(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** Heavily annotated for a tutorial introduction.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** See the Makefile for how to strip the annotations
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** First, import the entire Floyd proof automation system, which
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** includes the VeriC program logic and the MSL theory of separation logic
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)
Require Import VST.floyd.proofauto.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** Import the theory of list segments.  This is not, strictly speaking,
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** part of the Floyd system.  In principle, any user of Floyd can build
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** theories of new data structures (list segments, trees, doubly linked
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** lists, trees with cross edges, etc.).  We emphasize this by putting
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** list_dt in the progs directory.   "dt" stands for "dependent types",
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** as the theory uses Coq's dependent types to handle user-defined
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** record fields.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)
Require Import VST.progs.list_dt. Import LsegSpecial.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** Import the [reverse.v] file, which is produced by CompCert's clightgen
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** from reverse.c.   The file reverse.v defines abbreviations for identifiers
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** (variable names, etc.) of the C program, such as _head, _reverse.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** It also defines "prog", which is the entire abstract syntax tree
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** of the C program in the reverse.c file.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)
Require Import VST.progs.reverse.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(* The C programming language has a special namespace for struct
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
** and union identifiers, e.g., "struct foo {...}".  Some type-based operators
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
** in the program logic need access to an interpretation of this namespace,
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
** i.e., the meaning of each struct-identifier such as "foo".  The next
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
** line (which looks identical for any program) builds this
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
** interpretation, called "CompSpecs" *)
Instance CompSpecs : compspecs. make_compspecs prog. Defined.
Definition Vprog : varspecs. mk_varspecs prog. Defined.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** The reverse.c program uses the linked list structure [struct list].
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** This satisfies the linked-list pattern, in that it has one self-reference
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** field (in this case, called [tail]) and arbitrary other fields.  The [Instance]
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** explains (and proves) how [struct list] satisfies the [listspec] pattern.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)
Instance LS: listspec _list _tail (fun _ _ => emp).
Proof. eapply mk_listspec; reflexivity. Defined.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(**  An auxiliary definition useful in the specification of [sumlist] *)
Definition sum_int := fold_right Int.add Int.zero.

Definition t_struct_list := Tstruct _list noattr.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** Specification of the [sumlist] function from reverse.c.  All the functions
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** defined in the file, AND extern functions imported by the .c file,
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** must be declared in this way.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)
Definition sumlist_spec :=
 DECLARE _sumlist
  WITH sh : share, contents : list int, p: val
  PRE [ _p OF (tptr t_struct_list) ]
     PROP(readable_share sh)
     LOCAL (temp _p p)
     SEP (lseg LS sh (map Vint contents) p nullval)
  POST [ tuint ]
     PROP()
     LOCAL(temp ret_temp (Vint (sum_int contents)))
     SEP (lseg LS sh (map Vint contents) p nullval).

Definition reverse_spec :=
 DECLARE _reverse
  WITH sh : share, contents : list val, p: val
  PRE  [ _p OF (tptr t_struct_list) ]
     PROP (writable_share sh)
     LOCAL (temp _p p)
     SEP (lseg LS sh contents p nullval)
  POST [ (tptr t_struct_list) ]
    EX p:val,
     PROP () LOCAL (temp ret_temp p)
     SEP (lseg LS sh (rev contents) p nullval).

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** The "main" function is special, since its precondition includes
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** the spatial (SEP) resource describing all the extern initialized
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** global variables.  That resource is calculated automatically
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** from the program (prog) by the "main_pre" operator.  **)
Definition main_spec :=
 DECLARE _main
  WITH gv : globals
  PRE  [] main_pre prog nil gv
  POST [ tint ]
     PROP() LOCAL (temp ret_temp (Vint (Int.repr (3+2+1)))) SEP(TT).

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** List all the function-specs, to form the global hypothesis *)
Definition Gprog : funspecs :=   ltac:(with_library prog [
    sumlist_spec; main_spec; reverse_spec]).

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** A little equation about the list_cell predicate *)
Lemma list_cell_eq: forall sh i p ,
   sepalg.nonidentity sh ->
   field_compatible t_struct_list [] p ->
   list_cell LS sh (Vint i) p =
   field_at sh t_struct_list (DOT _head) (Vint i) p.
Proof.
(* Goal: forall (Delta : tycontext) (gv : globals) (_ : @eq (option type) (@PTree.get type _three (glob_types Delta)) (@Some type (tarray t_struct_list (Zpos (xI xH))))), @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) *)
  intros.
(* Goal: @eq mpred (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (Vint i) p) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) p) *)
  unfold list_cell, field_at; simpl.
