Require Import VST.floyd.proofauto.
Require Import VST.progs.strlib.
Instance CompSpecs : compspecs. make_compspecs prog. Defined.
Definition Vprog : varspecs. mk_varspecs prog. Defined.

Definition strchr_spec :=
 DECLARE _strchr
  WITH sh: share, str : val, s : list byte, c : byte
  PRE  [ _str OF tptr tschar, _c OF tint ]
    PROP (readable_share sh; c <> Byte.zero)
    LOCAL (temp _str str; temp _c (Vbyte c))
    SEP (cstring sh s str)
  POST [ tptr tschar ]
   EX r : val,
    PROP ((exists i, Znth i s = c /\ Forall (fun d => d<>c) (sublist 0 i s)
                     /\ r = offset_val i str)
       \/ (Forall (fun d => d<>c) s /\ r = nullval))
    LOCAL (temp ret_temp r)
    SEP (cstring sh s str).

Definition strcat_spec :=
 DECLARE _strcat
  WITH sh: share, sh': share, dest : val, sd : list byte, n : Z, src : val, ss : list byte
  PRE  [ _dest OF tptr tschar, _src OF tptr tschar ]
    PROP (writable_share sh; readable_share sh'; Zlength sd + Zlength ss < n)
    LOCAL (temp _dest dest; temp _src src)
    SEP (cstringn sh sd n dest; cstring sh' ss src)
  POST [ tptr tschar ]
    PROP ()
    LOCAL (temp ret_temp dest)
    SEP (cstringn sh (sd ++ ss) n dest; cstring sh' ss src).

Definition strcmp_spec :=
 DECLARE _strcmp
  WITH sh1: share, sh2: share, str1 : val, s1 : list byte, str2 : val, s2 : list byte
  PRE [ _str1 OF tptr tschar, _str2 OF tptr tschar ]
    PROP (readable_share sh1; readable_share sh2)
    LOCAL (temp _str1 str1; temp _str2 str2)
    SEP (cstring sh1 s1 str1; cstring sh2 s2 str2)
  POST [ tint ]
   EX i : int,
    PROP (if Int.eq_dec i Int.zero then s1 = s2 else s1 <> s2)
    LOCAL (temp ret_temp (Vint i))
    SEP (cstring sh1 s1 str1; cstring sh2 s2 str2).

Definition strcpy_spec :=
 DECLARE _strcpy
  WITH sh: share, sh': share, dest : val, n : Z, src : val, s : list byte
  PRE [ _dest OF tptr tschar, _src OF tptr tschar ]
    PROP (writable_share sh; readable_share sh'; Zlength s < n)
    LOCAL (temp _dest dest; temp _src src)
    SEP (data_at_ sh (tarray tschar n) dest; cstring sh' s src)
  POST [ tptr tschar ]
    PROP ()
    LOCAL (temp ret_temp dest)
    SEP (cstringn sh s n dest; cstring sh' s src).

Definition strlen_spec :=
 DECLARE _strlen
  WITH sh: share, s : list byte, str: val
  PRE [ _str OF tptr tschar ]
    PROP (readable_share sh)
    LOCAL (temp _str str)
    SEP (cstring sh s str)
  POST [ tptr tschar ]
    PROP ()
    LOCAL (temp ret_temp (Vptrofs (Ptrofs.repr (Zlength s))))
    SEP (cstring sh s str).

Definition Gprog : funspecs :=
         ltac:(with_library prog [ strchr_spec; strcat_spec; strcmp_spec ]).

Hint Rewrite Z.add_simpl_r Z.sub_simpl_r : norm entailer_rewrite.

Lemma body_strlen: semax_body Vprog Gprog f_strlen strlen_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@nil localdef)))) (SEPx (@cons mpred (@cstring CompSpecs sh s str) (@nil mpred))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Etempvar _c tint) tint) (Sreturn (@Some expr (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)))) Sskip) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
unfold cstring in *.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@andp mpred Nveric (@prop mpred Nveric (not (@In Byte.int Byte.zero s))) (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int s) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int s (@cons Byte.int Byte.zero (@nil Byte.int)))) src)) (@nil mpred)))))) (Ssequence (Sset _i (Econst_int (Int.repr Z0) tint)) MORE_COMMANDS) POSTCONDITION *)
rename s into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
forward_loop (EX i : Z,
  PROP (0 <= i < Zlength ls + 1)
  LOCAL (temp _str str; temp _i (Vptrofs (Ptrofs.repr i)))
  SEP (data_at sh (tarray tschar (Zlength ls + 1))
          (map Vbyte (ls ++ [Byte.zero])) str))
 continue: (EX i : Z,
  PROP (0 <= i < Zlength ls + 1)
  LOCAL (temp _str str; temp _i (Vptrofs (Ptrofs.repr (i-1))))
  SEP (data_at sh (tarray tschar (Zlength ls + 1))
          (map Vbyte (ls ++ [Byte.zero])) str)).
*
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
Exists 0. entailer!.
*
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
entailer!. f_equal. f_equal. cstring.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward. 
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
Exists (i+1).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
entailer!. cstring.
*
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
Exists i.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
entailer!.
Qed.

