(* This file are developed by Qinxiang Cao, Shengyi Wang and Aquinas Hobor in 2015 *)
(* summer in Yale-NUS.                                                             *)


Require Import VST.msl.base.
Require Import VST.msl.Extensionality.
Require Import VST.msl.simple_CCC.
Require Import VST.msl.seplog.
Require Import VST.msl.log_normalize.
Require Import Coq.Lists.List.
Require Import Coq.Sorting.Permutation.
Require Export Coq.Classes.Morphisms.

(* Goal: @incl B l' (@app B l1 l2) *)
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
Lemma In_Permutation_cons: forall {A : Type} (l : list A) (x : A),
  In x l ->
  exists l', Permutation l (x :: l').
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @derives A ND (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l) (iter_sepcon2 (@map (prod B1 B2) B1 (@fst B1 B2) l) (@map (prod B1 B2) B2 (@snd B1 B2) l)) *)
  induction l.
  + inversion H.
  + destruct H.
    - exists l; subst; reflexivity.
    - destruct (IHl H) as [l' ?].
(* Goal: @ex (list A) (fun l' : list A => @Permutation A (@cons A a l) (@cons A x l')) *)
      exists (a :: l').
(* Goal: @Permutation A (@cons A a l) (@cons A x (@cons A a l')) *)
      rewrite H0.
(* Goal: @NoDup B (@nil B) *)
      constructor.
Qed.

Lemma incl_Permutation {A: Type}: forall (l1 l2: list A), NoDup l2 -> incl l2 l1 -> exists l', Permutation l1 (l2 ++ l').
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros l1 l2. revert l1. induction l2; intros.
  - exists l1. simpl. auto.
(* Goal: @derives A ND (@sepcon A ND SL (p a b) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l)) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@cons B2 b l2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
  - rewrite NoDup_cons_iff in H. destruct H. hnf in H0. assert (In a l1) by (apply H0; simpl; auto). assert (incl l2 l1) by (hnf; intros; apply H0; simpl; auto).
(* Goal: @ex (list A) (fun l' : list A => @Permutation A l1 (@app A (@cons A a l2) l')) *)
    specialize (IHl2 l1 H1 H3). destruct IHl2 as [l3 ?]. assert (In a l3) by (rewrite H4 in H2; apply in_app_or in H2; destruct H2; [exfalso|]; auto).
    apply In_Permutation_cons in H5. destruct H5 as [l4 ?]. rewrite H5 in H4. exists l4. rewrite H4. rewrite <- app_comm_cons. symmetry. apply Permutation_middle.
Qed.

Local Open Scope logic.

Set Implicit Arguments.

Definition sepcon_unique1 {X A} `{SepLog A} (P: X -> A): Prop :=
  forall x, P x * P x |-- FF.

Definition sepcon_unique2 {X Y A} `{SepLog A} (P: X -> Y -> A): Prop :=
  forall x y1 y2, P x y1 * P x y2 |-- FF.

Section IterSepCon.

  Context {A : Type}.
  Context {B : Type}.
  Context {ND : NatDed A}.
  Context {SL : SepLog A}.
  Context {ClS: ClassicalSep A}.
  Context {CoSL: CorableSepLog A}.

Section SingleSepPred.

  Context (p : B -> A).

Fixpoint iter_sepcon (l : list B) : A :=
  match l with
    | nil => emp
    | x :: xl => p x * iter_sepcon xl
  end.

Lemma iter_sepcon_app:
  forall (l1 l2 : list B), iter_sepcon (l1 ++ l2) = iter_sepcon l1 * iter_sepcon l2.
Proof.
(* Goal: @derives A ND (p x0) (@iter_sepcon A B ND SL p (@cons B x0 (@nil B))) *)
  induction l1; intros; simpl. rewrite emp_sepcon; auto. rewrite IHl1. rewrite sepcon_assoc. auto.
Qed.

