Index: src/AST/Decl.cpp
===================================================================
--- src/AST/Decl.cpp	(revision 20a5977853b171b0b954c0b3e9fc8c385f94e3cf)
+++ src/AST/Decl.cpp	(revision af1e8f56b08eebb76f81dc0a9fb07b0239b067fa)
@@ -72,8 +72,8 @@
 // --- EnumDecl
 
-bool EnumDecl::valueOf( Decl* enumerator, long long& value ) const {
+bool EnumDecl::valueOf( const Decl * enumerator, long long& value ) const {
 	if ( enumValues.empty() ) {
 		long long crntVal = 0;
-		for ( const Decl* member : members ) {
+		for ( const Decl * member : members ) {
 			const ObjectDecl* field = strict_dynamic_cast< const ObjectDecl* >( member );
 			if ( field->init ) {
Index: src/AST/Decl.hpp
===================================================================
--- src/AST/Decl.hpp	(revision 20a5977853b171b0b954c0b3e9fc8c385f94e3cf)
+++ src/AST/Decl.hpp	(revision af1e8f56b08eebb76f81dc0a9fb07b0239b067fa)
@@ -287,5 +287,5 @@
 
 	/// gets the integer value for this enumerator, returning true iff value found
-	bool valueOf( Decl* enumerator, long long& value ) const;
+	bool valueOf( const Decl * enumerator, long long& value ) const;
 
 	const Decl * accept( Visitor & v ) const override { return v.visit( this ); }
Index: src/AST/Pass.proto.hpp
===================================================================
--- src/AST/Pass.proto.hpp	(revision 20a5977853b171b0b954c0b3e9fc8c385f94e3cf)
+++ src/AST/Pass.proto.hpp	(revision af1e8f56b08eebb76f81dc0a9fb07b0239b067fa)
@@ -109,4 +109,6 @@
 	};
 
+	/// "Short hand" to check if this is a valid previsit function
+	/// Mostly used to make the static_assert look (and print) prettier
 	template<typename pass_t, typename node_t>
 	struct is_valid_previsit {
@@ -117,4 +119,7 @@
 	};
 
+	/// Used by previsit implementation
+	/// We need to reassign the result to 'node', unless the function
+	/// returns void, then we just leave 'node' unchanged
 	template<bool is_void>
 	struct __assign;
@@ -134,4 +139,27 @@
 			node = pass.previsit( node );
 			assertf(node, "Previsit must not return NULL");
+		}
+	};
+
+	/// Used by postvisit implementation
+	/// We need to return the result unless the function
+	/// returns void, then we just return the original node
+	template<bool is_void>
+	struct __return;
+
+	template<>
+	struct __return<true> {
+		template<typename pass_t, typename node_t>
+		static inline const node_t * result( pass_t & pass, const node_t * & node ) {
+			pass.postvisit( node );
+			return node;
+		}
+	};
+
+	template<>
+	struct __return<false> {
+		template<typename pass_t, typename node_t>
+		static inline auto result( pass_t & pass, const node_t * & node ) {
+			return pass.postvisit( node );
 		}
 	};
@@ -174,5 +202,9 @@
 		decltype( pass.postvisit( node ), node->accept( *(Visitor*)nullptr ) )
 	{
-		return pass.postvisit( node );
+		return __return<
+			std::is_void<
+				decltype( pass.postvisit( node ) )
+			>::value
+		>::result( pass, node );
 	}
 
Index: src/Common/Eval.cc
===================================================================
--- src/Common/Eval.cc	(revision 20a5977853b171b0b954c0b3e9fc8c385f94e3cf)
+++ src/Common/Eval.cc	(revision af1e8f56b08eebb76f81dc0a9fb07b0239b067fa)
@@ -17,8 +17,11 @@
 
 #include "Common/PassVisitor.h"
+#include "AST/Pass.hpp"
 #include "InitTweak/InitTweak.h"
 #include "SynTree/Expression.h"
 
-struct Eval : public WithShortCircuiting {
+//-------------------------------------------------------------
+// Old AST
+struct EvalOld : public WithShortCircuiting {
 	long long int value = 0;
 	bool valid = true;
@@ -80,6 +83,68 @@
 };
 
