  143|  12.0k|        (void)ProduceSignature(provider, DUMMY_MAXIMUM_SIGNATURE_CREATOR, ConsumeScript(fuzzed_data_provider), signature_data_2);
  144|  12.0k|    }
  145|  12.0k|}

_Z20ConstructPubKeyBytesR18FuzzedDataProviderNSt3__14spanIKhLm18446744073709551615EEEb:
   17|  74.2k|{
   18|  74.2k|    uint8_t pk_type;
   19|  74.2k|    if (compressed) {
  ------------------
  |  Branch (19:9): [True: 67.4k, False: 6.77k]
  ------------------
   20|  67.4k|        pk_type = fuzzed_data_provider.PickValueInArray({0x02, 0x03});
   21|  67.4k|    } else {
   22|  6.77k|        pk_type = fuzzed_data_provider.PickValueInArray({0x04, 0x06, 0x07});
   23|  6.77k|    }
   24|  74.2k|    std::vector<uint8_t> pk_data{byte_data.begin(), byte_data.begin() + (compressed ? CPubKey::COMPRESSED_SIZE : CPubKey::SIZE)};
  ------------------
  |  Branch (24:74): [True: 67.4k, False: 6.77k]
  ------------------
   25|  74.2k|    pk_data[0] = pk_type;
   26|  74.2k|    return pk_data;
   27|  74.2k|}
_Z12ConsumeMoneyR18FuzzedDataProviderRKNSt3__18optionalIlEE:
   30|  2.40k|{
   31|  2.40k|    return fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, max.value_or(MAX_MONEY));
   32|  2.40k|}
_Z13ConsumeScriptR18FuzzedDataProviderb:
   94|  52.8k|{
   95|  52.8k|    CScript r_script{};
   96|  52.8k|    {
   97|       |        // Keep a buffer of bytes to allow the fuzz engine to produce smaller
   98|       |        // inputs to generate CScripts with repeated data.
   99|  52.8k|        static constexpr unsigned MAX_BUFFER_SZ{128};
  100|  52.8k|        std::vector<uint8_t> buffer(MAX_BUFFER_SZ, uint8_t{'a'});
  101|  14.3M|        while (fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (101:16): [True: 14.3M, False: 52.8k]
  ------------------
  102|  14.3M|            CallOneOf(
  103|  14.3M|                fuzzed_data_provider,
  104|  14.3M|                [&] {
  105|       |                    // Insert byte vector directly to allow malformed or unparsable scripts
  106|  14.3M|                    r_script.insert(r_script.end(), buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ));
  107|  14.3M|                },
  108|  14.3M|                [&] {
  109|       |                    // Push a byte vector from the buffer
  110|  14.3M|                    r_script << std::vector<uint8_t>{buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ)};
  111|  14.3M|                },
  112|  14.3M|                [&] {
  113|       |                    // Push multisig
  114|       |                    // There is a special case for this to aid the fuzz engine
  115|       |                    // navigate the highly structured multisig format.
  116|  14.3M|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  117|  14.3M|                    int num_data{fuzzed_data_provider.ConsumeIntegralInRange(1, 22)};
  118|  14.3M|                    while (num_data--) {
  119|  14.3M|                        auto pubkey_bytes{ConstructPubKeyBytes(fuzzed_data_provider, buffer, fuzzed_data_provider.ConsumeBool())};
  120|  14.3M|                        if (fuzzed_data_provider.ConsumeBool()) {
  121|  14.3M|                            pubkey_bytes.back() = num_data; // Make each pubkey different
  122|  14.3M|                        }
  123|  14.3M|                        r_script << pubkey_bytes;
  124|  14.3M|                    }
  125|  14.3M|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  126|  14.3M|                },
  127|  14.3M|                [&] {
  128|       |                    // Mutate the buffer
  129|  14.3M|                    const auto vec{ConsumeRandomLengthByteVector(fuzzed_data_provider, /*max_length=*/MAX_BUFFER_SZ)};
  130|  14.3M|                    std::copy(vec.begin(), vec.end(), buffer.begin());
  131|  14.3M|                },
  132|  14.3M|                [&] {
  133|       |                    // Push an integral
  134|  14.3M|                    r_script << fuzzed_data_provider.ConsumeIntegral<int64_t>();
  135|  14.3M|                },
  136|  14.3M|                [&] {
  137|       |                    // Push an opcode
  138|  14.3M|                    r_script << ConsumeOpcodeType(fuzzed_data_provider);
  139|  14.3M|                },
  140|  14.3M|                [&] {
  141|       |                    // Push a scriptnum
  142|  14.3M|                    r_script << ConsumeScriptNum(fuzzed_data_provider);
  143|  14.3M|                });
  144|  14.3M|        }
  145|  52.8k|    }
  146|  52.8k|    if (maybe_p2wsh && fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (146:9): [True: 0, False: 52.8k]
  |  Branch (146:24): [True: 0, False: 0]
  ------------------
  147|      0|        uint256 script_hash;
  148|      0|        CSHA256().Write(r_script.data(), r_script.size()).Finalize(script_hash.begin());
  149|      0|        r_script.clear();
  150|      0|        r_script << OP_0 << ToByteVector(script_hash);
  151|      0|    }