(* Goal: @eq mpred (@andp mpred Nveric (@prop mpred Nveric (@field_compatible CompSpecs (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@nil gfield) p)) (withspacer sh (Zpos (xO (xO xH))) (field_offset_next (@PTree.Node composite (@PTree.Node composite (@PTree.Leaf composite) (@Some composite (Build_composite Struct (@cons (prod ident type) (@pair ident type _head tuint) (@cons (prod ident type) (@pair ident type _tail (tptr (Tstruct _list noattr))) (@nil (prod ident type)))) noattr (Zpos (xO (xO (xO xH)))) (Zpos (xO (xO xH))) O (Zgeb0_ge0 (Zpos (xO (xO (xO xH)))) (@eq_refl bool (Z.geb (Zpos (xO (xO (xO xH)))) Z0))) (prove_alignof_two_p (Zpos (xO (xO xH))) (@eq_refl Z (Zpos (xO (xO xH))))) (prove_Zdivide (Zpos (xO (xO xH))) (Zpos (xO (xO (xO xH)))) (@eq_refl Z (Zpos (xO (xO (xO xH)))))))) (@PTree.Leaf composite)) (@None composite) (@PTree.Leaf composite)) _head (@cons (prod ident type) (@pair ident type _head tuint) (@cons (prod ident type) (@pair ident type _tail (tptr (Tstruct _list noattr))) (@nil (prod ident type)))) (Zpos (xO (xO (xO xH))))) (at_offset (@data_at_rec CompSpecs sh tuint (Vint i)) Z0) p)) (@andp mpred Nveric (@prop mpred Nveric (@field_compatible CompSpecs t_struct_list (@cons gfield (StructField _head) (@nil gfield)) p)) (at_offset (@data_at_rec CompSpecs sh tuint (Vint i)) Z0 p)) *)
  rewrite !prop_true_andp by auto with field_compatible.
(* Goal: @eq mpred (withspacer sh (Zpos (xO (xO xH))) (field_offset_next (@PTree.Node composite (@PTree.Node composite (@PTree.Leaf composite) (@Some composite (Build_composite Struct (@cons (prod ident type) (@pair ident type _head tuint) (@cons (prod ident type) (@pair ident type _tail (tptr (Tstruct _list noattr))) (@nil (prod ident type)))) noattr (Zpos (xO (xO (xO xH)))) (Zpos (xO (xO xH))) O (Zgeb0_ge0 (Zpos (xO (xO (xO xH)))) (@eq_refl bool (Z.geb (Zpos (xO (xO (xO xH)))) Z0))) (prove_alignof_two_p (Zpos (xO (xO xH))) (@eq_refl Z (Zpos (xO (xO xH))))) (prove_Zdivide (Zpos (xO (xO xH))) (Zpos (xO (xO (xO xH)))) (@eq_refl Z (Zpos (xO (xO (xO xH)))))))) (@PTree.Leaf composite)) (@None composite) (@PTree.Leaf composite)) _head (@cons (prod ident type) (@pair ident type _head tuint) (@cons (prod ident type) (@pair ident type _tail (tptr (Tstruct _list noattr))) (@nil (prod ident type)))) (Zpos (xO (xO (xO xH))))) (at_offset (@data_at_rec CompSpecs sh tuint (Vint i)) Z0) p) (at_offset (@data_at_rec CompSpecs sh tuint (Vint i)) Z0 p) *)
  reflexivity.
Qed.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** Here's a loop invariant for use in the body_sumlist proof *)
Definition sumlist_Inv (sh: share) (contents: list int) (p: val) : environ->mpred :=
          (EX cts1: list int, EX cts2: list int, EX t: val,
            PROP (contents = cts1++cts2)
            LOCAL (temp _t t; temp _s (Vint (sum_int cts1)))
            SEP ( lseg LS sh (map Vint cts1) p t ; lseg LS sh (map Vint cts2) t nullval)).

Lemma sum_int_app:
  forall a b, sum_int (a++b) = Int.add (sum_int a) (sum_int b).
Proof.
(* Goal: forall (Delta : tycontext) (gv : globals) (_ : @eq (option type) (@PTree.get type _three (glob_types Delta)) (@Some type (tarray t_struct_list (Zpos (xI xH))))), @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) *)
intros.
(* Goal: @eq Int.int (sum_int (@app Int.int a b)) (Int.add (sum_int a) (sum_int b)) *)
induction a; simpl. rewrite Int.add_zero_l; auto.
(* Goal: @eq Int.int (Int.add a (sum_int (@app Int.int a0 b))) (Int.add (Int.add a (sum_int a0)) (sum_int b)) *)
rewrite IHa. rewrite Int.add_assoc. auto.
Qed.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** For every function definition in the C program, prove that the
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** function-body (in this case, f_sumlist) satisfies its specification
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** (in this case, sumlist_spec).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)
Lemma body_sumlist: semax_body Vprog Gprog f_sumlist sumlist_spec.
Proof.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** Here is the standard way to start a function-body proof:  First,
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
 ** start-function; then forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)
(* Goal: semax_body Vprog Gprog CompSpecs f_main main_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* s = 0; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* t = p; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t p) (@cons localdef (temp _s (Vint (Int.repr Z0))) (@cons localdef (temp _p p) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint contents) p nullval) (@nil mpred))))) (Ssequence (Swhile (Etempvar _t (tptr (Tstruct _list noattr))) LOOP_BODY) MORE_COMMANDS) POSTCONDITION *)
forward_while (sumlist_Inv sh contents p).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* Prove that current precondition implies loop invariant *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t p) (@cons localdef (temp _s (Vint (Int.repr Z0))) (@cons localdef (temp _p p) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint contents) p nullval) (@nil mpred)))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (list Int.int) (fun cts1 : list Int.int => @exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (list Int.int) (fun cts2 : list Int.int => @exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) val (fun t : val => PROPx (@cons Prop (@eq (list Int.int) contents (@app Int.int cts1 cts2)) (@nil Prop)) (LOCALx (@cons localdef (temp _t t) (@cons localdef (temp _s (Vint (sum_int cts1))) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) t nullval) (@nil mpred))))))))) *)
Exists (@nil int) contents p.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
entailer!. cancel.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* Prove that loop invariant implies typechecking condition *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
entailer!.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* Prove that loop body preserves invariant *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t t) (@cons localdef (temp _s (Vint (sum_int cts1))) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) t nullval) (@nil mpred)))))) (Ssequence (Sset _h (Efield (Ederef (Etempvar _t (tptr (Tstruct _list noattr))) (Tstruct _list noattr)) _head tuint)) MORE_COMMANDS) POSTCONDITION *)
focus_SEP 1; apply semax_lseg_nonnull; [ | intros h' r y ? ?].
