func (curve *CurveParams) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
	// If there is a dedicated constant-time implementation for this curve operation,
	// use that instead of the generic one.
	if specific, ok := matchesSpecificCurve(curve); ok {
		return specific.Double(x1, y1)
	}
	panicIfNotOnCurve(curve, x1, y1)

	z1 := zForAffine(x1, y1)

		// eliminate bounds checks on p
		q := p[i:]
		q = q[:BlockSize:BlockSize]

		// save current state
		aa, bb, cc, dd := a, b, c, d

		// load input block
		x0 := byteorder.LeUint32(q[4*0x0:])
		x1 := byteorder.LeUint32(q[4*0x1:])
		x2 := byteorder.LeUint32(q[4*0x2:])
		x3 := byteorder.LeUint32(q[4*0x3:])
		x4 := byteorder.LeUint32(q[4*0x4:])
		x5 := byteorder.LeUint32(q[4*0x5:])
		x6 := byteorder.LeUint32(q[4*0x6:])

	e := hashToInt(hash, c)
	w := new(big.Int).ModInverse(s, N)

	u1 := e.Mul(e, w)
	u1.Mod(u1, N)
	u2 := w.Mul(r, w)
	u2.Mod(u2, N)

	x1, y1 := c.ScalarBaseMult(u1.Bytes())
	x2, y2 := c.ScalarMult(pub.X, pub.Y, u2.Bytes())
	x, y := c.Add(x1, y1, x2, y2)

	if x.Sign() == 0 && y.Sign() == 0 {
		return false
	}
	x.Mod(x, N)
	return x.Cmp(r) == 0
}

var one = new(big.Int).SetInt64(1)

package main

var z [10 << 20]byte

func main() { // GC_ERROR "stack frame too large"
	// seq 1 206 | sed 's/.*/	var x& [10<<20]byte/'
	// seq 1 206 | sed 's/.*/	z = x&/'
	var x1 [10<<20]byte
	var x2 [10<<20]byte
	var x3 [10<<20]byte
	var x4 [10<<20]byte
	var x5 [10<<20]byte
	var x6 [10<<20]byte
	var x7 [10<<20]byte
	var x8 [10<<20]byte
	var x9 [10<<20]byte
	var x10 [10<<20]byte