From 88d8e616784c18789ab28e5af09064633397a330 Mon Sep 17 00:00:00 2001
From: Yiming Xiang <yiming@cs.utexas.edu>
Date: Sat, 27 Jun 2026 00:45:20 +0000
Subject: [PATCH 1/4] fix: liveness bug

---
 core-rs/epass-ir/src/cg/liveness.rs |  12 ++++
 core-rs/epasstool/tests/falco.rs    | 103 ++++++++++++++++++++++++++++
 2 files changed, 115 insertions(+)
 create mode 100644 core-rs/epasstool/tests/falco.rs

diff --git a/core-rs/epass-ir/src/cg/liveness.rs b/core-rs/epass-ir/src/cg/liveness.rs
index 146452e..d335e7b 100644
--- a/core-rs/epass-ir/src/cg/liveness.rs
+++ b/core-rs/epass-ir/src/cg/liveness.rs
@@ -67,6 +67,12 @@ pub fn analyze(env: &mut Env, func: &mut Function, cg: &mut CgState) -> Result<(
         let users = func.insn(v).users.clone();
         let mut visited: HashSet<BbId> = HashSet::new();
         for s in users {
+            if !cg.extra.contains_key(&s) {
+                // Def-use chains can still contain users in unreachable blocks.
+                // CG metadata is allocated only for reachable instructions, so
+                // these uses are irrelevant to register allocation.
+                continue;
+            }
             if matches!(func.insn(s).kind, InsnKind::Phi) {
                 // For a phi user, liveness propagates from the predecessor block
                 // corresponding to each operand equal to `v`.
@@ -112,6 +118,9 @@ fn live_out_at_statement(
     s: InsnId,
     v: InsnId,
 ) {
+    if !cg.extra.contains_key(&s) {
+        return;
+    }
     push_unique(&mut cg.extra_mut(s).live_out, v);
     let dst = cg.extra(s).dst;
     match dst {
@@ -137,6 +146,9 @@ fn live_in_at_statement(
     s: InsnId,
     v: InsnId,
 ) {
+    if !cg.extra.contains_key(&s) {
+        return;
+    }
     push_unique(&mut cg.extra_mut(s).live_in, v);
     match func.prev_insn(s) {
         None => {
diff --git a/core-rs/epasstool/tests/falco.rs b/core-rs/epasstool/tests/falco.rs
new file mode 100644
index 0000000..eae1c5f
--- /dev/null
+++ b/core-rs/epasstool/tests/falco.rs
@@ -0,0 +1,103 @@
+use std::collections::HashSet;
+use std::path::PathBuf;
+use std::process::Command;
+
+const KNOWN_FALCO_FAILURES: &[&str] = &[
+    // libbpf poison/dummy path leaves a dead def in these large programs
+    "prog195.txt",
+    "prog198.txt",
+    // RA post-spill fallback currently hits convergence cap / repeated pre-spills
+    "prog280.txt",
+    "prog286.txt",
+];
+
+fn have_timeout() -> bool {
+    Command::new("sh")
+        .arg("-c")
+        .arg("command -v timeout >/dev/null 2>&1")
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+#[test]
+fn falco_dump_corpus_rewrites_except_known_failures() {
+    let manifest = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let falco = manifest.parent().unwrap().join("bpftests/falco");
+    if !falco.exists() {
+        eprintln!("skipping falco tests: {} does not exist", falco.display());
+        return;
+    }
+
+    let mut files: Vec<_> = std::fs::read_dir(&falco)
+        .expect("read falco dir")
+        .filter_map(|e| e.ok().map(|e| e.path()))
+        .filter(|p| p.extension().and_then(|s| s.to_str()) == Some("txt"))
+        .collect();
+    files.sort();
+
+    if files.is_empty() {
+        eprintln!("skipping falco tests: no .txt programs in {}", falco.display());
+        return;
+    }
+
+    let known: HashSet<&str> = KNOWN_FALCO_FAILURES.iter().copied().collect();
+    let epasstool = env!("CARGO_BIN_EXE_epasstool");
+    let out = std::env::temp_dir().join(format!("epass-falco-{}.dump", std::process::id()));
+    let use_timeout = have_timeout();
+
+    let mut passed = 0usize;
+    let mut known_failed = 0usize;
+    let mut unexpected = Vec::new();
+
+    for file in files {
+        let name = file.file_name().unwrap().to_string_lossy().to_string();
+        let output = if use_timeout {
+            Command::new("timeout")
+                .arg("-k")
+                .arg("2")
+                .arg("10")
+                .arg(epasstool)
+                .arg("read")
+                .arg("-F")
+                .arg("log")
+                .arg("-o")
+                .arg(&out)
+                .arg(&file)
+                .output()
+                .expect("run epasstool with timeout")
+        } else {
+            Command::new(epasstool)
+                .arg("read")
+                .arg("-F")
+                .arg("log")
+                .arg("-o")
+                .arg(&out)
+                .arg(&file)
+                .output()
+                .expect("run epasstool")
+        };
+        if output.status.success() {
+            passed += 1;
+        } else if known.contains(name.as_str()) {
+            known_failed += 1;
+        } else {
+            unexpected.push(format!(
+                "{}: rc={:?}\nstdout={}\nstderr={}",
+                name,
+                output.status.code(),
+                String::from_utf8_lossy(&output.stdout),
+                String::from_utf8_lossy(&output.stderr)
+            ));
+        }
+    }
+    let _ = std::fs::remove_file(&out);
+
+    eprintln!(
+        "falco corpus: passed={} known_failed={} unexpected_failed={}",
+        passed,
+        known_failed,
+        unexpected.len()
+    );
+    assert!(unexpected.is_empty(), "unexpected Falco failures:\n{}", unexpected.join("\n\n"));
+}

From aa6ee09ad66d8ed158af68a708f3b22a0e275e0f Mon Sep 17 00:00:00 2001
From: Yiming Xiang <yiming@cs.utexas.edu>
Date: Fri, 3 Jul 2026 01:26:28 +0000
Subject: [PATCH 2/4] fix: ra spill once

---
 core-rs/epass-ir/src/cg/alloc.rs  |  6 ++++++
 core-rs/epass-ir/tests/ir_text.rs | 24 ++++++++++++++++++++++++
 core-rs/epasstool/tests/falco.rs  |  5 +++--
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/core-rs/epass-ir/src/cg/alloc.rs b/core-rs/epass-ir/src/cg/alloc.rs
index f526c15..c917048 100644
--- a/core-rs/epass-ir/src/cg/alloc.rs
+++ b/core-rs/epass-ir/src/cg/alloc.rs
@@ -169,6 +169,9 @@ fn spill_one_use(
                 if entry.value == Value::Insn(v) {
                     let load = func.build_load_bb(entry.bb, alloc, InsertPos::BackBeforeJmp);
                     ensure_extra(cg, func, load);
+                    // This reload is a fragment of an already-spilled parent;
+                    // it must never be selected as a spill victim itself.
+                    cg.extra_mut(load).spilled_once = true;
                     // Update the phi operand.
                     func.remove_use(entry.value, user);
                     func.insn_mut(user).phi[idx].value = Value::Insn(load);
@@ -180,6 +183,9 @@ fn spill_one_use(
         _ => {
             let load = func.build_load_at(user, alloc, InsertPos::Front);
             ensure_extra(cg, func, load);
+            // This reload is a fragment of an already-spilled parent;
+            // it must never be selected as a spill victim itself.
+            cg.extra_mut(load).spilled_once = true;
             func.change_value(user, Value::Insn(v), Value::Insn(load));
             Ok(())
         }
diff --git a/core-rs/epass-ir/tests/ir_text.rs b/core-rs/epass-ir/tests/ir_text.rs
index 31e9cbf..06df0e1 100644
--- a/core-rs/epass-ir/tests/ir_text.rs
+++ b/core-rs/epass-ir/tests/ir_text.rs
@@ -32,3 +32,27 @@ fn load_ir_gopt_bypasses_lift_and_compiles() {
     autorun(&mut env2, &default_passes()).expect("autorun load_ir");
     assert_eq!(env2.insns.last().unwrap().code, class::JMP | op::EXIT);
 }
+
+#[test]
+fn ra_pressure_reload_spill_converges() {
+    // Load the EPIR test case that creates high register pressure at a use
+    // point.  Before the fix (reload temps not marked spilled_once), the RA
+    // allocator could recursively spill reload temps and fail to converge.
+    // We disable const_prop and optimize_ir so that loadimm values are not
+    // constant-folded away, preserving the high register pressure.
+    let path = concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/tests/epir/ra_pressure_reload_spill.epir"
+    );
+    let mut opts = Opts::default();
+    opts.verbose = 3;
+    opts.apply_gopt(&format!("load_ir={}", path)).unwrap();
+    let mut env = Env::new(opts, vec![]);
+    let passes = epass_ir::passes_from_popt("!const_prop,!optimize_ir").unwrap();
+    let result = autorun(&mut env, &passes);
+    result.expect("RA should converge");
+    eprintln!("produced {} instructions", env.insns.len());
+    assert!(!env.insns.is_empty(), "should produce output instructions");
+    let last = env.insns.last().unwrap();
+    eprintln!("last insn: code={:#04x}", last.code);
+}
diff --git a/core-rs/epasstool/tests/falco.rs b/core-rs/epasstool/tests/falco.rs
index eae1c5f..976a441 100644
--- a/core-rs/epasstool/tests/falco.rs
+++ b/core-rs/epasstool/tests/falco.rs
@@ -6,8 +6,9 @@ const KNOWN_FALCO_FAILURES: &[&str] = &[
     // libbpf poison/dummy path leaves a dead def in these large programs
     "prog195.txt",
     "prog198.txt",
-    // RA post-spill fallback currently hits convergence cap / repeated pre-spills
-    "prog280.txt",
+    // prog286: after spilling 18 values, the remaining oversized clique
+    // consists entirely of reload temps (protected from re-spilling).
+    // This means the program genuinely needs >10 registers at some point.
     "prog286.txt",
 ];
 

From 9c5e39e4ced48d87349a0c7598f4be80aa1f562e Mon Sep 17 00:00:00 2001
From: Yiming Xiang <yiming@cs.utexas.edu>
Date: Wed, 8 Jul 2026 01:51:40 +0000
Subject: [PATCH 3/4] fix: ra split error

---
 .gitignore                                    |   1 -
 core-rs/epass-ir/src/cg/alloc.rs              |  28 +-
 ...luation_compile_speed_speed_100__prog.epir | 582 ++++++++++++++++++
 ...luation_compile_speed_speed_120__prog.epir | 294 +++++++++
 ...aluation_compile_speed_speed_20__prog.epir |  48 ++
 ...aluation_compile_speed_speed_30__prog.epir | 127 ++++
 ...aluation_compile_speed_speed_50__prog.epir | 305 +++++++++
 ...aluation_compile_speed_speed_70__prog.epir | 550 +++++++++++++++++
 .../evaluation_counter_complex2__prog.epir    |  40 ++
 .../evaluation_counter_complex__prog.epir     | 110 ++++
 .../epir/evaluation_counter_loop1__prog.epir  | 114 ++++
 .../evaluation_counter_loop1med__prog.epir    |  44 ++
 .../evaluation_counter_loop1sim__prog.epir    |  44 ++
 .../epir/evaluation_counter_loop2__prog.epir  |  16 +
 .../epir/evaluation_counter_loop3__prog.epir  |  28 +
 .../epir/evaluation_counter_loop4__prog.epir  |  22 +
 .../evaluation_counter_loopnested__prog.epir  |  17 +
 .../evaluation_counter_loopwithif__prog.epir  |  41 ++
 ...n_div_by_zero_div_by_zero2__handle_tp.epir |  14 +
 ...on_div_by_zero_div_by_zero__handle_tp.epir |   5 +
 ...g_map_val_accepted__handle_tracepoint.epir |  65 ++
 ...g_map_val_rejected__handle_tracepoint.epir |  64 ++
 .../epir/evaluation_masking_mask__prog.epir   |  23 +
 .../evaluation_masking_masksimple__prog.epir  |   7 +
 .../epir/evaluation_msan_msan1__prog.epir     |  10 +
 .../epir/evaluation_msan_msan2__prog.epir     |  17 +
 .../epir/evaluation_msan_msan3__prog.epir     |  20 +
 .../epir/evaluation_msan_simpl1__prog.epir    |   9 +
 .../epir/evaluation_msan_simpl2__prog.epir    |   5 +
 .../epir/evaluation_msan_simpl3__prog.epir    |   5 +
 core-rs/epass-ir/tests/epir/min_phi_6.epir    |  36 ++
 ...s_Thejokr_ebpf-playground_probe__prog.epir | 439 +++++++++++++
 .../tests/epir/progs_alu64__prog.epir         |   8 +
 .../tests/epir/progs_compact_opt__prog.epir   |   7 +
 .../tests/epir/progs_counter__prog.epir       |  11 +
 .../tests/epir/progs_empty__prog.epir         |   5 +
 .../tests/epir/progs_filter__prog.epir        |  12 +
 ..._uninit_var_access__handle_tracepoint.epir |   7 +
 .../epir/progs_fn_oob__handle_tracepoint.epir |   5 +
 .../tests/epir/progs_hashmap__prog.epir       |  31 +
 .../tests/epir/progs_latency__prog.epir       |  12 +
 ...ogs_libbpf_bootstrap.bpf__handle_exit.epir |  73 +++
 .../progs_libbpf_bootstrap.bpf__prog.epir     |  47 ++
 ...s_libbpf_fentry.bpf__do_unlinkat_exit.epir |  12 +
 .../epir/progs_libbpf_fentry.bpf__prog.epir   |  11 +
 ...s_libbpf_kprobe.bpf__do_unlinkat_exit.epir |  10 +
 .../epir/progs_libbpf_kprobe.bpf__prog.epir   |  14 +
 ...rogs_libbpf_ksyscall.bpf__entry_probe.epir |  55 ++
 .../epir/progs_libbpf_ksyscall.bpf__prog.epir |  77 +++
 .../epir/progs_libbpf_lsm.bpf__prog.epir      |  14 +
 .../epir/progs_libbpf_minimal.bpf__prog.epir  |  16 +
 ...progs_libbpf_minimal_legacy.bpf__prog.epir |  30 +
 .../progs_libbpf_minimal_ns.bpf__prog.epir    |  21 +
 .../epir/progs_libbpf_profile.bpf__prog.epir  |  35 ++
 .../progs_libbpf_sockfilter.bpf__prog.epir    |  55 ++
 .../progs_libbpf_task_iter.bpf__prog.epir     |  55 ++
 .../epir/progs_libbpf_uprobe.bpf__prog.epir   |   9 +
 .../progs_libbpf_uprobe.bpf__uprobe_sub.epir  |   9 +
 ...rogs_libbpf_uprobe.bpf__uretprobe_add.epir |   8 +
 ...rogs_libbpf_uprobe.bpf__uretprobe_sub.epir |   8 +
 .../tests/epir/progs_loop1__prog.epir         |  22 +
 .../tests/epir/progs_loop2__prog.epir         |  20 +
 .../tests/epir/progs_loop3__prog.epir         |  16 +
 .../epass-ir/tests/epir/progs_map1__prog.epir |   7 +
 .../epass-ir/tests/epir/progs_mask__prog.epir |  28 +
 .../epass-ir/tests/epir/progs_mem1__prog.epir |  28 +
 .../epass-ir/tests/epir/progs_mem2__prog.epir |  56 ++
 .../tests/epir/progs_ringbuf__prog.epir       |  14 +
 .../tests/epir/progs_simple1__prog.epir       |   7 +
 .../tests/epir/progs_simple2__prog.epir       |   8 +
 .../epass-ir/tests/epir/progs_str__prog.epir  |   9 +
 ...l__lsm_access_control_file_permission.epir |  29 +
 .../progs_tengjiang_access_control__prog.epir |  29 +
 .../progs_tengjiang_simple_trace__prog.epir   |   9 +
 .../epir/progs_tengjiang_syscount__prog.epir  |  33 +
 .../progs_tengjiang_unbounded_loop__prog.epir |   7 +
 .../tests/epir/progs_tengjiang_xdp__prog.epir |  29 +
 .../tests/epir/progs_test_asm__prog.epir      | 101 +++
 .../tests/epir/ra_oversized_clique.epir       |  73 +++
 .../tests/epir/ra_pressure_reload_spill.epir  |  37 ++
 core-rs/epass-ir/tests/ir_text.rs             |  39 +-
 core-rs/epasstool/tests/falco.rs              |  15 +-
 82 files changed, 4372 insertions(+), 31 deletions(-)
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_100__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_120__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_20__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_30__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_50__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_70__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_complex2__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_complex__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loop1__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loop1med__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loop1sim__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loop2__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loop3__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loop4__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loopnested__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_counter_loopwithif__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero2__handle_tp.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero__handle_tp.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_masking_map_val_accepted__handle_tracepoint.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_masking_map_val_rejected__handle_tracepoint.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_masking_mask__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_masking_masksimple__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_msan_msan1__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_msan_msan2__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_msan_msan3__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_msan_simpl1__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_msan_simpl2__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/evaluation_msan_simpl3__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/min_phi_6.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_Thejokr_ebpf-playground_probe__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_alu64__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_compact_opt__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_counter__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_empty__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_filter__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_fn_nonrejected_uninit_var_access__handle_tracepoint.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_fn_oob__handle_tracepoint.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_hashmap__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_latency__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__handle_exit.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__do_unlinkat_exit.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__do_unlinkat_exit.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__entry_probe.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_lsm.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_minimal.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_minimal_legacy.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_minimal_ns.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_profile.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_sockfilter.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_task_iter.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uprobe_sub.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_add.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_sub.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_loop1__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_loop2__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_loop3__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_map1__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_mask__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_mem1__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_mem2__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_ringbuf__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_simple1__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_simple2__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_str__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__lsm_access_control_file_permission.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_tengjiang_simple_trace__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_tengjiang_syscount__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_tengjiang_unbounded_loop__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_tengjiang_xdp__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/progs_test_asm__prog.epir
 create mode 100644 core-rs/epass-ir/tests/epir/ra_oversized_clique.epir
 create mode 100644 core-rs/epass-ir/tests/epir/ra_pressure_reload_spill.epir

diff --git a/.gitignore b/.gitignore
index 6fe0c6f..44cde5a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,4 +55,3 @@ Mkfile.old
 dkms.conf
 /core-rs/target
 /paper
-/core-rs/epass-ir/tests/epir
diff --git a/core-rs/epass-ir/src/cg/alloc.rs b/core-rs/epass-ir/src/cg/alloc.rs
index c917048..41f4b3c 100644
--- a/core-rs/epass-ir/src/cg/alloc.rs
+++ b/core-rs/epass-ir/src/cg/alloc.rs
@@ -5,7 +5,7 @@ use crate::env::Env;
 use crate::error::Result;
 use crate::ir::insn::InsnKind;
 use crate::ir::value::VrType;
-use crate::ir::{Function, InsnId, InsertPos, Value};
+use crate::ir::{Function, InsertPos, InsnId, Value};
 use crate::{internal, invalid};
 
 use super::prepare::{create_alloc, ensure_extra};
@@ -67,8 +67,15 @@ pub fn pre_spill(env: &mut Env, func: &mut Function, cg: &mut CgState) -> Result
         cg.extra_mut(v).w += 1;
         let adj = cg.extra(v).adj.clone();
         for u in adj {
-            // u is in the clique if it appears earlier in the SEO.
-            if seo[..i].contains(&u) {
+            // On a chordal graph, every earlier neighbor of `v` in a perfect
+            // elimination order is mutually adjacent and therefore belongs to
+            // this clique. Our interference graph is not always chordal, so an
+            // MCS order is not necessarily perfect; only keep `u` if it is
+            // adjacent to every value already in `q`. Otherwise `q` is merely an
+            // earlier-neighbor set, and treating it as an oversized clique can
+            // force bogus spills or fail with "no spillable VR" even when the
+            // graph is colorable.
+            if seo[..i].contains(&u) && q.iter().all(|&x| cg.extra(u).adj.contains(&x)) {
                 q.push(u);
                 cg.extra_mut(u).w += 1;
             }
@@ -110,7 +117,10 @@ pub fn spill(
 ) -> Result<()> {
     let _ = env;
     for &v in to_spill {
-        if matches!(func.insn(v).kind, InsnKind::Call { .. } | InsnKind::AllocArray { .. }) {
+        if matches!(
+            func.insn(v).kind,
+            InsnKind::Call { .. } | InsnKind::AllocArray { .. }
+        ) {
             return Err(internal!("attempted to spill a call/allocarray"));
         }
         let users = func.insn(v).users.clone();
@@ -157,11 +167,7 @@ fn spill_one_use(
 ) -> Result<()> {
     match func.insn(user).kind.clone() {
         // A store of the spilled value into its own slot: nothing to do.
-        InsnKind::Store
-            if func.insn(user).values.first() == Some(&Value::Insn(user)) =>
-        {
-            Ok(())
-        }
+        InsnKind::Store if func.insn(user).values.first() == Some(&Value::Insn(user)) => Ok(()),
         InsnKind::Phi => {
             // Reload at the end of each predecessor block contributing v.
             let entries = func.insn(user).phi.clone();
@@ -268,9 +274,7 @@ pub fn pick_spill_victim(func: &Function, cg: &CgState, failed: InsnId) -> Resul
         }
     }
     best.ok_or_else(|| {
-        crate::error::Error::RegAlloc(
-            "coloring failed and no spillable value is available".into(),
-        )
+        crate::error::Error::RegAlloc("coloring failed and no spillable value is available".into())
     })
 }
 
