Simplified test case; still failing, though. Reason seems to be that unfold_asg doesn't properly maintain parent/root pointers when it hoists sub-expressions into global declarations.