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
entailer!.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t t) (@cons localdef (temp _s (Vint (sum_int cts1))) (@nil localdef))) (SEPx (@cons mpred (@emp mpred Nveric Sveric) (@cons mpred (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h' t) (@cons mpred (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) (@valinject CompSpecs (@nested_field_type CompSpecs (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield))) y) t) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh r y nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t) (@nil mpred))))))))) (Ssequence (Sset _h (Efield (Ederef (Etempvar _t (tptr (Tstruct _list noattr))) (Tstruct _list noattr)) _head tuint)) MORE_COMMANDS) POSTCONDITION *)
destruct cts2; inversion H0; clear H0; subst_any.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
simpl. (* this line not necessary, but makes things look nicer *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
assert_PROP (field_compatible t_struct_list nil t) as FC by entailer!.
(* Goal: @derives mpred Nveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) *)
rewrite list_cell_eq by auto.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* h = t->head; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (*  t = t->tail; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* s = s + h; *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (Int.add (sum_int cts1) i))) (@cons localdef (temp _t y) (@cons localdef (temp _h (Vint i)) (@nil localdef)))) (SEPx (@cons mpred (@emp mpred Nveric Sveric) (@cons mpred (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t) (@cons mpred (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y t) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t) (@nil mpred)))))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (prod (prod (list Int.int) (list Int.int)) val) (fun a : prod (prod (list Int.int) (list Int.int)) val => PROPx (@cons Prop (@eq (list Int.int) (@app Int.int cts1 (@cons Int.int i cts2)) (@app Int.int (@fst (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val a)) (@snd (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val a)))) (@nil Prop)) (LOCALx (@cons localdef (temp _t (@snd (prod (list Int.int) (list Int.int)) val a)) (@cons localdef (temp _s (Vint (sum_int (@fst (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val a))))) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@fst (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val a))) p (@snd (prod (list Int.int) (list Int.int)) val a)) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@snd (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val a))) (@snd (prod (list Int.int) (list Int.int)) val a) nullval) (@nil mpred))))))) *)
Exists (cts1++[i],cts2,y).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (Int.add (sum_int cts1) i))) (@cons localdef (temp _t y) (@cons localdef (temp _h (Vint i)) (@nil localdef)))) (SEPx (@cons mpred (@emp mpred Nveric Sveric) (@cons mpred (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t) (@cons mpred (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y t) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t) (@nil mpred)))))))))) (PROPx (@cons Prop (@eq (list Int.int) (@app Int.int cts1 (@cons Int.int i cts2)) (@app Int.int (@fst (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y))) (@snd (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y))))) (@nil Prop)) (LOCALx (@cons localdef (temp _t (@snd (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y))) (@cons localdef (temp _s (Vint (sum_int (@fst (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y)))))) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@fst (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y)))) p (@snd (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y))) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@snd (list Int.int) (list Int.int) (@fst (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y)))) (@snd (prod (list Int.int) (list Int.int)) val (@pair (prod (list Int.int) (list Int.int)) val (@pair (list Int.int) (list Int.int) (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2) y)) nullval) (@nil mpred)))))) *)
entailer.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval)) (@andp mpred Nveric (@prop mpred Nveric (not (ptr_eq v nullval))) (@exp mpred Nveric (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (fun h0 : @elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS => @exp mpred Nveric (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (fun r : list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) => @exp mpred Nveric val (fun y : val => @sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@andp mpred Nveric (@prop mpred Nveric (and (@eq (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h0 r)) (is_pointer_or_null y))) (@emp mpred Nveric Sveric)) (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h0 v)) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) (@valinject CompSpecs (@nested_field_type CompSpecs (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield))) y) v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh r y nullval)))))) *)
apply andp_right.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval)) (@prop mpred Nveric (not (ptr_eq v nullval))) *)
apply prop_right.
(* Goal: and (@eq (list Int.int) (@app Int.int cts1 (@cons Int.int i cts2)) (@app Int.int (@app Int.int cts1 (@cons Int.int i (@nil Int.int))) cts2)) (@eq val (Vint (sum_int (@app Int.int cts1 (@cons Int.int i (@nil Int.int))))) (Vint (Int.add (sum_int cts1) i))) *)
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y t)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t)) (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@app Int.int cts1 (@cons Int.int i (@nil Int.int)))) p y) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) *)
split.