Lemma body_strchr: semax_body Vprog Gprog f_strchr strchr_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@nil localdef)))) (SEPx (@cons mpred (@cstring CompSpecs sh s str) (@nil mpred))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Etempvar _c tint) tint) (Sreturn (@Some expr (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)))) Sskip) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
unfold cstring in *.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@andp mpred Nveric (@prop mpred Nveric (not (@In Byte.int Byte.zero s))) (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int s) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int s (@cons Byte.int Byte.zero (@nil Byte.int)))) src)) (@nil mpred)))))) (Ssequence (Sset _i (Econst_int (Int.repr Z0) tint)) MORE_COMMANDS) POSTCONDITION *)
rename s into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
forward_loop (EX i : Z,
  PROP (0 <= i < Zlength ls + 1; Forall (fun d => d <> c) (sublist 0 i ls))
  LOCAL (temp _str str; temp _c (Vbyte c); temp _i (Vint (Int.repr i)))
  SEP (data_at sh (tarray tschar (Zlength ls + 1))
          (map Vbyte (ls ++ [Byte.zero])) str))
 continue: (EX i : Z,
  PROP (0 <= i < Zlength ls + 1; Forall (fun d => d <> c) (sublist 0 i ls))
  LOCAL (temp _str str; temp _c (Vbyte c); temp _i (Vint (Int.repr (i-1))))
  SEP (data_at sh (tarray tschar (Zlength ls + 1))
          (map Vbyte (ls ++ [Byte.zero])) str)).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists 0; rewrite sublist_nil; entailer!.
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
- Intros i. 
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
  assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
 forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward. simpl. 
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@exp mpred Nveric val (fun a : val => @andp mpred Nveric (@prop mpred Nveric (and (or (@ex Z (fun i0 : Z => and (@eq Byte.int (@Znth Byte.int Inhabitant_byte i0 ls) (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int))))) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@sublist Byte.int Z0 i0 ls)) (@eq val a (offset_val i0 str))))) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) ls) (@eq val a nullval))) (@eq val (force_val (@sem_add_ptr_int CompSpecs tschar Unsigned str (Vint (Int.repr i)))) a))) (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str))) *)
    Exists (offset_val i str).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
    left. exists i. split3; auto. rewrite app_Znth1; auto. cstring. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  { forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
    { forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
      Exists nullval; rewrite !map_app; entailer!.
(* Goal: or (@ex Z (fun i : Z => and (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@eq val nullval (offset_val i str))))) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) ls) (@eq val nullval nullval)) *)
      right. split; auto.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
      assert (i = Zlength ls) by cstring.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) dest) *)
      subst i.
     autorewrite with sublist in H2; auto. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists (i+1); entailer!.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
  assert (i <> Zlength ls) by cstring.
(* Goal: and (and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls)) *)
  split. omega.
(* Goal: and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) *)
  rewrite (sublist_split 0 i) by rep_omega. rewrite Forall_app. split; auto.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite sublist_len_1 by rep_omega. repeat constructor.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite app_Znth1 in H4 by rep_omega. auto.
  }
-
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
  Exists i.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
 entailer!.
Qed.

Lemma split_data_at_app_tschar:
 forall sh n (al bl: list val) p ,
   n = Zlength (al++bl) ->
   data_at sh (tarray tschar n) (al++bl) p = 
         data_at sh (tarray tschar (Zlength al)) al p
        * data_at sh (tarray tschar (n - Zlength al)) bl
                 (field_address0 (tarray tschar n) [ArraySubsc (Zlength al)] p).
Proof.
(* Goal: forall (sh : Share.t) (n : Z) (al bl : list val) (p : val) (_ : @eq Z n (@Zlength val (@app val al bl))), @eq mpred (@data_at CompSpecs sh (tarray tschar n) (@app val al bl) p) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val al)) al p) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val al))) bl (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val al)) (@nil gfield)) p))) *)
intros.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
apply (split2_data_at_Tarray_app _ n  sh tschar al bl ); auto.
(* Goal: @eq Z (@Zlength (@reptype CompSpecs tschar) bl) (Z.sub n (@Zlength val al)) *)
rewrite Zlength_app in H.
change ( Zlength bl = n - Zlength al); omega.
Qed.

Lemma body_strcat: semax_body Vprog Gprog f_strcat strcat_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
unfold cstringn, cstring in *.
rename sd into ld. rename ss into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
forward_loop (EX i : Z,
    PROP (0 <= i < Zlength ld + 1)
    LOCAL (temp _i (Vint (Int.repr i)); temp _dest dest; temp _src src)
    SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ [Byte.zero]) ++
           list_repeat (Z.to_nat (n - (Zlength ld + 1))) Vundef) dest;
   data_at sh' (tarray tschar (Zlength ls + 1))
     (map Vbyte (ls ++ [Byte.zero])) src))
 continue: (EX i : Z,
    PROP (0 <= i < Zlength ld + 1)
    LOCAL (temp _i (Vint (Int.repr (i-1))); temp _dest dest; temp _src src)
    SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ [Byte.zero]) ++
           list_repeat (Z.to_nat (n - (Zlength ld + 1))) Vundef) dest;
   data_at sh' (tarray tschar (Zlength ls + 1))
     (map Vbyte (ls ++ [Byte.zero])) src))
  break: (PROP ( )
   LOCAL (temp _i (Vint (Int.repr (Zlength ld))); temp _dest dest; 
   temp _src src)
   SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ [Byte.zero]) ++
           list_repeat (Z.to_nat (n - (Zlength ld + 1))) Vundef) dest;
   data_at sh' (tarray tschar (Zlength ls + 1))
     (map Vbyte (ls ++ [Byte.zero])) src)).
-
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists 0; entailer!.
-
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  { entailer!. }
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  { entailer!. autorewrite with sublist. normalize.  }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Sset _d (Ecast (Etempvar _t'1 tschar) tschar)) MORE_COMMANDS) POSTCONDITION *)
  autorewrite with sublist; normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  + forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!. f_equal. f_equal. cstring.
  +
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
    forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    Exists (i+1); entailer!. cstring.
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
- Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
   forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
   Exists i. entailer!. 
-
  abbreviate_semax.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
  forward_loop (EX j : Z,
    PROP (0 <= j < Zlength ls + 1)
    LOCAL (temp _j (Vint (Int.repr j)); temp _i (Vint (Int.repr (Zlength ld)));
           temp _dest dest; temp _src src)
    SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ sublist 0 j ls) ++
           list_repeat (Z.to_nat (n - (Zlength ld + j))) Vundef) dest;
         data_at sh' (tarray tschar (Zlength ls + 1))
           (map Vbyte (ls ++ [Byte.zero])) src))
   continue: (EX j : Z,
    PROP (0 <= j < Zlength ls + 1)
    LOCAL (temp _j (Vint (Int.repr (j-1))); temp _i (Vint (Int.repr (Zlength ld)));
           temp _dest dest; temp _src src)
    SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ sublist 0 j ls) ++
           list_repeat (Z.to_nat (n - (Zlength ld + j))) Vundef) dest;
         data_at sh' (tarray tschar (Zlength ls + 1))
           (map Vbyte (ls ++ [Byte.zero])) src)).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  { Exists 0; entailer!.  autorewrite with sublist.
    rewrite !map_app. rewrite <- app_assoc.
    rewrite split_data_at_app_tschar by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
    rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    autorewrite with sublist.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    cancel.    
   }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  { Intros j.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
  assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!.
  clear H3.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val (@Zlength Byte.int ls) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 (@Zlength Byte.int ls) ls)) (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte (@Zlength Byte.int ls) (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) dest) *)
  rewrite upd_Znth_app2 by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  + forward.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
      autorewrite with sublist.
      rewrite prop_true_andp 
        by (intro Hx; apply in_app in Hx; destruct Hx; contradiction).
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
      cancel.
    assert (j = Zlength ls) by cstring; subst.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    autorewrite with sublist.
    apply derives_refl'.
(* Goal: @eq Int.int (Int.repr i) (Int.repr (@Zlength Byte.int ls)) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr i))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr (Z.sub i (Zpos xH))))) (@nil localdef))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
    unfold data_at; f_equal. 
    replace (n - (Zlength ld + Zlength ls))
     with (1 + (n - (Zlength ld + Zlength ls+1))) by rep_omega.
    rewrite <- list_repeat_app' by rep_omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength Byte.int ls)) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength Byte.int ls))) (@upd_Znth val Z0 (@app val (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength Byte.int ls)) (@nil gfield)) dest))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength Byte.int ls)) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength Byte.int ls))) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength Byte.int ls)) (@nil gfield)) dest))) *)
    rewrite upd_Znth_app1 by list_solve.
    rewrite app_assoc.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@map Byte.int val Vbyte (@cons Byte.int (@Znth Byte.int Inhabitant_byte i ls) (@nil Byte.int))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    simpl.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int (@sublist Byte.int Z0 i ls) (@sublist Byte.int i (Z.add i (Zpos xH)) ls))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) dest) *)
    rewrite !map_app.
    reflexivity.
 +
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
  Exists (j+1).
  destruct (zlt j (Zlength ls)); [ | cstring].
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef))) dest) *)
  change (field_at Tsh (tarray tschar n) []) with (data_at Tsh (tarray tschar n)).
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite (sublist_split 0 j (j+1)) by rep_omega.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int (@sublist Byte.int Z0 i ls) (@sublist Byte.int i (Z.add i (Zpos xH)) ls))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) dest) *)
  rewrite (app_assoc ld). rewrite !map_app.
  rewrite <- (app_assoc (_ ++ _)).
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
  rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
  rewrite (split_data_at_app_tschar _ n) by list_solve.
  replace (n - (Zlength ld + j))
    with (1 + (n - (Zlength ld + (j + 1)))) by rep_omega.
  rewrite <- list_repeat_app' by rep_omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
  rewrite upd_Znth_app1 by (autorewrite with sublist; rep_omega).
  rewrite app_Znth1 by list_solve.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite sublist_len_1 by rep_omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
  }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 + Intros j. forward. Exists j. entailer!.
Qed.