diff --git a/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_100__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_100__prog.epir
new file mode 100644
index 0000000..f8926e0
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_100__prog.epir
@@ -0,0 +1,582 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  storeraw.u8 [%sp-2+sp], 0:i32
+  storeraw.u16 [%sp-4+sp], 26227:i32
+  storeraw.u32 [%sp-8+sp], 1684435809:i32
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %1 = phi [%1, bb2], [%0, bb1]
+  %2 = phi [%3, bb2], [0:i32, bb1]
+  %4 = add64 %sp, -8:i32
+  %5 = call #6(%4, %2)
+  %3 = add64 %2, 1:i32
+  jlt64 %3, %1 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[bb4,bb76]
+  %6 = call #5()
+  jeq64 %6, 0:i32 -> bb76 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+
+bb5: ; preds=[bb4,bb5] succs=[bb6,bb5]
+  %7 = phi [%7, bb5], [%6, bb4]
+  %8 = phi [%9, bb5], [0:i32, bb4]
+  %10 = call #5()
+  %11 = add64 %sp, -8:i32
+  %12 = call #6(%11, %10)
+  %9 = add64 %8, 1:i32
+  jlt64 %9, %7 -> bb5 else bb6
+
+bb6: ; preds=[bb5] succs=[bb7]
+
+bb7: ; preds=[bb6,bb7] succs=[bb8,bb7]
+  %13 = phi [%13, bb7], [%7, bb6]
+  %14 = phi [%15, bb7], [0:i32, bb6]
+  %16 = call #5()
+  %17 = add64 %sp, -8:i32
+  %18 = call #6(%17, %16)
+  %15 = add64 %14, 1:i32
+  jlt64 %15, %13 -> bb7 else bb8
+
+bb8: ; preds=[bb7] succs=[bb9]
+
+bb9: ; preds=[bb8,bb9] succs=[bb10,bb9]
+  %19 = phi [%19, bb9], [%13, bb8]
+  %20 = phi [%21, bb9], [0:i32, bb8]
+  %22 = call #5()
+  %23 = add64 %sp, -8:i32
+  %24 = call #6(%23, %22)
+  %21 = add64 %20, 1:i32
+  jlt64 %21, %19 -> bb9 else bb10
+
+bb10: ; preds=[bb9] succs=[bb11]
+
+bb11: ; preds=[bb10,bb11] succs=[bb12,bb11]
+  %25 = phi [%25, bb11], [%19, bb10]
+  %26 = phi [%27, bb11], [0:i32, bb10]
+  %28 = call #5()
+  %29 = add64 %sp, -8:i32
+  %30 = call #6(%29, %28)
+  %27 = add64 %26, 1:i32
+  jlt64 %27, %25 -> bb11 else bb12
+
+bb12: ; preds=[bb11] succs=[bb13]
+
+bb13: ; preds=[bb12,bb13] succs=[bb14,bb13]
+  %31 = phi [%31, bb13], [%25, bb12]
+  %32 = phi [%33, bb13], [0:i32, bb12]
+  %34 = call #5()
+  %35 = loadimm.imm64 7
+  %36 = call #6(%35, %34)
+  %37 = lsh64 %34, 32:i32
+  %38 = arsh64 %37, 32:i32
+  %39 = add64 %32, %38
+  %40 = loadimm.imm64 13
+  %41 = call #6(%40, 2:i32, %39)
+  %33 = add64 %32, 1:i32
+  jlt64 %33, %31 -> bb13 else bb14
+
+bb14: ; preds=[bb13] succs=[bb15]
+
+bb15: ; preds=[bb14,bb15] succs=[bb16,bb15]
+  %42 = phi [%42, bb15], [%31, bb14]
+  %43 = phi [%44, bb15], [0:i32, bb14]
+  %45 = call #5()
+  %46 = loadimm.imm64 7
+  %47 = call #6(%46, %45)
+  %48 = lsh64 %45, 32:i32
+  %49 = arsh64 %48, 32:i32
+  %50 = add64 %43, %49
+  %51 = loadimm.imm64 13
+  %52 = call #6(%51, 2:i32, %50)
+  %44 = add64 %43, 1:i32
+  jlt64 %44, %42 -> bb15 else bb16
+
+bb16: ; preds=[bb15] succs=[bb17]
+
+bb17: ; preds=[bb16,bb17] succs=[bb18,bb17]
+  %53 = phi [%53, bb17], [%42, bb16]
+  %54 = phi [%55, bb17], [0:i32, bb16]
+  %56 = call #5()
+  %57 = loadimm.imm64 7
+  %58 = call #6(%57, %56)
+  %59 = lsh64 %56, 32:i32
+  %60 = arsh64 %59, 32:i32
+  %61 = add64 %54, %60
+  %62 = loadimm.imm64 13
+  %63 = call #6(%62, 2:i32, %61)
+  %55 = add64 %54, 1:i32
+  jlt64 %55, %53 -> bb17 else bb18
+
+bb18: ; preds=[bb17] succs=[bb19]
+
+bb19: ; preds=[bb18,bb19] succs=[bb20,bb19]
+  %64 = phi [%64, bb19], [%53, bb18]
+  %65 = phi [%66, bb19], [0:i32, bb18]
+  %67 = call #5()
+  %68 = loadimm.imm64 7
+  %69 = call #6(%68, %67)
+  %70 = lsh64 %67, 32:i32
+  %71 = arsh64 %70, 32:i32
+  %72 = add64 %65, %71
+  %73 = loadimm.imm64 13
+  %74 = call #6(%73, 2:i32, %72)
+  %66 = add64 %65, 1:i32
+  jlt64 %66, %64 -> bb19 else bb20
+
+bb20: ; preds=[bb19] succs=[bb21]
+
+bb21: ; preds=[bb20,bb21] succs=[bb22,bb21]
+  %75 = phi [%75, bb21], [%64, bb20]
+  %76 = phi [%77, bb21], [0:i32, bb20]
+  %78 = call #5()
+  %79 = loadimm.imm64 7
+  %80 = call #6(%79, %78)
+  %81 = lsh64 %78, 32:i32
+  %82 = arsh64 %81, 32:i32
+  %83 = add64 %76, %82
+  %84 = loadimm.imm64 13
+  %85 = call #6(%84, 2:i32, %83)
+  %77 = add64 %76, 1:i32
+  jlt64 %77, %75 -> bb21 else bb22
+
+bb22: ; preds=[bb21] succs=[bb23]
+
+bb23: ; preds=[bb22,bb23] succs=[bb24,bb23]
+  %86 = phi [%86, bb23], [%75, bb22]
+  %87 = phi [%88, bb23], [0:i32, bb22]
+  %89 = call #5()
+  %90 = loadimm.imm64 7
+  %91 = call #6(%90, %89)
+  %92 = lsh64 %89, 32:i32
+  %93 = arsh64 %92, 32:i32
+  %94 = add64 %87, %93
+  %95 = loadimm.imm64 13
+  %96 = call #6(%95, 2:i32, %94)
+  %88 = add64 %87, 1:i32
+  jlt64 %88, %86 -> bb23 else bb24
+
+bb24: ; preds=[bb23] succs=[bb25]
+
+bb25: ; preds=[bb24,bb25] succs=[bb26,bb25]
+  %97 = phi [%97, bb25], [%86, bb24]
+  %98 = phi [%99, bb25], [0:i32, bb24]
+  %100 = call #5()
+  %101 = loadimm.imm64 7
+  %102 = call #6(%101, %100)
+  %103 = lsh64 %100, 32:i32
+  %104 = arsh64 %103, 32:i32
+  %105 = add64 %98, %104
+  %106 = loadimm.imm64 13
+  %107 = call #6(%106, 2:i32, %105)
+  %99 = add64 %98, 1:i32
+  jlt64 %99, %97 -> bb25 else bb26
+
+bb26: ; preds=[bb25] succs=[bb27]
+
+bb27: ; preds=[bb26,bb27] succs=[bb28,bb27]
+  %108 = phi [%108, bb27], [%97, bb26]
+  %109 = phi [%110, bb27], [0:i32, bb26]
+  %111 = call #5()
+  %112 = loadimm.imm64 7
+  %113 = call #6(%112, %111)
+  %114 = lsh64 %111, 32:i32
+  %115 = arsh64 %114, 32:i32
+  %116 = add64 %109, %115
+  %117 = loadimm.imm64 13
+  %118 = call #6(%117, 2:i32, %116)
+  %110 = add64 %109, 1:i32
+  jlt64 %110, %108 -> bb27 else bb28
+
+bb28: ; preds=[bb27] succs=[bb29]
+
+bb29: ; preds=[bb28,bb29] succs=[bb30,bb29]
+  %119 = phi [%119, bb29], [%108, bb28]
+  %120 = phi [%121, bb29], [0:i32, bb28]
+  %122 = call #5()
+  %123 = loadimm.imm64 7
+  %124 = call #6(%123, %122)
+  %125 = lsh64 %122, 32:i32
+  %126 = arsh64 %125, 32:i32
+  %127 = add64 %120, %126
+  %128 = loadimm.imm64 13
+  %129 = call #6(%128, 2:i32, %127)
+  %121 = add64 %120, 1:i32
+  jlt64 %121, %119 -> bb29 else bb30
+
+bb30: ; preds=[bb29] succs=[bb31]
+
+bb31: ; preds=[bb30,bb31] succs=[bb32,bb31]
+  %130 = phi [%130, bb31], [%119, bb30]
+  %131 = phi [%132, bb31], [0:i32, bb30]
+  %133 = call #5()
+  %134 = loadimm.imm64 7
+  %135 = call #6(%134, %133)
+  %136 = lsh64 %133, 32:i32
+  %137 = arsh64 %136, 32:i32
+  %138 = add64 %131, %137
+  %139 = loadimm.imm64 13
+  %140 = call #6(%139, 2:i32, %138)
+  %132 = add64 %131, 1:i32
+  jlt64 %132, %130 -> bb31 else bb32
+
+bb32: ; preds=[bb31] succs=[bb33]
+
+bb33: ; preds=[bb32,bb33] succs=[bb34,bb33]
+  %141 = phi [%141, bb33], [%130, bb32]
+  %142 = phi [%143, bb33], [0:i32, bb32]
+  %144 = call #5()
+  %145 = loadimm.imm64 7
+  %146 = call #6(%145, %144)
+  %147 = lsh64 %144, 32:i32
+  %148 = arsh64 %147, 32:i32
+  %149 = add64 %142, %148
+  %150 = loadimm.imm64 13
+  %151 = call #6(%150, 2:i32, %149)
+  %143 = add64 %142, 1:i32
+  jlt64 %143, %141 -> bb33 else bb34
+
+bb34: ; preds=[bb33] succs=[bb35]
+
+bb35: ; preds=[bb34,bb35] succs=[bb36,bb35]
+  %152 = phi [%152, bb35], [%141, bb34]
+  %153 = phi [%154, bb35], [0:i32, bb34]
+  %155 = call #5()
+  %156 = loadimm.imm64 7
+  %157 = call #6(%156, %155)
+  %158 = lsh64 %155, 32:i32
+  %159 = arsh64 %158, 32:i32
+  %160 = add64 %153, %159
+  %161 = loadimm.imm64 13
+  %162 = call #6(%161, 2:i32, %160)
+  %154 = add64 %153, 1:i32
+  jlt64 %154, %152 -> bb35 else bb36
+
+bb36: ; preds=[bb35] succs=[bb37]
+
+bb37: ; preds=[bb36,bb37] succs=[bb38,bb37]
+  %163 = phi [%163, bb37], [%152, bb36]
+  %164 = phi [%165, bb37], [0:i32, bb36]
+  %166 = call #5()
+  %167 = loadimm.imm64 7
+  %168 = call #6(%167, %166)
+  %169 = lsh64 %166, 32:i32
+  %170 = arsh64 %169, 32:i32
+  %171 = add64 %164, %170
+  %172 = loadimm.imm64 13
+  %173 = call #6(%172, 2:i32, %171)
+  %165 = add64 %164, 1:i32
+  jlt64 %165, %163 -> bb37 else bb38
+
+bb38: ; preds=[bb37] succs=[bb39]
+
+bb39: ; preds=[bb38,bb39] succs=[bb40,bb39]
+  %174 = phi [%174, bb39], [%163, bb38]
+  %175 = phi [%176, bb39], [0:i32, bb38]
+  %177 = call #5()
+  %178 = loadimm.imm64 7
+  %179 = call #6(%178, %177)
+  %180 = lsh64 %177, 32:i32
+  %181 = arsh64 %180, 32:i32
+  %182 = add64 %175, %181
+  %183 = loadimm.imm64 13
+  %184 = call #6(%183, 2:i32, %182)
+  %176 = add64 %175, 1:i32
+  jlt64 %176, %174 -> bb39 else bb40
+
+bb40: ; preds=[bb39] succs=[bb41]
+
+bb41: ; preds=[bb40,bb41] succs=[bb42,bb41]
+  %185 = phi [%185, bb41], [%174, bb40]
+  %186 = phi [%187, bb41], [0:i32, bb40]
+  %188 = call #5()
+  %189 = loadimm.imm64 7
+  %190 = call #6(%189, %188)
+  %191 = lsh64 %188, 32:i32
+  %192 = arsh64 %191, 32:i32
+  %193 = add64 %186, %192
+  %194 = loadimm.imm64 13
+  %195 = call #6(%194, 2:i32, %193)
+  %187 = add64 %186, 1:i32
+  jlt64 %187, %185 -> bb41 else bb42
+
+bb42: ; preds=[bb41] succs=[bb43]
+
+bb43: ; preds=[bb42,bb43] succs=[bb44,bb43]
+  %196 = phi [%196, bb43], [%185, bb42]
+  %197 = phi [%198, bb43], [0:i32, bb42]
+  %199 = call #5()
+  %200 = loadimm.imm64 7
+  %201 = call #6(%200, %199)
+  %202 = lsh64 %199, 32:i32
+  %203 = arsh64 %202, 32:i32
+  %204 = add64 %197, %203
+  %205 = loadimm.imm64 13
+  %206 = call #6(%205, 2:i32, %204)
+  %198 = add64 %197, 1:i32
+  jlt64 %198, %196 -> bb43 else bb44
+
+bb44: ; preds=[bb43] succs=[bb45]
+
+bb45: ; preds=[bb44,bb45] succs=[bb46,bb45]
+  %207 = phi [%207, bb45], [%196, bb44]
+  %208 = phi [%209, bb45], [0:i32, bb44]
+  %210 = call #5()
+  %211 = loadimm.imm64 7
+  %212 = call #6(%211, %210)
+  %213 = lsh64 %210, 32:i32
+  %214 = arsh64 %213, 32:i32
+  %215 = add64 %208, %214
+  %216 = loadimm.imm64 13
+  %217 = call #6(%216, 2:i32, %215)
+  %209 = add64 %208, 1:i32
+  jlt64 %209, %207 -> bb45 else bb46
+
+bb46: ; preds=[bb45] succs=[bb47]
+
+bb47: ; preds=[bb46,bb47] succs=[bb48,bb47]
+  %218 = phi [%218, bb47], [%207, bb46]
+  %219 = phi [%220, bb47], [0:i32, bb46]
+  %221 = call #5()
+  %222 = loadimm.imm64 7
+  %223 = call #6(%222, %221)
+  %224 = lsh64 %221, 32:i32
+  %225 = arsh64 %224, 32:i32
+  %226 = add64 %219, %225
+  %227 = loadimm.imm64 13
+  %228 = call #6(%227, 2:i32, %226)
+  %220 = add64 %219, 1:i32
+  jlt64 %220, %218 -> bb47 else bb48
+
+bb48: ; preds=[bb47] succs=[bb49]
+
+bb49: ; preds=[bb48,bb49] succs=[bb50,bb49]
+  %229 = phi [%229, bb49], [%218, bb48]
+  %230 = phi [%231, bb49], [0:i32, bb48]
+  %232 = call #5()
+  %233 = loadimm.imm64 7
+  %234 = call #6(%233, %232)
+  %235 = lsh64 %232, 32:i32
+  %236 = arsh64 %235, 32:i32
+  %237 = add64 %230, %236
+  %238 = loadimm.imm64 13
+  %239 = call #6(%238, 2:i32, %237)
+  %231 = add64 %230, 1:i32
+  jlt64 %231, %229 -> bb49 else bb50
+
+bb50: ; preds=[bb49] succs=[bb51]
+
+bb51: ; preds=[bb50,bb51] succs=[bb52,bb51]
+  %240 = phi [%240, bb51], [%229, bb50]
+  %241 = phi [%242, bb51], [0:i32, bb50]
+  %243 = call #5()
+  %244 = loadimm.imm64 7
+  %245 = call #6(%244, %243)
+  %246 = lsh64 %243, 32:i32
+  %247 = arsh64 %246, 32:i32
+  %248 = add64 %241, %247
+  %249 = loadimm.imm64 13
+  %250 = call #6(%249, 2:i32, %248)
+  %242 = add64 %241, 1:i32
+  jlt64 %242, %240 -> bb51 else bb52
+
+bb52: ; preds=[bb51] succs=[bb53]
+
+bb53: ; preds=[bb52,bb53] succs=[bb54,bb53]
+  %251 = phi [%251, bb53], [%240, bb52]
+  %252 = phi [%253, bb53], [0:i32, bb52]
+  %254 = call #5()
+  %255 = loadimm.imm64 7
+  %256 = call #6(%255, %254)
+  %257 = lsh64 %254, 32:i32
+  %258 = arsh64 %257, 32:i32
+  %259 = add64 %252, %258
+  %260 = loadimm.imm64 13
+  %261 = call #6(%260, 2:i32, %259)
+  %253 = add64 %252, 1:i32
+  jlt64 %253, %251 -> bb53 else bb54
+
+bb54: ; preds=[bb53] succs=[bb55]
+
+bb55: ; preds=[bb54,bb55] succs=[bb56,bb55]
+  %262 = phi [%262, bb55], [%251, bb54]
+  %263 = phi [%264, bb55], [0:i32, bb54]
+  %265 = call #5()
+  %266 = loadimm.imm64 7
+  %267 = call #6(%266, %265)
+  %268 = lsh64 %265, 32:i32
+  %269 = arsh64 %268, 32:i32
+  %270 = add64 %263, %269
+  %271 = loadimm.imm64 13
+  %272 = call #6(%271, 2:i32, %270)
+  %264 = add64 %263, 1:i32
+  jlt64 %264, %262 -> bb55 else bb56
+
+bb56: ; preds=[bb55] succs=[bb57]
+
+bb57: ; preds=[bb56,bb57] succs=[bb58,bb57]
+  %273 = phi [%273, bb57], [%262, bb56]
+  %274 = phi [%275, bb57], [0:i32, bb56]
+  %276 = call #5()
+  %277 = loadimm.imm64 7
+  %278 = call #6(%277, %276)
+  %279 = lsh64 %276, 32:i32
+  %280 = arsh64 %279, 32:i32
+  %281 = add64 %274, %280
+  %282 = loadimm.imm64 13
+  %283 = call #6(%282, 2:i32, %281)
+  %275 = add64 %274, 1:i32
+  jlt64 %275, %273 -> bb57 else bb58
+
+bb58: ; preds=[bb57] succs=[bb59]
+
+bb59: ; preds=[bb58,bb59] succs=[bb60,bb59]
+  %284 = phi [%284, bb59], [%273, bb58]
+  %285 = phi [%286, bb59], [0:i32, bb58]
+  %287 = call #5()
+  %288 = loadimm.imm64 7
+  %289 = call #6(%288, %287)
+  %290 = lsh64 %287, 32:i32
+  %291 = arsh64 %290, 32:i32
+  %292 = add64 %285, %291
+  %293 = loadimm.imm64 13
+  %294 = call #6(%293, 2:i32, %292)
+  %286 = add64 %285, 1:i32
+  jlt64 %286, %284 -> bb59 else bb60
+
+bb60: ; preds=[bb59] succs=[bb61]
+
+bb61: ; preds=[bb60,bb61] succs=[bb62,bb61]
+  %295 = phi [%295, bb61], [%284, bb60]
+  %296 = phi [%297, bb61], [0:i32, bb60]
+  %298 = call #5()
+  %299 = loadimm.imm64 7
+  %300 = call #6(%299, %298)
+  %301 = lsh64 %298, 32:i32
+  %302 = arsh64 %301, 32:i32
+  %303 = add64 %296, %302
+  %304 = loadimm.imm64 13
+  %305 = call #6(%304, 2:i32, %303)
+  %297 = add64 %296, 1:i32
+  jlt64 %297, %295 -> bb61 else bb62
+
+bb62: ; preds=[bb61] succs=[bb63]
+
+bb63: ; preds=[bb62,bb63] succs=[bb64,bb63]
+  %306 = phi [%306, bb63], [%295, bb62]
+  %307 = phi [%308, bb63], [0:i32, bb62]
+  %309 = call #5()
+  %310 = loadimm.imm64 7
+  %311 = call #6(%310, %309)
+  %312 = lsh64 %309, 32:i32
+  %313 = arsh64 %312, 32:i32
+  %314 = add64 %307, %313
+  %315 = loadimm.imm64 13
+  %316 = call #6(%315, 2:i32, %314)
+  %308 = add64 %307, 1:i32
+  jlt64 %308, %306 -> bb63 else bb64
+
+bb64: ; preds=[bb63] succs=[bb65]
+
+bb65: ; preds=[bb64,bb65] succs=[bb66,bb65]
+  %317 = phi [%317, bb65], [%306, bb64]
+  %318 = phi [%319, bb65], [0:i32, bb64]
+  %320 = call #5()
+  %321 = loadimm.imm64 7
+  %322 = call #6(%321, %320)
+  %323 = lsh64 %320, 32:i32
+  %324 = arsh64 %323, 32:i32
+  %325 = add64 %318, %324
+  %326 = loadimm.imm64 13
+  %327 = call #6(%326, 2:i32, %325)
+  %319 = add64 %318, 1:i32
+  jlt64 %319, %317 -> bb65 else bb66
+
+bb66: ; preds=[bb65] succs=[bb67]
+
+bb67: ; preds=[bb66,bb67] succs=[bb68,bb67]
+  %328 = phi [%328, bb67], [%317, bb66]
+  %329 = phi [%330, bb67], [0:i32, bb66]
+  %331 = call #5()
+  %332 = loadimm.imm64 7
+  %333 = call #6(%332, %331)
+  %334 = lsh64 %331, 32:i32
+  %335 = arsh64 %334, 32:i32
+  %336 = add64 %329, %335
+  %337 = loadimm.imm64 13
+  %338 = call #6(%337, 2:i32, %336)
+  %330 = add64 %329, 1:i32
+  jlt64 %330, %328 -> bb67 else bb68
+
+bb68: ; preds=[bb67] succs=[bb69]
+
+bb69: ; preds=[bb68,bb69] succs=[bb70,bb69]
+  %339 = phi [%339, bb69], [%328, bb68]
+  %340 = phi [%341, bb69], [0:i32, bb68]
+  %342 = call #5()
+  %343 = loadimm.imm64 7
+  %344 = call #6(%343, %342)
+  %345 = lsh64 %342, 32:i32
+  %346 = arsh64 %345, 32:i32
+  %347 = add64 %340, %346
+  %348 = loadimm.imm64 13
+  %349 = call #6(%348, 2:i32, %347)
+  %341 = add64 %340, 1:i32
+  jlt64 %341, %339 -> bb69 else bb70
+
+bb70: ; preds=[bb69] succs=[bb71]
+
+bb71: ; preds=[bb70,bb71] succs=[bb72,bb71]
+  %350 = phi [%350, bb71], [%339, bb70]
+  %351 = phi [%352, bb71], [0:i32, bb70]
+  %353 = call #5()
+  %354 = loadimm.imm64 7
+  %355 = call #6(%354, %353)
+  %356 = lsh64 %353, 32:i32
+  %357 = arsh64 %356, 32:i32
+  %358 = add64 %351, %357
+  %359 = loadimm.imm64 13
+  %360 = call #6(%359, 2:i32, %358)
+  %352 = add64 %351, 1:i32
+  jlt64 %352, %350 -> bb71 else bb72
+
+bb72: ; preds=[bb71] succs=[bb73]
+
+bb73: ; preds=[bb72,bb73] succs=[bb74,bb73]
+  %361 = phi [%361, bb73], [%350, bb72]
+  %362 = phi [%363, bb73], [0:i32, bb72]
+  %364 = call #5()
+  %365 = loadimm.imm64 7
+  %366 = call #6(%365, %364)
+  %367 = lsh64 %364, 32:i32
+  %368 = arsh64 %367, 32:i32
+  %369 = add64 %362, %368
+  %370 = loadimm.imm64 13
+  %371 = call #6(%370, 2:i32, %369)
+  %363 = add64 %362, 1:i32
+  jlt64 %363, %361 -> bb73 else bb74
+
+bb74: ; preds=[bb73] succs=[bb75]
+
+bb75: ; preds=[bb74,bb75] succs=[bb76,bb75]
+  %372 = phi [%372, bb75], [%361, bb74]
+  %373 = phi [%374, bb75], [0:i32, bb74]
+  %375 = call #5()
+  %376 = loadimm.imm64 7
+  %377 = call #6(%376, %375)
+  %378 = lsh64 %375, 32:i32
+  %379 = arsh64 %378, 32:i32
+  %380 = add64 %373, %379
+  %381 = loadimm.imm64 13
+  %382 = call #6(%381, 2:i32, %380)
+  %374 = add64 %373, 1:i32
+  jlt64 %374, %372 -> bb75 else bb76
+
+bb76: ; preds=[bb3,bb75] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_120__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_120__prog.epir
new file mode 100644
index 0000000..9daf0aa
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_120__prog.epir
@@ -0,0 +1,294 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  storeraw.u8 [%sp-2+sp], 0:i32
+  storeraw.u16 [%sp-4+sp], 26227:i32
+  storeraw.u32 [%sp-8+sp], 1684435809:i32
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %1 = phi [%1, bb2], [%0, bb1]
+  %2 = phi [%3, bb2], [0:i32, bb1]
+  %4 = add64 %sp, -8:i32
+  %5 = call #6(%4, %2)
+  %3 = add64 %2, 1:i32
+  jlt64 %3, %1 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[bb4,bb40]
+  %6 = call #5()
+  jeq64 %6, 0:i32 -> bb40 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+
+bb5: ; preds=[bb4,bb5] succs=[bb6,bb5]
+  %7 = phi [%7, bb5], [%6, bb4]
+  %8 = phi [%9, bb5], [0:i32, bb4]
+  %10 = call #5()
+  %11 = add64 %sp, -8:i32
+  %12 = call #6(%11, %10)
+  %9 = add64 %8, 1:i32
+  jlt64 %9, %7 -> bb5 else bb6
+
+bb6: ; preds=[bb5] succs=[bb7]
+
+bb7: ; preds=[bb6,bb7] succs=[bb8,bb7]
+  %13 = phi [%13, bb7], [%7, bb6]
+  %14 = phi [%15, bb7], [0:i32, bb6]
+  %16 = call #5()
+  %17 = add64 %sp, -8:i32
+  %18 = call #6(%17, %16)
+  %15 = add64 %14, 1:i32
+  jlt64 %15, %13 -> bb7 else bb8
+
+bb8: ; preds=[bb7] succs=[bb9]
+
+bb9: ; preds=[bb8,bb9] succs=[bb10,bb9]
+  %19 = phi [%19, bb9], [%13, bb8]
+  %20 = phi [%21, bb9], [0:i32, bb8]
+  %22 = call #5()
+  %23 = add64 %sp, -8:i32
+  %24 = call #6(%23, %22)
+  %21 = add64 %20, 1:i32
+  jlt64 %21, %19 -> bb9 else bb10
+
+bb10: ; preds=[bb9] succs=[bb11]
+
+bb11: ; preds=[bb10,bb11] succs=[bb12,bb11]
+  %25 = phi [%25, bb11], [%19, bb10]
+  %26 = phi [%27, bb11], [0:i32, bb10]
+  %28 = call #5()
+  %29 = add64 %sp, -8:i32
+  %30 = call #6(%29, %28)
+  %27 = add64 %26, 1:i32
+  jlt64 %27, %25 -> bb11 else bb12
+
+bb12: ; preds=[bb11] succs=[bb13]
+
+bb13: ; preds=[bb12,bb13] succs=[bb14,bb13]
+  %31 = phi [%31, bb13], [%25, bb12]
+  %32 = phi [%33, bb13], [0:i32, bb12]
+  %34 = call #5()
+  %35 = loadimm.imm64 7
+  %36 = call #6(%35, %34)
+  %37 = lsh64 %34, 32:i32
+  %38 = arsh64 %37, 32:i32
+  %39 = add64 %32, %38
+  %40 = loadimm.imm64 13
+  %41 = call #6(%40, 2:i32, %39)
+  %33 = add64 %32, 1:i32
+  jlt64 %33, %31 -> bb13 else bb14
+
+bb14: ; preds=[bb13] succs=[bb15]
+
+bb15: ; preds=[bb14,bb15] succs=[bb16,bb15]
+  %42 = phi [%42, bb15], [%31, bb14]
+  %43 = phi [%44, bb15], [0:i32, bb14]
+  %45 = call #5()
+  %46 = loadimm.imm64 7
+  %47 = call #6(%46, %45)
+  %48 = lsh64 %45, 32:i32
+  %49 = arsh64 %48, 32:i32
+  %50 = add64 %43, %49
+  %51 = loadimm.imm64 13
+  %52 = call #6(%51, 2:i32, %50)
+  %44 = add64 %43, 1:i32
+  jlt64 %44, %42 -> bb15 else bb16
+
+bb16: ; preds=[bb15] succs=[bb17]
+
+bb17: ; preds=[bb16,bb17] succs=[bb18,bb17]
+  %53 = phi [%53, bb17], [%42, bb16]
+  %54 = phi [%55, bb17], [0:i32, bb16]
+  %56 = call #5()
+  %57 = loadimm.imm64 7
+  %58 = call #6(%57, %56)
+  %59 = lsh64 %56, 32:i32
+  %60 = arsh64 %59, 32:i32
+  %61 = add64 %54, %60
+  %62 = loadimm.imm64 13
+  %63 = call #6(%62, 2:i32, %61)
+  %55 = add64 %54, 1:i32
+  jlt64 %55, %53 -> bb17 else bb18
+
+bb18: ; preds=[bb17] succs=[bb19]
+
+bb19: ; preds=[bb18,bb19] succs=[bb20,bb19]
+  %64 = phi [%64, bb19], [%53, bb18]
+  %65 = phi [%66, bb19], [0:i32, bb18]
+  %67 = call #5()
+  %68 = loadimm.imm64 7
+  %69 = call #6(%68, %67)
+  %70 = lsh64 %67, 32:i32
+  %71 = arsh64 %70, 32:i32
+  %72 = add64 %65, %71
+  %73 = loadimm.imm64 13
+  %74 = call #6(%73, 2:i32, %72)
+  %66 = add64 %65, 1:i32
+  jlt64 %66, %64 -> bb19 else bb20
+
+bb20: ; preds=[bb19] succs=[bb21]
+
+bb21: ; preds=[bb20,bb21] succs=[bb22,bb21]
+  %75 = phi [%75, bb21], [%64, bb20]
+  %76 = phi [%77, bb21], [0:i32, bb20]
+  %78 = call #5()
+  %79 = loadimm.imm64 7
+  %80 = call #6(%79, %78)
+  %81 = lsh64 %78, 32:i32
+  %82 = arsh64 %81, 32:i32
+  %83 = add64 %76, %82
+  %84 = loadimm.imm64 13
+  %85 = call #6(%84, 2:i32, %83)
+  %77 = add64 %76, 1:i32
+  jlt64 %77, %75 -> bb21 else bb22
+
+bb22: ; preds=[bb21] succs=[bb23]
+
+bb23: ; preds=[bb22,bb23] succs=[bb24,bb23]
+  %86 = phi [%86, bb23], [%75, bb22]
+  %87 = phi [%88, bb23], [0:i32, bb22]
+  %89 = call #5()
+  %90 = loadimm.imm64 7
+  %91 = call #6(%90, %89)
+  %92 = lsh64 %89, 32:i32
+  %93 = arsh64 %92, 32:i32
+  %94 = add64 %87, %93
+  %95 = loadimm.imm64 13
+  %96 = call #6(%95, 2:i32, %94)
+  %88 = add64 %87, 1:i32
+  jlt64 %88, %86 -> bb23 else bb24
+
+bb24: ; preds=[bb23] succs=[bb25]
+
+bb25: ; preds=[bb24,bb25] succs=[bb26,bb25]
+  %97 = phi [%97, bb25], [%86, bb24]
+  %98 = phi [%99, bb25], [0:i32, bb24]
+  %100 = call #5()
+  %101 = loadimm.imm64 7
+  %102 = call #6(%101, %100)
+  %103 = lsh64 %100, 32:i32
+  %104 = arsh64 %103, 32:i32
+  %105 = add64 %98, %104
+  %106 = loadimm.imm64 13
+  %107 = call #6(%106, 2:i32, %105)
+  %99 = add64 %98, 1:i32
+  jlt64 %99, %97 -> bb25 else bb26
+
+bb26: ; preds=[bb25] succs=[bb27]
+
+bb27: ; preds=[bb26,bb27] succs=[bb28,bb27]
+  %108 = phi [%108, bb27], [%97, bb26]
+  %109 = phi [%110, bb27], [0:i32, bb26]
+  %111 = call #5()
+  %112 = loadimm.imm64 7
+  %113 = call #6(%112, %111)
+  %114 = lsh64 %111, 32:i32
+  %115 = arsh64 %114, 32:i32
+  %116 = add64 %109, %115
+  %117 = loadimm.imm64 13
+  %118 = call #6(%117, 2:i32, %116)
+  %110 = add64 %109, 1:i32
+  jlt64 %110, %108 -> bb27 else bb28
+
+bb28: ; preds=[bb27] succs=[bb29]
+
+bb29: ; preds=[bb28,bb29] succs=[bb30,bb29]
+  %119 = phi [%119, bb29], [%108, bb28]
+  %120 = phi [%121, bb29], [0:i32, bb28]
+  %122 = call #5()
+  %123 = loadimm.imm64 7
+  %124 = call #6(%123, %122)
+  %125 = lsh64 %122, 32:i32
+  %126 = arsh64 %125, 32:i32
+  %127 = add64 %120, %126
+  %128 = loadimm.imm64 13
+  %129 = call #6(%128, 2:i32, %127)
+  %121 = add64 %120, 1:i32
+  jlt64 %121, %119 -> bb29 else bb30
+
+bb30: ; preds=[bb29] succs=[bb31]
+
+bb31: ; preds=[bb30,bb31] succs=[bb32,bb31]
+  %130 = phi [%130, bb31], [%119, bb30]
+  %131 = phi [%132, bb31], [0:i32, bb30]
+  %133 = call #5()
+  %134 = loadimm.imm64 7
+  %135 = call #6(%134, %133)
+  %136 = lsh64 %133, 32:i32
+  %137 = arsh64 %136, 32:i32
+  %138 = add64 %131, %137
+  %139 = loadimm.imm64 13
+  %140 = call #6(%139, 2:i32, %138)
+  %132 = add64 %131, 1:i32
+  jlt64 %132, %130 -> bb31 else bb32
+
+bb32: ; preds=[bb31] succs=[bb33]
+
+bb33: ; preds=[bb32,bb33] succs=[bb34,bb33]
+  %141 = phi [%141, bb33], [%130, bb32]
+  %142 = phi [%143, bb33], [0:i32, bb32]
+  %144 = call #5()
+  %145 = loadimm.imm64 7
+  %146 = call #6(%145, %144)
+  %147 = lsh64 %144, 32:i32
+  %148 = arsh64 %147, 32:i32
+  %149 = add64 %142, %148
+  %150 = loadimm.imm64 13
+  %151 = call #6(%150, 2:i32, %149)
+  %143 = add64 %142, 1:i32
+  jlt64 %143, %141 -> bb33 else bb34
+
+bb34: ; preds=[bb33] succs=[bb35]
+
+bb35: ; preds=[bb34,bb35] succs=[bb36,bb35]
+  %152 = phi [%152, bb35], [%141, bb34]
+  %153 = phi [%154, bb35], [0:i32, bb34]
+  %155 = call #5()
+  %156 = loadimm.imm64 7
+  %157 = call #6(%156, %155)
+  %158 = lsh64 %155, 32:i32
+  %159 = arsh64 %158, 32:i32
+  %160 = add64 %153, %159
+  %161 = loadimm.imm64 13
+  %162 = call #6(%161, 2:i32, %160)
+  %154 = add64 %153, 1:i32
+  jlt64 %154, %152 -> bb35 else bb36
+
+bb36: ; preds=[bb35] succs=[bb37]
+
+bb37: ; preds=[bb36,bb37] succs=[bb38,bb37]
+  %163 = phi [%163, bb37], [%152, bb36]
+  %164 = phi [%165, bb37], [0:i32, bb36]
+  %166 = call #5()
+  %167 = loadimm.imm64 7
+  %168 = call #6(%167, %166)
+  %169 = lsh64 %166, 32:i32
+  %170 = arsh64 %169, 32:i32
+  %171 = add64 %164, %170
+  %172 = loadimm.imm64 13
+  %173 = call #6(%172, 2:i32, %171)
+  %165 = add64 %164, 1:i32
+  jlt64 %165, %163 -> bb37 else bb38
+
+bb38: ; preds=[bb37] succs=[bb39]
+
+bb39: ; preds=[bb38,bb39] succs=[bb40,bb39]
+  %174 = phi [%174, bb39], [%163, bb38]
+  %175 = phi [%176, bb39], [0:i32, bb38]
+  %177 = call #5()
+  %178 = loadimm.imm64 7
+  %179 = call #6(%178, %177)
+  %180 = lsh64 %177, 32:i32
+  %181 = arsh64 %180, 32:i32
+  %182 = add64 %175, %181
+  %183 = loadimm.imm64 13
+  %184 = call #6(%183, 2:i32, %182)
+  %176 = add64 %175, 1:i32
+  jlt64 %176, %174 -> bb39 else bb40
+
+bb40: ; preds=[bb3,bb39] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_20__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_20__prog.epir
new file mode 100644
index 0000000..d79452c
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_20__prog.epir
@@ -0,0 +1,48 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  storeraw.u8 [%sp-2+sp], 0:i32
+  storeraw.u16 [%sp-4+sp], 26227:i32
+  storeraw.u32 [%sp-8+sp], 1684435809:i32
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %1 = phi [%1, bb2], [%0, bb1]
+  %2 = phi [%3, bb2], [0:i32, bb1]
+  %4 = add64 %sp, -8:i32
+  %5 = call #6(%4, %2)
+  %3 = add64 %2, 1:i32
+  jlt64 %3, %1 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[bb4,bb8]
+  %6 = call #5()
+  jeq64 %6, 0:i32 -> bb8 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+
+bb5: ; preds=[bb4,bb5] succs=[bb6,bb5]
+  %7 = phi [%7, bb5], [%6, bb4]
+  %8 = phi [%9, bb5], [0:i32, bb4]
+  %10 = call #5()
+  %11 = add64 %sp, -8:i32
+  %12 = call #6(%11, %10)
+  %9 = add64 %8, 1:i32
+  jlt64 %9, %7 -> bb5 else bb6
+
+bb6: ; preds=[bb5] succs=[bb7]
+
+bb7: ; preds=[bb6,bb7] succs=[bb8,bb7]
+  %13 = phi [%13, bb7], [%7, bb6]
+  %14 = phi [%15, bb7], [0:i32, bb6]
+  %16 = call #5()
+  %17 = add64 %sp, -8:i32
+  %18 = call #6(%17, %16)
+  %15 = add64 %14, 1:i32
+  jlt64 %15, %13 -> bb7 else bb8
+
+bb8: ; preds=[bb3,bb7] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_30__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_30__prog.epir
new file mode 100644
index 0000000..4a2ce2a
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_30__prog.epir
@@ -0,0 +1,127 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  storeraw.u8 [%sp-2+sp], 0:i32
+  storeraw.u16 [%sp-4+sp], 26227:i32
+  storeraw.u32 [%sp-8+sp], 1684435809:i32
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %1 = phi [%1, bb2], [%0, bb1]
+  %2 = phi [%3, bb2], [0:i32, bb1]
+  %4 = add64 %sp, -8:i32
+  %5 = call #6(%4, %2)
+  %3 = add64 %2, 1:i32