(* Goal: @eq mpred (withspacer sh (Zpos (xO (xO xH))) (field_offset_next (@PTree.Node composite (@PTree.Node composite (@PTree.Leaf composite) (@Some composite (Build_composite Struct (@cons (prod ident type) (@pair ident type _head tuint) (@cons (prod ident type) (@pair ident type _tail (tptr (Tstruct _list noattr))) (@nil (prod ident type)))) noattr (Zpos (xO (xO (xO xH)))) (Zpos (xO (xO xH))) O (Zgeb0_ge0 (Zpos (xO (xO (xO xH)))) (@eq_refl bool (Z.geb (Zpos (xO (xO (xO xH)))) Z0))) (prove_alignof_two_p (Zpos (xO (xO xH))) (@eq_refl Z (Zpos (xO (xO xH))))) (prove_Zdivide (Zpos (xO (xO xH))) (Zpos (xO (xO (xO xH)))) (@eq_refl Z (Zpos (xO (xO (xO xH)))))))) (@PTree.Leaf composite)) (@None composite) (@PTree.Leaf composite)) _head (@cons (prod ident type) (@pair ident type _head tuint) (@cons (prod ident type) (@pair ident type _tail (tptr (Tstruct _list noattr))) (@nil (prod ident type)))) (Zpos (xO (xO (xO xH))))) (at_offset (@data_at_rec CompSpecs sh tuint (Vint i)) Z0) p) (at_offset (@data_at_rec CompSpecs sh tuint (Vint i)) Z0 p) *)
rewrite app_ass; reflexivity.
(* Goal: @eq Int.int (sum_int (@cons Int.int i (@nil Int.int))) i *)
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y t)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t)) (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@app Int.int cts1 (@cons Int.int i (@nil Int.int)))) p y) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) *)
 f_equal. rewrite sum_int_app. f_equal. simpl. apply Int.add_zero.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y t)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t)) (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@app Int.int cts1 (@cons Int.int i (@nil Int.int)))) p y) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) *)
rewrite map_app. simpl map.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y t)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t)) (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@app val (@map Int.int val Vint cts1) (@cons val (Vint i) (@nil val))) p y) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) *)
eapply derives_trans; [ | apply (lseg_cons_right_list LS) with (y:=t); auto].
(* Goal: @derives mpred Nveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) *)
rewrite list_cell_eq by auto.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y t)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t)) (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@emp mpred Nveric Sveric) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _head) (@nil gfield)) (Vint i) t)) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) (@valinject CompSpecs (@nested_field_type CompSpecs (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield))) y) t)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p t)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts2) y nullval)) *)
cancel.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* After the loop *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* return s; *)
(* Goal: @derives mpred Nveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint cts1) p nullval) (@andp mpred Nveric (@prop mpred Nveric (@eq val (Vint (sum_int cts1)) (Vint (sum_int (@app Int.int cts1 cts2))))) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint (@app Int.int cts1 cts2)) p nullval)) *)
destruct cts2; [| inversion H]. rewrite <- app_nil_end.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
entailer!.
Qed.

Definition reverse_Inv (sh: share) (contents: list val) : environ->mpred :=
          (EX cts1: list val, EX cts2 : list val, EX w: val, EX v: val,
            PROP (contents = rev cts1 ++ cts2)
            LOCAL (temp _w w; temp _v v)
            SEP (lseg LS sh cts1 w nullval;
                   lseg LS sh cts2 v nullval)).

Lemma body_reverse: semax_body Vprog Gprog f_reverse reverse_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_main main_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* w = NULL; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* v = p; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _v p) (@cons localdef (temp _w (Vint (Int.repr Z0))) (@cons localdef (temp _p p) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh contents p nullval) (@nil mpred))))) (Ssequence (Swhile (Etempvar _v (tptr (Tstruct _list noattr))) LOOP_BODY) MORE_COMMANDS) POSTCONDITION *)
forward_while (reverse_Inv sh contents).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* precondition implies loop invariant *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _v p) (@cons localdef (temp _w (Vint (Int.repr Z0))) (@cons localdef (temp _p p) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh contents p nullval) (@nil mpred)))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (list val) (fun cts1 : list val => @exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (list val) (fun cts2 : list val => @exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) val (fun w : val => @exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) val (fun v : val => PROPx (@cons Prop (@eq (list val) contents (@app val (@rev val cts1) cts2)) (@nil Prop)) (LOCALx (@cons localdef (temp _w w) (@cons localdef (temp _v v) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts2 v nullval) (@nil mpred)))))))))) *)
Exists (@nil val) contents nullval p.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _v p) (@cons localdef (temp _w (Vint (Int.repr Z0))) (@cons localdef (temp _p p) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh contents p nullval) (@nil mpred)))))) (PROPx (@cons Prop (@eq (list val) contents (@app val (@rev val (@nil val)) contents)) (@nil Prop)) (LOCALx (@cons localdef (temp _w nullval) (@cons localdef (temp _v p) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@nil val) nullval nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh contents p nullval) (@nil mpred)))))) *)
rewrite lseg_eq by (simpl; auto).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
entailer!.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* loop invariant implies typechecking of loop condition *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
entailer!.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* loop body preserves invariant *)
focus_SEP 1; apply semax_lseg_nonnull;
        [entailer | intros h r y ? ?; simpl].