  152|  52.8k|    return r_script;
  153|  52.8k|}
_Z12ConsumeCoinsR18FuzzedDataProvider:
  167|  7.72k|{
  168|  7.72k|    std::map<COutPoint, Coin> coins;
  169|  12.7k|    LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 10000) {
  ------------------
  |  |   23|  19.4k|    for (unsigned _count{limit}; (condition) && _count; --_count)
  |  |  ------------------
  |  |  |  Branch (23:34): [True: 12.7k, False: 6.74k]
  |  |  |  Branch (23:49): [True: 12.7k, False: 0]
  |  |  ------------------
  ------------------
  170|  12.7k|        const std::optional<COutPoint> outpoint{ConsumeDeserializable<COutPoint>(fuzzed_data_provider)};
  171|  12.7k|        if (!outpoint) {
  ------------------
  |  Branch (171:13): [True: 624, False: 12.1k]
  ------------------
  172|    624|            break;
  173|    624|        }
  174|  12.1k|        const std::optional<Coin> coin{ConsumeDeserializable<Coin>(fuzzed_data_provider)};
  175|  12.1k|        if (!coin) {
  ------------------
  |  Branch (175:13): [True: 356, False: 11.7k]
  ------------------
  176|    356|            break;
  177|    356|        }
  178|  11.7k|        coins[*outpoint] = *coin;
  179|  11.7k|    }
  180|       |
  181|  7.72k|    return coins;
  182|  7.72k|}
_Z17ConsumePrivateKeyR18FuzzedDataProviderNSt3__18optionalIbEE:
  231|  12.0k|{
  232|  12.0k|    auto key_data = fuzzed_data_provider.ConsumeBytes<uint8_t>(32);
  233|  12.0k|    key_data.resize(32);
  234|  12.0k|    CKey key;
  235|  12.0k|    bool compressed_value = compressed ? *compressed : fuzzed_data_provider.ConsumeBool();
  ------------------
  |  Branch (235:29): [True: 0, False: 12.0k]
  ------------------
  236|  12.0k|    key.Set(key_data.begin(), key_data.end(), compressed_value);
  237|  12.0k|    return key;
  238|  12.0k|}
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_0clEv:
  104|  5.54M|                [&] {
  105|       |                    // Insert byte vector directly to allow malformed or unparsable scripts
  106|  5.54M|                    r_script.insert(r_script.end(), buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ));
  107|  5.54M|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_1clEv:
  108|  8.18M|                [&] {
  109|       |                    // Push a byte vector from the buffer
  110|  8.18M|                    r_script << std::vector<uint8_t>{buffer.begin(), buffer.begin() + fuzzed_data_provider.ConsumeIntegralInRange(0U, MAX_BUFFER_SZ)};
  111|  8.18M|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_2clEv:
  112|  8.28k|                [&] {
  113|       |                    // Push multisig
  114|       |                    // There is a special case for this to aid the fuzz engine
  115|       |                    // navigate the highly structured multisig format.
  116|  8.28k|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  117|  8.28k|                    int num_data{fuzzed_data_provider.ConsumeIntegralInRange(1, 22)};
  118|  82.4k|                    while (num_data--) {
  ------------------
  |  Branch (118:28): [True: 74.2k, False: 8.28k]
  ------------------
  119|  74.2k|                        auto pubkey_bytes{ConstructPubKeyBytes(fuzzed_data_provider, buffer, fuzzed_data_provider.ConsumeBool())};
  120|  74.2k|                        if (fuzzed_data_provider.ConsumeBool()) {
  ------------------
  |  Branch (120:29): [True: 67.7k, False: 6.49k]
  ------------------
  121|  67.7k|                            pubkey_bytes.back() = num_data; // Make each pubkey different
  122|  67.7k|                        }
  123|  74.2k|                        r_script << pubkey_bytes;
  124|  74.2k|                    }
  125|  8.28k|                    r_script << fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(0, 22);
  126|  8.28k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_3clEv:
  127|  13.4k|                [&] {
  128|       |                    // Mutate the buffer
  129|  13.4k|                    const auto vec{ConsumeRandomLengthByteVector(fuzzed_data_provider, /*max_length=*/MAX_BUFFER_SZ)};
  130|  13.4k|                    std::copy(vec.begin(), vec.end(), buffer.begin());
  131|  13.4k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_4clEv:
  132|  58.1k|                [&] {
  133|       |                    // Push an integral
  134|  58.1k|                    r_script << fuzzed_data_provider.ConsumeIntegral<int64_t>();
  135|  58.1k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_5clEv:
  136|   498k|                [&] {
  137|       |                    // Push an opcode
  138|   498k|                    r_script << ConsumeOpcodeType(fuzzed_data_provider);
  139|   498k|                },
util.cpp:_ZZ13ConsumeScriptR18FuzzedDataProviderbENK3$_6clEv:
  140|  15.8k|                [&] {
  141|       |                    // Push a scriptnum
  142|  15.8k|                    r_script << ConsumeScriptNum(fuzzed_data_provider);
  143|  15.8k|                });