+  jlt64 %3, %1 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[bb4,bb6]
+  %6 = call #5()
+  jeq64 %6, 0:i32 -> bb6 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+
+bb5: ; preds=[bb4,bb5] succs=[bb6,bb5]
+  %7 = phi [%7, bb5], [%6, bb4]
+  %8 = phi [%9, bb5], [0:i32, bb4]
+  %10 = call #5()
+  %11 = add64 %sp, -8:i32
+  %12 = call #6(%11, %10)
+  %9 = add64 %8, 1:i32
+  jlt64 %9, %7 -> bb5 else bb6
+
+bb6: ; preds=[bb3,bb5] succs=[]
+  %13 = phi [%6, bb3], [%7, bb5]
+  %14 = call #5()
+  %15 = sub32 %14, %13
+  %16 = loadimm.imm64 7
+  %17 = call #6(%16, %15)
+  %18 = lsh64 %14, 32:i32
+  %19 = arsh64 %18, 32:i32
+  %20 = loadimm.imm64 13
+  %21 = call #6(%20, 2:i32, %19)
+  %22 = call #5()
+  %23 = sub32 %22, %13
+  %24 = loadimm.imm64 7
+  %25 = call #6(%24, %23, %19)
+  %26 = lsh64 %22, 32:i32
+  %27 = arsh64 %26, 32:i32
+  %28 = add64 %27, 1:i32
+  %29 = loadimm.imm64 13
+  %30 = call #6(%29, 2:i32, %28)
+  %31 = call #5()
+  %32 = sub32 %31, %13
+  %33 = loadimm.imm64 7
+  %34 = call #6(%33, %32, %28)
+  %35 = lsh64 %31, 32:i32
+  %36 = arsh64 %35, 32:i32
+  %37 = add64 %36, 2:i32
+  %38 = loadimm.imm64 13
+  %39 = call #6(%38, 2:i32, %37)
+  %40 = call #5()
+  %41 = sub32 %40, %13
+  %42 = loadimm.imm64 7
+  %43 = call #6(%42, %41, %37)
+  %44 = lsh64 %40, 32:i32
+  %45 = arsh64 %44, 32:i32
+  %46 = add64 %45, 3:i32
+  %47 = loadimm.imm64 13
+  %48 = call #6(%47, 2:i32, %46)
+  %49 = call #5()
+  %50 = sub32 %49, %13
+  %51 = loadimm.imm64 7
+  %52 = call #6(%51, %50, %46)
+  %53 = lsh64 %49, 32:i32
+  %54 = arsh64 %53, 32:i32
+  %55 = add64 %54, 4:i32
+  %56 = loadimm.imm64 13
+  %57 = call #6(%56, 2:i32, %55)
+  %58 = call #5()
+  %59 = sub32 %58, %13
+  %60 = loadimm.imm64 7
+  %61 = call #6(%60, %59, %55)
+  %62 = lsh64 %58, 32:i32
+  %63 = arsh64 %62, 32:i32
+  %64 = add64 %63, 5:i32
+  %65 = loadimm.imm64 13
+  %66 = call #6(%65, 2:i32, %64)
+  %67 = call #5()
+  %68 = sub32 %67, %13
+  %69 = loadimm.imm64 7
+  %70 = call #6(%69, %68, %64)
+  %71 = lsh64 %67, 32:i32
+  %72 = arsh64 %71, 32:i32
+  %73 = add64 %72, 6:i32
+  %74 = loadimm.imm64 13
+  %75 = call #6(%74, 2:i32, %73)
+  %76 = call #5()
+  %77 = sub32 %76, %13
+  %78 = loadimm.imm64 7
+  %79 = call #6(%78, %77, %73)
+  %80 = lsh64 %76, 32:i32
+  %81 = arsh64 %80, 32:i32
+  %82 = add64 %81, 7:i32
+  %83 = loadimm.imm64 13
+  %84 = call #6(%83, 2:i32, %82)
+  %85 = call #5()
+  %86 = sub32 %85, %13
+  %87 = loadimm.imm64 7
+  %88 = call #6(%87, %86, %82)
+  %89 = lsh64 %85, 32:i32
+  %90 = arsh64 %89, 32:i32
+  %91 = add64 %90, 8:i32
+  %92 = loadimm.imm64 13
+  %93 = call #6(%92, 2:i32, %91)
+  %94 = call #5()
+  %95 = sub32 %94, %13
+  %96 = loadimm.imm64 7
+  %97 = call #6(%96, %95, %91)
+  %98 = lsh64 %94, 32:i32
+  %99 = arsh64 %98, 32:i32
+  %100 = add64 %99, 9:i32
+  %101 = loadimm.imm64 13
+  %102 = call #6(%101, 2:i32, %100)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_50__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_50__prog.epir
new file mode 100644
index 0000000..852c4a9
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_50__prog.epir
@@ -0,0 +1,305 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  storeraw.u8 [%sp-2+sp], 0:i32
+  storeraw.u16 [%sp-4+sp], 26227:i32
+  storeraw.u32 [%sp-8+sp], 1684435809:i32
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %1 = phi [%1, bb2], [%0, bb1]
+  %2 = phi [%3, bb2], [0:i32, bb1]
+  %4 = add64 %sp, -8:i32
+  %5 = call #6(%4, %2)
+  %3 = add64 %2, 1:i32
+  jlt64 %3, %1 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[bb4,bb6]
+  %6 = call #5()
+  jeq64 %6, 0:i32 -> bb6 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+
+bb5: ; preds=[bb4,bb5] succs=[bb6,bb5]
+  %7 = phi [%7, bb5], [%6, bb4]
+  %8 = phi [%9, bb5], [0:i32, bb4]
+  %10 = call #5()
+  %11 = add64 %sp, -8:i32
+  %12 = call #6(%11, %10)
+  %9 = add64 %8, 1:i32
+  jlt64 %9, %7 -> bb5 else bb6
+
+bb6: ; preds=[bb3,bb5] succs=[]
+  %13 = phi [%6, bb3], [%7, bb5]
+  %14 = call #5()
+  %15 = sub32 %14, %13
+  %16 = loadimm.imm64 7
+  %17 = call #6(%16, %15)
+  %18 = lsh64 %14, 32:i32
+  %19 = arsh64 %18, 32:i32
+  %20 = loadimm.imm64 13
+  %21 = call #6(%20, 2:i32, %19)
+  %22 = call #5()
+  %23 = sub32 %22, %13
+  %24 = loadimm.imm64 7
+  %25 = call #6(%24, %23, %19)
+  %26 = lsh64 %22, 32:i32
+  %27 = arsh64 %26, 32:i32
+  %28 = add64 %27, 1:i32
+  %29 = loadimm.imm64 13
+  %30 = call #6(%29, 2:i32, %28)
+  %31 = call #5()
+  %32 = sub32 %31, %13
+  %33 = loadimm.imm64 7
+  %34 = call #6(%33, %32, %28)
+  %35 = lsh64 %31, 32:i32
+  %36 = arsh64 %35, 32:i32
+  %37 = add64 %36, 2:i32
+  %38 = loadimm.imm64 13
+  %39 = call #6(%38, 2:i32, %37)
+  %40 = call #5()
+  %41 = sub32 %40, %13
+  %42 = loadimm.imm64 7
+  %43 = call #6(%42, %41, %37)
+  %44 = lsh64 %40, 32:i32
+  %45 = arsh64 %44, 32:i32
+  %46 = add64 %45, 3:i32
+  %47 = loadimm.imm64 13
+  %48 = call #6(%47, 2:i32, %46)
+  %49 = call #5()
+  %50 = sub32 %49, %13
+  %51 = loadimm.imm64 7
+  %52 = call #6(%51, %50, %46)
+  %53 = lsh64 %49, 32:i32
+  %54 = arsh64 %53, 32:i32
+  %55 = add64 %54, 4:i32
+  %56 = loadimm.imm64 13
+  %57 = call #6(%56, 2:i32, %55)
+  %58 = call #5()
+  %59 = sub32 %58, %13
+  %60 = loadimm.imm64 7
+  %61 = call #6(%60, %59, %55)
+  %62 = lsh64 %58, 32:i32
+  %63 = arsh64 %62, 32:i32
+  %64 = add64 %63, 5:i32
+  %65 = loadimm.imm64 13
+  %66 = call #6(%65, 2:i32, %64)
+  %67 = call #5()
+  %68 = sub32 %67, %13
+  %69 = loadimm.imm64 7
+  %70 = call #6(%69, %68, %64)
+  %71 = lsh64 %67, 32:i32
+  %72 = arsh64 %71, 32:i32
+  %73 = add64 %72, 6:i32
+  %74 = loadimm.imm64 13
+  %75 = call #6(%74, 2:i32, %73)
+  %76 = call #5()
+  %77 = sub32 %76, %13
+  %78 = loadimm.imm64 7
+  %79 = call #6(%78, %77, %73)
+  %80 = lsh64 %76, 32:i32
+  %81 = arsh64 %80, 32:i32
+  %82 = add64 %81, 7:i32
+  %83 = loadimm.imm64 13
+  %84 = call #6(%83, 2:i32, %82)
+  %85 = call #5()
+  %86 = sub32 %85, %13
+  %87 = loadimm.imm64 7
+  %88 = call #6(%87, %86, %82)
+  %89 = lsh64 %85, 32:i32
+  %90 = arsh64 %89, 32:i32
+  %91 = add64 %90, 8:i32
+  %92 = loadimm.imm64 13
+  %93 = call #6(%92, 2:i32, %91)
+  %94 = call #5()
+  %95 = sub32 %94, %13
+  %96 = loadimm.imm64 7
+  %97 = call #6(%96, %95, %91)
+  %98 = lsh64 %94, 32:i32
+  %99 = arsh64 %98, 32:i32
+  %100 = add64 %99, 9:i32
+  %101 = loadimm.imm64 13
+  %102 = call #6(%101, 2:i32, %100)
+  %103 = call #5()
+  %104 = sub32 %103, %13
+  %105 = loadimm.imm64 7
+  %106 = call #6(%105, %104, %100)
+  %107 = lsh64 %103, 32:i32
+  %108 = arsh64 %107, 32:i32
+  %109 = loadimm.imm64 13
+  %110 = call #6(%109, 2:i32, %108)
+  %111 = call #5()
+  %112 = sub32 %111, %13
+  %113 = loadimm.imm64 7
+  %114 = call #6(%113, %112, %108)
+  %115 = lsh64 %111, 32:i32
+  %116 = arsh64 %115, 32:i32
+  %117 = add64 %116, 1:i32
+  %118 = loadimm.imm64 13
+  %119 = call #6(%118, 2:i32, %117)
+  %120 = call #5()
+  %121 = sub32 %120, %13
+  %122 = loadimm.imm64 7
+  %123 = call #6(%122, %121, %117)
+  %124 = lsh64 %120, 32:i32
+  %125 = arsh64 %124, 32:i32
+  %126 = add64 %125, 2:i32
+  %127 = loadimm.imm64 13
+  %128 = call #6(%127, 2:i32, %126)
+  %129 = call #5()
+  %130 = sub32 %129, %13
+  %131 = loadimm.imm64 7
+  %132 = call #6(%131, %130, %126)
+  %133 = lsh64 %129, 32:i32
+  %134 = arsh64 %133, 32:i32
+  %135 = add64 %134, 3:i32
+  %136 = loadimm.imm64 13
+  %137 = call #6(%136, 2:i32, %135)
+  %138 = call #5()
+  %139 = sub32 %138, %13
+  %140 = loadimm.imm64 7
+  %141 = call #6(%140, %139, %135)
+  %142 = lsh64 %138, 32:i32
+  %143 = arsh64 %142, 32:i32
+  %144 = add64 %143, 4:i32
+  %145 = loadimm.imm64 13
+  %146 = call #6(%145, 2:i32, %144)
+  %147 = call #5()
+  %148 = sub32 %147, %13
+  %149 = loadimm.imm64 7
+  %150 = call #6(%149, %148, %144)
+  %151 = lsh64 %147, 32:i32
+  %152 = arsh64 %151, 32:i32
+  %153 = add64 %152, 5:i32
+  %154 = loadimm.imm64 13
+  %155 = call #6(%154, 2:i32, %153)
+  %156 = call #5()
+  %157 = sub32 %156, %13
+  %158 = loadimm.imm64 7
+  %159 = call #6(%158, %157, %153)
+  %160 = lsh64 %156, 32:i32
+  %161 = arsh64 %160, 32:i32
+  %162 = add64 %161, 6:i32
+  %163 = loadimm.imm64 13
+  %164 = call #6(%163, 2:i32, %162)
+  %165 = call #5()
+  %166 = sub32 %165, %13
+  %167 = loadimm.imm64 7
+  %168 = call #6(%167, %166, %162)
+  %169 = lsh64 %165, 32:i32
+  %170 = arsh64 %169, 32:i32
+  %171 = add64 %170, 7:i32
+  %172 = loadimm.imm64 13
+  %173 = call #6(%172, 2:i32, %171)
+  %174 = call #5()
+  %175 = sub32 %174, %13
+  %176 = loadimm.imm64 7
+  %177 = call #6(%176, %175, %171)
+  %178 = lsh64 %174, 32:i32
+  %179 = arsh64 %178, 32:i32
+  %180 = add64 %179, 8:i32
+  %181 = loadimm.imm64 13
+  %182 = call #6(%181, 2:i32, %180)
+  %183 = call #5()
+  %184 = sub32 %183, %13
+  %185 = loadimm.imm64 7
+  %186 = call #6(%185, %184, %180)
+  %187 = lsh64 %183, 32:i32
+  %188 = arsh64 %187, 32:i32
+  %189 = add64 %188, 9:i32
+  %190 = loadimm.imm64 13
+  %191 = call #6(%190, 2:i32, %189)
+  %192 = call #5()
+  %193 = sub32 %192, %13
+  %194 = loadimm.imm64 7
+  %195 = call #6(%194, %193, %189)
+  %196 = lsh64 %192, 32:i32
+  %197 = arsh64 %196, 32:i32
+  %198 = loadimm.imm64 13
+  %199 = call #6(%198, 2:i32, %197)
+  %200 = call #5()
+  %201 = sub32 %200, %13
+  %202 = loadimm.imm64 7
+  %203 = call #6(%202, %201, %197)
+  %204 = lsh64 %200, 32:i32
+  %205 = arsh64 %204, 32:i32
+  %206 = add64 %205, 1:i32
+  %207 = loadimm.imm64 13
+  %208 = call #6(%207, 2:i32, %206)
+  %209 = call #5()
+  %210 = sub32 %209, %13
+  %211 = loadimm.imm64 7
+  %212 = call #6(%211, %210, %206)
+  %213 = lsh64 %209, 32:i32
+  %214 = arsh64 %213, 32:i32
+  %215 = add64 %214, 2:i32
+  %216 = loadimm.imm64 13
+  %217 = call #6(%216, 2:i32, %215)
+  %218 = call #5()
+  %219 = sub32 %218, %13
+  %220 = loadimm.imm64 7
+  %221 = call #6(%220, %219, %215)
+  %222 = lsh64 %218, 32:i32
+  %223 = arsh64 %222, 32:i32
+  %224 = add64 %223, 3:i32
+  %225 = loadimm.imm64 13
+  %226 = call #6(%225, 2:i32, %224)
+  %227 = call #5()
+  %228 = sub32 %227, %13
+  %229 = loadimm.imm64 7
+  %230 = call #6(%229, %228, %224)
+  %231 = lsh64 %227, 32:i32
+  %232 = arsh64 %231, 32:i32
+  %233 = add64 %232, 4:i32
+  %234 = loadimm.imm64 13
+  %235 = call #6(%234, 2:i32, %233)
+  %236 = call #5()
+  %237 = sub32 %236, %13
+  %238 = loadimm.imm64 7
+  %239 = call #6(%238, %237, %233)
+  %240 = lsh64 %236, 32:i32
+  %241 = arsh64 %240, 32:i32
+  %242 = add64 %241, 5:i32
+  %243 = loadimm.imm64 13
+  %244 = call #6(%243, 2:i32, %242)
+  %245 = call #5()
+  %246 = sub32 %245, %13
+  %247 = loadimm.imm64 7
+  %248 = call #6(%247, %246, %242)
+  %249 = lsh64 %245, 32:i32
+  %250 = arsh64 %249, 32:i32
+  %251 = add64 %250, 6:i32
+  %252 = loadimm.imm64 13
+  %253 = call #6(%252, 2:i32, %251)
+  %254 = call #5()
+  %255 = sub32 %254, %13
+  %256 = loadimm.imm64 7
+  %257 = call #6(%256, %255, %251)
+  %258 = lsh64 %254, 32:i32
+  %259 = arsh64 %258, 32:i32
+  %260 = add64 %259, 7:i32
+  %261 = loadimm.imm64 13
+  %262 = call #6(%261, 2:i32, %260)
+  %263 = call #5()
+  %264 = sub32 %263, %13
+  %265 = loadimm.imm64 7
+  %266 = call #6(%265, %264, %260)
+  %267 = lsh64 %263, 32:i32
+  %268 = arsh64 %267, 32:i32
+  %269 = add64 %268, 8:i32
+  %270 = loadimm.imm64 13
+  %271 = call #6(%270, 2:i32, %269)
+  %272 = call #5()
+  %273 = sub32 %272, %13
+  %274 = loadimm.imm64 7
+  %275 = call #6(%274, %273, %269)
+  %276 = lsh64 %272, 32:i32
+  %277 = arsh64 %276, 32:i32
+  %278 = add64 %277, 9:i32
+  %279 = loadimm.imm64 13
+  %280 = call #6(%279, 2:i32, %278)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_70__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_70__prog.epir
new file mode 100644
index 0000000..14397da
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_compile_speed_speed_70__prog.epir
@@ -0,0 +1,550 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  storeraw.u8 [%sp-2+sp], 0:i32
+  storeraw.u16 [%sp-4+sp], 26227:i32
+  storeraw.u32 [%sp-8+sp], 1684435809:i32
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %1 = phi [%1, bb2], [%0, bb1]
+  %2 = phi [%3, bb2], [0:i32, bb1]
+  %4 = add64 %sp, -8:i32
+  %5 = call #6(%4, %2)
+  %3 = add64 %2, 1:i32
+  jlt64 %3, %1 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[bb4,bb72]
+  %6 = call #5()
+  jeq64 %6, 0:i32 -> bb72 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+
+bb5: ; preds=[bb4,bb5] succs=[bb6,bb5]
+  %7 = phi [%7, bb5], [%6, bb4]
+  %8 = phi [%9, bb5], [0:i32, bb4]
+  %10 = call #5()
+  %11 = add64 %sp, -8:i32
+  %12 = call #6(%11, %10)
+  %9 = add64 %8, 1:i32
+  jlt64 %9, %7 -> bb5 else bb6
+
+bb6: ; preds=[bb5] succs=[bb7]
+
+bb7: ; preds=[bb6,bb7] succs=[bb8,bb7]
+  %13 = phi [%13, bb7], [%7, bb6]
+  %14 = phi [%15, bb7], [0:i32, bb6]
+  %16 = call #5()
+  %17 = add64 %sp, -8:i32
+  %18 = call #6(%17, %16)
+  %15 = add64 %14, 1:i32
+  jlt64 %15, %13 -> bb7 else bb8
+
+bb8: ; preds=[bb7] succs=[bb9]
+
+bb9: ; preds=[bb8,bb9] succs=[bb10,bb9]
+  %19 = phi [%19, bb9], [%13, bb8]
+  %20 = phi [%21, bb9], [0:i32, bb8]
+  %22 = call #5()
+  %23 = add64 %sp, -8:i32
+  %24 = call #6(%23, %22)
+  %21 = add64 %20, 1:i32
+  jlt64 %21, %19 -> bb9 else bb10
+
+bb10: ; preds=[bb9] succs=[bb11]
+
+bb11: ; preds=[bb10,bb11] succs=[bb12,bb11]
+  %25 = phi [%25, bb11], [%19, bb10]
+  %26 = phi [%27, bb11], [0:i32, bb10]
+  %28 = call #5()
+  %29 = add64 %sp, -8:i32
+  %30 = call #6(%29, %28)
+  %27 = add64 %26, 1:i32
+  jlt64 %27, %25 -> bb11 else bb12
+
+bb12: ; preds=[bb11] succs=[bb13]
+
+bb13: ; preds=[bb12,bb13] succs=[bb14,bb13]
+  %31 = phi [%31, bb13], [%25, bb12]
+  %32 = phi [%33, bb13], [0:i32, bb12]
+  %34 = call #5()
+  %35 = loadimm.imm64 7
+  %36 = call #6(%35, %34)
+  %37 = lsh64 %34, 32:i32
+  %38 = arsh64 %37, 32:i32
+  %39 = add64 %32, %38
+  %40 = loadimm.imm64 13
+  %41 = call #6(%40, 2:i32, %39)
+  %33 = add64 %32, 1:i32
+  jlt64 %33, %31 -> bb13 else bb14
+
+bb14: ; preds=[bb13] succs=[bb15]
+
+bb15: ; preds=[bb14,bb15] succs=[bb16,bb15]
+  %42 = phi [%42, bb15], [%31, bb14]
+  %43 = phi [%44, bb15], [0:i32, bb14]
+  %45 = call #5()
+  %46 = loadimm.imm64 7
+  %47 = call #6(%46, %45)
+  %48 = lsh64 %45, 32:i32
+  %49 = arsh64 %48, 32:i32
+  %50 = add64 %43, %49
+  %51 = loadimm.imm64 13
+  %52 = call #6(%51, 2:i32, %50)
+  %44 = add64 %43, 1:i32
+  jlt64 %44, %42 -> bb15 else bb16
+
+bb16: ; preds=[bb15] succs=[bb17]
+
+bb17: ; preds=[bb16,bb17] succs=[bb18,bb17]
+  %53 = phi [%53, bb17], [%42, bb16]
+  %54 = phi [%55, bb17], [0:i32, bb16]
+  %56 = call #5()
+  %57 = loadimm.imm64 7
+  %58 = call #6(%57, %56)
+  %59 = lsh64 %56, 32:i32
+  %60 = arsh64 %59, 32:i32
+  %61 = add64 %54, %60
+  %62 = loadimm.imm64 13
+  %63 = call #6(%62, 2:i32, %61)
+  %55 = add64 %54, 1:i32
+  jlt64 %55, %53 -> bb17 else bb18
+
+bb18: ; preds=[bb17] succs=[bb19]
+
+bb19: ; preds=[bb18,bb19] succs=[bb20,bb19]
+  %64 = phi [%64, bb19], [%53, bb18]
+  %65 = phi [%66, bb19], [0:i32, bb18]
+  %67 = call #5()
+  %68 = loadimm.imm64 7
+  %69 = call #6(%68, %67)
+  %70 = lsh64 %67, 32:i32
+  %71 = arsh64 %70, 32:i32
+  %72 = add64 %65, %71
+  %73 = loadimm.imm64 13
+  %74 = call #6(%73, 2:i32, %72)
+  %66 = add64 %65, 1:i32
+  jlt64 %66, %64 -> bb19 else bb20
+
+bb20: ; preds=[bb19] succs=[bb21]
+
+bb21: ; preds=[bb20,bb21] succs=[bb22,bb21]
+  %75 = phi [%75, bb21], [%64, bb20]
+  %76 = phi [%77, bb21], [0:i32, bb20]
+  %78 = call #5()
+  %79 = loadimm.imm64 7
+  %80 = call #6(%79, %78)
+  %81 = lsh64 %78, 32:i32
+  %82 = arsh64 %81, 32:i32
+  %83 = add64 %76, %82
+  %84 = loadimm.imm64 13
+  %85 = call #6(%84, 2:i32, %83)
+  %77 = add64 %76, 1:i32
+  jlt64 %77, %75 -> bb21 else bb22
+
+bb22: ; preds=[bb21] succs=[bb23]
+
+bb23: ; preds=[bb22,bb23] succs=[bb24,bb23]
+  %86 = phi [%86, bb23], [%75, bb22]
+  %87 = phi [%88, bb23], [0:i32, bb22]
+  %89 = call #5()
+  %90 = loadimm.imm64 7
+  %91 = call #6(%90, %89)
+  %92 = lsh64 %89, 32:i32
+  %93 = arsh64 %92, 32:i32
+  %94 = add64 %87, %93
+  %95 = loadimm.imm64 13
+  %96 = call #6(%95, 2:i32, %94)
+  %88 = add64 %87, 1:i32
+  jlt64 %88, %86 -> bb23 else bb24
+
+bb24: ; preds=[bb23] succs=[bb25]
+
+bb25: ; preds=[bb24,bb25] succs=[bb26,bb25]
+  %97 = phi [%97, bb25], [%86, bb24]
+  %98 = phi [%99, bb25], [0:i32, bb24]
+  %100 = call #5()
+  %101 = loadimm.imm64 7
+  %102 = call #6(%101, %100)
+  %103 = lsh64 %100, 32:i32
+  %104 = arsh64 %103, 32:i32
+  %105 = add64 %98, %104
+  %106 = loadimm.imm64 13
+  %107 = call #6(%106, 2:i32, %105)
+  %99 = add64 %98, 1:i32
+  jlt64 %99, %97 -> bb25 else bb26
+
+bb26: ; preds=[bb25] succs=[bb27]
+
+bb27: ; preds=[bb26,bb27] succs=[bb28,bb27]
+  %108 = phi [%108, bb27], [%97, bb26]
+  %109 = phi [%110, bb27], [0:i32, bb26]
+  %111 = call #5()
+  %112 = loadimm.imm64 7
+  %113 = call #6(%112, %111)
+  %114 = lsh64 %111, 32:i32
+  %115 = arsh64 %114, 32:i32
+  %116 = add64 %109, %115
+  %117 = loadimm.imm64 13
+  %118 = call #6(%117, 2:i32, %116)
+  %110 = add64 %109, 1:i32
+  jlt64 %110, %108 -> bb27 else bb28
+
+bb28: ; preds=[bb27] succs=[bb29]
+
+bb29: ; preds=[bb28,bb29] succs=[bb30,bb29]
+  %119 = phi [%119, bb29], [%108, bb28]
+  %120 = phi [%121, bb29], [0:i32, bb28]
+  %122 = call #5()
+  %123 = loadimm.imm64 7
+  %124 = call #6(%123, %122)
+  %125 = lsh64 %122, 32:i32
+  %126 = arsh64 %125, 32:i32
+  %127 = add64 %120, %126
+  %128 = loadimm.imm64 13
+  %129 = call #6(%128, 2:i32, %127)
+  %121 = add64 %120, 1:i32
+  jlt64 %121, %119 -> bb29 else bb30
+
+bb30: ; preds=[bb29] succs=[bb31]
+
+bb31: ; preds=[bb30,bb31] succs=[bb32,bb31]
+  %130 = phi [%130, bb31], [%119, bb30]
+  %131 = phi [%132, bb31], [0:i32, bb30]
+  %133 = call #5()
+  %134 = loadimm.imm64 7
+  %135 = call #6(%134, %133)
+  %136 = lsh64 %133, 32:i32
+  %137 = arsh64 %136, 32:i32
+  %138 = add64 %131, %137
+  %139 = loadimm.imm64 13
+  %140 = call #6(%139, 2:i32, %138)
+  %132 = add64 %131, 1:i32
+  jlt64 %132, %130 -> bb31 else bb32
+
+bb32: ; preds=[bb31] succs=[bb33]
+
+bb33: ; preds=[bb32,bb33] succs=[bb34,bb33]
+  %141 = phi [%141, bb33], [%130, bb32]
+  %142 = phi [%143, bb33], [0:i32, bb32]
+  %144 = call #5()
+  %145 = loadimm.imm64 7
+  %146 = call #6(%145, %144)
+  %147 = lsh64 %144, 32:i32
+  %148 = arsh64 %147, 32:i32
+  %149 = add64 %142, %148
+  %150 = loadimm.imm64 13
+  %151 = call #6(%150, 2:i32, %149)
+  %143 = add64 %142, 1:i32
+  jlt64 %143, %141 -> bb33 else bb34
+
+bb34: ; preds=[bb33] succs=[bb35]
+
+bb35: ; preds=[bb34,bb35] succs=[bb36,bb35]
+  %152 = phi [%152, bb35], [%141, bb34]
+  %153 = phi [%154, bb35], [0:i32, bb34]
+  %155 = call #5()
+  %156 = loadimm.imm64 7
+  %157 = call #6(%156, %155)
+  %158 = lsh64 %155, 32:i32
+  %159 = arsh64 %158, 32:i32
+  %160 = add64 %153, %159
+  %161 = loadimm.imm64 13
+  %162 = call #6(%161, 2:i32, %160)
+  %154 = add64 %153, 1:i32
+  jlt64 %154, %152 -> bb35 else bb36
+
+bb36: ; preds=[bb35] succs=[bb37]
+
+bb37: ; preds=[bb36,bb37] succs=[bb38,bb37]
+  %163 = phi [%163, bb37], [%152, bb36]
+  %164 = phi [%165, bb37], [0:i32, bb36]
+  %166 = call #5()
+  %167 = loadimm.imm64 7
+  %168 = call #6(%167, %166)
+  %169 = lsh64 %166, 32:i32
+  %170 = arsh64 %169, 32:i32
+  %171 = add64 %164, %170
+  %172 = loadimm.imm64 13
+  %173 = call #6(%172, 2:i32, %171)
+  %165 = add64 %164, 1:i32
+  jlt64 %165, %163 -> bb37 else bb38
+
+bb38: ; preds=[bb37] succs=[bb39]
+
+bb39: ; preds=[bb38,bb39] succs=[bb40,bb39]
+  %174 = phi [%174, bb39], [%163, bb38]
+  %175 = phi [%176, bb39], [0:i32, bb38]
+  %177 = call #5()
+  %178 = loadimm.imm64 7
+  %179 = call #6(%178, %177)
+  %180 = lsh64 %177, 32:i32
+  %181 = arsh64 %180, 32:i32
+  %182 = add64 %175, %181
+  %183 = loadimm.imm64 13
+  %184 = call #6(%183, 2:i32, %182)
+  %176 = add64 %175, 1:i32
+  jlt64 %176, %174 -> bb39 else bb40
+
+bb40: ; preds=[bb39] succs=[bb41]
+
+bb41: ; preds=[bb40,bb41] succs=[bb42,bb41]
+  %185 = phi [%185, bb41], [%174, bb40]
+  %186 = phi [%187, bb41], [0:i32, bb40]
+  %188 = call #5()
+  %189 = loadimm.imm64 7
+  %190 = call #6(%189, %188)
+  %191 = lsh64 %188, 32:i32
+  %192 = arsh64 %191, 32:i32
+  %193 = add64 %186, %192
+  %194 = loadimm.imm64 13
+  %195 = call #6(%194, 2:i32, %193)
+  %187 = add64 %186, 1:i32
+  jlt64 %187, %185 -> bb41 else bb42
+
+bb42: ; preds=[bb41] succs=[bb43]
+
+bb43: ; preds=[bb42,bb43] succs=[bb44,bb43]
+  %196 = phi [%196, bb43], [%185, bb42]
+  %197 = phi [%198, bb43], [0:i32, bb42]
+  %199 = call #5()
+  %200 = loadimm.imm64 7
+  %201 = call #6(%200, %199)
+  %202 = lsh64 %199, 32:i32
+  %203 = arsh64 %202, 32:i32
+  %204 = add64 %197, %203
+  %205 = loadimm.imm64 13
+  %206 = call #6(%205, 2:i32, %204)
+  %198 = add64 %197, 1:i32
+  jlt64 %198, %196 -> bb43 else bb44
+
+bb44: ; preds=[bb43] succs=[bb45]
+
+bb45: ; preds=[bb44,bb45] succs=[bb46,bb45]
+  %207 = phi [%207, bb45], [%196, bb44]
+  %208 = phi [%209, bb45], [0:i32, bb44]
+  %210 = call #5()
+  %211 = loadimm.imm64 7
+  %212 = call #6(%211, %210)
+  %213 = lsh64 %210, 32:i32
+  %214 = arsh64 %213, 32:i32
+  %215 = add64 %208, %214
+  %216 = loadimm.imm64 13
+  %217 = call #6(%216, 2:i32, %215)
+  %209 = add64 %208, 1:i32
+  jlt64 %209, %207 -> bb45 else bb46
+
+bb46: ; preds=[bb45] succs=[bb47]
+
+bb47: ; preds=[bb46,bb47] succs=[bb48,bb47]
+  %218 = phi [%218, bb47], [%207, bb46]
+  %219 = phi [%220, bb47], [0:i32, bb46]
+  %221 = call #5()
+  %222 = loadimm.imm64 7
+  %223 = call #6(%222, %221)
+  %224 = lsh64 %221, 32:i32
+  %225 = arsh64 %224, 32:i32
+  %226 = add64 %219, %225
+  %227 = loadimm.imm64 13
+  %228 = call #6(%227, 2:i32, %226)
+  %220 = add64 %219, 1:i32
+  jlt64 %220, %218 -> bb47 else bb48
+
+bb48: ; preds=[bb47] succs=[bb49]
+
+bb49: ; preds=[bb48,bb49] succs=[bb50,bb49]
+  %229 = phi [%229, bb49], [%218, bb48]
+  %230 = phi [%231, bb49], [0:i32, bb48]
+  %232 = call #5()
+  %233 = loadimm.imm64 7
+  %234 = call #6(%233, %232)
+  %235 = lsh64 %232, 32:i32
+  %236 = arsh64 %235, 32:i32
+  %237 = add64 %230, %236
+  %238 = loadimm.imm64 13
+  %239 = call #6(%238, 2:i32, %237)
+  %231 = add64 %230, 1:i32
+  jlt64 %231, %229 -> bb49 else bb50
+
+bb50: ; preds=[bb49] succs=[bb51]
+
+bb51: ; preds=[bb50,bb51] succs=[bb52,bb51]
+  %240 = phi [%240, bb51], [%229, bb50]
+  %241 = phi [%242, bb51], [0:i32, bb50]
+  %243 = call #5()
+  %244 = loadimm.imm64 7
+  %245 = call #6(%244, %243)
+  %246 = lsh64 %243, 32:i32
+  %247 = arsh64 %246, 32:i32
+  %248 = add64 %241, %247
+  %249 = loadimm.imm64 13
+  %250 = call #6(%249, 2:i32, %248)
+  %242 = add64 %241, 1:i32
+  jlt64 %242, %240 -> bb51 else bb52
+
+bb52: ; preds=[bb51] succs=[bb53]
+
+bb53: ; preds=[bb52,bb53] succs=[bb54,bb53]
+  %251 = phi [%251, bb53], [%240, bb52]
+  %252 = phi [%253, bb53], [0:i32, bb52]
+  %254 = call #5()
+  %255 = loadimm.imm64 7
+  %256 = call #6(%255, %254)
+  %257 = lsh64 %254, 32:i32
+  %258 = arsh64 %257, 32:i32
+  %259 = add64 %252, %258
+  %260 = loadimm.imm64 13
+  %261 = call #6(%260, 2:i32, %259)
+  %253 = add64 %252, 1:i32
+  jlt64 %253, %251 -> bb53 else bb54
+
+bb54: ; preds=[bb53] succs=[bb55]
+
+bb55: ; preds=[bb54,bb55] succs=[bb56,bb55]
+  %262 = phi [%262, bb55], [%251, bb54]
+  %263 = phi [%264, bb55], [0:i32, bb54]
+  %265 = call #5()
+  %266 = loadimm.imm64 7
+  %267 = call #6(%266, %265)
+  %268 = lsh64 %265, 32:i32
+  %269 = arsh64 %268, 32:i32
+  %270 = add64 %263, %269
+  %271 = loadimm.imm64 13
+  %272 = call #6(%271, 2:i32, %270)
+  %264 = add64 %263, 1:i32
+  jlt64 %264, %262 -> bb55 else bb56
+
+bb56: ; preds=[bb55] succs=[bb57]
+
+bb57: ; preds=[bb56,bb57] succs=[bb58,bb57]
+  %273 = phi [%273, bb57], [%262, bb56]
+  %274 = phi [%275, bb57], [0:i32, bb56]
+  %276 = call #5()
+  %277 = loadimm.imm64 7
+  %278 = call #6(%277, %276)
+  %279 = lsh64 %276, 32:i32
+  %280 = arsh64 %279, 32:i32
+  %281 = add64 %274, %280
+  %282 = loadimm.imm64 13
+  %283 = call #6(%282, 2:i32, %281)
+  %275 = add64 %274, 1:i32
+  jlt64 %275, %273 -> bb57 else bb58
+
+bb58: ; preds=[bb57] succs=[bb59]
+
+bb59: ; preds=[bb58,bb59] succs=[bb60,bb59]
+  %284 = phi [%284, bb59], [%273, bb58]
+  %285 = phi [%286, bb59], [0:i32, bb58]
+  %287 = call #5()
+  %288 = loadimm.imm64 7
+  %289 = call #6(%288, %287)
+  %290 = lsh64 %287, 32:i32
+  %291 = arsh64 %290, 32:i32
+  %292 = add64 %285, %291
+  %293 = loadimm.imm64 13
+  %294 = call #6(%293, 2:i32, %292)
+  %286 = add64 %285, 1:i32
+  jlt64 %286, %284 -> bb59 else bb60
+
+bb60: ; preds=[bb59] succs=[bb61]
+
+bb61: ; preds=[bb60,bb61] succs=[bb62,bb61]
+  %295 = phi [%295, bb61], [%284, bb60]
+  %296 = phi [%297, bb61], [0:i32, bb60]
+  %298 = call #5()
+  %299 = loadimm.imm64 7
+  %300 = call #6(%299, %298)
+  %301 = lsh64 %298, 32:i32
+  %302 = arsh64 %301, 32:i32
+  %303 = add64 %296, %302
+  %304 = loadimm.imm64 13
+  %305 = call #6(%304, 2:i32, %303)
+  %297 = add64 %296, 1:i32
+  jlt64 %297, %295 -> bb61 else bb62
+
+bb62: ; preds=[bb61] succs=[bb63]
+
+bb63: ; preds=[bb62,bb63] succs=[bb64,bb63]
+  %306 = phi [%306, bb63], [%295, bb62]
+  %307 = phi [%308, bb63], [0:i32, bb62]
+  %309 = call #5()
+  %310 = loadimm.imm64 7
+  %311 = call #6(%310, %309)
+  %312 = lsh64 %309, 32:i32
+  %313 = arsh64 %312, 32:i32
+  %314 = add64 %307, %313
+  %315 = loadimm.imm64 13
+  %316 = call #6(%315, 2:i32, %314)
+  %308 = add64 %307, 1:i32
+  jlt64 %308, %306 -> bb63 else bb64
+
+bb64: ; preds=[bb63] succs=[bb65]
+
+bb65: ; preds=[bb64,bb65] succs=[bb66,bb65]
+  %317 = phi [%317, bb65], [%306, bb64]
+  %318 = phi [%319, bb65], [0:i32, bb64]
+  %320 = call #5()
+  %321 = loadimm.imm64 7
+  %322 = call #6(%321, %320)
+  %323 = lsh64 %320, 32:i32
+  %324 = arsh64 %323, 32:i32
+  %325 = add64 %318, %324
+  %326 = loadimm.imm64 13
+  %327 = call #6(%326, 2:i32, %325)
+  %319 = add64 %318, 1:i32
+  jlt64 %319, %317 -> bb65 else bb66
+
+bb66: ; preds=[bb65] succs=[bb67]
+
+bb67: ; preds=[bb66,bb67] succs=[bb68,bb67]
+  %328 = phi [%328, bb67], [%317, bb66]
+  %329 = phi [%330, bb67], [0:i32, bb66]
+  %331 = call #5()
+  %332 = loadimm.imm64 7
+  %333 = call #6(%332, %331)
+  %334 = lsh64 %331, 32:i32
+  %335 = arsh64 %334, 32:i32
+  %336 = add64 %329, %335
+  %337 = loadimm.imm64 13
+  %338 = call #6(%337, 2:i32, %336)
+  %330 = add64 %329, 1:i32
+  jlt64 %330, %328 -> bb67 else bb68
+
+bb68: ; preds=[bb67] succs=[bb69]
+
+bb69: ; preds=[bb68,bb69] succs=[bb70,bb69]
+  %339 = phi [%339, bb69], [%328, bb68]
+  %340 = phi [%341, bb69], [0:i32, bb68]
+  %342 = call #5()
+  %343 = loadimm.imm64 7
+  %344 = call #6(%343, %342)
+  %345 = lsh64 %342, 32:i32
+  %346 = arsh64 %345, 32:i32
+  %347 = add64 %340, %346
+  %348 = loadimm.imm64 13
+  %349 = call #6(%348, 2:i32, %347)
+  %341 = add64 %340, 1:i32
+  jlt64 %341, %339 -> bb69 else bb70
+
+bb70: ; preds=[bb69] succs=[bb71]
+
+bb71: ; preds=[bb70,bb71] succs=[bb72,bb71]