Lemma body_strcmp: semax_body Vprog Gprog f_strcmp strcmp_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@nil localdef)))) (SEPx (@cons mpred (@cstring CompSpecs sh s str) (@nil mpred))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Etempvar _c tint) tint) (Sreturn (@Some expr (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)))) Sskip) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
unfold cstring in *.
rename s1 into ls1. rename s2 into ls2.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
forward_loop (EX i : Z,
  PROP (0 <= i < Zlength ls1 + 1; 0 <= i < Zlength ls2 + 1;
        sublist 0 i ls1 = sublist 0 i ls2)
  LOCAL (temp _str1 str1; temp _str2 str2; temp _i (Vint (Int.repr i)))
  SEP (data_at sh1 (tarray tschar (Zlength ls1 + 1))
          (map Vbyte (ls1 ++ [Byte.zero])) str1;
       data_at sh2 (tarray tschar (Zlength ls2 + 1))
          (map Vbyte (ls2 ++ [Byte.zero])) str2))
  continue: (EX i : Z,
  PROP (0 <= i < Zlength ls1 + 1; 0 <= i < Zlength ls2 + 1;
        sublist 0 i ls1 = sublist 0 i ls2)
  LOCAL (temp _str1 str1; temp _str2 str2; temp _i (Vint (Int.repr (i-1))))
  SEP (data_at sh1 (tarray tschar (Zlength ls1 + 1))
          (map Vbyte (ls1 ++ [Byte.zero])) str1;
       data_at sh2 (tarray tschar (Zlength ls2 + 1))
          (map Vbyte (ls2 ++ [Byte.zero])) str2)).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
- Exists 0; entailer!.
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
- Intros i.
  assert (Zlength (ls1 ++ [Byte.zero]) = Zlength ls1 + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
  assert (Zlength (ls2 ++ [Byte.zero]) = Zlength ls2 + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
  assert (Znth i (ls1 ++ [Byte.zero]) = Byte.zero <-> i = Zlength ls1) as Hs1.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  { split; [|intro; subst; rewrite app_Znth2, Zminus_diag by omega; auto].
    destruct (zlt i (Zlength ls1)); [|omega].
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
    intro X; lapply (Znth_In i ls1); [|omega]. cstring. }
  assert (Znth i (ls2 ++ [Byte.zero]) = Byte.zero <-> i = Zlength ls2) as Hs2.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  { split; [|intro; subst; rewrite app_Znth2, Zminus_diag by omega; auto].
    destruct (zlt i (Zlength ls2)); [|omega].
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
    intro X; lapply (Znth_In i ls2); [|omega]. cstring. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
  forward_if (temp _t'1 (Val.of_bool (Z.eqb i (Zlength ls1) && Z.eqb i (Zlength ls2)))).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward.
    simpl force_val.
    rewrite Hs1 in *.
    destruct (Byte.eq_dec (Znth i (ls2 ++ [Byte.zero])) Byte.zero).
    + rewrite e; simpl force_val.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
         assert (i = Zlength ls2) by cstring.
        rewrite  (proj2 Hs1 H6).
     rewrite (proj2 (Z.eqb_eq i (Zlength ls1)) H6).
     rewrite (proj2 (Z.eqb_eq i (Zlength ls2)) H7).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
     entailer!.
  +
    rewrite Int.eq_false.
     rewrite (proj2 (Z.eqb_eq i (Zlength ls1)) H6).
     rewrite Hs2 in n.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
     rewrite (proj2 (Z.eqb_neq i (Zlength ls2))) by auto.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!.
     contradict n.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
     apply repr_inj_signed in n; try rep_omega. normalize in n.
 }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
    destruct (i =? Zlength ls1) eqn: Heq; auto.
    rewrite Z.eqb_eq in Heq; tauto. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if.
 +
  rewrite andb_true_iff in H6; destruct H6.
  rewrite Z.eqb_eq in H6,H7.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
  Exists (Int.repr 0).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!. simpl.
  autorewrite with sublist in H3.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
  auto.
 +
  deadvars!.
  rewrite andb_false_iff in H6. rewrite !Z.eqb_neq in H6.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if.
  *
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
    forward. Exists (Int.repr (-1)). entailer!.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@map Byte.int val Vbyte (@cons Byte.int (@Znth Byte.int Inhabitant_byte i ls) (@nil Byte.int))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    simpl. intro; subst. omega.
 *
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
   forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
   forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
   Exists (Int.repr 1). entailer!. simpl. intro. subst. omega.

