let result = try newValues(input, n);

/// Exact-capacity storage with a fully initialized operand prefix.

record ValueBuilder {

    /// Opaque storage reserved for the full operand count.

    storage: *mut [opaque],

    /// Number of initialized operands in the prefix.

    initialized: u32,

}

/// Reserve operand storage without exposing uninitialized typed elements.

unsafe fn newValues 'input (input: &mut Reader 'input, count: u32) -> ValueBuilder throws (binary::Error) {

    let buffer = try storage(input, @sizeOf(il::Val), @alignOf(il::Val), count);

    return ValueBuilder { storage: buffer, initialized: 0 };

}

/// Initialize the next operand. Return false when the storage is full.

fn pushValue(builder: &mut ValueBuilder, value: il::Val) -> bool {

    if builder.initialized == builder.storage.len {

        return false;

    }

    unsafe {

        let values = (&mut builder.storage[..]) as *unsafe mut [il::Val];

        set values[builder.initialized] = value;

    }

    set builder.initialized += 1;

    return true;

}

/// Consume a builder and publish its owned table only when it is complete.

/// Incomplete Copy operands need no element cleanup; the arena retains storage.

fn finishValues(builder: ValueBuilder) -> ValueCompletion {

    let case ValueBuilder { storage, initialized } = builder

        else panic "finishValues: invalid builder";

    if initialized <> storage.len {

        return ValueCompletion::Incomplete;

    }

    unsafe {

        return ValueCompletion::Complete(storage as *mut [il::Val]);

    }

}

/// Completion distinguishes an empty initialized table from incomplete storage.

union ValueCompletion {

    /// Fully initialized table, including zero operands.

    Complete(*mut [il::Val]),

    /// Storage discarded before all operands were initialized.

    Incomplete,

}

fn fillValues 'input (input: &mut Reader 'input, builder: ValueBuilder) -> *mut [il::Val] throws (binary::Error) {

    let mut pending = builder;

    while pending.initialized < pending.storage.len {

        assert pushValue(&mut pending, try val(input));

    let case ValueCompletion::Complete(result) = finishValues(pending)

        else panic "fillValues: incomplete operand table";

/// Exact operand tables use one allocation and publish only complete prefixes.

@test unsafe fn exactValueStorage() throws (testing::TestError) {

    let namesTable: [*[u8]; 0] = [];

    let alignment = @alignOf(il::Val);

    let remainder = ((&MEMORY[0]) as u64) & (alignment as u64 - 1);

    let padding = ((alignment as u64 - remainder) & (alignment as u64 - 1)) as u32;

    for count in 0..4 {

        let required = 0 if count == 0 else padding + count * @sizeOf(il::Val);

        let mut encoded: [u8; 7] = [0, 0, 0, 0, 4, 4, 4];

        set encoded[0] = count as u8;

        for capacity in 0..required + 1 {

            let mut arena = alloc::new(&mut MEMORY[..capacity]);

            let source: 'input = &encoded[..4 + count], names = &namesTable[..] in {

                let mut input = reader::new(source, &mut arena, names);

                let mut failed = false;

                let result = try reader::values(&mut input) catch error {

                    assert error == binary::Error::Storage;

                    set failed = true;

                    &mut [] as *unsafe mut [il::Val]

                };

                assert failed == (capacity < required);

                assert input.offset == (4 if failed else 4 + count);

                if not failed {

                    assert result.len == count;

                    for value in result { assert value == il::Val::Undef; }

                }

            }

            assert arena.offset == (0 if capacity < required else required);

        }

    }

}