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _w w) (@cons localdef (temp _v v) (@nil localdef))) (SEPx (@cons mpred (@emp mpred Nveric Sveric) (@cons mpred (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@cons mpred (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) y v) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh r y nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@nil mpred))))))))) (Ssequence (Sset _t (Efield (Ederef (Etempvar _v (tptr (Tstruct _list noattr))) (Tstruct _list noattr)) _tail (tptr (Tstruct _list noattr)))) MORE_COMMANDS) POSTCONDITION *)
subst cts2.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward. (* t = v->tail; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward. (* v->tail = w; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(* The following line is optional, the proof works without it. *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
replace_SEP 2 (field_at sh t_struct_list (DOT _tail) w v) by entailer!.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (*  w = v; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* v = t; *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(* at end of loop body, re-establish invariant *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _v y) (@cons localdef (temp _w v) (@cons localdef (temp _t y) (@nil localdef)))) (SEPx (@cons mpred (@emp mpred Nveric Sveric) (@cons mpred (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@cons mpred (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh r y nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@nil mpred)))))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (prod (prod (prod (list val) (list val)) val) val) (fun a : prod (prod (prod (list val) (list val)) val) val => PROPx (@cons Prop (@eq (list val) contents (@app val (@rev val (@fst (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val a)))) (@snd (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val a))))) (@nil Prop)) (LOCALx (@cons localdef (temp _w (@snd (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val a))) (@cons localdef (temp _v (@snd (prod (prod (list val) (list val)) val) val a)) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@fst (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val a))) (@snd (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val a)) nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@snd (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val a))) (@snd (prod (prod (list val) (list val)) val) val a) nullval) (@nil mpred))))))) *)
Exists (h::cts1,r,v,y).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _v y) (@cons localdef (temp _w v) (@cons localdef (temp _t y) (@nil localdef)))) (SEPx (@cons mpred (@emp mpred Nveric Sveric) (@cons mpred (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@cons mpred (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh r y nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@nil mpred)))))))))) (PROPx (@cons Prop (@eq (list val) contents (@app val (@rev val (@fst (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y))))) (@snd (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y)))))) (@nil Prop)) (LOCALx (@cons localdef (temp _w (@snd (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y)))) (@cons localdef (temp _v (@snd (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y))) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@fst (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y)))) (@snd (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y))) nullval) (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@snd (list val) (list val) (@fst (prod (list val) (list val)) val (@fst (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y)))) (@snd (prod (prod (list val) (list val)) val) val (@pair (prod (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val) val (@pair (prod (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))) val (@pair (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) r) v) y)) nullval) (@nil mpred)))))) *)
 simpl fst. simpl snd. simpl rev.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
entailer!.  (* smt_test verif_reverse_example2 *)
(* Goal: @derives mpred Nveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) *)
 - rewrite app_ass. auto.
 - rewrite (lseg_unroll _ sh (h::cts1)).
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval)) (@orp mpred Nveric (@andp mpred Nveric (@andp mpred Nveric (@prop mpred Nveric (ptr_eq v nullval)) (@prop mpred Nveric (@eq (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) (@nil (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS))))) (@emp mpred Nveric Sveric)) (@lseg_cons CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) v nullval)) *)
    apply orp_right2.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval)) (@lseg_cons CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) v nullval) *)
   unfold lseg_cons.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval)) (@andp mpred Nveric (@prop mpred Nveric (not (ptr_eq v nullval))) (@exp mpred Nveric (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (fun h0 : @elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS => @exp mpred Nveric (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (fun r : list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) => @exp mpred Nveric val (fun y : val => @sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@andp mpred Nveric (@prop mpred Nveric (and (@eq (list (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS)) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h cts1) (@cons (@elemtype CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) h0 r)) (is_pointer_or_null y))) (@emp mpred Nveric Sveric)) (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h0 v)) (@field_at CompSpecs sh (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield)) (@valinject CompSpecs (@nested_field_type CompSpecs (@list_struct CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS) (@cons gfield (StructField _tail) (@nil gfield))) y) v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh r y nullval)))))) *)
   apply andp_right.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (@list_cell CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh h v) (@field_at CompSpecs sh t_struct_list (@cons gfield (StructField _tail) (@nil gfield)) w v)) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval)) (@prop mpred Nveric (not (ptr_eq v nullval))) *)
   + apply prop_right.
(* Goal: not (ptr_eq v nullval) *)
      destruct v; try contradiction; intro Hx; inv Hx.
   + Exists h cts1 w.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
      entailer!.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
* (* after the loop *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* return w; *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
Exists w; entailer!.
rewrite <- app_nil_end, rev_involutive.
(* Goal: @derives mpred Nveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) *)
auto.
Qed.

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
(** The next lemma concerns the extern global initializer,
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** struct list three[] = {{1, three+1}, {2, three+2}, {3, NULL}};
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** This is equivalent to a linked list of three elements [1,2,3].
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** The proof is not very beautiful at present; it would be helpful
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 ** to have a nicer proof theory for reasoning about this kind of thing.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 **)

Lemma setup_globals:
 forall Delta gv,
  PTree.get _three (glob_types Delta) = Some (tarray t_struct_list 3) ->
  ENTAIL Delta, PROP  ()
   LOCAL  (gvars gv)
   SEP
   (data_at Ews tuint (Vint (Int.repr 1)) (gv _three);
    mapsto Ews (tptr t_struct_list) (offset_val 4 (gv _three))
        (offset_val 8 (gv _three));
   mapsto Ews tuint (offset_val 8 (gv _three)) (Vint (Int.repr 2));
   mapsto Ews (tptr t_struct_list) (offset_val 12 (gv _three))
       (offset_val 16 (gv _three));
   mapsto Ews tuint (offset_val 16 (gv _three)) (Vint (Int.repr 3));
   mapsto Ews tuint (offset_val 20 (gv _three)) (Vint (Int.repr 0)))
  |-- PROP() LOCAL(gvars gv)
        SEP (lseg LS Ews (map Vint (Int.repr 1 :: Int.repr 2 :: Int.repr 3 :: nil))
                  (gv _three) nullval).