   assert (H17: Byte.signed (Znth i (ls1 ++ [Byte.zero])) =
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
     Byte.signed (Znth i (ls2 ++ [Byte.zero]))) by omega.
   normalize in H17. clear H7 H8.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
   forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
   Exists (i+1).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
   entailer!.
   clear H7 H8.
   clear H13 H14 H12 PNstr1 PNstr2.
   clear H10 H11 H9.
   destruct (zlt i (Zlength ls1)).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  2:{
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth2 in Hs1 by rep_omega.
         destruct (zeq i (Zlength ls1)); [ | omega].
         subst.
         destruct H6; [congruence | ].
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         assert (Zlength ls1 < Zlength ls2) by omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth2 in H17 by rep_omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth1 in H17 by rep_omega.
         rewrite Z.sub_diag in H17. contradiction H0.
         change (Znth 0 [Byte.zero]) with Byte.zero in H17. rewrite H17.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         apply Znth_In. omega.
   }
  destruct (zlt i (Zlength ls2)).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  2:{
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth2 in Hs2 by rep_omega.
         destruct (zeq i (Zlength ls2)); [ | omega].
         subst.
         destruct H6; [ | congruence].
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         assert (Zlength ls1 > Zlength ls2) by omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth1 in H17 by rep_omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth2 in H17 by rep_omega.
         rewrite Z.sub_diag in H17. contradiction H.
         change (Znth 0 [Byte.zero]) with Byte.zero in H17. rewrite <- H17.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         apply Znth_In. omega.
   }
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite (sublist_split 0 i (i+1)) by omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite (sublist_split 0 i (i+1)) by omega.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
  f_equal; auto.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite !sublist_len_1 by omega.
  rewrite !app_Znth1 in H17 by list_solve.
(* Goal: and (and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls)) *)
  split. rep_omega. split. rep_omega.
(* Goal: @eq Int.int (Int.repr i) (Int.repr (@Zlength Byte.int ls)) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr i))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr (Z.sub i (Zpos xH))))) (@nil localdef))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  f_equal; auto. f_equal. auto.
 -
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
  Exists i.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!.
Qed.

Lemma body_strcpy: semax_body Vprog Gprog f_strcpy strcpy_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
unfold cstring,cstringn in *.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@andp mpred Nveric (@prop mpred Nveric (not (@In Byte.int Byte.zero s))) (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int s) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int s (@cons Byte.int Byte.zero (@nil Byte.int)))) src)) (@nil mpred)))))) (Ssequence (Sset _i (Econst_int (Int.repr Z0) tint)) MORE_COMMANDS) POSTCONDITION *)
rename s into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
forward_loop (EX i : Z,
  PROP (0 <= i < Zlength ls + 1)
  LOCAL (temp _i (Vint (Int.repr i)); temp _dest dest; temp _src src)
  SEP (data_at sh (tarray tschar n)
        (map Vbyte (sublist 0 i ls) ++ list_repeat (Z.to_nat (n - i)) Vundef) dest;
       data_at sh' (tarray tschar (Zlength ls + 1)) (map Vbyte (ls ++ [Byte.zero])) src))
 continue: (EX i : Z,
  PROP (0 <= i < Zlength ls + 1)
  LOCAL (temp _i (Vint (Int.repr (i-1))); temp _dest dest; temp _src src)
  SEP (data_at sh (tarray tschar n)
        (map Vbyte (sublist 0 i ls) ++ list_repeat (Z.to_nat (n - i)) Vundef) dest;
       data_at sh' (tarray tschar (Zlength ls + 1)) (map Vbyte (ls ++ [Byte.zero])) src)).
*
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
 Exists 0. rewrite Z.sub_0_r; entailer!. simpl. entailer!.
*
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
 assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 forward. fold_Vbyte.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
 forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
+ forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
   entailer!.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
  assert (i = Zlength ls) by cstring. subst i.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef))) dest) *)
  change (field_at Tsh (tarray tschar n) []) with (data_at Tsh (tarray tschar n)).
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val (@Zlength Byte.int ls) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 (@Zlength Byte.int ls) ls)) (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte (@Zlength Byte.int ls) (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) dest) *)
  rewrite upd_Znth_app2 by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int (@sublist Byte.int Z0 i ls) (@sublist Byte.int i (Z.add i (Zpos xH)) ls))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) dest) *)
  rewrite !map_app.
  rewrite <- app_assoc.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
   rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
   rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
   autorewrite with sublist.
   replace (n - Zlength ls) with (1 + (n - (Zlength ls + 1))) at 2 by list_solve.
  rewrite <- list_repeat_app' by omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength Byte.int ls)) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength Byte.int ls))) (@upd_Znth val Z0 (@app val (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength Byte.int ls)) (@nil gfield)) dest))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength Byte.int ls)) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength Byte.int ls))) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength Byte.int ls)) (@nil gfield)) dest))) *)
  rewrite upd_Znth_app1 by list_solve.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) *)
  rewrite !split_data_at_app_tschar by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
+
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
   assert (i < Zlength ls) by cstring.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists (i+1). entailer!. 
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
  rewrite (sublist_split 0 i (i+1)) by list_solve.
  rewrite !map_app. rewrite <- app_assoc.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef))) dest) *)
  change (field_at Tsh (tarray tschar n) []) with (data_at Tsh (tarray tschar n)).
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef))) dest) *)
  rewrite !(split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
   replace (n - i) with (1 + (n-(i+ 1))) at 2 by list_solve.
  rewrite <- list_repeat_app' by omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) *)
  rewrite !split_data_at_app_tschar by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite sublist_len_1 by omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@map Byte.int val Vbyte (@cons Byte.int (@Znth Byte.int Inhabitant_byte i ls) (@nil Byte.int))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  simpl. cancel.
*
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
  Exists i.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!.
Qed.