Lemma iter_sepcon_app_comm: forall (l1 l2 : list B), iter_sepcon (l1 ++ l2) = iter_sepcon (l2 ++ l1).
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
Proof. intros. do 2 rewrite iter_sepcon_app. rewrite sepcon_comm. auto. Qed.

Lemma iter_sepcon_permutation: forall  (l1 l2 : list B), Permutation l1 l2 -> iter_sepcon l1 = iter_sepcon l2.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros. induction H; simpl; auto.
  + rewrite IHPermutation. auto.
  + do 2 rewrite <- sepcon_assoc. rewrite (sepcon_comm (p y)). auto.
  + rewrite IHPermutation1. auto.
Qed.

Lemma iter_sepcon_in_true: forall (l : list B) x, In x l -> iter_sepcon l |-- p x * TT.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros. apply in_split in H. destruct H as [l1 [l2 ?]]. subst.
  rewrite iter_sepcon_app_comm. rewrite <- app_comm_cons. simpl.
(* Goal: P v *)
  apply sepcon_derives; auto. apply TT_right.
Qed.

Lemma iter_sepcon_incl_true: forall (l s: list B),
    NoDup s -> incl s l -> iter_sepcon l |-- iter_sepcon s * TT.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros. destruct (incl_Permutation l s H H0) as [l' ?].
(* Goal: @derives A ND (iter_sepcon l) (@sepcon A ND SL (iter_sepcon s) (@TT A ND)) *)
  apply iter_sepcon_permutation in H1. rewrite H1, iter_sepcon_app.
(* Goal: P v *)
  apply sepcon_derives; auto. apply TT_right.
Qed.

Lemma iter_sepcon_unique_nodup: forall (l : list B), sepcon_unique1 p -> iter_sepcon l |-- !!(NoDup l).
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros. induction l.
  + apply prop_right. constructor.
  + simpl.
    assert (p a * iter_sepcon l |-- !!(~ In a l)). {
(* Goal: @derives A ND (@sepcon A ND SL (p a) (iter_sepcon l)) (@prop A ND (not (@In B a l))) *)
      apply not_prop_right.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
      intros. apply iter_sepcon_in_true in H0.
(* Goal: @derives A ND (@sepcon A ND SL (p a) (iter_sepcon l)) (@FF A ND) *)
      apply derives_trans with (p a * p a * TT).
      + rewrite sepcon_assoc. apply sepcon_derives. apply derives_refl. auto.
      + specialize (H a). apply derives_trans with (FF * TT).
(* Goal: P v *)
        apply sepcon_derives; auto. rewrite sepcon_comm, sepcon_FF. apply derives_refl.
    }
(* Goal: @derives A ND (@sepcon A ND SL (p a) (iter_sepcon l)) (@prop A ND (@NoDup B (@cons B a l))) *)
  apply derives_trans with (!!(NoDup l) && !!(~ In a l)).
  - apply andp_right; auto. rewrite (add_andp _ _ IHl). normalize.
  - normalize. constructor; auto.
Qed.

Lemma iter_sepcon_emp': forall (l : list B), (forall x, In x l -> p x = emp) -> iter_sepcon l = emp.
Proof.
(* Goal: P v *)
  induction l; intros; simpl; auto.
(* Goal: P v *)
  rewrite H, IHl, sepcon_emp; simpl; auto.
(* Goal: P v *)
  intros; apply H; simpl; auto.
Qed.