Proof.
(* Goal: forall (Delta : tycontext) (gv : globals) (_ : @eq (option type) (@PTree.get type _three (glob_types Delta)) (@Some type (tarray t_struct_list (Zpos (xI xH))))), @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) *)
  intros.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) *)
  go_lowerx.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@emp mpred Nveric Sveric))))))) (@andp mpred Nveric (@prop mpred Nveric (and (gvars_denote gv rho) True)) (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@cons val (Vint (Int.repr (Zpos xH))) (@cons val (Vint (Int.repr (Zpos (xO xH)))) (@cons val (Vint (Int.repr (Zpos (xI xH)))) (@nil val)))) (gv _three) nullval) (@emp mpred Nveric Sveric))) *)
  pose proof (gvars_denote_HP _ _ _ _ _ H2 H0 H).
(* Goal: @derives mpred Nveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) *)
  rewrite !prop_true_andp by auto.
  assert_PROP (size_compatible tuint (gv _three) /\ align_compatible tuint (gv _three)) by (entailer!; clear - H5; hnf in H5; intuition).
  rewrite <- mapsto_data_at with (v := Vint(Int.repr 1)); try intuition. 
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (mapsto Ews tuint (gv _three) (Vint (Int.repr (Zpos xH)))) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@emp mpred Nveric Sveric))))))) (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@cons val (Vint (Int.repr (Zpos xH))) (@cons val (Vint (Int.repr (Zpos (xO xH)))) (@cons val (Vint (Int.repr (Zpos (xI xH)))) (@nil val)))) (gv _three) nullval) (@emp mpred Nveric Sveric)) *)
  clear H0.
  rewrite <- (sepcon_emp (mapsto _ _ (offset_val 20 _) _)).
  assert (FC: field_compatible (tarray t_struct_list 3) [] (gv _three))
    by auto with field_compatible.
  match goal with |- ?A |-- _ => set (a:=A) end.
(* Goal: @derives mpred Nveric a (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@cons val (Vint (Int.repr (Zpos xH))) (@cons val (Vint (Int.repr (Zpos (xO xH)))) (@cons val (Vint (Int.repr (Zpos (xI xH)))) (@nil val)))) (gv _three) nullval) (@emp mpred Nveric Sveric)) *)
  replace (gv _three) with (offset_val 0 (gv _three)) by normalize.
(* Goal: @derives mpred Nveric a (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@cons val (Vint (Int.repr (Zpos xH))) (@cons val (Vint (Int.repr (Zpos (xO xH)))) (@cons val (Vint (Int.repr (Zpos (xI xH)))) (@nil val)))) (offset_val Z0 (gv _three)) nullval) (@emp mpred Nveric Sveric)) *)
  subst a.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (mapsto Ews tuint (gv _three) (Vint (Int.repr (Zpos xH)))) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@emp mpred Nveric Sveric)) (@emp mpred Nveric Sveric))))))) (@sepcon mpred Nveric Sveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@cons val (Vint (Int.repr (Zpos xH))) (@cons val (Vint (Int.repr (Zpos (xO xH)))) (@cons val (Vint (Int.repr (Zpos (xI xH)))) (@nil val)))) (offset_val Z0 (gv _three)) nullval) (@emp mpred Nveric Sveric)) *)
  rewrite (sepcon_emp (lseg _ _ _ _ _)).
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (mapsto Ews tuint (gv _three) (Vint (Int.repr (Zpos xH)))) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@sepcon mpred Nveric Sveric (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@sepcon mpred Nveric Sveric (@sepcon mpred Nveric Sveric (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@emp mpred Nveric Sveric)) (@emp mpred Nveric Sveric))))))) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@cons val (Vint (Int.repr (Zpos xH))) (@cons val (Vint (Int.repr (Zpos (xO xH)))) (@cons val (Vint (Int.repr (Zpos (xI xH)))) (@nil val)))) (offset_val Z0 (gv _three)) nullval) *)
  rewrite sepcon_emp.
  repeat
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
  match goal with |- _ * (mapsto _ _ _ ?q * _) |-- lseg _ _ _ (offset_val ?n _) _ =>
    assert (FC': field_compatible t_struct_list [] (offset_val n (gv _three)));
      [apply (@field_compatible_nested_field CompSpecs (tarray t_struct_list 3)
         [ArraySubsc (n/8)] (gv _three));
       simpl;
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
       unfold field_compatible in FC |- *; simpl in FC |- *;
       assert (0 <= n/8 < 3) by (cbv [Z.div]; simpl; omega);
       tauto
      |];
    apply @lseg_unroll_nonempty1 with q;
      [destruct (gv _three); try contradiction; intro Hx; inv Hx | normalize; reflexivity | ];
    rewrite list_cell_eq by auto;
    do 2 (apply sepcon_derives;
      [ unfold field_at; rewrite prop_true_andp by auto with field_compatible;
        unfold data_at_rec, at_offset; simpl; normalize; try apply derives_refl | ]);
    clear FC'
    end.