Module Alternate.

(* Alternate proofs of these functions, using the form of "forward_loop"
  that relies on semax_loop_nocontinue *)

Lemma body_strlen: semax_body Vprog Gprog f_strlen strlen_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@nil localdef)))) (SEPx (@cons mpred (@cstring CompSpecs sh s str) (@nil mpred))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Etempvar _c tint) tint) (Sreturn (@Some expr (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)))) Sskip) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
unfold cstring in *.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@andp mpred Nveric (@prop mpred Nveric (not (@In Byte.int Byte.zero s))) (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int s) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int s (@cons Byte.int Byte.zero (@nil Byte.int)))) src)) (@nil mpred)))))) (Ssequence (Sset _i (Econst_int (Int.repr Z0) tint)) MORE_COMMANDS) POSTCONDITION *)
rename s into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
forward_loop  (EX i : Z,
  PROP (0 <= i < Zlength ls + 1)
  LOCAL (temp _str str; temp _i (Vptrofs (Ptrofs.repr i)))
  SEP (data_at sh (tarray tschar (Zlength ls + 1))
          (map Vbyte (ls ++ [Byte.zero])) str)).
*
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
Exists 0. entailer!.
*
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Sset _d (Ecast (Etempvar _t'1 tschar) tschar)) MORE_COMMANDS) POSTCONDITION *)
normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
entailer!. f_equal. f_equal. cstring.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward. (* entailer!.  *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
Exists (i+1).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
entailer!. cstring.
Qed.

Lemma body_strchr: semax_body Vprog Gprog f_strchr strchr_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@nil localdef)))) (SEPx (@cons mpred (@cstring CompSpecs sh s str) (@nil mpred))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Etempvar _c tint) tint) (Sreturn (@Some expr (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)))) Sskip) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
unfold cstring in *.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@andp mpred Nveric (@prop mpred Nveric (not (@In Byte.int Byte.zero s))) (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int s) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int s (@cons Byte.int Byte.zero (@nil Byte.int)))) src)) (@nil mpred)))))) (Ssequence (Sset _i (Econst_int (Int.repr Z0) tint)) MORE_COMMANDS) POSTCONDITION *)
rename s into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
forward_loop (EX i : Z,
  PROP (0 <= i < Zlength ls + 1; Forall (fun d => d <> c) (sublist 0 i ls))
  LOCAL (temp _str str; temp _c (Vbyte c); temp _i (Vint (Int.repr i)))
  SEP (data_at sh (tarray tschar (Zlength ls + 1))
          (map Vbyte (ls ++ [Byte.zero])) str)).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists 0; rewrite sublist_nil; entailer!.
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
- Intros i. 
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
  assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
  forward_if (Znth i (ls ++ [Byte.zero]) <> c).

(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward. simpl.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@exp mpred Nveric val (fun a : val => @andp mpred Nveric (@prop mpred Nveric (and (or (@ex Z (fun i0 : Z => and (@eq Byte.int (@Znth Byte.int Inhabitant_byte i0 ls) (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int))))) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@sublist Byte.int Z0 i0 ls)) (@eq val a (offset_val i0 str))))) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) ls) (@eq val a nullval))) (@eq val (force_val (@sem_add_ptr_int CompSpecs tschar Unsigned str (Vint (Int.repr i)))) a))) (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str))) *)
    Exists (offset_val i str).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
    left. exists i. split3; auto. rewrite app_Znth1; auto. cstring. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
  Intros.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if. 
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    Exists nullval; rewrite !map_app; entailer!.
(* Goal: or (@ex Z (fun i : Z => and (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@eq val nullval (offset_val i str))))) (and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) ls) (@eq val nullval nullval)) *)
    right. split; auto.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
    assert (i = Zlength ls) by cstring.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) dest) *)
    subst i.
    autorewrite with sublist in H2; auto. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. (* entailer!. *)
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists (i+1); entailer!.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
  assert (i <> Zlength ls) by cstring.
(* Goal: and (and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls)) *)
  split. omega.
(* Goal: and (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) *)
  rewrite (sublist_split 0 i) by rep_omega. rewrite Forall_app. split; auto.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite sublist_len_1 by rep_omega. repeat constructor.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite app_Znth1 in H4 by rep_omega. auto.
Qed.