Lemma iter_sepcon_emp: forall (l l' : list B), (forall x, p x |-- emp) -> NoDup l' -> incl l' l -> iter_sepcon l |-- iter_sepcon l'.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  revert l H1; induction l'; intros.
  + simpl; clear H1.
(* Goal: P v *)
    induction l; simpl; auto.
    rewrite <- (emp_sepcon emp).
(* Goal: P v *)
    apply sepcon_derives; auto.
  + inversion H0; subst.
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    spec IHl'; [auto |].
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    assert (In a l) by (specialize (H1 a); simpl in H1; auto).
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    apply in_split in H2.
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    destruct H2 as [l1 [l2 ?]].
    specialize (IHl' (l1 ++ l2)).
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    spec IHl'.
(* Goal: @incl B l' (@app B l1 l2) *)
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    {
      clear - H2 H1 H4.
(* Goal: @incl B l' (@app B l1 l2) *)
      intros x ?H.
(* Goal: @In B x (@app B l1 l2) *)
      specialize (H1 x).
(* Goal: @In B x (@app B l1 l2) *)
      spec H1; [simpl; auto |].
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
      subst.
(* Goal: @In B x (@app B l1 l2) *)
      rewrite in_app_iff in H1; simpl in H1.
(* Goal: @In B x (@app B l1 l2) *)
      rewrite in_app_iff.
      assert (a = x -> False) by (intros; subst; tauto).
(* Goal: P v *)
      tauto.
    }
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    subst.
(* Goal: @derives A ND (iter_sepcon (@app B l1 (@cons B a l2))) (iter_sepcon (@cons B a l')) *)
    rewrite iter_sepcon_app in *.
(* Goal: @derives A ND (p x0) (@iter_sepcon A B ND SL p (@cons B x0 (@nil B))) *)
    simpl.
    rewrite (sepcon_comm (p a)), <- sepcon_assoc, (sepcon_comm _ (p a)).
(* Goal: P v *)
    apply sepcon_derives; auto.
Qed.

Lemma iter_sepcon_nil: iter_sepcon nil = emp.
Proof. intros; reflexivity. Qed.

End SingleSepPred.

Lemma iter_sepcon_func: forall l P Q, (forall x, P x = Q x) -> iter_sepcon P l = iter_sepcon Q l.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
Proof. intros. induction l; simpl; [|f_equal]; auto. Qed.

Lemma iter_sepcon_func_strong: forall l P Q, (forall x, In x l -> P x = Q x) -> iter_sepcon P l = iter_sepcon Q l.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros. induction l.
  + reflexivity.
  + simpl.
(* Goal: @eq A (@exp A ND (list B) (fun l : list B => @andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x l) (P x))) (@prop A ND (@NoDup B l))) (@iter_sepcon A B ND SL p l))) (@exp A ND (list B) (fun l : list B => @andp A ND (@prop A ND (and (forall x : B, iff (@In B x l) (P x)) (@NoDup B l))) (@iter_sepcon A B ND SL p l))) *)
    f_equal.
    - apply H.
(* Goal: P v *)
      simpl; auto.
    - apply IHl.
(* Goal: @eq A (P a) (Q a) *)
      intros; apply H.
(* Goal: P v *)
      simpl; auto.
Qed. 

Instance iter_sepcon_permutation_proper : Proper ((pointwise_relation B eq) ==> (@Permutation B) ==> eq) iter_sepcon.
Proof.
(* Goal: @Proper (forall (_ : forall _ : B, A) (_ : list B), A) (@respectful (forall _ : B, A) (forall _ : list B, A) (@pointwise_relation B A (@eq A)) (@respectful (list B) A (@Permutation B) (@eq A))) iter_sepcon *)
  repeat intro. transitivity (iter_sepcon x y0).
  + apply iter_sepcon_permutation. auto.
  + apply iter_sepcon_func.
(* Goal: forall x0 : B, @eq A (x x0) (y x0) *)
    exact H.
Qed.

End IterSepCon.

Lemma iter_sepcon_map: forall {A B C: Type} {ND : NatDed A} {SL : SepLog A} (l : list C) (f : B -> A) (g: C -> B),
                         iter_sepcon (fun x : C => f (g x)) l = iter_sepcon f (map g l).
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
Proof. intros. induction l; simpl; [|f_equal]; auto. Qed.

Global Existing Instance iter_sepcon_permutation_proper.

Definition uncurry {A B C} (f: A -> B -> C) (xy: A*B) : C :=
  f (fst xy) (snd xy).

Section IterSepCon2.