+  %350 = phi [%350, bb71], [%339, bb70]
+  %351 = phi [%352, bb71], [0:i32, bb70]
+  %353 = call #5()
+  %354 = loadimm.imm64 7
+  %355 = call #6(%354, %353)
+  %356 = lsh64 %353, 32:i32
+  %357 = arsh64 %356, 32:i32
+  %358 = add64 %351, %357
+  %359 = loadimm.imm64 13
+  %360 = call #6(%359, 2:i32, %358)
+  %352 = add64 %351, 1:i32
+  jlt64 %352, %350 -> bb71 else bb72
+
+bb72: ; preds=[bb3,bb71] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_complex2__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_complex2__prog.epir
new file mode 100644
index 0000000..db45a4c
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_complex2__prog.epir
@@ -0,0 +1,40 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+  %0 = loadimm.imm64 0
+  %1 = add64 %sp, -100:i32
+
+bb1: ; preds=[bb0,bb4] succs=[bb2]
+  %2 = phi [%3, bb4], [0:i32, bb0]
+  %4 = phi [%5, bb4], [%1, bb0]
+  %6 = phi [%7, bb4], [%0, bb0]
+  %8 = add64 %6, 1:i32
+  ja bb2
+
+bb2: ; preds=[bb1,bb6] succs=[bb3,bb6]
+  %9 = phi [%4, bb1], [%9, bb6]
+  %7 = phi [%8, bb1], [%10, bb6]
+  %11 = phi [%2, bb1], [%12, bb6]
+  %13 = loadraw.u8 [%7-1]
+  jeq32 %13, 104:i32 -> bb6 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb5]
+  jeq32 %13, 0:i32 -> bb5 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5,bb1]
+  storeraw.u8 [%9+0], %13
+  %5 = add64 %9, 1:i32
+  %3 = add32 %11, 1:i32
+  jslt32 %11, 999:i32 -> bb1 else bb5
+
+bb5: ; preds=[bb7,bb3,bb4] succs=[]
+  ret 0:i32
+
+bb6: ; preds=[bb2] succs=[bb7,bb2]
+  %10 = add64 %7, 1:i32
+  %12 = add32 %11, 1:i32
+  jslt32 %11, 999:i32 -> bb2 else bb7
+
+bb7: ; preds=[bb6] succs=[bb5]
+  ja bb5
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_complex__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_complex__prog.epir
new file mode 100644
index 0000000..c6c10e7
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_complex__prog.epir
@@ -0,0 +1,110 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+  %0 = loadraw.u32 [%arg0+0]
+  %1 = loadraw.u32 [%arg0+4]
+
+bb1: ; preds=[bb0,bb8] succs=[bb2,bb14]
+  %2 = phi [%3, bb8], [%1, bb0]
+  %4 = phi [%5, bb8], [%0, bb0]
+  %6 = phi [%7, bb8], [0:i32, bb0]
+  %8 = add64 %4, 6:i32
+  jgt64 %8, %2 -> bb14 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb8]
+  %9 = loadraw.u8 [%4+0]
+  jne32 %9, 72:i32 -> bb8 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb8]
+  %10 = loadraw.u8 [%4+1]
+  jne32 %10, 111:i32 -> bb8 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5,bb8]
+  %11 = loadraw.u8 [%4+2]
+  jne32 %11, 115:i32 -> bb8 else bb5
+
+bb5: ; preds=[bb4] succs=[bb6,bb8]
+  %12 = loadraw.u8 [%4+3]
+  jne32 %12, 116:i32 -> bb8 else bb6
+
+bb6: ; preds=[bb5] succs=[bb7,bb8]
+  %13 = loadraw.u8 [%4+4]
+  jne32 %13, 58:i32 -> bb8 else bb7
+
+bb7: ; preds=[bb6] succs=[bb8,bb10]
+  %14 = loadraw.u8 [%4+5]
+  jeq32 %14, 32:i32 -> bb10 else bb8
+
+bb8: ; preds=[bb2,bb3,bb4,bb5,bb6,bb7] succs=[bb9,bb1]
+  %3 = phi [%2, bb2], [%2, bb3], [%2, bb4], [%2, bb5], [%2, bb6], [%2, bb7]
+  %15 = phi [%4, bb2], [%4, bb3], [%4, bb4], [%4, bb5], [%4, bb6], [%4, bb7]
+  %16 = phi [%6, bb2], [%6, bb3], [%6, bb4], [%6, bb5], [%6, bb6], [%6, bb7]
+  %7 = add32 %16, 1:i32
+  %5 = add64 %15, 1:i32
+  %17 = and32 %16, 65535:i32
+  jlt32 %17, 506:i32 -> bb1 else bb9
+
+bb9: ; preds=[bb8] succs=[bb14]
+  ja bb14
+
+bb10: ; preds=[bb7] succs=[bb11]
+  storeraw.u16 [%sp-8+sp], 0:i32
+  storeraw.u64 [%sp-16+sp], 0:i32
+  storeraw.u64 [%sp-24+sp], 0:i32
+  storeraw.u64 [%sp-32+sp], 0:i32
+  storeraw.u64 [%sp-40+sp], 0:i32
+  storeraw.u64 [%sp-48+sp], 0:i32
+  storeraw.u64 [%sp-56+sp], 0:i32
+  storeraw.u64 [%sp-64+sp], 0:i32
+  storeraw.u64 [%sp-72+sp], 0:i32
+  storeraw.u64 [%sp-80+sp], 0:i32
+  storeraw.u64 [%sp-88+sp], 0:i32
+  storeraw.u64 [%sp-96+sp], 0:i32
+  storeraw.u64 [%sp-104+sp], 0:i32
+  storeraw.u64 [%sp-112+sp], 0:i32
+  storeraw.u64 [%sp-120+sp], 0:i32
+  storeraw.u64 [%sp-128+sp], 0:i32
+  storeraw.u64 [%sp-136+sp], 0:i32
+  storeraw.u64 [%sp-144+sp], 0:i32
+  storeraw.u64 [%sp-152+sp], 0:i32
+  storeraw.u64 [%sp-160+sp], 0:i32
+  storeraw.u64 [%sp-168+sp], 0:i32
+  storeraw.u64 [%sp-176+sp], 0:i32
+  storeraw.u64 [%sp-184+sp], 0:i32
+  storeraw.u64 [%sp-192+sp], 0:i32
+  storeraw.u64 [%sp-200+sp], 0:i32
+  storeraw.u64 [%sp-208+sp], 0:i32
+  storeraw.u64 [%sp-216+sp], 0:i32
+  storeraw.u64 [%sp-224+sp], 0:i32
+  storeraw.u64 [%sp-232+sp], 0:i32
+  storeraw.u64 [%sp-240+sp], 0:i32
+  storeraw.u64 [%sp-248+sp], 0:i32
+  storeraw.u64 [%sp-256+sp], 0:i32
+  storeraw.u64 [%sp-264+sp], 0:i32
+  storeraw.u8 [%sp-264+sp], 97:i32
+
+bb11: ; preds=[bb10,bb13] succs=[bb12,bb14]
+  %18 = phi [%18, bb13], [%2, bb10]
+  %19 = phi [%20, bb13], [0:i32, bb10]
+  %21 = phi [%21, bb13], [%4, bb10]
+  %22 = add64 %21, %19
+  %23 = add64 %22, 7:i32
+  jgt64 %23, %18 -> bb14 else bb12
+
+bb12: ; preds=[bb11] succs=[bb13,bb14]
+  %24 = loadraw.u8 [%22+6]
+  jeq32 %24, 13:i32 -> bb14 else bb13
+
+bb13: ; preds=[bb12] succs=[bb14,bb11]
+  %25 = add64 %sp, -264:i32
+  %26 = add64 %25, %19
+  storeraw.u8 [%26+0], %24
+  %27 = loadraw.u16 [%sp-8+sp]
+  %28 = add32 %27, 1:i32
+  storeraw.u16 [%sp-8+sp], %28
+  %20 = add64 %19, 1:i32
+  jne64 %20, 253:i32 -> bb11 else bb14
+
+bb14: ; preds=[bb1,bb9,bb11,bb12,bb13] succs=[]
+  ret 2:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loop1__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loop1__prog.epir
new file mode 100644
index 0000000..d314513
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loop1__prog.epir
@@ -0,0 +1,114 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb4]
+  %0 = call #5()
+  jeq64 %0, 0:i32 -> bb4 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb3] succs=[bb3,bb4]
+  %1 = phi [%1, bb3], [%0, bb1]
+  %2 = phi [%3, bb3], [0:i32, bb1]
+  %4 = call #5()
+  %5 = call #5()
+  %6 = call #5()
+  %7 = call #5()
+  %8 = call #5()
+  %9 = call #5()
+  %10 = call #5()
+  %11 = call #5()
+  %12 = call #5()
+  %13 = call #5()
+  %14 = call #5()
+  %15 = call #5()
+  %16 = call #5()
+  %17 = call #5()
+  %18 = call #5()
+  %19 = call #5()
+  %20 = call #5()
+  %21 = call #5()
+  %22 = call #5()
+  %23 = call #5()
+  %24 = call #5()
+  %25 = call #5()
+  %26 = call #5()
+  %27 = call #5()
+  %28 = call #5()
+  %29 = call #5()
+  %30 = call #5()
+  %31 = call #5()
+  %32 = call #5()
+  %33 = call #5()
+  %34 = call #5()
+  %35 = call #5()
+  %36 = call #5()
+  %37 = call #5()
+  %38 = call #5()
+  %39 = call #5()
+  %40 = call #5()
+  %41 = call #5()
+  %42 = call #5()
+  %43 = call #5()
+  %44 = call #5()
+  %45 = call #5()
+  %46 = call #5()
+  %47 = call #5()
+  %48 = call #5()
+  %49 = call #5()
+  %50 = call #5()
+  %51 = call #5()
+  %52 = call #5()
+  %53 = call #5()
+  %54 = call #5()
+  %55 = call #5()
+  %56 = call #5()
+  %57 = call #5()
+  %58 = call #5()
+  %59 = call #5()
+  %60 = call #5()
+  %61 = call #5()
+  %62 = call #5()
+  %63 = call #5()
+  %64 = call #5()
+  %65 = call #5()
+  %66 = call #5()
+  %67 = call #5()
+  %68 = call #5()
+  %69 = call #5()
+  %70 = call #5()
+  %71 = call #5()
+  %72 = call #5()
+  %73 = call #5()
+  %74 = call #5()
+  %75 = call #5()
+  %76 = call #5()
+  %77 = call #5()
+  %78 = call #5()
+  %79 = call #5()
+  %80 = call #5()
+  %81 = call #5()
+  %82 = call #5()
+  %83 = call #5()
+  %84 = call #5()
+  %85 = call #5()
+  %86 = call #5()
+  %87 = call #5()
+  %88 = call #5()
+  %89 = call #5()
+  %90 = call #5()
+  %91 = call #5()
+  %92 = call #5()
+  %93 = call #5()
+  %94 = call #5()
+  %95 = call #5()
+  %96 = call #5()
+  %97 = call #5()
+  %3 = add64 %2, 1:i32
+  jge64 %3, %1 -> bb4 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb2]
+  jlt64 %2, 8000:i32 -> bb2 else bb4
+
+bb4: ; preds=[bb0,bb2,bb3] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loop1med__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loop1med__prog.epir
new file mode 100644
index 0000000..4e11d3a
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loop1med__prog.epir
@@ -0,0 +1,44 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb4]
+  %0 = call #5()
+  jeq64 %0, 0:i32 -> bb4 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb3] succs=[bb3,bb4]
+  %1 = phi [%1, bb3], [%0, bb1]
+  %2 = phi [%3, bb3], [0:i32, bb1]
+  %4 = call #5()
+  %5 = call #5()
+  %6 = call #5()
+  %7 = call #5()
+  %8 = call #5()
+  %9 = call #5()
+  %10 = call #5()
+  %11 = call #5()
+  %12 = call #5()
+  %13 = call #5()
+  %14 = call #5()
+  %15 = call #5()
+  %16 = call #5()
+  %17 = call #5()
+  %18 = call #5()
+  %19 = call #5()
+  %20 = call #5()
+  %21 = call #5()
+  %22 = call #5()
+  %23 = call #5()
+  %24 = call #5()
+  %25 = call #5()
+  %26 = call #5()
+  %27 = call #5()
+  %3 = add64 %2, 1:i32
+  jge64 %3, %1 -> bb4 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb2]
+  jlt64 %2, 1000:i32 -> bb2 else bb4
+
+bb4: ; preds=[bb0,bb2,bb3] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loop1sim__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loop1sim__prog.epir
new file mode 100644
index 0000000..d556bb5
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loop1sim__prog.epir
@@ -0,0 +1,44 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb4]
+  %0 = call #5()
+  jeq64 %0, 0:i32 -> bb4 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb3] succs=[bb3,bb4]
+  %1 = phi [%1, bb3], [%0, bb1]
+  %2 = phi [%3, bb3], [0:i32, bb1]
+  %4 = call #5()
+  %5 = call #5()
+  %6 = call #5()
+  %7 = call #5()
+  %8 = call #5()
+  %9 = call #5()
+  %10 = call #5()
+  %11 = call #5()
+  %12 = call #5()
+  %13 = call #5()
+  %14 = call #5()
+  %15 = call #5()
+  %16 = call #5()
+  %17 = call #5()
+  %18 = call #5()
+  %19 = call #5()
+  %20 = call #5()
+  %21 = call #5()
+  %22 = call #5()
+  %23 = call #5()
+  %24 = call #5()
+  %25 = call #5()
+  %26 = call #5()
+  %27 = call #5()
+  %3 = add64 %2, 1:i32
+  jge64 %3, %1 -> bb4 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb2]
+  jlt64 %2, 100:i32 -> bb2 else bb4
+
+bb4: ; preds=[bb0,bb2,bb3] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loop2__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loop2__prog.epir
new file mode 100644
index 0000000..996d1f3
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loop2__prog.epir
@@ -0,0 +1,16 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+
+bb1: ; preds=[bb0,bb1] succs=[bb2,bb1]
+  %0 = phi [%1, bb1], [1000:i32, bb0]
+  %2 = call #5()
+  %3 = call #5()
+  %1 = add64 %0, -1:i32
+  jne64 %1, 0:i32 -> bb1 else bb2
+
+bb2: ; preds=[bb1] succs=[]
+  %4 = loadimm.imm64 0
+  %5 = call #6(%4, 14:i32, 1000:i32)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loop3__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loop3__prog.epir
new file mode 100644
index 0000000..23b47d3
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loop3__prog.epir
@@ -0,0 +1,28 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+
+bb1: ; preds=[bb0,bb2] succs=[bb2,bb3]
+  %0 = phi [%1, bb2], [0:i32, bb0]
+  %2 = call #5()
+  %3 = mod64 %2, 100:i32
+  %4 = mul32 %3, 86:i32
+  %5 = rsh32 %4, 8:i32
+  %6 = mul32 %3, 103:i32
+  %7 = rsh32 %6, 10:i32
+  %8 = add32 %7, %5
+  %9 = mul32 %3, 147:i32
+  %10 = rsh32 %9, 10:i32
+  %11 = add32 %8, %10
+  %12 = add64 %0, %11
+  %13 = loadimm.imm64 0
+  %14 = call #6(%13, 5:i32, %12)
+  %1 = add64 %0, -1:i32
+  jeq64 %1, -10000:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb1]
+  ja bb1
+
+bb3: ; preds=[bb1] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loop4__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loop4__prog.epir
new file mode 100644
index 0000000..02fd9bf
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loop4__prog.epir
@@ -0,0 +1,22 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+  %0 = call #5()
+
+bb1: ; preds=[bb0,bb2] succs=[bb2,bb3]
+  %1 = phi [%2, bb2], [100:i32, bb0]
+  %3 = phi [%4, bb2], [0:i32, bb0]
+  %5 = call #5()
+  %6 = mod64 %5, 7:i32
+  %4 = add32 %3, %6
+  %2 = add64 %1, -1:i32
+  jeq64 %2, 0:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb1]
+  ja bb1
+
+bb3: ; preds=[bb1] succs=[]
+  %7 = loadimm.imm64 0
+  %8 = call #6(%7, 3:i32, %4)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loopnested__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loopnested__prog.epir
new file mode 100644
index 0000000..0d7b47f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loopnested__prog.epir
@@ -0,0 +1,17 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %1 = phi [%2, bb2], [5000:i32, bb1]
+  %3 = call #5()
+  %2 = add32 %1, -1:i32
+  jne32 %2, 0:i32 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_counter_loopwithif__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_counter_loopwithif__prog.epir
new file mode 100644
index 0000000..16b0c86
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_counter_loopwithif__prog.epir
@@ -0,0 +1,41 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb5]
+  %0 = call #5()
+  %1 = mod64 %0, 10:i32
+  jlt64 %1, 6:i32 -> bb5 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb3] succs=[bb3,bb9]
+  %2 = phi [%2, bb3], [%1, bb1]
+  %3 = phi [%4, bb3], [0:i32, bb1]
+  %5 = call #5()
+  %4 = add32 %3, 1:i32
+  jge32 %4, %2 -> bb9 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb2]
+  jlt32 %3, 5000:i32 -> bb2 else bb4
+
+bb4: ; preds=[bb3] succs=[bb9]
+  ja bb9
+
+bb5: ; preds=[bb0] succs=[bb6,bb9]
+  %6 = call #5()
+  jeq64 %6, 0:i32 -> bb9 else bb6
+
+bb6: ; preds=[bb5] succs=[bb7]
+
+bb7: ; preds=[bb6,bb8] succs=[bb8,bb9]
+  %7 = phi [%7, bb8], [%6, bb6]
+  %8 = phi [%9, bb8], [0:i32, bb6]
+  %10 = call #5()
+  %9 = add64 %8, 1:i32
+  jle64 %7, %9 -> bb9 else bb8
+
+bb8: ; preds=[bb7] succs=[bb9,bb7]
+  jlt64 %8, 5000:i32 -> bb7 else bb9
+
+bb9: ; preds=[bb2,bb4,bb5,bb7,bb8] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero2__handle_tp.epir b/core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero2__handle_tp.epir
new file mode 100644
index 0000000..31d9fa8
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero2__handle_tp.epir
@@ -0,0 +1,14 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = call #5()
+  %1 = and64 %0, 1:i32
+  jne64 %1, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+  %2 = loadimm.imm64 0
+  %3 = call #6(%2, 4:i32, 10:i32)
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero__handle_tp.epir b/core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero__handle_tp.epir
new file mode 100644
index 0000000..021277f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_div_by_zero_div_by_zero__handle_tp.epir
@@ -0,0 +1,5 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_masking_map_val_accepted__handle_tracepoint.epir b/core-rs/epass-ir/tests/epir/evaluation_masking_map_val_accepted__handle_tracepoint.epir
new file mode 100644
index 0000000..eebb0e8
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_masking_map_val_accepted__handle_tracepoint.epir
@@ -0,0 +1,65 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  storeraw.u8 [%sp-1+sp], 1:i32
+  %0 = add64 %sp, -1:i32
+  %1 = loadimm.imm64 0
+  %2 = call #1(%1, %0)
+  jne64 %2, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb6]
+  storeraw.u32 [%sp-8+sp], 0:i32
+  storeraw.u32 [%sp-108+sp], 1:i32
+  storeraw.u32 [%sp-104+sp], 0:i32
+  storeraw.u32 [%sp-100+sp], 0:i32
+  storeraw.u32 [%sp-12+sp], 0:i32
+  storeraw.u32 [%sp-16+sp], 0:i32
+  storeraw.u32 [%sp-20+sp], 0:i32
+  storeraw.u32 [%sp-24+sp], 0:i32
+  storeraw.u32 [%sp-28+sp], 0:i32
+  storeraw.u32 [%sp-32+sp], 0:i32
+  storeraw.u32 [%sp-36+sp], 0:i32
+  storeraw.u32 [%sp-40+sp], 0:i32
+  storeraw.u32 [%sp-44+sp], 0:i32
+  storeraw.u32 [%sp-48+sp], 0:i32
+  storeraw.u32 [%sp-52+sp], 0:i32
+  storeraw.u32 [%sp-56+sp], 0:i32
+  storeraw.u32 [%sp-60+sp], 0:i32
+  storeraw.u32 [%sp-64+sp], 0:i32
+  storeraw.u32 [%sp-68+sp], 0:i32
+  storeraw.u32 [%sp-72+sp], 0:i32
+  storeraw.u32 [%sp-76+sp], 0:i32
+  storeraw.u32 [%sp-80+sp], 0:i32
+  storeraw.u32 [%sp-84+sp], 0:i32
+  storeraw.u32 [%sp-88+sp], 0:i32
+  storeraw.u32 [%sp-92+sp], 0:i32
+  storeraw.u32 [%sp-96+sp], 0:i32
+  storeraw.u8 [%sp-104+sp], 44:i32
+  %3 = add64 %sp, -1:i32
+  %4 = add64 %sp, -108:i32
+  %5 = loadimm.imm64 0
+  %6 = call #2(%5, %3, %4, 1:i32)
+  ja bb6
+
+bb2: ; preds=[bb0] succs=[bb3,bb5]
+  %7 = loadraw.u32 [%2+0]
+  jgt32 %7, 99:i32 -> bb5 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb5]
+  %8 = add64 %2, 4:i32
+  %9 = add64 %8, %7
+  storeraw.u8 [%9+0], 44:i32
+  jeq32 %7, 99:i32 -> bb5 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+  storeraw.u8 [%9+1], 44:i32
+  %10 = add32 %7, 2:i32
+
+bb5: ; preds=[bb2,bb3,bb4] succs=[bb6]
+  %11 = phi [%7, bb2], [100:i32, bb3], [%10, bb4]
+  %12 = phi [%2, bb2], [%2, bb3], [%2, bb4]
+  storeraw.u32 [%12+0], %11
+
+bb6: ; preds=[bb1,bb5] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_masking_map_val_rejected__handle_tracepoint.epir b/core-rs/epass-ir/tests/epir/evaluation_masking_map_val_rejected__handle_tracepoint.epir
new file mode 100644
index 0000000..5cb98f1
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_masking_map_val_rejected__handle_tracepoint.epir
@@ -0,0 +1,64 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  storeraw.u8 [%sp-1+sp], 1:i32
+  %0 = add64 %sp, -1:i32
+  %1 = loadimm.imm64 0
+  %2 = call #1(%1, %0)
+  jne64 %2, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb5]
+  storeraw.u32 [%sp-8+sp], 0:i32
+  storeraw.u32 [%sp-108+sp], 1:i32
+  storeraw.u32 [%sp-104+sp], 0:i32
+  storeraw.u32 [%sp-100+sp], 0:i32
+  storeraw.u32 [%sp-12+sp], 0:i32
+  storeraw.u32 [%sp-16+sp], 0:i32
+  storeraw.u32 [%sp-20+sp], 0:i32
+  storeraw.u32 [%sp-24+sp], 0:i32
+  storeraw.u32 [%sp-28+sp], 0:i32
+  storeraw.u32 [%sp-32+sp], 0:i32
+  storeraw.u32 [%sp-36+sp], 0:i32
+  storeraw.u32 [%sp-40+sp], 0:i32
+  storeraw.u32 [%sp-44+sp], 0:i32
+  storeraw.u32 [%sp-48+sp], 0:i32
+  storeraw.u32 [%sp-52+sp], 0:i32
+  storeraw.u32 [%sp-56+sp], 0:i32
+  storeraw.u32 [%sp-60+sp], 0:i32
+  storeraw.u32 [%sp-64+sp], 0:i32
+  storeraw.u32 [%sp-68+sp], 0:i32
+  storeraw.u32 [%sp-72+sp], 0:i32
+  storeraw.u32 [%sp-76+sp], 0:i32
+  storeraw.u32 [%sp-80+sp], 0:i32
+  storeraw.u32 [%sp-84+sp], 0:i32
+  storeraw.u32 [%sp-88+sp], 0:i32
+  storeraw.u32 [%sp-92+sp], 0:i32
+  storeraw.u32 [%sp-96+sp], 0:i32
+  storeraw.u8 [%sp-104+sp], 44:i32
+  %3 = add64 %sp, -1:i32
+  %4 = add64 %sp, -108:i32
+  %5 = loadimm.imm64 0
+  %6 = call #2(%5, %3, %4, 1:i32)
+  ja bb5
+
+bb2: ; preds=[bb0] succs=[bb3,bb5]
+  %7 = loadraw.u32 [%2+0]
+  jgt32 %7, 99:i32 -> bb5 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb5]
+  %8 = add64 %2, 4:i32
+  %9 = add64 %8, %7
+  storeraw.u8 [%9+0], 44:i32
+  %10 = add32 %7, 1:i32
+  storeraw.u32 [%2+0], %10
+  jeq32 %7, 99:i32 -> bb5 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+  %11 = add64 %8, %10
+  storeraw.u8 [%11+0], 44:i32
+  %12 = add32 %7, 2:i32
+  storeraw.u32 [%2+0], %12
+
+bb5: ; preds=[bb1,bb2,bb3,bb4] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_masking_mask__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_masking_mask__prog.epir
new file mode 100644
index 0000000..e8c9db6
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_masking_mask__prog.epir
@@ -0,0 +1,23 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = call #5()
+  %1 = loadimm.imm64 0
+  storeraw.u32 [%1+32], 8:i32
+  storeraw.u32 [%1+28], 7:i32
+  storeraw.u32 [%1+24], 6:i32
+  storeraw.u32 [%1+20], 5:i32
+  storeraw.u32 [%1+16], 4:i32
+  storeraw.u32 [%1+12], 3:i32
+  storeraw.u32 [%1+8], 2:i32
+  storeraw.u32 [%1+4], 1:i32
+  storeraw.u32 [%1+36], 9:i32
+  storeraw.u32 [%1+0], 0:i32
+  %2 = mod64 %0, 10:i32
+  %3 = lsh64 %2, 2:i32
+  %4 = add64 %1, %3
+  %5 = loadraw.u32 [%4+0]
+  %6 = loadimm.imm64 0
+  %7 = call #6(%6, 9:i32, %5)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_masking_masksimple__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_masking_masksimple__prog.epir
new file mode 100644
index 0000000..e3d0781
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_masking_masksimple__prog.epir
@@ -0,0 +1,7 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadimm.imm64 0
+  %1 = call #6(%0, 3:i32)
+  ret 2:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_msan_msan1__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_msan_msan1__prog.epir
new file mode 100644
index 0000000..58b042a
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_msan_msan1__prog.epir
@@ -0,0 +1,10 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  storeraw.u32 [%sp-8+sp], 174486369:i32
+  storeraw.u8 [%sp-4+sp], 0:i32
+  %0 = add64 %sp, -8:i32
+  %1 = loadimm.imm64 0
+  %2 = call #6(%1, 4:i32, %0)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_msan_msan2__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_msan_msan2__prog.epir
new file mode 100644
index 0000000..c0570c0
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_msan_msan2__prog.epir
@@ -0,0 +1,17 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = call #5()
+  %1 = and32 %0, 1:i32
+  storeraw.u32 [%sp-20+sp], %1
+  %2 = add32 %1, -1:i32
+  storeraw.u32 [%sp-16+sp], %2
+  %3 = and64 %0, 1:i32
+  %4 = lsh64 %3, 2:i32
+  %5 = add64 %sp, -20:i32
+  %6 = add64 %5, %4
+  %7 = loadraw.u32 [%6+0]
+  %8 = loadimm.imm64 0
+  %9 = call #6(%8, 4:i32, %7)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_msan_msan3__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_msan_msan3__prog.epir
new file mode 100644
index 0000000..64c3ae4
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_msan_msan3__prog.epir
@@ -0,0 +1,20 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = call #5()
+  storeraw.u32 [%sp-60+sp], 0:i32
+  %1 = and64 %0, 1:i32
+  %2 = lsh64 %1, 2:i32
+  %3 = add64 %sp, -80:i32
+  %4 = add64 %3, %2
+  %5 = loadraw.u32 [%4+16]
+  jeq32 %5, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+  %6 = add64 %4, 16:i32
+  %7 = loadimm.imm64 0
+  %8 = call #6(%7, 4:i32, %6)
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_msan_simpl1__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_msan_simpl1__prog.epir
new file mode 100644
index 0000000..0124b9f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_msan_simpl1__prog.epir
@@ -0,0 +1,9 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  storeraw.u8 [%sp-1+sp], 97:i32
+  %0 = add64 %sp, -1:i32
+  %1 = loadimm.imm64 0
+  %2 = call #6(%1, 4:i32, %0)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_msan_simpl2__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_msan_simpl2__prog.epir
new file mode 100644
index 0000000..021277f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_msan_simpl2__prog.epir
@@ -0,0 +1,5 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/evaluation_msan_simpl3__prog.epir b/core-rs/epass-ir/tests/epir/evaluation_msan_simpl3__prog.epir
new file mode 100644
index 0000000..021277f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/evaluation_msan_simpl3__prog.epir
@@ -0,0 +1,5 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/min_phi_6.epir b/core-rs/epass-ir/tests/epir/min_phi_6.epir
new file mode 100644
index 0000000..29e047d
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/min_phi_6.epir
@@ -0,0 +1,36 @@
+; ePass IR v1
+
+bb0:
+  %a0 = loadimm.imm64 0
+  %a1 = loadimm.imm64 1
+  %a2 = loadimm.imm64 2
+  %a3 = loadimm.imm64 3
+  %a4 = loadimm.imm64 4
+  %a5 = loadimm.imm64 5
+  ja bb1
+
+bb1:
+  %p0 = phi [%a0, bb0], [%n0, bb2]
+  %p1 = phi [%a1, bb0], [%n1, bb2]
+  %p2 = phi [%a2, bb0], [%n2, bb2]
+  %p3 = phi [%a3, bb0], [%n3, bb2]
+  %p4 = phi [%a4, bb0], [%n4, bb2]
+  %p5 = phi [%a5, bb0], [%n5, bb2]
+  %s1 = add64 %p0, %p1
+  %s2 = add64 %s1, %p2
+  %s3 = add64 %s2, %p3
+  %s4 = add64 %s3, %p4
+  %sum = add64 %s4, %p5
+  jgt64 %sum, 1000000:i64 -> bb3 else bb2
+
+bb2:
+  %n0 = add64 %p0, 1:i64
+  %n1 = add64 %p1, 1:i64
+  %n2 = add64 %p2, 1:i64
+  %n3 = add64 %p3, 1:i64
+  %n4 = add64 %p4, 1:i64
+  %n5 = add64 %p5, 1:i64
+  ja bb1
+
+bb3:
+  ret %sum
diff --git a/core-rs/epass-ir/tests/epir/progs_Thejokr_ebpf-playground_probe__prog.epir b/core-rs/epass-ir/tests/epir/progs_Thejokr_ebpf-playground_probe__prog.epir
new file mode 100644
index 0000000..d527b5b
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_Thejokr_ebpf-playground_probe__prog.epir
@@ -0,0 +1,439 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb7]
+  %0 = loadraw.u64 [%arg0+88]
+  jne32 %0, 0:i32 -> bb7 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb7]
+  %1 = loadraw.u64 [%arg0+80]
+  %2 = lsh64 %1, 32:i32
+  %3 = rsh64 %2, 32:i32
+  jeq64 %3, 0:i32 -> bb7 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb7]
+  %4 = loadimm.imm64 0
+  %5 = call #131(%4, 504:i32, 0:i32)
+  jeq64 %5, 0:i32 -> bb7 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb8]
+  %6 = add64 %sp, -144:i32
+  %7 = call #112(%6, 120:i32, %3)
+  jeq64 %7, 0:i32 -> bb8 else bb4
+
+bb4: ; preds=[bb3] succs=[bb7]
+  %8 = call #133(%5, 1:i32)
+  ja bb7
+
+bb5: ; preds=[bb30,bb31,bb43,bb44,bb54,bb55,bb68,bb69] succs=[bb6]
+  %9 = loadraw.u64 [%sp-160+sp]
+  %10 = loadraw.u64 [%sp-184+sp]
+  storeraw.u16 [%9+4], %10
+
+bb6: ; preds=[bb13,bb19,bb20,bb24,bb74,bb5] succs=[bb7]
+  %11 = loadraw.u64 [%sp-160+sp]
+  %12 = call #132(%11, 0:i32)
+
+bb7: ; preds=[bb0,bb1,bb2,bb4,bb6] succs=[]
+  %13 = phi [0:i32, bb0], [0:i32, bb1], [0:i32, bb2], [1:i32, bb4], [0:i32, bb6]
+  ret %13
+
+bb8: ; preds=[bb3] succs=[bb9,bb10]
+  storeraw.u64 [%sp-152+sp], 0:i32
+  %14 = loadimm.imm64 0
+  %15 = loadraw.u64 [%14+0]
+  %16 = loadimm.imm64 0
+  %17 = loadraw.u64 [%16+0]
+  %18 = add64 %sp, -152:i32
+  %19 = call #120(%15, %17, %18, 8:i32)
+  jeq64 %19, 0:i32 -> bb10 else bb9
+
+bb9: ; preds=[bb8] succs=[bb10]
+  %20 = call #14()
+  %21 = rsh64 %20, 32:i32
+  storeraw.u32 [%sp-148+sp], %21
+
+bb10: ; preds=[bb8,bb9] succs=[bb11,bb13]
+  %22 = phi [%5, bb8], [%5, bb9]
+  %23 = loadraw.u32 [%sp-104+sp]
+  %24 = lsh32 %23, 4:i32
+  %25 = loadraw.u32 [%sp-100+sp]
+  %26 = and32 %25, 15:i32
+  %27 = or32 %26, %24
+  %28 = loadraw.u32 [%sp-128+sp]
+  %29 = loadraw.u64 [%sp-72+sp]
+  jslt64 %29, 0:i32 -> bb13 else bb11
+
+bb11: ; preds=[bb10] succs=[bb12,bb13]
+  %30 = loadimm.imm64 4294967294
+  jsgt64 %29, %30 -> bb13 else bb12
+
+bb12: ; preds=[bb11] succs=[bb13]
+
+bb13: ; preds=[bb10,bb11,bb12] succs=[bb14,bb6]
+  %31 = phi [%27, bb10], [%27, bb11], [%27, bb12]
+  %32 = phi [%28, bb10], [%28, bb11], [%28, bb12]
+  %33 = phi [-1:i32, bb10], [-2:i32, bb11], [%29, bb12]
+  %34 = phi [%22, bb10], [%22, bb11], [%22, bb12]
+  %35 = loadraw.u32 [%sp-148+sp]
+  storeraw.u32 [%34+12], %35
+  storeraw.u32 [%34+8], %33
+  storeraw.u16 [%34+6], %32
+  storeraw.u16 [%34+4], 0:i32