_Z17ConsumeDataStreamR18FuzzedDataProviderRKNSt3__18optionalImEE:
   75|  12.0k|{
   76|  12.0k|    return DataStream{ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length)};
   77|  12.0k|}
_Z21ConsumeDeserializableI13KeyOriginInfoENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  121|  16.9k|{
  122|  16.9k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  123|  16.9k|    SpanReader ds{buffer};
  124|  16.9k|    T obj;
  125|  16.9k|    try {
  126|  16.9k|        ds >> obj;
  127|  16.9k|    } catch (const std::ios_base::failure&) {
  128|    610|        return std::nullopt;
  129|    610|    }
  130|  16.3k|    return obj;
  131|  16.9k|}
_Z21ConsumeDeserializableI6CTxOutENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  121|  12.0k|{
  122|  12.0k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  123|  12.0k|    SpanReader ds{buffer};
  124|  12.0k|    T obj;
  125|  12.0k|    try {
  126|  12.0k|        ds >> obj;
  127|  12.0k|    } catch (const std::ios_base::failure&) {
  128|  9.31k|        return std::nullopt;
  129|  9.31k|    }
  130|  2.75k|    return obj;
  131|  12.0k|}
_Z21ConsumeDeserializableI19CMutableTransaction20TransactionSerParamsENSt3__18optionalIT_EER18FuzzedDataProviderRKT0_RKNS3_ImEE:
  107|  19.8k|{
  108|  19.8k|    const std::vector<uint8_t> buffer{ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length)};
  109|  19.8k|    SpanReader ds{buffer};
  110|  19.8k|    T obj;
  111|  19.8k|    try {
  112|  19.8k|        ds >> params(obj);
  113|  19.8k|    } catch (const std::ios_base::failure&) {
  114|  7.17k|        return std::nullopt;
  115|  7.17k|    }
  116|  12.6k|    return obj;
  117|  19.8k|}
_Z21ConsumeDeserializableI7CPubKeyENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  121|  19.5k|{
  122|  19.5k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  123|  19.5k|    SpanReader ds{buffer};
  124|  19.5k|    T obj;
  125|  19.5k|    try {
  126|  19.5k|        ds >> obj;
  127|  19.5k|    } catch (const std::ios_base::failure&) {
  128|  2.56k|        return std::nullopt;
  129|  2.56k|    }
  130|  16.9k|    return obj;
  131|  19.5k|}
_Z17ConsumeOpcodeTypeR18FuzzedDataProvider:
  155|   498k|{
  156|   498k|    return static_cast<opcodetype>(fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, MAX_OPCODE));
  157|   498k|}
_Z16ConsumeScriptNumR18FuzzedDataProvider:
  182|  15.8k|{
  183|  15.8k|    return CScriptNum{fuzzed_data_provider.ConsumeIntegral<int64_t>()};
  184|  15.8k|}
_Z14ConsumeUInt160R18FuzzedDataProvider:
  187|    149|{
  188|    149|    const std::vector<uint8_t> v160 = fuzzed_data_provider.ConsumeBytes<uint8_t>(160 / 8);
  189|    149|    if (v160.size() != 160 / 8) {
  ------------------
  |  Branch (189:9): [True: 108, False: 41]
  ------------------
  190|    108|        return {};
  191|    108|    }
  192|     41|    return uint160{v160};
  193|    149|}
_Z29ConsumeRandomLengthByteVectorIhENSt3__16vectorIT_NS0_9allocatorIS2_EEEER18FuzzedDataProviderRKNS0_8optionalImEE:
   64|   130k|{
   65|   130k|    static_assert(sizeof(B) == 1);
   66|   130k|    const std::string s = max_length ?
  ------------------
  |  Branch (66:27): [True: 25.5k, False: 105k]
  ------------------
   67|  25.5k|                              fuzzed_data_provider.ConsumeRandomLengthString(*max_length) :
   68|   130k|                              fuzzed_data_provider.ConsumeRandomLengthString();
   69|   130k|    std::vector<B> ret(s.size());
   70|   130k|    std::copy(s.begin(), s.end(), reinterpret_cast<char*>(ret.data()));
   71|   130k|    return ret;
   72|   130k|}
util.cpp:_Z9CallOneOfIJZ13ConsumeScriptR18FuzzedDataProviderbE3$_0Z13ConsumeScriptS1_bE3$_1Z13ConsumeScriptS1_bE3$_2Z13ConsumeScriptS1_bE3$_3Z13ConsumeScriptS1_bE3$_4Z13ConsumeScriptS1_bE3$_5Z13ConsumeScriptS1_bE3$_6EEmS1_DpT_:
   38|  14.3M|{
   39|  14.3M|    constexpr size_t call_size{sizeof...(callables)};
   40|  14.3M|    static_assert(call_size >= 1);
   41|  14.3M|    const size_t call_index{fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, call_size - 1)};
   42|       |
   43|  14.3M|    size_t i{0};
   44|   100M|    ((i++ == call_index ? callables() : void()), ...);
  ------------------
  |  Branch (44:7): [True: 5.54M, False: 8.77M]
  |  Branch (44:7): [True: 8.18M, False: 6.13M]
  |  Branch (44:7): [True: 8.28k, False: 14.3M]
  |  Branch (44:7): [True: 13.4k, False: 14.3M]
  |  Branch (44:7): [True: 58.1k, False: 14.2M]
  |  Branch (44:7): [True: 498k, False: 13.8M]
  |  Branch (44:7): [True: 15.8k, False: 14.3M]
  ------------------
   45|  14.3M|    return call_size;
   46|  14.3M|}
_Z21ConsumeDeserializableI9COutPointENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  121|  12.7k|{
  122|  12.7k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  123|  12.7k|    SpanReader ds{buffer};
  124|  12.7k|    T obj;
  125|  12.7k|    try {
  126|  12.7k|        ds >> obj;
  127|  12.7k|    } catch (const std::ios_base::failure&) {
  128|    624|        return std::nullopt;
  129|    624|    }
  130|  12.1k|    return obj;
  131|  12.7k|}
_Z21ConsumeDeserializableI4CoinENSt3__18optionalIT_EER18FuzzedDataProviderRKNS2_ImEE:
  121|  12.1k|{
  122|  12.1k|    const std::vector<uint8_t> buffer = ConsumeRandomLengthByteVector(fuzzed_data_provider, max_length);
  123|  12.1k|    SpanReader ds{buffer};
  124|  12.1k|    T obj;
  125|  12.1k|    try {
  126|  12.1k|        ds >> obj;
  127|  12.1k|    } catch (const std::ios_base::failure&) {
  128|    356|        return std::nullopt;
  129|    356|    }
  130|  11.7k|    return obj;
  131|  12.1k|}