(* Goal: @derives mpred Nveric (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh cts1 w nullval) *)
  rewrite mapsto_tuint_tptr_nullval; auto. apply derives_refl.
(* Goal: @derives mpred Nveric (@emp mpred Nveric Sveric) (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@nil val) (Vint (Int.repr Z0)) nullval) *)
  rewrite @lseg_nil_eq.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
  entailer!.
Qed.

Lemma body_main:  semax_body Vprog Gprog f_main main_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_main main_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (Tpointer (Tstruct (xO xH) (mk_attr false (@None N))) noattr) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (Tpointer (Tstruct (xO xH) (mk_attr false (@None N))) noattr) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred)))))))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr (Tstruct _list noattr)) Tnil) (tptr (Tstruct _list noattr)) cc_default)) (@cons expr (Evar _three (tarray (Tstruct _list noattr) (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr (Tstruct _list noattr))))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr (Tstruct _list noattr)) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr (Tstruct _list noattr))) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
change (Tstruct _ _) with t_struct_list.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (Tpointer t_struct_list noattr) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (Tpointer t_struct_list noattr) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred)))))))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
fold noattr. fold (tptr t_struct_list).
eapply semax_pre; [
  eapply ENTAIL_trans; [ | apply (setup_globals Delta gv); auto ] | ].
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@nil mpred))))))))))) (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@data_at CompSpecs Ews tuint (Vint (Int.repr (Zpos xH))) (gv _three)) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO xH))) (gv _three)) (offset_val (Zpos (xO (xO (xO xH)))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO xH)))) (gv _three)) (Vint (Int.repr (Zpos (xO xH))))) (@cons mpred (mapsto Ews (tptr t_struct_list) (offset_val (Zpos (xO (xO (xI xH)))) (gv _three)) (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xO (xO xH))))) (gv _three)) (Vint (Int.repr (Zpos (xI xH))))) (@cons mpred (mapsto Ews tuint (offset_val (Zpos (xO (xO (xI (xO xH))))) (gv _three)) (Vint (Int.repr Z0))) (@nil mpred)))))))))) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
 entailer!.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
*
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
forward_call (*  r = reverse(three); *)
  (Ews, map Vint [Int.repr 1; Int.repr 2; Int.repr 3], gv _three).
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) val (fun vret : val => PROPx (@nil Prop) (LOCALx (@cons localdef (temp _r vret) (@cons localdef (gvars gv) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@rev val (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int)))))) vret nullval) (@nil mpred)))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint)))) MORE_COMMANDS) POSTCONDITION *)
Intros r'.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@rev Int.int (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int)))))) r' nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint)))) MORE_COMMANDS) POSTCONDITION *)
rewrite <- map_rev. simpl rev.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (gvars gv) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos xH)) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos (xI xH))) (@nil Int.int))))) (gv _three) nullval) (@nil mpred))))) (Ssequence (Ssequence (Ssequence (Scall (@Some ident _t'1) (Evar _reverse (Tfunction (Tcons (tptr t_struct_list) Tnil) (tptr t_struct_list) cc_default)) (@cons expr (Evar _three (tarray t_struct_list (Zpos (xI xH)))) (@nil expr))) (Sset _r (Etempvar _t'1 (tptr t_struct_list)))) (Ssequence (Ssequence (Scall (@Some ident _t'2) (Evar _sumlist (Tfunction (Tcons (tptr t_struct_list) Tnil) tuint cc_default)) (@cons expr (Etempvar _r (tptr t_struct_list)) (@nil expr))) (Sset _s (Etempvar _t'2 tuint))) (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))))) MORE_COMMANDS) POSTCONDITION *)
forward_call  (* s = sumlist(r); *)
   (Ews, Int.repr 3 :: Int.repr 2 :: Int.repr 1 :: nil, r').
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _s (Vint (sum_int (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))))) (@cons localdef (temp _r r') (@cons localdef (gvars gv) (@nil localdef)))) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS Ews (@map Int.int val Vint (@cons Int.int (Int.repr (Zpos (xI xH))) (@cons Int.int (Int.repr (Zpos (xO xH))) (@cons Int.int (Int.repr (Zpos xH)) (@nil Int.int))))) r' nullval) (@nil mpred))))) (Ssequence (Sreturn (@Some expr (Ecast (Etempvar _s tuint) tint))) MORE_COMMANDS) POSTCONDITION *)
forward.  (* return s; *)
Qed.

Existing Instance NullExtension.Espec.

Lemma prog_correct:
  semax_prog prog Vprog Gprog.
Proof.
(* Goal: semax_prog NullExtension.Espec CompSpecs prog Vprog Gprog *)
prove_semax_prog.