+  storeraw.u16 [%34+2], 0:i32
+  storeraw.u8 [%34+1], %31
+  storeraw.u64 [%sp-160+sp], %34
+  storeraw.u8 [%34+0], 1:i32
+  %36 = loadraw.u64 [%sp-32+sp]
+  %37 = add64 %sp, -144:i32
+  %38 = call #112(%37, 56:i32, %36)
+  jne64 %38, 0:i32 -> bb6 else bb14
+
+bb14: ; preds=[bb13] succs=[bb15,bb24]
+  %39 = loadraw.u32 [%sp-136+sp]
+  jslt32 %39, 1:i32 -> bb24 else bb15
+
+bb15: ; preds=[bb14] succs=[bb16,bb17]
+  jlt32 %39, 488:i32 -> bb17 else bb16
+
+bb16: ; preds=[bb15] succs=[bb17]
+
+bb17: ; preds=[bb15,bb16] succs=[bb18]
+  %40 = phi [%39, bb15], [488:i32, bb16]
+  %41 = loadraw.u64 [%sp-144+sp]
+  %42 = loadraw.u64 [%sp-160+sp]
+  %43 = add64 %42, 16:i32
+  storeraw.u64 [%sp-168+sp], %43
+
+bb18: ; preds=[bb17,bb22] succs=[bb19,bb22]
+  %44 = phi [%45, bb22], [%41, bb17]
+  %46 = phi [%47, bb22], [0:i32, bb17]
+  %48 = phi [%49, bb22], [%40, bb17]
+  %50 = phi [%51, bb22], [256:i32, bb17]
+  %52 = and64 %50, %48
+  jeq64 %52, 0:i32 -> bb22 else bb19
+
+bb19: ; preds=[bb18] succs=[bb20,bb6]
+  %53 = sub64 488:i32, %50
+  jgt64 %46, %53 -> bb6 else bb20
+
+bb20: ; preds=[bb19] succs=[bb21,bb6]
+  %54 = loadraw.u64 [%sp-168+sp]
+  %55 = add64 %54, %46
+  %56 = call #112(%55, %50, %44)
+  jne64 %56, 0:i32 -> bb6 else bb21
+
+bb21: ; preds=[bb20] succs=[bb22]
+  %57 = add64 %50, %46
+  %58 = add64 %44, %50
+
+bb22: ; preds=[bb18,bb21] succs=[bb23,bb18]
+  %45 = phi [%44, bb18], [%58, bb21]
+  %47 = phi [%46, bb18], [%57, bb21]
+  %49 = phi [%48, bb18], [%48, bb21]
+  %59 = phi [%50, bb18], [%50, bb21]
+  %51 = rsh64 %59, 1:i32
+  jne64 %51, 0:i32 -> bb18 else bb23
+
+bb23: ; preds=[bb22] succs=[bb24]
+
+bb24: ; preds=[bb14,bb23] succs=[bb25,bb6]
+  %60 = phi [0:i32, bb14], [%49, bb23]
+  %61 = loadraw.u64 [%sp-160+sp]
+  storeraw.u8 [%61+2], %60
+  %62 = loadraw.u64 [%sp-128+sp]
+  %63 = add64 %sp, -144:i32
+  %64 = call #112(%63, 144:i32, %62)
+  jne64 %64, 0:i32 -> bb6 else bb25
+
+bb25: ; preds=[bb24] succs=[bb26,bb35]
+  %65 = loadraw.u64 [%sp-160+sp]
+  %66 = loadraw.u8 [%65+2]
+  %67 = loadraw.u32 [%sp-136+sp]
+  jslt32 %67, 1:i32 -> bb35 else bb26
+
+bb26: ; preds=[bb25] succs=[bb27,bb28]
+  %68 = sub64 488:i32, %66
+  %69 = lsh64 %67, 32:i32
+  %70 = arsh64 %69, 32:i32
+  jlt64 %68, %70 -> bb28 else bb27
+
+bb27: ; preds=[bb26] succs=[bb28]
+
+bb28: ; preds=[bb26,bb27] succs=[bb29]
+  %71 = phi [%68, bb26], [%70, bb27]
+  %72 = phi [%66, bb26], [%66, bb27]
+  %73 = phi [%65, bb26], [%65, bb27]
+  %74 = loadraw.u64 [%sp-144+sp]
+  %75 = add64 %73, 16:i32
+  storeraw.u64 [%sp-168+sp], %75
+  storeraw.u64 [%sp-184+sp], %72
+
+bb29: ; preds=[bb28,bb33] succs=[bb30,bb33]
+  %76 = phi [%77, bb33], [%74, bb28]
+  %78 = phi [%79, bb33], [%72, bb28]
+  %80 = phi [%81, bb33], [%71, bb28]
+  %82 = phi [%83, bb33], [256:i32, bb28]
+  %84 = and64 %82, %80
+  jeq64 %84, 0:i32 -> bb33 else bb30
+
+bb30: ; preds=[bb29] succs=[bb31,bb5]
+  %85 = sub64 488:i32, %82
+  jgt64 %78, %85 -> bb5 else bb31
+
+bb31: ; preds=[bb30] succs=[bb32,bb5]
+  %86 = loadraw.u64 [%sp-168+sp]
+  %87 = add64 %86, %78
+  %88 = call #112(%87, %82, %76)
+  jne64 %88, 0:i32 -> bb5 else bb32
+
+bb32: ; preds=[bb31] succs=[bb33]
+  %89 = add64 %82, %78
+  %90 = add64 %76, %82
+
+bb33: ; preds=[bb29,bb32] succs=[bb34,bb29]
+  %77 = phi [%76, bb29], [%90, bb32]
+  %79 = phi [%78, bb29], [%89, bb32]
+  %81 = phi [%80, bb29], [%80, bb32]
+  %91 = phi [%82, bb29], [%82, bb32]
+  %83 = rsh64 %91, 1:i32
+  jne64 %83, 0:i32 -> bb29 else bb34
+
+bb34: ; preds=[bb33] succs=[bb35]
+  %92 = loadraw.u64 [%sp-160+sp]
+  %93 = loadraw.u64 [%sp-184+sp]
+
+bb35: ; preds=[bb25,bb34] succs=[bb36,bb37]
+  %94 = phi [%65, bb25], [%92, bb34]
+  %95 = phi [%66, bb25], [%93, bb34]
+  %96 = phi [0:i32, bb25], [%81, bb34]
+  %97 = lsh64 %96, 32:i32
+  %98 = arsh64 %97, 32:i32
+  %99 = add64 %98, %95
+  jgt64 %99, 485:i32 -> bb37 else bb36
+
+bb36: ; preds=[bb35] succs=[bb37]
+  %100 = add64 %94, %99
+  storeraw.u8 [%100+18], 47:i32
+  storeraw.u8 [%100+17], 47:i32
+  storeraw.u8 [%100+16], 58:i32
+  %101 = add64 %99, 3:i32
+
+bb37: ; preds=[bb35,bb36] succs=[bb38,bb48]
+  %102 = phi [%94, bb35], [%94, bb36]
+  %103 = phi [%99, bb35], [%101, bb36]
+  storeraw.u64 [%sp-168+sp], 0:i32
+  jgt64 %103, 487:i32 -> bb48 else bb38
+
+bb38: ; preds=[bb37] succs=[bb39,bb48]
+  %104 = loadraw.u32 [%sp-96+sp]
+  jslt32 %104, 1:i32 -> bb48 else bb39
+
+bb39: ; preds=[bb38] succs=[bb40,bb41]
+  %105 = sub64 488:i32, %103
+  %106 = lsh64 %104, 32:i32
+  %107 = arsh64 %106, 32:i32
+  jlt64 %105, %107 -> bb41 else bb40
+
+bb40: ; preds=[bb39] succs=[bb41]
+
+bb41: ; preds=[bb39,bb40] succs=[bb42]
+  %108 = phi [%105, bb39], [%107, bb40]
+  %109 = phi [%103, bb39], [%103, bb40]
+  %110 = phi [%102, bb39], [%102, bb40]
+  %111 = loadraw.u64 [%sp-104+sp]
+  %112 = add64 %110, 16:i32
+  storeraw.u64 [%sp-176+sp], %112
+  storeraw.u64 [%sp-184+sp], %109
+
+bb42: ; preds=[bb41,bb46] succs=[bb43,bb46]
+  %113 = phi [%114, bb46], [%111, bb41]
+  %115 = phi [%116, bb46], [%109, bb41]
+  %117 = phi [%118, bb46], [%108, bb41]
+  %119 = phi [%120, bb46], [256:i32, bb41]
+  %121 = and64 %119, %117
+  jeq64 %121, 0:i32 -> bb46 else bb43
+
+bb43: ; preds=[bb42] succs=[bb44,bb5]
+  %122 = sub64 488:i32, %119
+  jgt64 %115, %122 -> bb5 else bb44
+
+bb44: ; preds=[bb43] succs=[bb45,bb5]
+  %123 = loadraw.u64 [%sp-176+sp]
+  %124 = add64 %123, %115
+  %125 = call #112(%124, %119, %113)
+  jne64 %125, 0:i32 -> bb5 else bb45
+
+bb45: ; preds=[bb44] succs=[bb46]
+  %126 = add64 %119, %115
+  %127 = add64 %113, %119
+
+bb46: ; preds=[bb42,bb45] succs=[bb47,bb42]
+  %114 = phi [%113, bb42], [%127, bb45]
+  %116 = phi [%115, bb42], [%126, bb45]
+  %118 = phi [%117, bb42], [%117, bb45]
+  %128 = phi [%119, bb42], [%119, bb45]
+  %120 = rsh64 %128, 1:i32
+  jne64 %120, 0:i32 -> bb42 else bb47
+
+bb47: ; preds=[bb46] succs=[bb48]
+  %129 = loadraw.u64 [%sp-160+sp]
+  %130 = loadraw.u64 [%sp-184+sp]
+
+bb48: ; preds=[bb37,bb38,bb47] succs=[bb49,bb59]
+  %131 = phi [%102, bb37], [%102, bb38], [%129, bb47]
+  %132 = phi [%103, bb37], [%103, bb38], [%130, bb47]
+  %133 = phi [0:i32, bb37], [0:i32, bb38], [%118, bb47]
+  %134 = lsh64 %133, 32:i32
+  %135 = arsh64 %134, 32:i32
+  %136 = add64 %132, %135
+  %137 = loadraw.u32 [%sp-80+sp]
+  jslt32 %137, 1:i32 -> bb59 else bb49
+
+bb49: ; preds=[bb48] succs=[bb50,bb59]
+  jgt64 %136, 487:i32 -> bb59 else bb50
+
+bb50: ; preds=[bb49] succs=[bb51,bb52]
+  %138 = sub64 488:i32, %136
+  %139 = lsh64 %137, 32:i32
+  %140 = arsh64 %139, 32:i32
+  storeraw.u64 [%sp-168+sp], %138
+  jlt64 %138, %140 -> bb52 else bb51
+
+bb51: ; preds=[bb50] succs=[bb52]
+  storeraw.u64 [%sp-168+sp], %140
+
+bb52: ; preds=[bb50,bb51] succs=[bb53]
+  %141 = phi [%136, bb50], [%136, bb51]
+  %142 = phi [%131, bb50], [%131, bb51]
+  %143 = loadraw.u64 [%sp-88+sp]
+  %144 = add64 %142, 16:i32
+  storeraw.u64 [%sp-184+sp], %141
+
+bb53: ; preds=[bb52,bb57] succs=[bb54,bb57]
+  %145 = phi [%146, bb57], [%143, bb52]
+  %147 = phi [%148, bb57], [%144, bb52]
+  %149 = phi [%150, bb57], [%141, bb52]
+  %151 = phi [%152, bb57], [256:i32, bb52]
+  %153 = loadraw.u64 [%sp-168+sp]
+  %154 = and64 %151, %153
+  jeq64 %154, 0:i32 -> bb57 else bb54
+
+bb54: ; preds=[bb53] succs=[bb55,bb5]
+  %155 = sub64 488:i32, %151
+  jgt64 %149, %155 -> bb5 else bb55
+
+bb55: ; preds=[bb54] succs=[bb56,bb5]
+  %156 = add64 %147, %149
+  %157 = call #112(%156, %151, %145)
+  jne64 %157, 0:i32 -> bb5 else bb56
+
+bb56: ; preds=[bb55] succs=[bb57]
+  %158 = add64 %151, %149
+  %159 = add64 %145, %151
+
+bb57: ; preds=[bb53,bb56] succs=[bb58,bb53]
+  %146 = phi [%145, bb53], [%159, bb56]
+  %150 = phi [%149, bb53], [%158, bb56]
+  %148 = phi [%147, bb53], [%147, bb56]
+  %160 = phi [%151, bb53], [%151, bb56]
+  %152 = rsh64 %160, 1:i32
+  jne64 %152, 0:i32 -> bb53 else bb58
+
+bb58: ; preds=[bb57] succs=[bb59]
+  %161 = loadraw.u64 [%sp-160+sp]
+  %162 = loadraw.u64 [%sp-184+sp]
+
+bb59: ; preds=[bb48,bb49,bb58] succs=[bb60,bb61]
+  %163 = phi [%131, bb48], [%131, bb49], [%161, bb58]
+  %164 = phi [%136, bb48], [%136, bb49], [%162, bb58]
+  %165 = loadraw.u64 [%sp-168+sp]
+  %166 = lsh64 %165, 32:i32
+  %167 = arsh64 %166, 32:i32
+  %168 = add64 %164, %167
+  %169 = loadraw.u8 [%sp-55+sp]
+  jne32 %169, 0:i32 -> bb61 else bb60
+
+bb60: ; preds=[bb59] succs=[bb61,bb74]
+  %170 = loadraw.u32 [%sp-40+sp]
+  jslt32 %170, 1:i32 -> bb74 else bb61
+
+bb61: ; preds=[bb59,bb60] succs=[bb62,bb73]
+  %171 = phi [%163, bb59], [%163, bb60]
+  %172 = phi [%168, bb59], [%168, bb60]
+  jgt64 %172, 487:i32 -> bb73 else bb62
+
+bb62: ; preds=[bb61] succs=[bb63,bb73]
+  %173 = add64 %171, 16:i32
+  storeraw.u64 [%sp-168+sp], %173
+  %174 = add64 %173, %172
+  storeraw.u8 [%174+0], 63:i32
+  %175 = add64 %172, 1:i32
+  jeq64 %172, 487:i32 -> bb73 else bb63
+
+bb63: ; preds=[bb62] succs=[bb64,bb73]
+  %176 = loadraw.u32 [%sp-40+sp]
+  jslt32 %176, 1:i32 -> bb73 else bb64
+
+bb64: ; preds=[bb63] succs=[bb65,bb66]
+  %177 = sub64 487:i32, %172
+  %178 = lsh64 %176, 32:i32
+  %179 = arsh64 %178, 32:i32
+  jlt64 %177, %179 -> bb66 else bb65
+
+bb65: ; preds=[bb64] succs=[bb66]
+
+bb66: ; preds=[bb64,bb65] succs=[bb67]
+  %180 = phi [%177, bb64], [%179, bb65]
+  %181 = phi [%175, bb64], [%175, bb65]
+  %182 = loadraw.u64 [%sp-48+sp]
+  storeraw.u64 [%sp-184+sp], %181
+
+bb67: ; preds=[bb66,bb71] succs=[bb68,bb71]
+  %183 = phi [%184, bb71], [%181, bb66]
+  %185 = phi [%186, bb71], [%182, bb66]
+  %187 = phi [%188, bb71], [%181, bb66]
+  %189 = phi [%190, bb71], [%180, bb66]
+  %191 = phi [%192, bb71], [256:i32, bb66]
+  %193 = and64 %191, %189
+  jeq64 %193, 0:i32 -> bb71 else bb68
+
+bb68: ; preds=[bb67] succs=[bb69,bb5]
+  %194 = sub64 488:i32, %191
+  jgt64 %187, %194 -> bb5 else bb69
+
+bb69: ; preds=[bb68] succs=[bb70,bb5]
+  %195 = loadraw.u64 [%sp-168+sp]
+  %196 = add64 %195, %187
+  %197 = call #112(%196, %191, %185)
+  jne64 %197, 0:i32 -> bb5 else bb70
+
+bb70: ; preds=[bb69] succs=[bb71]
+  %198 = add64 %191, %187
+  %199 = add64 %185, %191
+  %200 = loadraw.u64 [%sp-184+sp]
+
+bb71: ; preds=[bb67,bb70] succs=[bb72,bb67]
+  %186 = phi [%185, bb67], [%199, bb70]
+  %188 = phi [%187, bb67], [%198, bb70]
+  %184 = phi [%183, bb67], [%200, bb70]
+  %190 = phi [%189, bb67], [%189, bb70]
+  %201 = phi [%191, bb67], [%191, bb70]
+  %192 = rsh64 %201, 1:i32
+  jne64 %192, 0:i32 -> bb67 else bb72
+
+bb72: ; preds=[bb71] succs=[bb73]
+  %202 = loadraw.u64 [%sp-160+sp]
+
+bb73: ; preds=[bb61,bb62,bb63,bb72] succs=[bb74]
+  %203 = phi [%171, bb61], [%171, bb62], [%171, bb63], [%202, bb72]
+  %204 = phi [%172, bb61], [%175, bb62], [%175, bb63], [%184, bb72]
+  %205 = phi [0:i32, bb61], [0:i32, bb62], [0:i32, bb63], [%190, bb72]
+  %206 = add64 %204, %205
+
+bb74: ; preds=[bb60,bb73] succs=[bb6]
+  %207 = phi [%168, bb60], [%206, bb73]
+  %208 = phi [%163, bb60], [%203, bb73]
+  storeraw.u8 [%208+0], 0:i32
+  storeraw.u16 [%208+4], %207
+  ja bb6
+
diff --git a/core-rs/epass-ir/tests/epir/progs_alu64__prog.epir b/core-rs/epass-ir/tests/epir/progs_alu64__prog.epir
new file mode 100644
index 0000000..f8dc6f1
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_alu64__prog.epir
@@ -0,0 +1,8 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  storeraw.u16 [%sp-2+sp], 49:i32
+  %0 = add64 %sp, -2:i32
+  %1 = call #6(%0, 2:i32)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_compact_opt__prog.epir b/core-rs/epass-ir/tests/epir/progs_compact_opt__prog.epir
new file mode 100644
index 0000000..1200c55
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_compact_opt__prog.epir
@@ -0,0 +1,7 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadimm.imm64 0
+  %1 = call #6(%0, 9:i32, 2:i32)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_counter__prog.epir b/core-rs/epass-ir/tests/epir/progs_counter__prog.epir
new file mode 100644
index 0000000..d95f721
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_counter__prog.epir
@@ -0,0 +1,11 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadimm.imm64 0
+  %1 = loadraw.u64 [%0+0]
+  %2 = add64 %1, 1:i32
+  storeraw.u64 [%0+0], %2
+  %3 = loadimm.imm64 0
+  %4 = call #6(%3, %2)
+  ret 2:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_empty__prog.epir b/core-rs/epass-ir/tests/epir/progs_empty__prog.epir
new file mode 100644
index 0000000..021277f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_empty__prog.epir
@@ -0,0 +1,5 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_filter__prog.epir b/core-rs/epass-ir/tests/epir/progs_filter__prog.epir
new file mode 100644
index 0000000..4bca3b2
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_filter__prog.epir
@@ -0,0 +1,12 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = loadraw.u32 [%arg0+0]
+  jlt32 %0, 100:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  %1 = phi [1:i32, bb0], [2:i32, bb1]
+  ret %1
+
diff --git a/core-rs/epass-ir/tests/epir/progs_fn_nonrejected_uninit_var_access__handle_tracepoint.epir b/core-rs/epass-ir/tests/epir/progs_fn_nonrejected_uninit_var_access__handle_tracepoint.epir
new file mode 100644
index 0000000..325a476
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_fn_nonrejected_uninit_var_access__handle_tracepoint.epir
@@ -0,0 +1,7 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadimm.imm64 0
+  %1 = call #6(%0, 4:i32, 1:i32)
+  ret 1:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_fn_oob__handle_tracepoint.epir b/core-rs/epass-ir/tests/epir/progs_fn_oob__handle_tracepoint.epir
new file mode 100644
index 0000000..021277f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_fn_oob__handle_tracepoint.epir
@@ -0,0 +1,5 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_hashmap__prog.epir b/core-rs/epass-ir/tests/epir/progs_hashmap__prog.epir
new file mode 100644
index 0000000..4d43b7f
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_hashmap__prog.epir
@@ -0,0 +1,31 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  storeraw.u32 [%sp-4+sp], 1:i32
+  %0 = add64 %sp, -4:i32
+  %1 = loadimm.imm64 0
+  %2 = call #1(%1, %0)
+  jeq64 %2, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb3]
+  %3 = loadraw.u64 [%2+0]
+  %4 = add64 %3, 1:i32
+  storeraw.u64 [%2+0], %4
+  %5 = loadraw.u32 [%sp-4+sp]
+  %6 = loadimm.imm64 0
+  %7 = call #6(%6, %5, %4)
+  ja bb3
+
+bb2: ; preds=[bb0] succs=[bb3]
+  storeraw.u64 [%sp-16+sp], 1:i32
+  %8 = add64 %sp, -4:i32
+  %9 = add64 %sp, -16:i32
+  %10 = loadimm.imm64 0
+  %11 = call #2(%10, %8, %9, 0:i32)
+  %12 = loadraw.u32 [%sp-4+sp]
+  %13 = loadimm.imm64 24
+  %14 = call #6(%13, %12, %9, 0:i32)
+
+bb3: ; preds=[bb1,bb2] succs=[]
+  ret 2:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_latency__prog.epir b/core-rs/epass-ir/tests/epir/progs_latency__prog.epir
new file mode 100644
index 0000000..c72ce8d
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_latency__prog.epir
@@ -0,0 +1,12 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = call #5()
+  %1 = loadimm.imm64 0
+  %2 = call #6(%1, 15:i32)
+  %3 = call #5()
+  %4 = sub32 %3, %0
+  %5 = loadimm.imm64 0
+  %6 = call #6(%5, %4)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__handle_exit.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__handle_exit.epir
new file mode 100644
index 0000000..a1123e8
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__handle_exit.epir
@@ -0,0 +1,73 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb8]
+  %0 = call #14()
+  %1 = rsh64 %0, 32:i32
+  storeraw.u32 [%sp-4+sp], %1
+  jne32 %1, %0 -> bb8 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb3]
+  %2 = add64 %sp, -4:i32
+  %3 = loadimm.imm64 0
+  %4 = call #1(%3, %2)
+  jeq64 %4, 0:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb4]
+  %5 = call #5()
+  %6 = loadraw.u64 [%4+0]
+  %7 = sub64 %5, %6
+  ja bb4
+
+bb3: ; preds=[bb1] succs=[bb4,bb8]
+  %8 = loadimm.imm64 0
+  %9 = loadraw.u64 [%8+0]
+  jne64 %9, 0:i32 -> bb8 else bb4
+
+bb4: ; preds=[bb2,bb3] succs=[bb5,bb6]
+  %10 = phi [%7, bb2], [0:i32, bb3]
+  %11 = add64 %sp, -4:i32
+  %12 = loadimm.imm64 0
+  %13 = call #3(%12, %11)
+  %14 = loadimm.imm64 0
+  %15 = loadraw.u64 [%14+0]
+  jeq64 %15, 0:i32 -> bb6 else bb5
+
+bb5: ; preds=[bb4] succs=[bb6,bb8]
+  %16 = loadraw.u64 [%14+0]
+  jlt64 %10, %16 -> bb8 else bb6
+
+bb6: ; preds=[bb4,bb5] succs=[bb7,bb8]
+  %17 = phi [%10, bb4], [%10, bb5]
+  %18 = loadimm.imm64 0
+  %19 = call #131(%18, 168:i32, 0:i32)
+  jeq64 %19, 0:i32 -> bb8 else bb7
+
+bb7: ; preds=[bb6] succs=[bb8]
+  %20 = call #35()
+  storeraw.u8 [%19+167], 1:i32
+  storeraw.u64 [%19+16], %17
+  %21 = loadraw.u32 [%sp-4+sp]
+  storeraw.u32 [%19+0], %21
+  %22 = add64 %20, 2504:i32
+  %23 = add64 %sp, -16:i32
+  %24 = call #113(%23, 8:i32, %22)
+  %25 = loadraw.u64 [%sp-16+sp]
+  %26 = add64 %25, 2492:i32
+  %27 = add64 %sp, -8:i32
+  %28 = call #113(%27, 4:i32, %26)
+  %29 = loadraw.u32 [%sp-8+sp]
+  storeraw.u32 [%19+4], %29
+  %30 = add64 %20, 2388:i32
+  %31 = add64 %sp, -16:i32
+  %32 = call #113(%31, 4:i32, %30)
+  %33 = loadraw.u32 [%sp-16+sp]
+  %34 = rsh32 %33, 8:i32
+  %35 = and32 %34, 255:i32
+  storeraw.u32 [%19+8], %35
+  %36 = add64 %19, 24:i32
+  %37 = call #16(%36, 16:i32)
+  %38 = call #132(%19, 0:i32)
+
+bb8: ; preds=[bb0,bb3,bb5,bb6,bb7] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__prog.epir
new file mode 100644
index 0000000..5ff9de3
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_bootstrap.bpf__prog.epir
@@ -0,0 +1,47 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #14()
+  %1 = rsh64 %0, 32:i32
+  storeraw.u32 [%sp-4+sp], %1
+  %2 = call #5()
+  storeraw.u64 [%sp-16+sp], %2
+  %3 = add64 %sp, -4:i32
+  %4 = add64 %sp, -16:i32
+  %5 = loadimm.imm64 0
+  %6 = call #2(%5, %3, %4, 0:i32)
+  %7 = loadimm.imm64 0
+  %8 = loadraw.u64 [%7+0]
+  jne64 %8, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb3]
+  %9 = loadimm.imm64 0
+  %10 = call #131(%9, 168:i32, 0:i32)
+  jeq64 %10, 0:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3]
+  %11 = call #35()
+  storeraw.u8 [%10+167], 0:i32
+  %12 = loadraw.u32 [%sp-4+sp]
+  storeraw.u32 [%10+0], %12
+  %13 = add64 %11, 2504:i32
+  %14 = add64 %sp, -32:i32
+  %15 = call #113(%14, 8:i32, %13)
+  %16 = loadraw.u64 [%sp-32+sp]
+  %17 = add64 %16, 2492:i32
+  %18 = add64 %sp, -20:i32
+  %19 = call #113(%18, 4:i32, %17)
+  %20 = loadraw.u32 [%sp-20+sp]
+  storeraw.u32 [%10+4], %20
+  %21 = add64 %10, 24:i32
+  %22 = call #16(%21, 16:i32)
+  %23 = loadraw.u32 [%arg0+8]
+  %24 = and32 %23, 65535:i32
+  %25 = add64 %arg0, %24
+  %26 = add64 %10, 40:i32
+  %27 = call #45(%26, 127:i32, %25)
+  %28 = call #132(%10, 0:i32)
+
+bb3: ; preds=[bb0,bb1,bb2] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__do_unlinkat_exit.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__do_unlinkat_exit.epir
new file mode 100644
index 0000000..25aa0fd
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__do_unlinkat_exit.epir
@@ -0,0 +1,12 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+16]
+  %1 = loadraw.u64 [%arg0+8]
+  %2 = call #14()
+  %3 = loadraw.u64 [%1+0]
+  %4 = rsh64 %2, 32:i32
+  %5 = loadimm.imm64 33
+  %6 = call #6(%5, 43:i32, %4, %3, %0)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__prog.epir
new file mode 100644
index 0000000..bf549c1
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_fentry.bpf__prog.epir
@@ -0,0 +1,11 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+8]
+  %1 = call #14()
+  %2 = loadraw.u64 [%0+0]
+  %3 = rsh64 %1, 32:i32
+  %4 = loadimm.imm64 0
+  %5 = call #6(%4, 33:i32, %3, %2)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__do_unlinkat_exit.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__do_unlinkat_exit.epir
new file mode 100644
index 0000000..8f23cff
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__do_unlinkat_exit.epir
@@ -0,0 +1,10 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+80]
+  %1 = call #14()
+  %2 = rsh64 %1, 32:i32
+  %3 = loadimm.imm64 38
+  %4 = call #6(%3, 34:i32, %2, %0)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__prog.epir
new file mode 100644
index 0000000..3b543c6
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_kprobe.bpf__prog.epir
@@ -0,0 +1,14 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+104]
+  %1 = call #14()
+  %2 = add64 %0, 0:i32
+  %3 = add64 %sp, -8:i32
+  %4 = call #113(%3, 8:i32, %2)
+  %5 = loadraw.u64 [%sp-8+sp]
+  %6 = rsh64 %1, 32:i32
+  %7 = loadimm.imm64 0
+  %8 = call #6(%7, 38:i32, %6, %5)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__entry_probe.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__entry_probe.epir
new file mode 100644
index 0000000..2c9410e
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__entry_probe.epir
@@ -0,0 +1,55 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = loadimm.imm64 0
+  %1 = loadraw.u8 [%0+0]
+  jne32 %1, 1:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb5]
+  %2 = loadraw.u64 [%arg0+112]
+  %3 = add64 %2, 112:i32
+  %4 = add64 %sp, -48:i32
+  %5 = call #113(%4, 8:i32, %3)
+  %6 = add64 %2, 104:i32
+  %7 = loadraw.u64 [%sp-48+sp]
+  %8 = add64 %sp, -48:i32
+  %9 = call #113(%8, 8:i32, %6)
+  %10 = loadraw.u64 [%sp-48+sp]
+  %11 = call #14()
+  %12 = lsh64 %10, 32:i32
+  %13 = rsh64 %12, 32:i32
+  jeq64 %13, 0:i32 -> bb5 else bb2
+
+bb2: ; preds=[bb1] succs=[bb4]
+  ja bb4
+
+bb3: ; preds=[bb0] succs=[bb4,bb5]
+  %14 = loadraw.u64 [%arg0+112]
+  %15 = loadraw.u64 [%arg0+104]
+  %16 = call #14()
+  %17 = lsh64 %15, 32:i32
+  %18 = rsh64 %17, 32:i32
+  jeq64 %18, 0:i32 -> bb5 else bb4
+
+bb4: ; preds=[bb2,bb3] succs=[bb5]
+  %19 = phi [%11, bb2], [%16, bb3]
+  %20 = phi [%7, bb2], [%14, bb3]
+  %21 = phi [%13, bb2], [%18, bb3]
+  %22 = add64 %sp, -16:i32
+  %23 = call #16(%22, 16:i32)
+  %24 = lsh64 %21, 32:i32
+  %25 = arsh64 %24, 32:i32
+  storeraw.u64 [%sp-24+sp], %25
+  %26 = lsh64 %20, 32:i32
+  %27 = arsh64 %26, 32:i32
+  storeraw.u64 [%sp-32+sp], %27
+  storeraw.u64 [%sp-40+sp], %22
+  %28 = rsh64 %19, 32:i32
+  storeraw.u64 [%sp-48+sp], %28
+  %29 = add64 %sp, -48:i32
+  %30 = loadimm.imm64 81
+  %31 = call #177(%30, 62:i32, %29, 32:i32)
+
+bb5: ; preds=[bb1,bb3,bb4] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__prog.epir
new file mode 100644
index 0000000..2a0f33e
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_ksyscall.bpf__prog.epir
@@ -0,0 +1,77 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = loadimm.imm64 0
+  %1 = loadraw.u8 [%0+0]
+  jne32 %1, 1:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb6]
+  %2 = loadraw.u64 [%arg0+112]
+  %3 = add64 %2, 112:i32
+  %4 = add64 %sp, -56:i32
+  %5 = call #113(%4, 8:i32, %3)
+  %6 = add64 %2, 104:i32
+  %7 = loadraw.u64 [%sp-56+sp]
+  %8 = add64 %sp, -56:i32
+  %9 = call #113(%8, 8:i32, %6)
+  %10 = add64 %2, 96:i32
+  %11 = loadraw.u64 [%sp-56+sp]
+  %12 = add64 %sp, -56:i32
+  %13 = call #113(%12, 8:i32, %10)
+  %14 = loadraw.u64 [%sp-56+sp]
+  %15 = call #14()
+  %16 = lsh64 %14, 32:i32
+  %17 = rsh64 %16, 32:i32
+  jeq64 %17, 0:i32 -> bb6 else bb2
+
+bb2: ; preds=[bb1] succs=[bb5]
+  %18 = add64 %sp, -16:i32
+  storeraw.u64 [%sp-64+sp], %18
+  %19 = call #16(%18, 16:i32)
+  %20 = lsh64 %17, 32:i32
+  %21 = arsh64 %20, 32:i32
+  storeraw.u64 [%sp-24+sp], %21
+  %22 = lsh64 %7, 32:i32
+  %23 = arsh64 %22, 32:i32
+  storeraw.u64 [%sp-32+sp], %23
+  %24 = lsh64 %11, 32:i32
+  %25 = arsh64 %24, 32:i32
+  storeraw.u64 [%sp-40+sp], %25
+  ja bb5
+
+bb3: ; preds=[bb0] succs=[bb4,bb6]
+  %26 = loadraw.u64 [%arg0+112]
+  %27 = loadraw.u64 [%arg0+104]
+  %28 = loadraw.u64 [%arg0+96]
+  %29 = call #14()
+  %30 = lsh64 %28, 32:i32
+  %31 = rsh64 %30, 32:i32
+  jeq64 %31, 0:i32 -> bb6 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+  %32 = add64 %sp, -16:i32
+  storeraw.u64 [%sp-64+sp], %32
+  %33 = call #16(%32, 16:i32)
+  %34 = lsh64 %31, 32:i32
+  %35 = arsh64 %34, 32:i32
+  storeraw.u64 [%sp-24+sp], %35
+  %36 = lsh64 %26, 32:i32
+  %37 = arsh64 %36, 32:i32
+  storeraw.u64 [%sp-32+sp], %37
+  %38 = lsh64 %27, 32:i32
+  %39 = arsh64 %38, 32:i32
+  storeraw.u64 [%sp-40+sp], %39
+
+bb5: ; preds=[bb2,bb4] succs=[bb6]
+  %40 = phi [%15, bb2], [%29, bb4]
+  %41 = loadraw.u64 [%sp-64+sp]
+  storeraw.u64 [%sp-48+sp], %41
+  %42 = rsh64 %40, 32:i32
+  storeraw.u64 [%sp-56+sp], %42
+  %43 = add64 %sp, -56:i32
+  %44 = loadimm.imm64 0
+  %45 = call #177(%44, 81:i32, %43, 40:i32)
+
+bb6: ; preds=[bb1,bb3,bb5] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_lsm.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_lsm.bpf__prog.epir
new file mode 100644
index 0000000..b31f277
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_lsm.bpf__prog.epir
@@ -0,0 +1,14 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = loadraw.u64 [%arg0+24]
+  jne32 %0, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+  %1 = loadimm.imm64 0
+  %2 = call #6(%1, 24:i32)
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  %3 = phi [%0, bb0], [-1:i32, bb1]
+  ret %3
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_minimal.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_minimal.bpf__prog.epir
new file mode 100644
index 0000000..4a1c7a4
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_minimal.bpf__prog.epir
@@ -0,0 +1,16 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = call #14()
+  %1 = rsh64 %0, 32:i32
+  %2 = loadimm.imm64 0
+  %3 = loadraw.u32 [%2+0]
+  jne32 %3, %1 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+  %4 = loadimm.imm64 0
+  %5 = call #6(%4, 28:i32, %1)
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_minimal_legacy.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_minimal_legacy.bpf__prog.epir
new file mode 100644
index 0000000..94d6529
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_minimal_legacy.bpf__prog.epir
@@ -0,0 +1,30 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  storeraw.u32 [%sp-4+sp], 0:i32
+  %0 = call #14()
+  %1 = add64 %sp, -4:i32
+  %2 = loadimm.imm64 0
+  %3 = call #1(%2, %1)
+  jeq64 %3, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb3]
+  %4 = rsh64 %0, 32:i32
+  %5 = loadraw.u32 [%3+0]
+  jne32 %5, %4 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3]
+  storeraw.u32 [%sp-8+sp], 667236:i32
+  %6 = loadimm.imm64 2675213260325678447
+  storeraw.u64 [%sp-16+sp], %6
+  %7 = loadimm.imm64 8243311783519085927
+  storeraw.u64 [%sp-24+sp], %7
+  %8 = loadimm.imm64 7451612901544448066
+  storeraw.u64 [%sp-32+sp], %8
+  %9 = add64 %sp, -32:i32
+  %10 = call #6(%9, 28:i32, %4)
+
+bb3: ; preds=[bb0,bb1,bb2] succs=[]
+  %11 = phi [1:i32, bb0], [1:i32, bb1], [0:i32, bb2]
+  ret %11
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_minimal_ns.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_minimal_ns.bpf__prog.epir