Lemma body_strcat: semax_body Vprog Gprog f_strcat strcat_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
unfold cstringn, cstring in *.
rename sd into ld. rename ss into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
forward_loop (EX i : Z,
    PROP (0 <= i < Zlength ld + 1)
    LOCAL (temp _i (Vint (Int.repr i)); temp _dest dest; temp _src src)
    SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ [Byte.zero]) ++
           list_repeat (Z.to_nat (n - (Zlength ld + 1))) Vundef) dest;
   data_at sh' (tarray tschar (Zlength ls + 1))
     (map Vbyte (ls ++ [Byte.zero])) src))
  break: (PROP ( )
   LOCAL (temp _i (Vint (Int.repr (Zlength ld))); temp _dest dest; 
   temp _src src)
   SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ [Byte.zero]) ++
           list_repeat (Z.to_nat (n - (Zlength ld + 1))) Vundef) dest;
   data_at sh' (tarray tschar (Zlength ls + 1))
     (map Vbyte (ls ++ [Byte.zero])) src)).
-
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists 0; entailer!.
-
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  { entailer!. }
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  { entailer!. autorewrite with sublist. normalize.  }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Sset _d (Ecast (Etempvar _t'1 tschar) tschar)) MORE_COMMANDS) POSTCONDITION *)
  autorewrite with sublist; normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
  forward_if (*  (Znth i (ld ++ [Byte.zero]) Byte.zero <> Byte.zero). *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  + forward.
   (*  entailer!. f_equal. f_equal. cstring. *)
  +
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
    forward. entailer!. f_equal. f_equal. cstring. 
  +
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
    forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    Exists (i+1); entailer!. cstring.
-
  abbreviate_semax.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
  forward_loop (EX j : Z,
    PROP (0 <= j < Zlength ls + 1)
    LOCAL (temp _j (Vint (Int.repr j)); temp _i (Vint (Int.repr (Zlength ld)));
           temp _dest dest; temp _src src)
    SEP (data_at sh (tarray tschar n)
          (map Vbyte (ld ++ sublist 0 j ls) ++
           list_repeat (Z.to_nat (n - (Zlength ld + j))) Vundef) dest;
         data_at sh' (tarray tschar (Zlength ls + 1))
           (map Vbyte (ls ++ [Byte.zero])) src)).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  { Exists 0; entailer!.  autorewrite with sublist.
    rewrite !map_app. rewrite <- app_assoc.
    rewrite split_data_at_app_tschar by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
    rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    autorewrite with sublist.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    cancel.    
   }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  { Intros j.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
  assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!.
  clear H3.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val (@Zlength Byte.int ls) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 (@Zlength Byte.int ls) ls)) (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte (@Zlength Byte.int ls) (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) dest) *)
  rewrite upd_Znth_app2 by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  + forward.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
      autorewrite with sublist.
      rewrite prop_true_andp 
        by (intro Hx; apply in_app in Hx; destruct Hx; contradiction).
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
      cancel.
    assert (j = Zlength ls) by cstring; subst.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    autorewrite with sublist.
    apply derives_refl'.
(* Goal: @eq Int.int (Int.repr i) (Int.repr (@Zlength Byte.int ls)) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr i))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr (Z.sub i (Zpos xH))))) (@nil localdef))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
    unfold data_at; f_equal. 
    replace (n - (Zlength ld + Zlength ls))
     with (1 + (n - (Zlength ld + Zlength ls+1))) by rep_omega.
    rewrite <- list_repeat_app' by rep_omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength Byte.int ls)) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength Byte.int ls))) (@upd_Znth val Z0 (@app val (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength Byte.int ls)) (@nil gfield)) dest))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength Byte.int ls)) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength Byte.int ls))) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength Byte.int ls)) (@nil gfield)) dest))) *)
    rewrite upd_Znth_app1 by list_solve.
    rewrite app_assoc.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@map Byte.int val Vbyte (@cons Byte.int (@Znth Byte.int Inhabitant_byte i ls) (@nil Byte.int))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    simpl.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int (@sublist Byte.int Z0 i ls) (@sublist Byte.int i (Z.add i (Zpos xH)) ls))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) dest) *)
    rewrite !map_app.
    reflexivity.
 +
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. (* entailer!. *)
  Exists (j+1).
  destruct (zlt j (Zlength ls)); [ | cstring].
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite (sublist_split 0 j (j+1)) by rep_omega.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int (@sublist Byte.int Z0 i ls) (@sublist Byte.int i (Z.add i (Zpos xH)) ls))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) dest) *)
  rewrite (app_assoc ld). rewrite !map_app.
  rewrite <- (app_assoc (_ ++ _)).
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
  rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
  rewrite (split_data_at_app_tschar _ n) by list_solve.
  replace (n - (Zlength ld + j))
    with (1 + (n - (Zlength ld + (j + 1)))) by rep_omega.
  rewrite <- list_repeat_app' by rep_omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
  rewrite upd_Znth_app1 by (autorewrite with sublist; rep_omega).
  rewrite app_Znth1 by list_solve.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite sublist_len_1 by rep_omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
 }
Qed.

Lemma body_strcmp: semax_body Vprog Gprog f_strcmp strcmp_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@nil localdef)))) (SEPx (@cons mpred (@cstring CompSpecs sh s str) (@nil mpred))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Etempvar _c tint) tint) (Sreturn (@Some expr (Ebinop Oadd (Etempvar _str (tptr tschar)) (Etempvar _i tuint) (tptr tschar)))) Sskip) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
unfold cstring in *.
rename s1 into ls1. rename s2 into ls2.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
forward_loop (EX i : Z,
  PROP (0 <= i < Zlength ls1 + 1; 0 <= i < Zlength ls2 + 1;
        sublist 0 i ls1 = sublist 0 i ls2)
  LOCAL (temp _str1 str1; temp _str2 str2; temp _i (Vint (Int.repr i)))
  SEP (data_at sh1 (tarray tschar (Zlength ls1 + 1))
          (map Vbyte (ls1 ++ [Byte.zero])) str1;
       data_at sh2 (tarray tschar (Zlength ls2 + 1))
          (map Vbyte (ls2 ++ [Byte.zero])) str2)).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
- Exists 0; entailer!.
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
- Intros i.
  assert (Zlength (ls1 ++ [Byte.zero]) = Zlength ls1 + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
  assert (Zlength (ls2 ++ [Byte.zero]) = Zlength ls2 + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
  assert (Znth i (ls1 ++ [Byte.zero]) = Byte.zero <-> i = Zlength ls1) as Hs1.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  { split; [|intro; subst; rewrite app_Znth2, Zminus_diag by omega; auto].
    destruct (zlt i (Zlength ls1)); [|omega].
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
    intro X; lapply (Znth_In i ls1); [|omega]. cstring. }
  assert (Znth i (ls2 ++ [Byte.zero]) = Byte.zero <-> i = Zlength ls2) as Hs2.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  { split; [|intro; subst; rewrite app_Znth2, Zminus_diag by omega; auto].
    destruct (zlt i (Zlength ls2)); [|omega].
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
    intro X; lapply (Znth_In i ls2); [|omega]. cstring. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward. fold_Vbyte.
  forward_if (temp _t'1 (Val.of_bool (Z.eqb i (Zlength ls1) && Z.eqb i (Zlength ls2)))).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Sset _d (Ecast (Etempvar _t'1 tschar) tschar)) MORE_COMMANDS) POSTCONDITION *)
    simpl force_val. normalize.
    rewrite Hs1 in *.
    destruct (Byte.eq_dec (Znth i (ls2 ++ [Byte.zero])) Byte.zero).
    + rewrite e; simpl force_val.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
         assert (i = Zlength ls2) by cstring.
        rewrite  (proj2 Hs1 H6).
     rewrite (proj2 (Z.eqb_eq i (Zlength ls1)) H6).
     rewrite (proj2 (Z.eqb_eq i (Zlength ls2)) H7).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
     entailer!.
  +
    rewrite Int.eq_false.
     rewrite (proj2 (Z.eqb_eq i (Zlength ls1)) H6).
     rewrite Hs2 in n.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
     rewrite (proj2 (Z.eqb_neq i (Zlength ls2))) by auto.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!.
     contradict n.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
     apply repr_inj_signed in n; try rep_omega. normalize in n.
 }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  { forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
    entailer!.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
    destruct (i =? Zlength ls1) eqn: Heq; auto.
    rewrite Z.eqb_eq in Heq; tauto. }
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if. 
 +
  rewrite andb_true_iff in H6; destruct H6.
  rewrite Z.eqb_eq in H6,H7.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
  Exists (Int.repr 0).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  entailer!. simpl.
  autorewrite with sublist in H3.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
  auto.
 +
  rewrite andb_false_iff in H6. rewrite !Z.eqb_neq in H6.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
  forward_if.
  *
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
    forward. Exists (Int.repr (-1)). entailer!.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@map Byte.int val Vbyte (@cons Byte.int (@Znth Byte.int Inhabitant_byte i ls) (@nil Byte.int))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
    simpl. intro; subst. omega.
 *
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
   forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
   forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
   Exists (Int.repr 1). entailer!. simpl. intro. subst. omega.