_ZN12CheckGlobalsC2Ev:
   59|  12.0k|CheckGlobals::CheckGlobals() : m_impl(std::make_unique<CheckGlobalsImpl>()) {}
_ZN12CheckGlobalsD2Ev:
   60|  12.0k|CheckGlobals::~CheckGlobals() = default;
_ZN16CheckGlobalsImplC2Ev:
   17|  12.0k|    {
   18|  12.0k|        g_used_g_prng = false;
   19|  12.0k|        g_seeded_g_prng_zero = false;
   20|  12.0k|        g_used_system_time = false;
   21|  12.0k|        SetMockTime(0s);
   22|  12.0k|        MockableSteadyClock::ClearMockTime();
   23|  12.0k|    }
_ZN16CheckGlobalsImplD2Ev:
   25|  12.0k|    {
   26|  12.0k|        if (g_used_g_prng && !g_seeded_g_prng_zero) {
  ------------------
  |  Branch (26:13): [True: 2, False: 12.0k]
  |  Branch (26:30): [True: 0, False: 2]
  ------------------
   27|      0|            std::cerr << "\n\n"
   28|      0|                         "The current fuzz target used the global random state.\n\n"
   29|       |
   30|      0|                         "This is acceptable, but requires the fuzz target to call \n"
   31|      0|                         "SeedRandomStateForTest(SeedRand::ZEROS) in the first line \n"
   32|      0|                         "of the FUZZ_TARGET function.\n\n"
   33|       |
   34|      0|                         "An alternative solution would be to avoid any use of globals.\n\n"
   35|       |
   36|      0|                         "Without a solution, fuzz instability and non-determinism can lead \n"
   37|      0|                         "to non-reproducible bugs or inefficient fuzzing.\n\n"
   38|      0|                      << std::endl;
   39|      0|            std::abort(); // Abort, because AFL may try to recover from a std::exit
   40|      0|        }
   41|       |
   42|  12.0k|        if (g_used_system_time) {
  ------------------
  |  Branch (42:13): [True: 0, False: 12.0k]
  ------------------
   43|      0|            std::cerr << "\n\n"
   44|      0|                         "The current fuzz target accessed system time.\n\n"
   45|       |
   46|      0|                         "This is acceptable, but requires the fuzz target to use \n"
   47|      0|                         "a FakeNodeClock, FakeSteadyClock or call \n"
   48|      0|                         "SetMockTime() at the \n" "beginning of processing the \n"
   49|      0|                         "fuzz input.\n\n"
   50|       |
   51|      0|                         "Without setting mock time, time-dependent behavior can lead \n"
   52|      0|                         "to non-reproducible bugs or inefficient fuzzing.\n\n"
   53|      0|                      << std::endl;
   54|      0|            std::abort();
   55|      0|        }
   56|  12.0k|    }