+//-------------------------------------------------------------
+// New AST
+struct EvalNew : public ast::WithShortCircuiting {
+	long long int value = 0;
+	bool valid = true;
+
+	void previsit( const ast::Node * ) { visit_children = false; }
+	void postvisit( const ast::Node * ) { valid = false; }
+
+	void postvisit( const ast::ConstantExpr * expr ) {
+		value = expr->intValue();
+	}
+
+	void postvisit( const ast::CastExpr * expr ) {
+		auto arg = eval(expr->arg);
+		valid = arg.second;
+		value = arg.first;
+		// TODO: perform type conversion on value if valid
+	}
+
+	void postvisit( const ast::VariableExpr * expr ) {
+		if ( const ast::EnumInstType * inst = dynamic_cast<const ast::EnumInstType *>(expr->result.get()) ) {
+			if ( const ast::EnumDecl * decl = inst->base ) {
+				if ( decl->valueOf( expr->var, value ) ) { // value filled by valueOf
+					return;
+				}
+			}
+		}
+		valid = false;
+	}
+
+	void postvisit( const ast::ApplicationExpr * expr ) {
+		const ast::DeclWithType * function = InitTweak::getFunction(expr);
+		if ( ! function || function->linkage != ast::Linkage::Intrinsic ) { valid = false; return; }
+		const std::string & fname = function->name;
+		assertf( expr->args.size() == 1 || expr->args.size() == 2, "Intrinsic function with %zd arguments: %s", expr->args.size(), fname.c_str() );
+		std::pair<long long int, bool> arg1, arg2;
+		arg1 = eval(expr->args.front());
+		valid = valid && arg1.second;
+		if ( ! valid ) return;
+		if ( expr->args.size() == 2 ) {
+			arg2 = eval(expr->args.back());
+			valid = valid && arg2.second;
+			if ( ! valid ) return;
+		}
+		if (fname == "?+?") {
+			value = arg1.first + arg2.first;
+		} else if (fname == "?-?") {
+			value = arg1.first - arg2.first;
+		} else if (fname == "?*?") {
+			value = arg1.first * arg2.first;
+		} else if (fname == "?/?") {
+			value = arg1.first / arg2.first;
+		} else if (fname == "?%?") {
+			value = arg1.first % arg2.first;
+		} else {
+			valid = false;
+		}
+		// TODO: implement other intrinsic functions
+	}
+};
+
 std::pair<long long int, bool> eval(Expression * expr) {
-	PassVisitor<Eval> ev;
+	PassVisitor<EvalOld> ev;
 	if (expr) {
 		expr->accept(ev);
@@ -91,6 +156,11 @@
 
 std::pair<long long int, bool> eval(const ast::Expr * expr) {
-	#warning not implemented
-	return { 0, false };
+	ast::Pass<EvalNew> ev;
+	if (expr) {
+		expr->accept(ev);
+		return std::make_pair(ev.pass.value, ev.pass.valid);
+	} else {
+		return std::make_pair(0, false);
+	}
 }
 
Index: src/Common/PassVisitor.impl.h
===================================================================
--- src/Common/PassVisitor.impl.h	(revision 20a5977853b171b0b954c0b3e9fc8c385f94e3cf)
+++ src/Common/PassVisitor.impl.h	(revision af1e8f56b08eebb76f81dc0a9fb07b0239b067fa)
@@ -23,21 +23,4 @@
 	assert( __return ); \
 	return __return;
-
-
-#define VISIT_BODY( node )          \
-	VISIT_START( node );          \
-	if( children_guard ) {        \
-		Visitor::visit( node ); \
-	}                             \
-	VISIT_END( node );            \
-
-
-#define MUTATE_BODY( type, node )    \
-	MUTATE_START( node );          \
-	if( children_guard ) {         \
-		Mutator::mutate( node ); \
-	}                              \
-	MUTATE_END( type, node );      \
-
 