   assert (H17: Byte.signed (Znth i (ls1 ++ [Byte.zero])) =
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
     Byte.signed (Znth i (ls2 ++ [Byte.zero]))) by omega.
   normalize in H17. clear H7 H8.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
   forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
   Exists (i+1).
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
   entailer!.
   clear - H17 H6 Hs1 Hs2 H3 H1 H2 H H0.
   destruct (zlt i (Zlength ls1)).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  2:{
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         assert (i = Zlength ls1) by omega. subst.
         destruct H6; [congruence | ].
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         assert (Zlength ls1 < Zlength ls2) by omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth2 in H17 by rep_omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth1 in H17 by rep_omega.
         rewrite Z.sub_diag in H17. contradiction H0.
         change (Znth 0 [Byte.zero]) with Byte.zero in H17.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite H17. apply Znth_In. omega.
   }
  destruct (zlt i (Zlength ls2)).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) (Sreturn (@Some expr (Econst_int (Int.repr Z0) tint))) POSTCONDITION *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr i))) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@cons Prop (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 i ls)) (@nil Prop))) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _c (Vbyte c)) (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  2:{
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         assert (i = Zlength ls2) by omega. subst.
         destruct H6; [ | congruence].
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         assert (Zlength ls1 > Zlength ls2) by omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth1 in H17 by rep_omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
         rewrite app_Znth2 in H17 by rep_omega.
         rewrite Z.sub_diag in H17. contradiction H.
         change (Znth 0 [Byte.zero]) with Byte.zero in H17.
         rewrite <- H17.  apply Znth_In. omega.
   }
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite (sublist_split 0 i (i+1)) by omega.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite (sublist_split 0 i (i+1)) by omega.
(* Goal: not (@eq Byte.int (@Znth Byte.int Inhabitant_byte i ls) c) *)
  f_equal; auto.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite !sublist_len_1 by omega.
  autorewrite with sublist in H17.
(* Goal: and (and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls)) *)
  split. rep_omega. split. rep_omega.
(* Goal: @eq Int.int (Int.repr i) (Int.repr (@Zlength Byte.int ls)) *)
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr i))) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))) Sskip (normal_ret_assert (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _str str) (@cons localdef (temp _i (Vptrofs (Ptrofs.repr (Z.sub i (Zpos xH))))) (@nil localdef))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) str) (@nil mpred))))))) *)
  f_equal; auto. f_equal. auto.
Qed.