__gcov_reset:
   13|      2|extern "C" __attribute__((weak)) void __gcov_reset(void) {}

_Z13SignSignatureRK15SigningProviderRK7CScriptR19CMutableTransactionjRKliR13SignatureData:
   95|  1.22k|{
   96|  1.22k|    assert(nIn < txTo.vin.size());
  ------------------
  |  Branch (96:5): [True: 1.22k, False: 0]
  ------------------
   97|       |
   98|  1.22k|    MutableTransactionSignatureCreator creator(txTo, nIn, amount, {.sighash_type = nHashType});
   99|       |
  100|  1.22k|    bool ret = ProduceSignature(provider, creator, fromPubKey, sig_data);
  101|  1.22k|    UpdateInput(txTo.vin.at(nIn), sig_data);
  102|  1.22k|    return ret;
  103|  1.22k|}
_Z13SignSignatureRK15SigningProviderRK12CTransactionR19CMutableTransactionjiR13SignatureData:
  106|     20|{
  107|     20|    assert(nIn < txTo.vin.size());
  ------------------
  |  Branch (107:5): [True: 20, False: 0]
  ------------------
  108|     20|    const CTxIn& txin = txTo.vin[nIn];
  109|     20|    assert(txin.prevout.n < txFrom.vout.size());
  ------------------
  |  Branch (109:5): [True: 20, False: 0]
  ------------------
  110|     20|    const CTxOut& txout = txFrom.vout[txin.prevout.n];
  111|       |
  112|     20|    return SignSignature(provider, txout.scriptPubKey, txTo, nIn, txout.nValue, nHashType, sig_data);
  113|     20|}

_ZNK9base_blobILj160EE3endEv:
  105|  4.02k|    constexpr const unsigned char* end() const { return m_data.data() + WIDTH; }
_ZN9base_blobILj160EE5beginEv:
  101|  6.06k|    constexpr unsigned char* begin() { return m_data.data(); }
_ZNK9base_blobILj160EEeqERKS0_:
   62|  19.0k|    constexpr bool operator==(const base_blob&) const = default;
_ZN9base_blobILj256EE11UnserializeI12ParamsStreamIR10SpanReader20TransactionSerParamsEEEvRT_:
  119|   309k|    {
  120|   309k|        s.read(MakeWritableByteSpan(m_data));
  121|   309k|    }
_ZN7uint160C2ENSt3__14spanIKhLm18446744073709551615EEE:
  188|  45.8k|    constexpr explicit uint160(std::span<const unsigned char> vch) : base_blob<160>(vch) {}
_ZN9base_blobILj160EEC2ENSt3__14spanIKhLm18446744073709551615EEE:
   43|  45.8k|    {
   44|  45.8k|        assert(vch.size() == WIDTH);
  ------------------
  |  Branch (44:9): [True: 45.8k, False: 0]
  ------------------
   45|  45.8k|        std::copy(vch.begin(), vch.end(), m_data.begin());
   46|  45.8k|    }
_ZNK9base_blobILj160EEssERKS0_:
   68|   275k|    constexpr std::strong_ordering operator<=>(const base_blob& other) const = default;
_ZN9base_blobILj256EE11UnserializeI10SpanReaderEEvRT_:
  119|  12.7k|    {
  120|  12.7k|        s.read(MakeWritableByteSpan(m_data));
  121|  12.7k|    }
_ZNK9base_blobILj256EEssERKS0_:
   68|   362k|    constexpr std::strong_ordering operator<=>(const base_blob& other) const = default;
_ZNK9base_blobILj256EE9SerializeI12ParamsStreamIR10HashWriter20TransactionSerParamsEEEvRT_:
  113|   165k|    {
  114|   165k|        s << std::span(m_data);
  115|   165k|    }
_ZNK9base_blobILj256EE5beginEv:
  104|   193k|    constexpr const unsigned char* begin() const { return m_data.data(); }
_ZNK9base_blobILj256EE3endEv:
  105|  24.3k|    constexpr const unsigned char* end() const { return m_data.data() + WIDTH; }
_ZNK9base_blobILj160EE5beginEv:
  104|  4.02k|    constexpr const unsigned char* begin() const { return m_data.data(); }
_ZN7uint256C2ENSt3__14spanIKhLm18446744073709551615EEE:
  203|  13.9k|    constexpr explicit uint256(std::span<const unsigned char> vch) : base_blob<256>(vch) {}
_ZN9base_blobILj256EEC2ENSt3__14spanIKhLm18446744073709551615EEE:
   43|  13.9k|    {
   44|  13.9k|        assert(vch.size() == WIDTH);
  ------------------
  |  Branch (44:9): [True: 13.9k, False: 0]
  ------------------
   45|  13.9k|        std::copy(vch.begin(), vch.end(), m_data.begin());
   46|  13.9k|    }
_ZN9base_blobILj256EE4dataEv:
   99|  1.74k|    constexpr unsigned char* data() { return m_data.data(); }
_ZNK9base_blobILj256EE9SerializeI10HashWriterEEvRT_:
  113|  6.96M|    {
  114|  6.96M|        s << std::span(m_data);
  115|  6.96M|    }
_ZN7uint160C2Ev:
  187|   280k|    constexpr uint160() = default;
_ZN9base_blobILj160EEC2Ev:
   37|   280k|    constexpr base_blob() : m_data() {}
_ZN9base_blobILj160EE4dataEv:
   99|   129k|    constexpr unsigned char* data() { return m_data.data(); }
_ZN9base_blobILj160EE4sizeEv:
  107|   129k|    static constexpr unsigned int size() { return WIDTH; }
_ZN7uint256C2Ev:
  200|  2.16M|    constexpr uint256() = default;
_ZN9base_blobILj256EEC2Ev:
   37|  2.16M|    constexpr base_blob() : m_data() {}
_ZN9base_blobILj256EE5beginEv:
  101|   346k|    constexpr unsigned char* begin() { return m_data.data(); }
_ZNK9base_blobILj256EE4dataEv:
   98|    315|    constexpr const unsigned char* data() const { return m_data.data(); }
_ZN9base_blobILj256EE4sizeEv:
  107|  3.10k|    static constexpr unsigned int size() { return WIDTH; }