new file mode 100644
index 0000000..451fcc8
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_minimal_ns.bpf__prog.epir
@@ -0,0 +1,21 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = loadimm.imm64 0
+  %1 = loadraw.u64 [%0+0]
+  %2 = loadimm.imm64 0
+  %3 = loadraw.u64 [%2+0]
+  %4 = add64 %sp, -8:i32
+  %5 = call #120(%1, %3, %4, 8:i32)
+  %6 = loadimm.imm64 0
+  %7 = loadraw.u32 [%6+0]
+  %8 = loadraw.u32 [%sp-8+sp]
+  jne32 %8, %7 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+  %9 = loadimm.imm64 0
+  %10 = call #6(%9, 28:i32)
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_profile.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_profile.bpf__prog.epir
new file mode 100644
index 0000000..b82485e
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_profile.bpf__prog.epir
@@ -0,0 +1,35 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb4]
+  %0 = call #14()
+  %1 = call #8()
+  %2 = loadimm.imm64 0
+  %3 = call #131(%2, 2080:i32, 0:i32)
+  jeq64 %3, 0:i32 -> bb4 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb3]
+  storeraw.u32 [%3+4], %1
+  %4 = rsh64 %0, 32:i32
+  storeraw.u32 [%3+0], %4
+  %5 = add64 %3, 8:i32
+  %6 = call #16(%5, 16:i32)
+  jeq64 %6, 0:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3]
+  storeraw.u8 [%5+0], 0:i32
+
+bb3: ; preds=[bb1,bb2] succs=[bb4]
+  %7 = phi [%arg0, bb1], [%arg0, bb2]
+  %8 = phi [%3, bb1], [%3, bb2]
+  %9 = add64 %8, 32:i32
+  %10 = call #67(%7, %9, 1024:i32, 0:i32)
+  storeraw.u32 [%8+24], %10
+  %11 = add64 %8, 1056:i32
+  %12 = call #67(%7, %11, 1024:i32, 256:i32)
+  storeraw.u32 [%8+28], %12
+  %13 = call #132(%8, 0:i32)
+
+bb4: ; preds=[bb0,bb3] succs=[]
+  %14 = phi [1:i32, bb0], [0:i32, bb3]
+  ret %14
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_sockfilter.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_sockfilter.bpf__prog.epir
new file mode 100644
index 0000000..2f35d9e
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_sockfilter.bpf__prog.epir
@@ -0,0 +1,55 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb6]
+  %0 = add64 %sp, -6:i32
+  %1 = call #26(%arg0, 12:i32, %0, 2:i32)
+  %2 = loadraw.u16 [%sp-6+sp]
+  %3 = end.be16 %2
+  storeraw.u16 [%sp-6+sp], %3
+  jne32 %2, 8:i32 -> bb6 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb6]
+  %4 = add64 %sp, -2:i32
+  %5 = call #26(%arg0, 20:i32, %4, 2:i32)
+  %6 = loadraw.u16 [%sp-2+sp]
+  %7 = and32 %6, 65343:i32
+  jne32 %7, 0:i32 -> bb6 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb6]
+  %8 = loadimm.imm64 0
+  %9 = call #131(%8, 24:i32, 0:i32)
+  jeq64 %9, 0:i32 -> bb6 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb5]
+  %10 = add64 %9, 12:i32
+  %11 = call #26(%arg0, 23:i32, %10, 1:i32)
+  %12 = loadraw.u32 [%9+12]
+  jeq32 %12, 47:i32 -> bb5 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+  %13 = call #26(%arg0, 26:i32, %9, 4:i32)
+  %14 = add64 %9, 4:i32
+  %15 = call #26(%arg0, 30:i32, %14, 4:i32)
+
+bb5: ; preds=[bb3,bb4] succs=[bb6]
+  %16 = phi [%9, bb3], [%9, bb4]
+  %17 = phi [%arg0, bb3], [%arg0, bb4]
+  %18 = add64 %sp, -3:i32
+  %19 = call #26(%17, 14:i32, %18, 1:i32)
+  %20 = loadraw.u8 [%sp-3+sp]
+  %21 = lsh32 %20, 2:i32
+  %22 = and32 %21, 60:i32
+  %23 = add32 %22, 14:i32
+  %24 = add64 %16, 8:i32
+  %25 = call #26(%17, %23, %24, 4:i32)
+  %26 = loadraw.u32 [%17+4]
+  storeraw.u32 [%16+16], %26
+  %27 = loadraw.u32 [%17+40]
+  storeraw.u32 [%16+20], %27
+  %28 = call #132(%16, 0:i32)
+  %29 = loadraw.u32 [%17+0]
+
+bb6: ; preds=[bb0,bb1,bb2,bb5] succs=[]
+  %30 = phi [0:i32, bb0], [0:i32, bb1], [0:i32, bb2], [%29, bb5]
+  ret %30
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_task_iter.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_task_iter.bpf__prog.epir
new file mode 100644
index 0000000..c42b9dc
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_task_iter.bpf__prog.epir
@@ -0,0 +1,55 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb8]
+  %0 = loadraw.u64 [%arg0+0]
+  %1 = loadraw.u64 [%0+0]
+  %2 = loadraw.u64 [%arg0+8]
+  jeq64 %2, 0:i32 -> bb8 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb8]
+  %3 = loadimm.imm64 0
+  %4 = loadimm.imm64 0
+  %5 = call #1(%3, %4)
+  jeq64 %5, 0:i32 -> bb8 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb4]
+  %6 = loadraw.u32 [%2+2492]
+  storeraw.u32 [%5+0], %6
+  %7 = loadraw.u32 [%2+2488]
+  storeraw.u32 [%5+4], %7
+  jeq32 1:i32, 0:i32 -> bb4 else bb3
+
+bb3: ; preds=[bb2] succs=[bb5]
+  %8 = loadraw.u64 [%2+0]
+  ja bb5
+
+bb4: ; preds=[bb2] succs=[bb5]
+  %9 = loadraw.u32 [%2+0]
+
+bb5: ; preds=[bb3,bb4] succs=[bb6,bb7]
+  %10 = phi [%1, bb3], [%1, bb4]
+  %11 = phi [%5, bb3], [%5, bb4]
+  %12 = phi [%2, bb3], [%2, bb4]
+  %13 = phi [%8, bb3], [%9, bb4]
+  %14 = phi [%5, bb3], [%5, bb4]
+  storeraw.u32 [%14+8], %13
+  %15 = add64 %12, 3032:i32
+  %16 = add64 %11, 12:i32
+  %17 = call #115(%16, 16:i32, %15)
+  %18 = add64 %11, 32:i32
+  %19 = call #141(%12, %18, 1016:i32, 0:i32)
+  jslt64 %19, 1:i32 -> bb7 else bb6
+
+bb6: ; preds=[bb5] succs=[bb7]
+  %20 = rsh64 %19, 3:i32
+
+bb7: ; preds=[bb5,bb6] succs=[bb8]
+  %21 = phi [%10, bb5], [%10, bb6]
+  %22 = phi [%19, bb5], [%20, bb6]
+  %23 = phi [%14, bb5], [%14, bb6]
+  storeraw.u32 [%23+28], %22
+  %24 = call #127(%21, %23, 1048:i32)
+
+bb8: ; preds=[bb0,bb1,bb7] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__prog.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__prog.epir
new file mode 100644
index 0000000..d820d8b
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__prog.epir
@@ -0,0 +1,9 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+112]
+  %1 = loadraw.u64 [%arg0+104]
+  %2 = loadimm.imm64 0
+  %3 = call #6(%2, 34:i32, %0, %1)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uprobe_sub.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uprobe_sub.epir
new file mode 100644
index 0000000..97e06d9
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uprobe_sub.epir
@@ -0,0 +1,9 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+112]
+  %1 = loadraw.u64 [%arg0+104]
+  %2 = loadimm.imm64 64
+  %3 = call #6(%2, 34:i32, %0, %1)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_add.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_add.epir
new file mode 100644
index 0000000..fc2e659
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_add.epir
@@ -0,0 +1,8 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+80]
+  %1 = loadimm.imm64 34
+  %2 = call #6(%1, 30:i32, %0)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_sub.epir b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_sub.epir
new file mode 100644
index 0000000..af52d85
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_libbpf_uprobe.bpf__uretprobe_sub.epir
@@ -0,0 +1,8 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadraw.u64 [%arg0+80]
+  %1 = loadimm.imm64 98
+  %2 = call #6(%1, 30:i32, %0)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_loop1__prog.epir b/core-rs/epass-ir/tests/epir/progs_loop1__prog.epir
new file mode 100644
index 0000000..93b0779
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_loop1__prog.epir
@@ -0,0 +1,22 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb3]
+  %0 = call #5()
+  %1 = call #6(%arg0, %0)
+  jeq64 %0, 0:i32 -> bb3 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+
+bb2: ; preds=[bb1,bb2] succs=[bb3,bb2]
+  %2 = phi [%2, bb2], [%0, bb1]
+  %3 = phi [%3, bb2], [%arg0, bb1]
+  %4 = phi [%5, bb2], [0:i32, bb1]
+  %6 = loadimm.imm64 0
+  %7 = call #6(%6, %4)
+  %8 = call #6(%3, 2:i32)
+  %5 = add64 %4, 1:i32
+  jlt64 %5, %2 -> bb2 else bb3
+
+bb3: ; preds=[bb0,bb2] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_loop2__prog.epir b/core-rs/epass-ir/tests/epir/progs_loop2__prog.epir
new file mode 100644
index 0000000..257075a
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_loop2__prog.epir
@@ -0,0 +1,20 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+
+bb1: ; preds=[bb0,bb2] succs=[bb2,bb3]
+  %0 = phi [%1, bb2], [0:i32, bb0]
+  jeq64 %0, 10000:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb1]
+  %2 = call #5()
+  %1 = add64 %0, 1:i32
+  %3 = call #5()
+  jle64 %2, %3 -> bb1 else bb3
+
+bb3: ; preds=[bb1,bb2] succs=[]
+  %4 = phi [%0, bb1], [%0, bb2]
+  %5 = loadimm.imm64 0
+  %6 = call #6(%5, 14:i32, %4)
+  ret 2:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_loop3__prog.epir b/core-rs/epass-ir/tests/epir/progs_loop3__prog.epir
new file mode 100644
index 0000000..59cb2be
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_loop3__prog.epir
@@ -0,0 +1,16 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+
+bb1: ; preds=[bb0,bb2] succs=[bb2,bb3]
+  %0 = phi [%1, bb2], [500:i32, bb0]
+  %2 = call #5()
+  %1 = add64 %0, -1:i32
+  jeq64 %1, 0:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb1]
+  ja bb1
+
+bb3: ; preds=[bb1] succs=[]
+  ret 2:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_map1__prog.epir b/core-rs/epass-ir/tests/epir/progs_map1__prog.epir
new file mode 100644
index 0000000..5d18927
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_map1__prog.epir
@@ -0,0 +1,7 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadimm.imm64 0
+  %1 = call #6(%0, 4:i32)
+  ret %1
+
diff --git a/core-rs/epass-ir/tests/epir/progs_mask__prog.epir b/core-rs/epass-ir/tests/epir/progs_mask__prog.epir
new file mode 100644
index 0000000..58ac2b4
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_mask__prog.epir
@@ -0,0 +1,28 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+  %0 = loadimm.imm64 0
+  %1 = call #5()
+
+bb1: ; preds=[bb0,bb2] succs=[bb2,bb3]
+  %2 = phi [%2, bb2], [%1, bb0]
+  %3 = phi [%4, bb2], [0:i32, bb0]
+  %5 = phi [%6, bb2], [%0, bb0]
+  storeraw.u32 [%5+0], %3
+  %6 = add64 %5, 4:i32
+  %4 = add64 %3, 1:i32
+  jeq64 %4, 100:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb1]
+  ja bb1
+
+bb3: ; preds=[bb1] succs=[]
+  %7 = mod64 %2, 100:i32
+  %8 = lsh64 %7, 2:i32
+  %9 = loadimm.imm64 0
+  %10 = add64 %9, %8
+  %11 = loadraw.u32 [%10+0]
+  %12 = loadimm.imm64 0
+  %13 = call #6(%12, 9:i32, %11)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_mem1__prog.epir b/core-rs/epass-ir/tests/epir/progs_mem1__prog.epir
new file mode 100644
index 0000000..eca51e0
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_mem1__prog.epir
@@ -0,0 +1,28 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = call #5()
+  storeraw.u32 [%sp-4+sp], 9:i32
+  storeraw.u32 [%sp-8+sp], 8:i32
+  storeraw.u32 [%sp-12+sp], 7:i32
+  storeraw.u32 [%sp-16+sp], 6:i32
+  storeraw.u32 [%sp-20+sp], 5:i32
+  storeraw.u32 [%sp-24+sp], 4:i32
+  storeraw.u32 [%sp-28+sp], 3:i32
+  storeraw.u32 [%sp-32+sp], 2:i32
+  storeraw.u32 [%sp-36+sp], 1:i32
+  storeraw.u32 [%sp-40+sp], 0:i32
+  %1 = mod64 %0, 20:i32
+  jgt64 %1, 10:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+  %2 = lsh64 %1, 2:i32
+  %3 = add64 %sp, -40:i32
+  %4 = add64 %3, %2
+  %5 = loadraw.u32 [%4+0]
+  %6 = loadimm.imm64 0
+  %7 = call #6(%6, 1:i32, %5)
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_mem2__prog.epir b/core-rs/epass-ir/tests/epir/progs_mem2__prog.epir
new file mode 100644
index 0000000..a379396
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_mem2__prog.epir
@@ -0,0 +1,56 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb5]
+  %0 = call #5()
+  storeraw.u64 [%sp-16+sp], 8:i32
+  storeraw.u64 [%sp-24+sp], 7:i32
+  storeraw.u64 [%sp-32+sp], 6:i32
+  storeraw.u64 [%sp-40+sp], 5:i32
+  storeraw.u64 [%sp-48+sp], 4:i32
+  storeraw.u64 [%sp-56+sp], 3:i32
+  storeraw.u64 [%sp-64+sp], 2:i32
+  storeraw.u64 [%sp-72+sp], 1:i32
+  storeraw.u64 [%sp-80+sp], 0:i32
+  storeraw.u64 [%sp-8+sp], 9:i32
+  %1 = loadimm.imm64 0
+  %2 = call #6(%1, 4:i32, 9:i32)
+  %3 = mod64 %0, 20:i32
+  jgt64 %3, 9:i32 -> bb5 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb3]
+  %4 = lsh64 %3, 3:i32
+  %5 = add64 %sp, -80:i32
+  %6 = add64 %5, %4
+  %7 = loadraw.u64 [%6+0]
+  jgt64 %7, 100:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3]
+  %8 = loadimm.imm64 0
+  %9 = call #6(%8, 4:i32)
+
+bb3: ; preds=[bb1,bb2] succs=[bb6]
+  %10 = add64 %sp, -80:i32
+  ja bb6
+
+bb4: ; preds=[bb6,bb7] succs=[bb5,bb6]
+  %11 = phi [%12, bb6], [%12, bb7]
+  %13 = phi [%14, bb6], [%14, bb7]
+  storeraw.u64 [%13+0], %11
+  %15 = add64 %13, 8:i32
+  %16 = add64 %11, 1:i32
+  jne64 %16, 11:i32 -> bb6 else bb5
+
+bb5: ; preds=[bb0,bb4] succs=[]
+  ret 1:i32
+
+bb6: ; preds=[bb3,bb4] succs=[bb7,bb4]
+  %12 = phi [1:i32, bb3], [%16, bb4]
+  %14 = phi [%10, bb3], [%15, bb4]
+  %17 = loadraw.u64 [%14+0]
+  jgt64 %17, 100:i32 -> bb4 else bb7
+
+bb7: ; preds=[bb6] succs=[bb4]
+  %18 = loadimm.imm64 0
+  %19 = call #6(%18, 4:i32)
+  ja bb4
+
diff --git a/core-rs/epass-ir/tests/epir/progs_ringbuf__prog.epir b/core-rs/epass-ir/tests/epir/progs_ringbuf__prog.epir
new file mode 100644
index 0000000..e030687
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_ringbuf__prog.epir
@@ -0,0 +1,14 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = loadimm.imm64 0
+  %1 = call #131(%0, 4:i32, 0:i32)
+  jeq64 %1, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2]
+  %2 = call #132(%1, 0:i32)
+
+bb2: ; preds=[bb0,bb1] succs=[]
+  %3 = phi [1:i32, bb0], [2:i32, bb1]
+  ret %3
+
diff --git a/core-rs/epass-ir/tests/epir/progs_simple1__prog.epir b/core-rs/epass-ir/tests/epir/progs_simple1__prog.epir
new file mode 100644
index 0000000..be368d1
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_simple1__prog.epir
@@ -0,0 +1,7 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadimm.imm64 0
+  %1 = call #6(%0, 7:i32)
+  ret 1:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_simple2__prog.epir b/core-rs/epass-ir/tests/epir/progs_simple2__prog.epir
new file mode 100644
index 0000000..c80e69b
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_simple2__prog.epir
@@ -0,0 +1,8 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = call #5()
+  %1 = loadimm.imm64 0
+  %2 = call #6(%1, 6:i32, %0)
+  ret 2:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_str__prog.epir b/core-rs/epass-ir/tests/epir/progs_str__prog.epir
new file mode 100644
index 0000000..add9684
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_str__prog.epir
@@ -0,0 +1,9 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = loadimm.imm64 29687249694718053
+  storeraw.u64 [%sp-8+sp], %0
+  %1 = add64 %sp, -8:i32
+  %2 = call #6(%1, 8:i32)
+  ret 1:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__lsm_access_control_file_permission.epir b/core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__lsm_access_control_file_permission.epir
new file mode 100644
index 0000000..b7cfef1
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__lsm_access_control_file_permission.epir
@@ -0,0 +1,29 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb4]
+  %0 = loadraw.u64 [%arg0+16]
+  jne32 %0, 0:i32 -> bb4 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb4]
+  %1 = call #15()
+  %2 = lsh64 %1, 32:i32
+  %3 = rsh64 %2, 32:i32
+  storeraw.u64 [%sp-8+sp], %3
+  %4 = add64 %sp, -8:i32
+  %5 = loadimm.imm64 0
+  %6 = call #1(%5, %4)
+  jeq64 %6, 0:i32 -> bb4 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb4]
+  %7 = loadraw.u8 [%6+0]
+  jne32 %7, 1:i32 -> bb4 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4]
+  %8 = loadraw.u64 [%sp-8+sp]
+  %9 = loadimm.imm64 0
+  %10 = call #6(%9, 24:i32, %8)
+
+bb4: ; preds=[bb0,bb1,bb2,bb3] succs=[]
+  %11 = phi [%0, bb0], [0:i32, bb1], [0:i32, bb2], [-1:i32, bb3]
+  ret %11
+
diff --git a/core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__prog.epir b/core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__prog.epir
new file mode 100644
index 0000000..13fc63b
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_tengjiang_access_control__prog.epir
@@ -0,0 +1,29 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb4]
+  %0 = loadraw.u64 [%arg0+8]
+  jne32 %0, 0:i32 -> bb4 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb4]
+  %1 = call #15()
+  %2 = lsh64 %1, 32:i32
+  %3 = rsh64 %2, 32:i32
+  storeraw.u64 [%sp-8+sp], %3
+  %4 = add64 %sp, -8:i32
+  %5 = loadimm.imm64 0
+  %6 = call #1(%5, %4)
+  jeq64 %6, 0:i32 -> bb4 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb4]
+  %7 = loadraw.u8 [%6+0]
+  jne32 %7, 1:i32 -> bb4 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4]
+  %8 = loadraw.u64 [%sp-8+sp]
+  %9 = loadimm.imm64 0
+  %10 = call #6(%9, 24:i32, %8)
+
+bb4: ; preds=[bb0,bb1,bb2,bb3] succs=[]
+  %11 = phi [%0, bb0], [0:i32, bb1], [0:i32, bb2], [-1:i32, bb3]
+  ret %11
+
diff --git a/core-rs/epass-ir/tests/epir/progs_tengjiang_simple_trace__prog.epir b/core-rs/epass-ir/tests/epir/progs_tengjiang_simple_trace__prog.epir
new file mode 100644
index 0000000..fb4cc2b
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_tengjiang_simple_trace__prog.epir
@@ -0,0 +1,9 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[]
+  %0 = call #14()
+  %1 = rsh64 %0, 32:i32
+  %2 = loadimm.imm64 0
+  %3 = call #6(%2, 28:i32, %1)
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_tengjiang_syscount__prog.epir b/core-rs/epass-ir/tests/epir/progs_tengjiang_syscount__prog.epir
new file mode 100644
index 0000000..6497fc3
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_tengjiang_syscount__prog.epir
@@ -0,0 +1,33 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb2]
+  %0 = loadraw.u64 [%arg0+8]
+  storeraw.u64 [%sp-8+sp], %0
+  %1 = add64 %sp, -8:i32
+  %2 = loadimm.imm64 0
+  %3 = call #1(%2, %1)
+  jeq64 %3, 0:i32 -> bb2 else bb1
+
+bb1: ; preds=[bb0] succs=[bb3]
+  %4 = loadraw.u64 [%3+0]
+  %5 = loadraw.u64 [%sp-8+sp]
+  %6 = loadimm.imm64 0
+  %7 = call #6(%6, 28:i32, %5, %4)
+  %8 = loadraw.u64 [%3+0]
+  %9 = add64 %8, 1:i32
+  storeraw.u64 [%3+0], %9
+  ja bb3
+
+bb2: ; preds=[bb0] succs=[bb3]
+  storeraw.u64 [%sp-16+sp], 0:i32
+  %10 = loadraw.u64 [%sp-8+sp]
+  %11 = loadimm.imm64 28
+  %12 = call #6(%11, 38:i32, %10)
+  %13 = add64 %sp, -8:i32
+  %14 = add64 %sp, -16:i32
+  %15 = loadimm.imm64 0
+  %16 = call #2(%15, %13, %14, 0:i32)
+
+bb3: ; preds=[bb1,bb2] succs=[]
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/progs_tengjiang_unbounded_loop__prog.epir b/core-rs/epass-ir/tests/epir/progs_tengjiang_unbounded_loop__prog.epir
new file mode 100644
index 0000000..54afbe9
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_tengjiang_unbounded_loop__prog.epir
@@ -0,0 +1,7 @@
+; ePass IR v1
+
+bb0: ; preds=[bb0] succs=[bb0]
+  %0 = loadimm.imm64 0
+  %1 = call #6(%0, 14:i32)
+  ja bb0
+
diff --git a/core-rs/epass-ir/tests/epir/progs_tengjiang_xdp__prog.epir b/core-rs/epass-ir/tests/epir/progs_tengjiang_xdp__prog.epir
new file mode 100644
index 0000000..16016ee
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_tengjiang_xdp__prog.epir
@@ -0,0 +1,29 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1,bb5]
+  %0 = loadraw.u32 [%arg0+4]
+  %1 = loadraw.u32 [%arg0+0]
+  %2 = add64 %1, 34:i32
+  jgt64 %2, %0 -> bb5 else bb1
+
+bb1: ; preds=[bb0] succs=[bb2,bb5]
+  %3 = add64 %1, 9:i32
+  %4 = loadraw.u8 [%3+14]
+  jne32 %4, 17:i32 -> bb5 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb5]
+  %5 = add64 %1, 42:i32
+  jgt64 %5, %0 -> bb5 else bb3
+
+bb3: ; preds=[bb2] succs=[bb4,bb5]
+  %6 = loadraw.u16 [%2+2]
+  jne32 %6, 26411:i32 -> bb5 else bb4
+
+bb4: ; preds=[bb3] succs=[bb5]
+  %7 = loadimm.imm64 0
+  %8 = call #6(%7, 31:i32)
+
+bb5: ; preds=[bb0,bb1,bb2,bb3,bb4] succs=[]
+  %9 = phi [2:i32, bb0], [2:i32, bb1], [2:i32, bb2], [2:i32, bb3], [1:i32, bb4]
+  ret %9
+
diff --git a/core-rs/epass-ir/tests/epir/progs_test_asm__prog.epir b/core-rs/epass-ir/tests/epir/progs_test_asm__prog.epir
new file mode 100644
index 0000000..a35e349
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/progs_test_asm__prog.epir
@@ -0,0 +1,101 @@
+; ePass IR v1
+
+bb0: ; preds=[] succs=[bb1]
+
+bb1: ; preds=[bb0,bb2] succs=[bb2,bb3]
+  %0 = phi [%1, bb2], [0:i32, bb0]
+  %2 = phi [%1, bb2], [0:i32, bb0]
+  %3 = phi [%4, bb2], [0:i32, bb0]
+  %5 = phi [%6, bb2], [0:i32, bb0]
+  %7 = phi [%8, bb2], [0:i32, bb0]
+  %9 = sub32 1:i32, %7
+  %10 = mul32 %5, %5
+  %11 = mul32 %10, %9
+  %12 = mul32 %3, %3
+  %13 = mul32 %7, %7
+  %14 = add32 %13, %12
+  %15 = mul32 %2, %2
+  %16 = add32 %14, %15
+  %17 = add32 %16, %11
+  jsgt32 %17, 3:i32 -> bb3 else bb2
+
+bb2: ; preds=[bb1] succs=[bb3,bb1]
+  %18 = mul32 %7, %0
+  %19 = lsh32 %18, 1:i32
+  %8 = add32 %19, 2:i32
+  %20 = mul32 %8, %3
+  %21 = mul32 %20, %8
+  %22 = sub32 3:i32, %21
+  %23 = sub32 %15, %13
+  %1 = add32 %23, 1:i32
+  %4 = mul32 %22, %1
+  %6 = add32 %5, 1:i32
+  jne32 %6, 100:i32 -> bb1 else bb3
+
+bb3: ; preds=[bb1,bb2] succs=[]
+  %24 = phi [%5, bb1], [100:i32, bb2]
+  %25 = loadimm.imm64 10
+  %26 = loadraw.u8 [%25+0]
+  %27 = lsh32 %26, 24:i32
+  %28 = arsh32 %27, 24:i32
+  %29 = loadimm.imm64 0
+  %30 = call #6(%29, 1:i32, %28)
+  %31 = loadraw.u8 [%25+1]
+  %32 = lsh32 %31, 24:i32
+  %33 = arsh32 %32, 24:i32
+  %34 = loadimm.imm64 0
+  %35 = call #6(%34, 1:i32, %33)
+  %36 = loadraw.u8 [%25+2]
+  %37 = lsh32 %36, 24:i32
+  %38 = arsh32 %37, 24:i32
+  %39 = loadimm.imm64 0
+  %40 = call #6(%39, 1:i32, %38)
+  %41 = loadraw.u8 [%25+3]
+  %42 = lsh32 %41, 24:i32
+  %43 = arsh32 %42, 24:i32
+  %44 = loadimm.imm64 0
+  %45 = call #6(%44, 1:i32, %43)
+  %46 = loadraw.u8 [%25+4]
+  %47 = lsh32 %46, 24:i32
+  %48 = arsh32 %47, 24:i32
+  %49 = loadimm.imm64 0
+  %50 = call #6(%49, 1:i32, %48)
+  %51 = loadraw.u8 [%25+5]
+  %52 = lsh32 %51, 24:i32
+  %53 = arsh32 %52, 24:i32
+  %54 = loadimm.imm64 0
+  %55 = call #6(%54, 1:i32, %53)
+  %56 = loadraw.u8 [%25+6]
+  %57 = lsh32 %56, 24:i32
+  %58 = arsh32 %57, 24:i32
+  %59 = loadimm.imm64 0
+  %60 = call #6(%59, 1:i32, %58)
+  %61 = loadraw.u8 [%25+7]
+  %62 = lsh32 %61, 24:i32
+  %63 = arsh32 %62, 24:i32
+  %64 = loadimm.imm64 0
+  %65 = call #6(%64, 1:i32, %63)
+  %66 = loadraw.u8 [%25+8]
+  %67 = lsh32 %66, 24:i32
+  %68 = arsh32 %67, 24:i32
+  %69 = loadimm.imm64 0
+  %70 = call #6(%69, 1:i32, %68)
+  %71 = loadraw.u8 [%25+9]
+  %72 = lsh32 %71, 24:i32
+  %73 = arsh32 %72, 24:i32
+  %74 = loadimm.imm64 0
+  %75 = call #6(%74, 1:i32, %73)
+  %76 = loadimm.imm64 3
+  %77 = loadimm.imm64 10
+  %78 = call #6(%76, 1:i32, %77)
+  %79 = loadimm.imm64 3
+  %80 = loadimm.imm64 0
+  %81 = call #6(%79, 1:i32, %80)
+  %82 = loadraw.u8 [%25+0]
+  %83 = lsh32 %82, 24:i32
+  %84 = arsh32 %83, 24:i32
+  %85 = loadimm.imm64 0
+  %86 = call #6(%85, 1:i32, %84)
+  storeraw.u8 [%25+0], %24
+  ret 0:i32
+
diff --git a/core-rs/epass-ir/tests/epir/ra_oversized_clique.epir b/core-rs/epass-ir/tests/epir/ra_oversized_clique.epir
new file mode 100644
index 0000000..36e34c9
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/ra_oversized_clique.epir
@@ -0,0 +1,73 @@
+; ePass IR v1
+; Reproduces "oversized clique with no spillable VR".
+;
+; A block with 12 Phis, each with 2 predecessors.  The Phis all
+; interfere with each other (clique size 12 > 10 registers).
+; When a Phi is spilled, the reload is placed at the predecessor
+; block end.  Since both predecessors jump to the same merge block,
+; the reloads cluster at the same point.
+;
+; After all non-Phi values are spilled, the remaining clique consists
+; of Phis and their reloads (all spilled_once=true).
+;
+; Must be compiled with !const_prop so loadimm values are not folded.
+
+bb0: ; preds=[] succs=[bb_merge]
+  %v0  = loadimm.imm64 0
+  %v1  = loadimm.imm64 1
+  %v2  = loadimm.imm64 2
+  %v3  = loadimm.imm64 3
+  %v4  = loadimm.imm64 4
+  %v5  = loadimm.imm64 5
+  %v6  = loadimm.imm64 6
+  %v7  = loadimm.imm64 7
+  %v8  = loadimm.imm64 8
+  %v9  = loadimm.imm64 9
+  %v10 = loadimm.imm64 10
+  %v11 = loadimm.imm64 11
+  ja bb_merge
+
+bb1: ; preds=[] succs=[bb_merge]
+  %w0  = loadimm.imm64 100
+  %w1  = loadimm.imm64 101
+  %w2  = loadimm.imm64 102
+  %w3  = loadimm.imm64 103
+  %w4  = loadimm.imm64 104
+  %w5  = loadimm.imm64 105
+  %w6  = loadimm.imm64 106
+  %w7  = loadimm.imm64 107
+  %w8  = loadimm.imm64 108
+  %w9  = loadimm.imm64 109
+  %w10 = loadimm.imm64 110
+  %w11 = loadimm.imm64 111
+  ja bb_merge
+
+bb_merge: ; preds=[bb0,bb1] succs=[]
+  ; 12 Phis, all live simultaneously.
+  %p0  = phi [%v0, bb0], [%w0, bb1]
+  %p1  = phi [%v1, bb0], [%w1, bb1]
+  %p2  = phi [%v2, bb0], [%w2, bb1]
+  %p3  = phi [%v3, bb0], [%w3, bb1]
+  %p4  = phi [%v4, bb0], [%w4, bb1]
+  %p5  = phi [%v5, bb0], [%w5, bb1]
+  %p6  = phi [%v6, bb0], [%w6, bb1]
+  %p7  = phi [%v7, bb0], [%w7, bb1]
+  %p8  = phi [%v8, bb0], [%w8, bb1]
+  %p9  = phi [%v9, bb0], [%w9, bb1]
+  %p10 = phi [%v10, bb0], [%w10, bb1]
+  %p11 = phi [%v11, bb0], [%w11, bb1]
+
+  ; Use all Phis so they are live.
+  %t0  = add64 %p0, %p1
+  %t1  = add64 %t0, %p2
+  %t2  = add64 %t1, %p3
+  %t3  = add64 %t2, %p4
+  %t4  = add64 %t3, %p5
+  %t5  = add64 %t4, %p6
+  %t6  = add64 %t5, %p7
+  %t7  = add64 %t6, %p8
+  %t8  = add64 %t7, %p9
+  %t9  = add64 %t8, %p10
+  %t10 = add64 %t9, %p11
+
+  ret %t10
diff --git a/core-rs/epass-ir/tests/epir/ra_pressure_reload_spill.epir b/core-rs/epass-ir/tests/epir/ra_pressure_reload_spill.epir
new file mode 100644
index 0000000..2cb13af
--- /dev/null
+++ b/core-rs/epass-ir/tests/epir/ra_pressure_reload_spill.epir
@@ -0,0 +1,37 @@
+; ePass IR v1
+; Regression test: high register pressure at a use point.
+; 12 loadimm values are all live at the chain of adds.
+; Before the fix (reload temps not marked spilled_once), the RA
+; allocator could recursively spill reload temps and fail to converge.
+; After the fix, this converges correctly.
+;
+; Must be compiled with !const_prop so loadimm values are not folded.
+
+bb0: ; preds=[] succs=[]
+  %v0  = loadimm.imm64 0
+  %v1  = loadimm.imm64 1
+  %v2  = loadimm.imm64 2
+  %v3  = loadimm.imm64 3
+  %v4  = loadimm.imm64 4
+  %v5  = loadimm.imm64 5
+  %v6  = loadimm.imm64 6
+  %v7  = loadimm.imm64 7
+  %v8  = loadimm.imm64 8
+  %v9  = loadimm.imm64 9
+  %v10 = loadimm.imm64 10
+  %v11 = loadimm.imm64 11
+
+  ; Chain all 12 through adds so every value is used.
+  %t0  = add64 %v0, %v1
+  %t1  = add64 %t0, %v2
+  %t2  = add64 %t1, %v3
+  %t3  = add64 %t2, %v4
+  %t4  = add64 %t3, %v5
+  %t5  = add64 %t4, %v6
+  %t6  = add64 %t5, %v7
+  %t7  = add64 %t6, %v8
+  %t8  = add64 %t7, %v9
+  %t9  = add64 %t8, %v10
+  %t10 = add64 %t9, %v11
+
+  ret %t10
diff --git a/core-rs/epass-ir/tests/ir_text.rs b/core-rs/epass-ir/tests/ir_text.rs
index 06df0e1..b8482c0 100644
--- a/core-rs/epass-ir/tests/ir_text.rs
+++ b/core-rs/epass-ir/tests/ir_text.rs
@@ -27,12 +27,27 @@ fn load_ir_gopt_bypasses_lift_and_compiles() {
     std::fs::write(&path, text).unwrap();
 
