Generalize shift_bb() to handle double pushes

And use it in evaluate_space.

No functional change.