_ZN10btcsignals6signalIFvvENS_10null_valueEED2Ev:
  175|      6|    ~signal() = default;
_ZN10btcsignals6signalIFv20SynchronizationStatellbENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFv20SynchronizationStateRK11CBlockIndexdENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvRKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEibENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvbENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFviENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvRKNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFbRK13bilingual_strRKNSt3__112basic_stringIcNS4_11char_traitsIcEENS4_9allocatorIcEEEEjENS_6any_ofEED2Ev:
  175|      2|    ~signal() = default;
_ZN10btcsignals6signalIFvRK13bilingual_strjENS_10null_valueEED2Ev:
  175|      2|    ~signal() = default;

_Z22inline_assertion_checkILb1ERPKNSt3__18functionIFvNS0_4spanIKhLm18446744073709551615EEEEEEEOT0_SB_RKNS0_15source_locationENS0_17basic_string_viewIcNS0_11char_traitsIcEEEE:
   90|  12.0k|{
   91|  12.0k|    if (IS_ASSERT || std::is_constant_evaluated() || G_ABORT_ON_FAILED_ASSUME) {
  ------------------
  |  Branch (91:9): [True: 12.0k, Folded]
  |  Branch (91:22): [Folded, False: 0]
  |  Branch (91:54): [True: 0, Folded]
  ------------------
   92|  12.0k|        if (!val) {
  ------------------
  |  Branch (92:13): [True: 0, False: 12.0k]
  ------------------
   93|      0|            assertion_fail(loc, assertion);
   94|      0|        }
   95|  12.0k|    }
   96|  12.0k|    return std::forward<T>(val);
   97|  12.0k|}
_Z22inline_check_non_fatalIbEOT_S1_RKNSt3__115source_locationENS2_17basic_string_viewIcNS2_11char_traitsIcEEEE:
   73|  22.3k|{
   74|  22.3k|    if (!val) {
  ------------------
  |  Branch (74:9): [True: 0, False: 22.3k]
  ------------------
   75|      0|        if constexpr (G_ABORT_ON_FAILED_ASSUME) {
   76|      0|            assertion_fail(loc, assertion);
   77|      0|        }
   78|      0|        throw NonFatalCheckError{assertion, loc};
   79|      0|    }
   80|  22.3k|    return std::forward<T>(val);
   81|  22.3k|}
_Z22inline_assertion_checkILb1EbEOT0_S1_RKNSt3__115source_locationENS2_17basic_string_viewIcNS2_11char_traitsIcEEEE:
   90|  24.2k|{
   91|  24.2k|    if (IS_ASSERT || std::is_constant_evaluated() || G_ABORT_ON_FAILED_ASSUME) {
  ------------------
  |  Branch (91:9): [True: 24.2k, Folded]
  |  Branch (91:22): [Folded, False: 0]
  |  Branch (91:54): [True: 0, Folded]
  ------------------
   92|  24.2k|        if (!val) {
  ------------------
  |  Branch (92:13): [True: 0, False: 24.2k]
  ------------------
   93|      0|            assertion_fail(loc, assertion);
   94|      0|        }
   95|  24.2k|    }
   96|  24.2k|    return std::forward<T>(val);
   97|  24.2k|}
_Z22inline_assertion_checkILb0EbEOT0_S1_RKNSt3__115source_locationENS2_17basic_string_viewIcNS2_11char_traitsIcEEEE:
   90|     10|{
   91|     10|    if (IS_ASSERT || std::is_constant_evaluated() || G_ABORT_ON_FAILED_ASSUME) {
  ------------------
  |  Branch (91:9): [Folded, False: 0]
  |  Branch (91:22): [Folded, False: 0]
  |  Branch (91:54): [True: 0, Folded]
  ------------------
   92|     10|        if (!val) {
  ------------------
  |  Branch (92:13): [True: 0, False: 10]
  ------------------
   93|      0|            assertion_fail(loc, assertion);
   94|      0|        }
   95|     10|    }
   96|     10|    return std::forward<T>(val);
   97|     10|}

