case HALF_EVEN:
        // Since sqrt(2) is irrational, log2(x) - logFloor cannot be exactly 0.5
        int leadingZeros = Long.numberOfLeadingZeros(x);
        long cmp = MAX_POWER_OF_SQRT2_UNSIGNED >>> leadingZeros;
        // floor(2^(logFloor + 0.5))
        int logFloor = (Long.SIZE - 1) - leadingZeros;
        return logFloor + lessThanBranchFree(cmp, x);
    }
    throw new AssertionError("impossible");
  }

      case HALF_EVEN:
        // Since sqrt(2) is irrational, log2(x) - logFloor cannot be exactly 0.5
        int leadingZeros = Integer.numberOfLeadingZeros(x);
        int cmp = MAX_POWER_OF_SQRT2_UNSIGNED >>> leadingZeros;
        // floor(2^(logFloor + 0.5))
        int logFloor = (Integer.SIZE - 1) - leadingZeros;
        return logFloor + lessThanBranchFree(cmp, x);
    }
    throw new AssertionError();
  }

len(x.limbs) xLimbs := x.limbs[:size] for i := size - 1; i >= 0; i-- { if xLimbs[i] != 0 { return i*_W + bitLen(xLimbs[i]) } } return 0 } // bitLen is a version of bits.Len that only leaks the bit length of n, but not // its value. bits.Len and bits.LeadingZeros use a lookup table for the // low-order bits on some architectures. func bitLen(n uint) int { len := 0 // We assume, here and elsewhere, that comparison to zero is constant time // with respect to different non-zero values. for n != 0 { len++ n...