 
@@ -2762,2 +2745,8 @@
 	MUTATE_END( TypeSubstitution, node );
 }
+
+#undef VISIT_START
+#undef VISIT_END
+
+#undef MUTATE_START
+#undef MUTATE_END
Index: src/InitTweak/InitTweak.cc
===================================================================
--- src/InitTweak/InitTweak.cc	(revision 20a5977853b171b0b954c0b3e9fc8c385f94e3cf)
+++ src/InitTweak/InitTweak.cc	(revision af1e8f56b08eebb76f81dc0a9fb07b0239b067fa)
@@ -346,4 +346,5 @@
 	namespace {
 		DeclarationWithType * getCalledFunction( Expression * expr );
+		const ast::DeclWithType * getCalledFunction( const ast::Expr * expr );
 
 		template<typename CallExpr>
@@ -355,4 +356,14 @@
 			return getCalledFunction( expr->get_args().front() );
 		}
+
+		template<typename CallExpr>
+		const ast::DeclWithType * handleDerefCalledFunction( const CallExpr * expr ) {
+			// (*f)(x) => should get "f"
+			std::string name = getFunctionName( expr );
+			assertf( name == "*?", "Unexpected untyped expression: %s", name.c_str() );
+			assertf( ! expr->args.empty(), "Cannot get called function from dereference with no arguments" );
+			return getCalledFunction( expr->args.front() );
+		}
+
 
 		DeclarationWithType * getCalledFunction( Expression * expr ) {
@@ -375,4 +386,24 @@
 			return nullptr;
 		}
+
+		const ast::DeclWithType * getCalledFunction( const ast::Expr * expr ) {
+			assert( expr );
+			if ( const ast::VariableExpr * varExpr = dynamic_cast< const ast::VariableExpr * >( expr ) ) {
+				return varExpr->var;
+			} else if ( const ast::MemberExpr * memberExpr = dynamic_cast< const ast::MemberExpr * >( expr ) ) {
+				return memberExpr->member;
+			} else if ( const ast::CastExpr * castExpr = dynamic_cast< const ast::CastExpr * >( expr ) ) {
+				return getCalledFunction( castExpr->arg );
+			} else if ( const ast::UntypedExpr * untypedExpr = dynamic_cast< const ast::UntypedExpr * >( expr ) ) {
+				return handleDerefCalledFunction( untypedExpr );
+			} else if ( const ast::ApplicationExpr * appExpr = dynamic_cast< const ast::ApplicationExpr * > ( expr ) ) {
+				return handleDerefCalledFunction( appExpr );
+			} else if ( const ast::AddressExpr * addrExpr = dynamic_cast< const ast::AddressExpr * >( expr ) ) {
+				return getCalledFunction( addrExpr->arg );
+			} else if ( const ast::CommaExpr * commaExpr = dynamic_cast< const ast::CommaExpr * >( expr ) ) {
+				return getCalledFunction( commaExpr->arg2 );
+			}
+			return nullptr;
+		}
 	}
 
@@ -382,4 +413,13 @@
 		} else if ( UntypedExpr * untyped = dynamic_cast< UntypedExpr * > ( expr ) ) {
 			return getCalledFunction( untyped->get_function() );
+		}
+		assertf( false, "getFunction received unknown expression: %s", toString( expr ).c_str() );
+	}
+
+	const ast::DeclWithType * getFunction( const ast::Expr * expr ) {
+		if ( const ast::ApplicationExpr * appExpr = dynamic_cast< const ast::ApplicationExpr * >( expr ) ) {
+			return getCalledFunction( appExpr->func );
+		} else if ( const ast::UntypedExpr * untyped = dynamic_cast< const ast::UntypedExpr * > ( expr ) ) {
+			return getCalledFunction( untyped->func );
 		}
 		assertf( false, "getFunction received unknown expression: %s", toString( expr ).c_str() );
@@ -434,16 +474,16 @@
 		}
 
-		// template<typename CallExpr>
-		// const ast::Expr * callArg( const CallExpr * call, unsigned int pos ) {
-		// 	if( pos >= call->args.size() ) {
-		// 		assertf( false, "getCallArg for argument that doesn't exist: (%u); %s.",
-		// 			pos, toString( call ).c_str() );
-		// 	}
-		// 	for ( const ast::Expr * arg : call->args ) {
-		// 		if ( pos == 0 ) return arg;
-		// 		--pos;
-		// 	}
-		// 	assert( false );
-		// }
+		template<typename CallExpr>
+		const ast::Expr * callArg( const CallExpr * call, unsigned int pos ) {
+			if( pos >= call->args.size() ) {
+				assertf( false, "getCallArg for argument that doesn't exist: (%u); %s.",
+					pos, toString( call ).c_str() );
+			}
+			for ( const ast::Expr * arg : call->args ) {
+				if ( pos == 0 ) return arg;
+				--pos;
+			}
+			assert( false );
+		}
 	}
 