_ZNK8BaseHashI7uint160E5beginEv:
   24|  4.02k|    {
   25|  4.02k|        return m_hash.begin();
   26|  4.02k|    }
_ZNK8BaseHashI7uint160E3endEv:
   34|  4.02k|    {
   35|  4.02k|        return m_hash.end();
   36|  4.02k|    }
_ZNK8BaseHashI7uint160EeqERKS1_:
   49|  19.0k|    {
   50|  19.0k|        return m_hash == other.m_hash;
   51|  19.0k|    }
_ZNK8BaseHashI7uint160EltERKS1_:
   54|  20.3k|    {
   55|  20.3k|        return m_hash < other.m_hash;
   56|  20.3k|    }
_ZN8BaseHashI7uint160EC2ERKS0_:
   16|  44.2k|    explicit BaseHash(const HashType& in) : m_hash(in) {}

_Z10CheckedAddImENSt3__18optionalIT_EES2_S2_:
   28|  1.71M|{
   29|  1.71M|    if (AdditionOverflow(i, j)) {
  ------------------
  |  Branch (29:9): [True: 0, False: 1.71M]
  ------------------
   30|      0|        return std::nullopt;
   31|      0|    }
   32|  1.71M|    return i + j;
   33|  1.71M|}
_Z16AdditionOverflowITkNSt3__18integralEmEbT_S1_:
   18|  1.71M|{
   19|       |    if constexpr (std::numeric_limits<T>::is_signed) {
   20|       |        return (i > 0 && j > std::numeric_limits<T>::max() - i) ||
   21|       |               (i < 0 && j < std::numeric_limits<T>::min() - i);
   22|       |    }
   23|  1.71M|    return std::numeric_limits<T>::max() - i < j;
   24|  1.71M|}

_ZN16CThreadInterruptD2Ev:
   32|      4|    virtual ~CThreadInterrupt() = default;

_ZN10ThreadPoolD2Ev:
   93|     10|    {
   94|     10|        Stop(); // In case it hasn't been stopped.
   95|     10|    }
_ZN10ThreadPool4StopEv:
  129|     10|    {
  130|       |        // Notify workers and join them
  131|     10|        std::vector<std::thread> threads_to_join;
  132|     10|        {
  133|     10|            LOCK(m_mutex);
  ------------------
  |  |  268|     10|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|     10|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|     10|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|     10|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  134|       |            // Ensure Stop() is not called from a worker thread while workers are still registered,
  135|       |            // otherwise a self-join deadlock would occur.
  136|     10|            auto id = std::this_thread::get_id();
  137|     10|            for (const auto& worker : m_workers) assert(worker.get_id() != id);
  ------------------
  |  Branch (137:37): [True: 0, False: 10]
  |  Branch (137:50): [True: 0, False: 0]
  ------------------
  138|       |            // Early shutdown to return right away on any concurrent Submit() call
  139|     10|            m_interrupt = true;
  140|     10|            threads_to_join.swap(m_workers);
  141|     10|        }
  142|      0|        m_cv.notify_all();
  143|       |        // Help draining queue
  144|     10|        while (ProcessTask()) {}
  ------------------
  |  Branch (144:16): [True: 0, False: 10]
  ------------------
  145|       |        // Free resources
  146|     10|        for (auto& worker : threads_to_join) worker.join();
  ------------------
  |  Branch (146:27): [True: 0, False: 10]
  ------------------
  147|       |
  148|       |        // Since we currently wait for tasks completion, sanity-check empty queue
  149|     10|        LOCK(m_mutex);
  ------------------
  |  |  268|     10|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|     10|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|     10|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|     10|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  150|     10|        Assume(m_work_queue.empty());
  ------------------
  |  |  128|     10|#define Assume(val) inline_assertion_check<false>(val, std::source_location::current(), #val)
  ------------------
  151|       |        // Re-allow Start() now that all workers have exited
  152|     10|        m_interrupt = false;
  153|     10|    }
_ZN10ThreadPool11ProcessTaskEv:
  244|     10|    {
  245|     10|        std::packaged_task<void()> task;
  246|     10|        {
  247|     10|            LOCK(m_mutex);
  ------------------
  |  |  268|     10|#define LOCK(cs) UniqueLock BITCOIN_UNIQUE_NAME(criticalblock)(MaybeCheckNotHeld(cs), #cs, __FILE__, __LINE__)
  |  |  ------------------
  |  |  |  |   11|     10|#define BITCOIN_UNIQUE_NAME(name) PASTE2(name, __COUNTER__)
  |  |  |  |  ------------------
  |  |  |  |  |  |    9|     10|#define PASTE2(x, y) PASTE(x, y)
  |  |  |  |  |  |  ------------------
  |  |  |  |  |  |  |  |    8|     10|#define PASTE(x, y) x ## y
  |  |  |  |  |  |  ------------------
  |  |  |  |  ------------------
  |  |  ------------------
  ------------------
  248|     10|            if (m_work_queue.empty()) return false;
  ------------------
  |  Branch (248:17): [True: 10, False: 0]
  ------------------
  249|       |
  250|       |            // Pop the task
  251|      0|            task = std::move(m_work_queue.front());
  252|      0|            m_work_queue.pop();
  253|      0|        }
  254|      0|        task();
  255|      0|        return true;
  256|     10|    }