     let mut opts = Opts::default();
-    opts.apply_gopt(&format!("load_ir={}", path.display())).unwrap();
+    opts.apply_gopt(&format!("load_ir={}", path.display()))
+        .unwrap();
     let mut env2 = Env::new(opts, vec![BpfInsn::new(class::JMP | op::EXIT, 0, 0, 0, 0)]);
     autorun(&mut env2, &default_passes()).expect("autorun load_ir");
     assert_eq!(env2.insns.last().unwrap().code, class::JMP | op::EXIT);
 }
 
+fn run_loaded_ir(path: &str, popt: &str) -> Env {
+    let mut opts = Opts::default();
+    opts.verbose = 3;
+    opts.apply_gopt(&format!("load_ir={}", path)).unwrap();
+    let mut env = Env::new(opts, vec![]);
+    let passes = epass_ir::passes_from_popt(popt).unwrap();
+    autorun(&mut env, &passes).expect("RA should converge");
+    eprintln!("produced {} instructions", env.insns.len());
+    assert!(!env.insns.is_empty(), "should produce output instructions");
+    let last = env.insns.last().unwrap();
+    eprintln!("last insn: code={:#04x}", last.code);
+    env
+}
+
 #[test]
 fn ra_pressure_reload_spill_converges() {
     // Load the EPIR test case that creates high register pressure at a use
@@ -44,15 +59,15 @@ fn ra_pressure_reload_spill_converges() {
         env!("CARGO_MANIFEST_DIR"),
         "/tests/epir/ra_pressure_reload_spill.epir"
     );
-    let mut opts = Opts::default();
-    opts.verbose = 3;
-    opts.apply_gopt(&format!("load_ir={}", path)).unwrap();
-    let mut env = Env::new(opts, vec![]);
-    let passes = epass_ir::passes_from_popt("!const_prop,!optimize_ir").unwrap();
-    let result = autorun(&mut env, &passes);
-    result.expect("RA should converge");
-    eprintln!("produced {} instructions", env.insns.len());
-    assert!(!env.insns.is_empty(), "should produce output instructions");
-    let last = env.insns.last().unwrap();
-    eprintln!("last insn: code={:#04x}", last.code);
+    run_loaded_ir(path, "!const_prop,!optimize_ir");
+}
+
+#[test]
+fn ra_min_phi_6_converges() {
+    // This small loop used to fail in pre-spilling: the MCS earlier-neighbor set
+    // is larger than RA_COLORS but is not a real clique because the interference
+    // graph is non-chordal.  Treating it as a clique caused repeated false spills
+    // until only protected reload/phi fragments remained.
+    let path = concat!(env!("CARGO_MANIFEST_DIR"), "/tests/epir/min_phi_6.epir");
+    run_loaded_ir(path, "");
 }
diff --git a/core-rs/epasstool/tests/falco.rs b/core-rs/epasstool/tests/falco.rs
index 976a441..65bdbbb 100644
--- a/core-rs/epasstool/tests/falco.rs
+++ b/core-rs/epasstool/tests/falco.rs
@@ -6,10 +6,6 @@ const KNOWN_FALCO_FAILURES: &[&str] = &[
     // libbpf poison/dummy path leaves a dead def in these large programs
     "prog195.txt",
     "prog198.txt",
-    // prog286: after spilling 18 values, the remaining oversized clique
-    // consists entirely of reload temps (protected from re-spilling).
-    // This means the program genuinely needs >10 registers at some point.
-    "prog286.txt",
 ];
 