@@ -466,30 +506,28 @@
 		}
 	}
+
 	const ast::Expr * getCallArg( const ast::Expr * call, unsigned pos ) {
-		(void)call;
-		(void)pos;
-		#warning unimplemented; needs to build AST/Expr.cpp
-		assertf(false, "unimplemented; needs to build AST/Expr.cpp");
-		// if ( auto app = dynamic_cast< const ast::ApplicationExpr * >( call ) ) {
-		// 	return callArg( app, pos );
-		// } else if ( auto untyped = dynamic_cast< const ast::UntypedExpr * >( call ) ) {
-		// 	return callArg( untyped, pos );
-		// } else if ( auto tupleAssn = dynamic_cast< const ast::TupleAssignExpr * >( call ) ) {
-		// 	const std::list<ast::ptr<ast::Stmt>>& stmts = tupleAssn->stmtExpr->stmts->kids;
-		// 	assertf( ! stmts.empty(), "TupleAssignExpr missing statements." );
-		// 	const ExprStmt * stmt = strict_dynamic_cast< const ast::ExprStmt * >( stmts.back() );
-		// 	const TupleExpr * tuple = strict_dynamic_cast< const ast::TupleExpr * >( stmt->expr );
-		// 	assertf( ! tuple->exprs.empty(), "TupleAssignExpr has empty tuple expr.");
-		// 	return getCallArg( tuple->exprs.front(), pos );
-		// } else if ( auto ctor = dynamic_cast< const ast::ImplicitCopyCtorExpr * >( call ) ) {
-		// 	return getCallArg( ctor->callExpr, pos );
-		// } else {
-		// 	assertf( false, "Unexpected expression type passed to getCallArg: %s",
-		// 		toString( call ).c_str() );
-		// }
+		if ( auto app = dynamic_cast< const ast::ApplicationExpr * >( call ) ) {
+			return callArg( app, pos );
+		} else if ( auto untyped = dynamic_cast< const ast::UntypedExpr * >( call ) ) {
+			return callArg( untyped, pos );
+		} else if ( auto tupleAssn = dynamic_cast< const ast::TupleAssignExpr * >( call ) ) {
+			const std::list<ast::ptr<ast::Stmt>>& stmts = tupleAssn->stmtExpr->stmts->kids;
+			assertf( ! stmts.empty(), "TupleAssignExpr missing statements." );
+			auto stmt  = strict_dynamic_cast< const ast::ExprStmt * >( stmts.back().get() );
+			auto tuple = strict_dynamic_cast< const ast::TupleExpr * >( stmt->expr.get() );
+			assertf( ! tuple->exprs.empty(), "TupleAssignExpr has empty tuple expr.");
+			return getCallArg( tuple->exprs.front(), pos );
+		} else if ( auto ctor = dynamic_cast< const ast::ImplicitCopyCtorExpr * >( call ) ) {
+			return getCallArg( ctor->callExpr, pos );
+		} else {
+			assertf( false, "Unexpected expression type passed to getCallArg: %s",
+				toString( call ).c_str() );
+		}
 	}
 
 	namespace {
 		std::string funcName( Expression * func );
+		std::string funcName( const ast::Expr * func );
 
 		template<typename CallExpr>
@@ -500,4 +538,13 @@
 			assertf( ! expr->get_args().empty(), "Cannot get function name from dereference with no arguments" );
 			return funcName( expr->get_args().front() );
+		}
+
+		template<typename CallExpr>
+		std::string handleDerefName( const CallExpr * expr ) {
+			// (*f)(x) => should get name "f"
+			std::string name = getFunctionName( expr );
+			assertf( name == "*?", "Unexpected untyped expression: %s", name.c_str() );
+			assertf( ! expr->args.empty(), "Cannot get function name from dereference with no arguments" );
+			return funcName( expr->args.front() );
 		}
 