_Z11SetMockTimeNSt3__16chrono8durationIxNS_5ratioILl1ELl1EEEEE:
   54|  12.0k|{
   55|  12.0k|    Assert(mock_time_in >= 0s);
  ------------------
  |  |  116|  12.0k|#define Assert(val) inline_assertion_check<true>(val, std::source_location::current(), #val)
  ------------------
   56|  12.0k|    g_mock_time.store(mock_time_in, std::memory_order_relaxed);
   57|  12.0k|}
_ZN19MockableSteadyClock13ClearMockTimeEv:
   84|  12.0k|{
   85|  12.0k|    g_mock_steady_time.store(0ms, std::memory_order_relaxed);
   86|  12.0k|}

_ZNK4util17TranslatedLiteralcv13bilingual_strEv:
   61|  48.4k|    operator bilingual_str() const { return {original, std::string{*this}}; }
_ZNK4util17TranslatedLiteralcvNSt3__112basic_stringIcNS1_11char_traitsIcEENS1_9allocatorIcEEEEEv:
   60|  48.4k|    operator std::string() const { return translate_fn && *translate_fn ? (*translate_fn)(original) : original; }
  ------------------
  |  Branch (60:43): [True: 48.4k, False: 0]
  |  Branch (60:59): [True: 0, False: 48.4k]
  ------------------
_Z12UntranslatedNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE:
   82|  87.6k|inline bilingual_str Untranslated(std::string original) { return {original, original}; }

_Z6VectorIJRNSt3__16vectorIhNS0_9allocatorIhEEEEEENS1_INS0_11common_typeIJDpT_EE4typeENS2_ISA_EEEEDpOS7_:
   24|     20|{
   25|     20|    std::vector<std::common_type_t<Args...>> ret;
   26|     20|    ret.reserve(sizeof...(args));
   27|       |    // The line below uses the trick from https://www.experts-exchange.com/articles/32502/None-recursive-variadic-templates-with-std-initializer-list.html
   28|     20|    (void)std::initializer_list<int>{(ret.emplace_back(std::forward<Args>(args)), 0)...};
   29|     20|    return ret;
   30|     20|}
_Z6VectorIJN10miniscript4NodeI7CPubKeyEEEENSt3__16vectorINS4_11common_typeIJDpT_EE4typeENS4_9allocatorISA_EEEEDpOS7_:
   24|      2|{
   25|      2|    std::vector<std::common_type_t<Args...>> ret;
   26|      2|    ret.reserve(sizeof...(args));
   27|       |    // The line below uses the trick from https://www.experts-exchange.com/articles/32502/None-recursive-variadic-templates-with-std-initializer-list.html
   28|      2|    (void)std::initializer_list<int>{(ret.emplace_back(std::forward<Args>(args)), 0)...};
   29|      2|    return ret;
   30|      2|}
_Z6VectorIJN10miniscript4NodeI7CPubKeyEES3_EENSt3__16vectorINS4_11common_typeIJDpT_EE4typeENS4_9allocatorISA_EEEEDpOS7_:
   24|     23|{
   25|     23|    std::vector<std::common_type_t<Args...>> ret;
   26|     23|    ret.reserve(sizeof...(args));
   27|       |    // The line below uses the trick from https://www.experts-exchange.com/articles/32502/None-recursive-variadic-templates-with-std-initializer-list.html
   28|     23|    (void)std::initializer_list<int>{(ret.emplace_back(std::forward<Args>(args)), 0)...};
   29|     23|    return ret;
   30|     23|}

_ZN19WalletInitInterfaceD2Ev:
   25|      2|    virtual ~WalletInitInterface() = default;