 fn have_timeout() -> bool {
@@ -38,7 +34,10 @@ fn falco_dump_corpus_rewrites_except_known_failures() {
     files.sort();
 
     if files.is_empty() {
-        eprintln!("skipping falco tests: no .txt programs in {}", falco.display());
+        eprintln!(
+            "skipping falco tests: no .txt programs in {}",
+            falco.display()
+        );
         return;
     }
 
@@ -100,5 +99,9 @@ fn falco_dump_corpus_rewrites_except_known_failures() {
         known_failed,
         unexpected.len()
     );
-    assert!(unexpected.is_empty(), "unexpected Falco failures:\n{}", unexpected.join("\n\n"));
+    assert!(
+        unexpected.is_empty(),
+        "unexpected Falco failures:\n{}",
+        unexpected.join("\n\n")
+    );
 }

From f739a7f87e09afba180462b92a0540ea9d5edcf2 Mon Sep 17 00:00:00 2001
From: Yiming Xiang <yiming@cs.utexas.edu>
Date: Sat, 11 Jul 2026 06:45:51 +0000
Subject: [PATCH 4/4] feat: falcolib

---
 docs/FALCOLIB_BUILD.md      | 161 ++++++++++++++++++++++++++++++++++++
 third-party/ePass-falcolib  |   2 +-
 third-party/ePass-xdp-tools |   2 +-
 3 files changed, 163 insertions(+), 2 deletions(-)
 create mode 100644 docs/FALCOLIB_BUILD.md

diff --git a/docs/FALCOLIB_BUILD.md b/docs/FALCOLIB_BUILD.md
new file mode 100644
index 0000000..8b02f90
--- /dev/null
+++ b/docs/FALCOLIB_BUILD.md
@@ -0,0 +1,161 @@
+# Falcolib Scap and Probe Build Notes
+
+Date: 2026-07-11
+
+Workspace: `/home/ubuntu/Downloads/ePass`
+
+## Goal
+
+Build `third-party/ePass-falcolib` scap userspace, both BPF probe variants where possible, and the small tools used to exercise the probes.
+
+## Host Prerequisites Observed
+
+- Ubuntu kernel: `6.8.0-134-generic`
+- Kernel headers: `/lib/modules/6.8.0-134-generic/build`
+- Kernel BTF: `/sys/kernel/btf/vmlinux`
+- CMake: `3.28.3`
+- GCC: `13.3.0`
+- Clang: `22.1.8`
+- bpftool: `v7.4.0`
+- `llc` was not installed as an unversioned binary, but `/usr/bin/llc-22` was available.
+
+Additional packages installed while testing:
+
+```bash
+sudo -n apt-get install -y libcap-dev
+```
+
+`libpcap-dev` was also installed earlier while validating xdp-tools.
+
+## Relevant Source Changes
+
+Falcolib's bundled libbpf dependency was changed in `third-party/ePass-falcolib/cmake/modules/libbpf.cmake`:
+
+```cmake
+GIT_REPOSITORY "git@github.com:OrderLab/ePass-libbpf.git"
+GIT_TAG "rs"
+```
+
+The same CMake module now passes the repository root Rust ePass path into the cloned libbpf build:
+
+```cmake
+EPASS_RS_DIR=${PROJECT_SOURCE_DIR}/../../core-rs
+```
+
+Without that, the `rs` libbpf build fails at `#include "epass.h"` because the cloned libbpf cannot infer the parent ePass repository layout.
+
+The configured build verified that bundled libbpf was cloned from branch `rs`:
+
+```bash
+git -C build-scap-drivers/libbpf-prefix/src/libbpf rev-parse --abbrev-ref HEAD
+# rs
+git -C build-scap-drivers/libbpf-prefix/src/libbpf rev-parse HEAD
+# 31b632bc5a06a663aecaf5e936977e78bc4c4766
+```
+
+## Configure
+
+Used the repository preset that enables scap, modern BPF, legacy BPF, kmod, and driver/libscap test targets:
+
+```bash
+cd third-party/ePass-falcolib
+cmake --preset scap-drivers
+```
+
+Important preset options:
+
+```text
+USE_BUNDLED_DEPS=ON
+BUILD_LIBSCAP_MODERN_BPF=ON
+BUILD_BPF=ON
+BUILD_DRIVER=ON
+CREATE_TEST_TARGETS=ON
+ENABLE_DRIVERS_TESTS=ON
+ENABLE_LIBSCAP_TESTS=ON
+BUILD_LIBSCAP_GVISOR=OFF
+```
+
+## Build Commands
+
+Modern BPF skeleton and scap:
+
+```bash
+cmake --build build-scap-drivers --target ProbeSkeleton scap -j$(nproc)
+```
+
+Legacy BPF probe:
+
+```bash
+cmake --build build-scap-drivers --target bpf -j$(nproc) -- LLC=/usr/bin/llc-22
+```
+
+The explicit `LLC=/usr/bin/llc-22` is needed on this host because the legacy BPF Makefile defaults to `llc`, and only the versioned LLVM tool is installed.
+
+Runtime/example and test tools:
+
+```bash
+cmake --build build-scap-drivers --target scap-open drivers_test libscap_test driver -j$(nproc) -- LLC=/usr/bin/llc-22
+```
+
+## Build Results
+
+All requested targets built successfully after passing `LLC=/usr/bin/llc-22` and installing `libcap-dev`.
+
+Artifacts:
+
+```text
+build-scap-drivers/libscap/libscap.a                         235K
+build-scap-drivers/skel_dir/bpf_probe.skel.h                 8.3M
+build-scap-drivers/driver/modern_bpf/bpf_probe.o             2.8M
+build-scap-drivers/driver/bpf/probe.o                        5.7M
+build-scap-drivers/driver/src/scap.ko                        3.7M
+build-scap-drivers/libscap/examples/01-open/scap-open         13M
+build-scap-drivers/test/drivers/drivers_test                  64M
+build-scap-drivers/test/libscap/libscap_test                  24M
+```
+
+Notes:
+
+- Modern BPF built successfully and generated `skel_dir/bpf_probe.skel.h`.
+- `scap` built successfully with the modern BPF engine bundled.
+- Legacy BPF built successfully as `driver/bpf/probe.o` when `LLC=/usr/bin/llc-22` was supplied.
+- Kmod built successfully as `driver/src/scap.ko`; the build printed `Skipping BTF generation ... due to unavailability of vmlinux`, but still produced the module.
+- The legacy BPF configure probe `TASK_PIDS_FIELD` failed because this kernel's `struct task_struct` lacks `pids`; this is expected feature detection and did not fail the final probe build.
+
+## Probe Test Tools
+
+Built `scap-open`, the small libscap example used to load and test drivers:
+
+```bash
+build-scap-drivers/libscap/examples/01-open/scap-open --help
+```
+
+Supported source options from its help output:
+
+```text
+--kmod
+--bpf <probe_path>
+--modern_bpf
+--scap_file <file.scap>
+```
+
+Typical local smoke commands, run with privileges because loading probes/modules requires kernel capabilities:
+
+```bash
+sudo ./build-scap-drivers/libscap/examples/01-open/scap-open \
+  --modern_bpf --num_events 10 --verbose 6
+
+sudo ./build-scap-drivers/libscap/examples/01-open/scap-open \
+  --bpf ./build-scap-drivers/driver/bpf/probe.o --num_events 10 --verbose 6
+
+sudo ./build-scap-drivers/libscap/examples/01-open/scap-open \
+  --kmod --num_events 10 --verbose 6
+```
+
+Also built the broader driver test harness:
+
+```bash
+sudo ./build-scap-drivers/test/drivers/drivers_test -m
+```
+
+I only built these tools and inspected their help. I did not run the probe-loading smoke tests here because they attach kernel probes/modules and can perturb the host.
diff --git a/third-party/ePass-falcolib b/third-party/ePass-falcolib
index ae37f40..243c2be 160000
--- a/third-party/ePass-falcolib
+++ b/third-party/ePass-falcolib
@@ -1 +1 @@
-Subproject commit ae37f4027ece58f4c26f973f0712b5961bf0daac
+Subproject commit 243c2bea37dd6083e65c18cb0faedffb4af5c182
diff --git a/third-party/ePass-xdp-tools b/third-party/ePass-xdp-tools
index a0bbee0..09703a5 160000
--- a/third-party/ePass-xdp-tools
+++ b/third-party/ePass-xdp-tools
@@ -1 +1 @@
-Subproject commit a0bbee0248699a10938e23c22275a70ed852dff1
+Subproject commit 09703a5ec078e30b2013517b8ad48ba466e833ab