@@ -523,4 +570,26 @@
 			}
 		}
+
+		std::string funcName( const ast::Expr * func ) {
+			if ( const ast::NameExpr * nameExpr = dynamic_cast< const ast::NameExpr * >( func ) ) {
+				return nameExpr->name;
+			} else if ( const ast::VariableExpr * varExpr = dynamic_cast< const ast::VariableExpr * >( func ) ) {
+				return varExpr->var->name;
+			}	else if ( const ast::CastExpr * castExpr = dynamic_cast< const ast::CastExpr * >( func ) ) {
+				return funcName( castExpr->arg );
+			} else if ( const ast::MemberExpr * memberExpr = dynamic_cast< const ast::MemberExpr * >( func ) ) {
+				return memberExpr->member->name;
+			} else if ( const ast::UntypedMemberExpr * memberExpr = dynamic_cast< const ast::UntypedMemberExpr * > ( func ) ) {
+				return funcName( memberExpr->member );
+			} else if ( const ast::UntypedExpr * untypedExpr = dynamic_cast< const ast::UntypedExpr * >( func ) ) {
+				return handleDerefName( untypedExpr );
+			} else if ( const ast::ApplicationExpr * appExpr = dynamic_cast< const ast::ApplicationExpr * >( func ) ) {
+				return handleDerefName( appExpr );
+			} else if ( const ast::ConstructorExpr * ctorExpr = dynamic_cast< const ast::ConstructorExpr * >( func ) ) {
+				return funcName( getCallArg( ctorExpr->callExpr, 0 ) );
+			} else {
+				assertf( false, "Unexpected expression type being called as a function in call expression: %s", toString( func ).c_str() );
+			}
+		}
 	}
 
@@ -539,4 +608,18 @@
 	}
 
+	std::string getFunctionName( const ast::Expr * expr ) {
+		// there's some unforunate overlap here with getCalledFunction. Ideally this would be able to use getCalledFunction and
+		// return the name of the DeclarationWithType, but this needs to work for NameExpr and UntypedMemberExpr, where getCalledFunction
+		// can't possibly do anything reasonable.
+		if ( const ast::ApplicationExpr * appExpr = dynamic_cast< const ast::ApplicationExpr * >( expr ) ) {
+			return funcName( appExpr->func );
+		} else if ( const ast::UntypedExpr * untypedExpr = dynamic_cast< const ast::UntypedExpr * > ( expr ) ) {
+			return funcName( untypedExpr->func );
+		} else {
+			std::cerr << expr << std::endl;
+			assertf( false, "Unexpected expression type passed to getFunctionName" );
+		}
+	}
+
 	Type * getPointerBase( Type * type ) {
 		if ( PointerType * ptrType = dynamic_cast< PointerType * >( type ) ) {
@@ -551,14 +634,11 @@
 	}
 	const ast::Type* getPointerBase( const ast::Type* t ) {
-		(void)t;
-		#warning needs to build Type.cpp before inclusion
-		assertf(false, "needs to build Type.cpp before inclusion");
-		// if ( const auto * p = dynamic_cast< const ast::PointerType * >( t ) ) {
-		// 	return p->base;
-		// } else if ( const auto * a = dynamic_cast< const ast::ArrayType * >( t ) ) {
-		// 	return a->base;
-		// } else if ( const auto * r = dynamic_cast< const ast::ReferenceType * >( t ) ) {
-		// 	return r->base;
-		// } else return nullptr;
+		if ( const auto * p = dynamic_cast< const ast::PointerType * >( t ) ) {
+			return p->base;
+		} else if ( const auto * a = dynamic_cast< const ast::ArrayType * >( t ) ) {
+			return a->base;
+		} else if ( const auto * r = dynamic_cast< const ast::ReferenceType * >( t ) ) {
+			return r->base;
+		} else return nullptr;
 	}
 
Index: src/InitTweak/InitTweak.h
===================================================================
--- src/InitTweak/InitTweak.h	(revision 20a5977853b171b0b954c0b3e9fc8c385f94e3cf)
+++ src/InitTweak/InitTweak.h	(revision af1e8f56b08eebb76f81dc0a9fb07b0239b067fa)
@@ -58,4 +58,5 @@
 	/// returns the declaration of the function called by the expr (must be ApplicationExpr or UntypedExpr)
 	DeclarationWithType * getFunction( Expression * expr );
+	const ast::DeclWithType * getFunction( const ast::Expr * expr );
 
 	/// Non-Null if expr is a call expression whose target function is intrinsic
@@ -78,4 +79,5 @@
 	/// returns the name of the function being called
 	std::string getFunctionName( Expression * expr );
+	std::string getFunctionName( const ast::Expr * expr );
 
 	/// returns the argument to a call expression in position N indexed from 0