Lemma body_strcpy: semax_body Vprog Gprog f_strcpy strcpy_spec.
Proof.
(* Goal: semax_body Vprog Gprog CompSpecs f_strcpy strcpy_spec *)
start_function.
unfold cstring,cstringn in *.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@andp mpred Nveric (@prop mpred Nveric (not (@In Byte.int Byte.zero s))) (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int s) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int s (@cons Byte.int Byte.zero (@nil Byte.int)))) src)) (@nil mpred)))))) (Ssequence (Sset _i (Econst_int (Int.repr Z0) tint)) MORE_COMMANDS) POSTCONDITION *)
rename s into ls.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sloop (Ssequence Sskip (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) (Ssequence (Sassign (Ederef (Ebinop Oadd (Etempvar _dest (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar) (Etempvar _d tschar)) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip)))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint))) POSTCONDITION *)
Intros.
forward_loop (EX i : Z,
  PROP (0 <= i < Zlength ls + 1)
  LOCAL (temp _i (Vint (Int.repr i)); temp _dest dest; temp _src src)
  SEP (data_at sh (tarray tschar n)
        (map Vbyte (sublist 0 i ls) ++ list_repeat (Z.to_nat (n - i)) Vundef) dest;
       data_at sh' (tarray tschar (Zlength ls + 1)) (map Vbyte (ls ++ [Byte.zero])) src)).
*
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr Z0))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at_ CompSpecs sh (tarray tschar n) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) *)
 Exists 0. rewrite Z.sub_0_r; entailer!. simpl; entailer!.
*
(* Goal: semax CompSpecs Espec Delta (@exp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) Z (fun i : Z => PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 Intros i.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Ssequence (Ssequence (Sset _t'1 (Ederef (Ebinop Oadd (Etempvar _src (tptr tschar)) (Etempvar _i tuint) (tptr tschar)) tschar)) (Sset _d (Ecast (Etempvar _t'1 tschar) tschar))) MORE_COMMANDS) POSTCONDITION *)
 assert (Zlength (ls ++ [Byte.zero]) = Zlength ls + 1) by (autorewrite with sublist; auto).
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 forward. normalize.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 forward. fold_Vbyte.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
 forward.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _d (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _t'1 (Vbyte (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))) (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val i (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sifthenelse (Ebinop Oeq (Etempvar _d tschar) (Econst_int (Int.repr Z0) tint) tint) (Sreturn (@Some expr (Etempvar _dest (tptr tschar)))) Sskip) POSTCONDITION *)
 forward_if.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
+ forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
   entailer!.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
  assert (i = Zlength ls) by cstring. subst i.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int (@sublist Byte.int Z0 i ls) (@sublist Byte.int i (Z.add i (Zpos xH)) ls))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) dest) *)
  rewrite !map_app.
  rewrite <- app_assoc.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
   rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte ls))) (@map Byte.int val Vbyte ls) dest) (@data_at CompSpecs sh (tarray tschar (Z.sub n (@Zlength val (@map Byte.int val Vbyte ls)))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef) (Vint (Int.repr (Byte.signed Byte.zero)))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte ls))) (@nil gfield)) dest))) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte ls) (@app val (@map Byte.int val Vbyte (@cons Byte.int Byte.zero (@nil Byte.int))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef))) dest) *)
   rewrite (split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
   autorewrite with sublist.
   replace (n - Zlength ls) with (1 + (n - (Zlength ls + 1))) at 2 by list_solve.
  rewrite <- list_repeat_app' by omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) *)
  rewrite !split_data_at_app_tschar by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
+
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
   assert (i < Zlength ls) by cstring.
(* Goal: semax CompSpecs Espec Delta (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.repr (Z.sub i (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) (Sset _i (Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr (Zpos xH)) tint) tuint)) POSTCONDITION *)
  forward.
(* Goal: @derives (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (@andp (forall _ : environ, mpred) (@LiftNatDed' mpred Nveric) (local (tc_environ Delta)) (PROPx (@nil Prop) (LOCALx (@cons localdef (temp _i (Vint (Int.add (Int.repr (Z.sub i (Zpos xH))) (Int.repr (Zpos xH))))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred))))))) (PROPx (@cons Prop (and (Z.le Z0 i) (Z.lt i (Z.add (@Zlength Byte.int ls) (Zpos xH)))) (@nil Prop)) (LOCALx (@cons localdef (temp _i (Vint (Int.repr i))) (@cons localdef (temp _dest dest) (@cons localdef (temp _src src) (@nil localdef)))) (SEPx (@cons mpred (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef)) dest) (@cons mpred (@data_at CompSpecs sh' (tarray tschar (Z.add (@Zlength Byte.int ls) (Zpos xH))) (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) src) (@nil mpred)))))) *)
  Exists (i+1). entailer!.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@upd_Znth val (@Zlength Byte.int ls) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 (@Zlength Byte.int ls) ls)) (@list_repeat val (Z.to_nat (Z.sub n (@Zlength Byte.int ls))) Vundef)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte (@Zlength Byte.int ls) (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@app Byte.int ls (@cons Byte.int Byte.zero (@nil Byte.int)))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add (@Zlength Byte.int ls) (Zpos xH)))) Vundef)) dest) *)
  rewrite upd_Znth_app2 by list_solve.
(* Goal: Z.lt i (@Zlength Byte.int ls) *)
  assert (i < Zlength ls) by cstring.
  rewrite (sublist_split 0 i (i+1)) by list_solve.
  rewrite !map_app. rewrite <- app_assoc.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Z.sub n i)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))) dest) (@data_at CompSpecs sh (tarray tschar n) (@app val (@map Byte.int val Vbyte (@sublist Byte.int Z0 i ls)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef))) dest) *)
  rewrite !(split_data_at_app_tschar _ n) by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
   replace (n - i) with (1 + (n-(i+ 1))) at 2 by list_solve.
  rewrite <- list_repeat_app' by omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@cons val Vundef (@nil val)) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@cons val (Vbyte (@Znth Byte.int Inhabitant_byte i ls)) (@nil val)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  cancel.
(* Goal: @derives mpred Nveric (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub n i)) (@app val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) *)
  rewrite !split_data_at_app_tschar by list_solve.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls)))))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls))))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (@Zlength val (@map Byte.int val Vbyte (@sublist Byte.int i (Z.add i (Zpos xH)) ls)))) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  autorewrite with sublist.
(* Goal: and (Z.le Z0 (Z.add i (Zpos xH))) (Z.lt (Z.add i (Zpos xH)) (Z.add (@Zlength Byte.int ls) (Zpos xH))) *)
(* Goal: @Forall Byte.int (fun d : Byte.int => not (@eq Byte.int d c)) (@sublist Byte.int Z0 (Z.add i (Zpos xH)) ls) *)
  rewrite sublist_len_1 by omega.
(* Goal: @derives mpred Nveric (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@upd_Znth val Z0 (@list_repeat val (Z.to_nat (Zpos xH)) Vundef) (Vint (Int.repr (Byte.signed (@Znth Byte.int Inhabitant_byte i ls))))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) (@sepcon mpred Nveric Sveric (@data_at CompSpecs sh (tarray tschar (Zpos xH)) (@map Byte.int val Vbyte (@cons Byte.int (@Znth Byte.int Inhabitant_byte i ls) (@nil Byte.int))) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)) (@data_at CompSpecs sh (tarray tschar (Z.sub (Z.sub n i) (Zpos xH))) (@list_repeat val (Z.to_nat (Z.sub n (Z.add i (Zpos xH)))) Vundef) (@field_address0 CompSpecs (tarray tschar (Z.sub n i)) (@cons gfield (ArraySubsc (Zpos xH)) (@nil gfield)) (@field_address0 CompSpecs (tarray tschar n) (@cons gfield (ArraySubsc i) (@nil gfield)) dest)))) *)
  simpl. cancel.
Qed.

End Alternate.