(* Goal: semax_func NullExtension.Espec Vprog Gprog CompSpecs (@cons (prod ident (fundef function)) (@pair ident (fundef function) _sumlist (@Internal function f_sumlist)) (@cons (prod ident (fundef function)) (@pair ident (fundef function) _reverse (@Internal function f_reverse)) (@cons (prod ident (fundef function)) (@pair ident (fundef function) _main (@Internal function f_main)) (@nil (prod ident (fundef function)))))) (@cons (prod ident funspec) (@pair ident funspec _sumlist (NDmk_funspec (@pair (list (prod ident type)) type (@cons (prod ident type) (@pair ident type _p (tptr t_struct_list)) (@nil (prod ident type))) tuint) cc_default (prod (prod share (list Int.int)) val) (fun x : prod (prod share (list Int.int)) val => let (p0, p) := x in let (sh, contents) := p0 in PROPx (@cons Prop (readable_share sh) (@nil Prop)) (LOCALx (@cons localdef (temp _p p) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint contents) p nullval) (@nil mpred))))) (fun x : prod (prod share (list Int.int)) val => let (p0, p) := x in let (sh, contents) := p0 in PROPx (@nil Prop) (LOCALx (@cons localdef (temp ret_temp (Vint (sum_int contents))) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@map Int.int val Vint contents) p nullval) (@nil mpred))))))) (@cons (prod ident funspec) (@pair ident funspec _reverse (NDmk_funspec (@pair (list (prod ident type)) type (@cons (prod ident type) (@pair ident type _p (tptr t_struct_list)) (@nil (prod ident type))) (tptr t_struct_list)) cc_default (prod (prod share (list val)) val) (fun x : prod (prod share (list val)) val => let (p0, p) := x in let (sh, contents) := p0 in PROPx (@cons Prop (writable_share sh) (@nil Prop)) (LOCALx (@cons localdef (temp _p p) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh contents p nullval) (@nil mpred))))) (fun x : prod (prod share (list val)) val => let (p0, _) := x in let (sh, contents) := p0 in @exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) val (fun p1 : val => PROPx (@nil Prop) (LOCALx (@cons localdef (temp ret_temp p1) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@rev val contents) p1 nullval) (@nil mpred)))))))) (@cons (prod ident funspec) (@pair ident funspec _main (NDmk_funspec (@pair (list (prod ident type)) type (@nil (prod ident type)) tint) cc_default globals (fun gv : globals => main_pre prog (@nil Type) gv) (fun _ : globals => PROPx (@nil Prop) (LOCALx (@cons localdef (temp ret_temp (Vint (Int.repr (Z.add (Z.add (Zpos (xI xH)) (Zpos (xO xH))) (Zpos xH))))) (@nil localdef)) (SEPx (@cons mpred (@TT mpred Nveric) (@nil mpred))))))) (@nil (prod ident funspec))))) *)
semax_func_cons body_sumlist.
(* Goal: semax_func NullExtension.Espec Vprog Gprog CompSpecs (@cons (prod ident (fundef function)) (@pair ident (fundef function) _reverse (@Internal function f_reverse)) (@cons (prod ident (fundef function)) (@pair ident (fundef function) _main (@Internal function f_main)) (@nil (prod ident (fundef function))))) (@cons (prod ident funspec) (@pair ident funspec _reverse (NDmk_funspec (@pair (list (prod ident type)) type (@cons (prod ident type) (@pair ident type _p (tptr t_struct_list)) (@nil (prod ident type))) (tptr t_struct_list)) cc_default (prod (prod share (list val)) val) (fun x : prod (prod share (list val)) val => let (p0, p) := x in let (sh, contents) := p0 in PROPx (@cons Prop (writable_share sh) (@nil Prop)) (LOCALx (@cons localdef (temp _p p) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh contents p nullval) (@nil mpred))))) (fun x : prod (prod share (list val)) val => let (p0, _) := x in let (sh, contents) := p0 in @exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) val (fun p1 : val => PROPx (@nil Prop) (LOCALx (@cons localdef (temp ret_temp p1) (@nil localdef)) (SEPx (@cons mpred (@lseg CompSpecs _list _tail (fun (_ : share) (_ : val) => @emp mpred Nveric Sveric) LS sh (@rev val contents) p1 nullval) (@nil mpred)))))))) (@cons (prod ident funspec) (@pair ident funspec _main (NDmk_funspec (@pair (list (prod ident type)) type (@nil (prod ident type)) tint) cc_default globals (fun gv : globals => main_pre prog (@nil Type) gv) (fun _ : globals => PROPx (@nil Prop) (LOCALx (@cons localdef (temp ret_temp (Vint (Int.repr (Z.add (Z.add (Zpos (xI xH)) (Zpos (xO xH))) (Zpos xH))))) (@nil localdef)) (SEPx (@cons mpred (@TT mpred Nveric) (@nil mpred))))))) (@nil (prod ident funspec)))) *)
semax_func_cons body_reverse.
(* Goal: semax_func NullExtension.Espec Vprog Gprog CompSpecs (@cons (prod ident (fundef function)) (@pair ident (fundef function) _main (@Internal function f_main)) (@nil (prod ident (fundef function)))) (@cons (prod ident funspec) (@pair ident funspec _main (NDmk_funspec (@pair (list (prod ident type)) type (@nil (prod ident type)) tint) cc_default globals (fun gv : globals => main_pre prog (@nil Type) gv) (fun _ : globals => PROPx (@nil Prop) (LOCALx (@cons localdef (temp ret_temp (Vint (Int.repr (Z.add (Z.add (Zpos (xI xH)) (Zpos (xO xH))) (Zpos xH))))) (@nil localdef)) (SEPx (@cons mpred (@TT mpred Nveric) (@nil mpred))))))) (@nil (prod ident funspec))) *)
semax_func_cons body_main.
Qed.