  Context {A : Type}.
(* Goal: @incl B l' (@app B l1 l2) *)
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
  Context {B1 B2 : Type}.
  Context {ND : NatDed A}.
  Context {SL : SepLog A}.
  Context {ClS: ClassicalSep A}.
  Context {CoSL: CorableSepLog A}.
  Context (p : B1 -> B2 -> A).

Fixpoint iter_sepcon2 (l : list B1) : list B2 -> A :=
    match l with
    | nil => fun l2 =>
       match l2 with
       | nil => emp
       | _ => FF
       end
    | x :: xl => fun l' =>
       match l' with
       | nil => FF
       | y :: yl => p x y * iter_sepcon2 xl yl
       end
  end.

Lemma iter_sepcon2_spec: forall l1 l2,
  iter_sepcon2 l1 l2 = EX l: list (B1 * B2), !! (l1 = map fst l /\ l2 = map snd l) && iter_sepcon (uncurry p) l.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @eq A (@exp A ND (list B) (fun l : list B => @andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x l) False)) (@prop A ND (@NoDup B l))) (@iter_sepcon A B ND SL p l))) (@emp A ND SL) *)
  apply pred_ext.
  + revert l2; induction l1; intros; destruct l2.
    - apply (exp_right nil); simpl.
(* Goal: P v *)
      apply andp_right; auto.
(* Goal: P v *)
      apply prop_right; auto.
    - simpl.
(* Goal: @derives A ND (@FF A ND) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@nil B2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
      apply FF_left.
    - simpl.
(* Goal: @derives A ND (@FF A ND) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@nil B2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
      apply FF_left.
    - simpl.
(* Goal: @derives A ND (@sepcon A ND SL (p a b) (iter_sepcon2 l1 l2)) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@cons B2 b l2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
      specialize (IHl1 l2).
(* Goal: @derives A ND (@sepcon A ND SL (p a b) (iter_sepcon2 l1 l2)) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@cons B2 b l2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
      eapply derives_trans; [apply sepcon_derives; [apply derives_refl | apply IHl1] | clear IHl1].
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
      normalize.
(* Goal: @derives A ND (@sepcon A ND SL (p a b) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l)) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@cons B2 b l2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
      destruct H.
(* Goal: @derives A ND (@sepcon A ND SL (p a b) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l)) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@cons B2 b l2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
      apply (exp_right ((a, b) :: l)).
(* Goal: @derives A ND (p x0) (@iter_sepcon A B ND SL p (@cons B x0 (@nil B))) *)
      simpl.
(* Goal: @derives A ND (@sepcon A ND SL (p a b) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l)) (@andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@cons B1 a (@map (prod B1 B2) B1 (@fst B1 B2) l))) (@eq (list B2) (@cons B2 b l2) (@cons B2 b (@map (prod B1 B2) B2 (@snd B1 B2) l))))) (@sepcon A ND SL (@uncurry B1 B2 A p (@pair B1 B2 a b)) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
      apply andp_right; [apply prop_right; subst; auto |].
(* Goal: @derives A ND (@emp A ND SL) (@iter_sepcon A B ND SL p (@nil B)) *)
      apply derives_refl.
  + apply exp_left; intros l.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
    normalize.
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
    destruct H; subst.
(* Goal: @derives A ND (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l) (iter_sepcon2 (@map (prod B1 B2) B1 (@fst B1 B2) l) (@map (prod B1 B2) B2 (@snd B1 B2) l)) *)
    induction l.
    - simpl. auto.
    - simpl.
(* Goal: @derives A ND (@sepcon A ND SL (@uncurry B1 B2 A p a) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l)) (@sepcon A ND SL (p (@fst B1 B2 a) (@snd B1 B2 a)) (iter_sepcon2 (@map (prod B1 B2) B1 (@fst B1 B2) l) (@map (prod B1 B2) B2 (@snd B1 B2) l))) *)
      eapply derives_trans; [apply sepcon_derives; [apply derives_refl | apply IHl] | clear IHl].
(* Goal: @derives A ND (@emp A ND SL) (@iter_sepcon A B ND SL p (@nil B)) *)
      apply derives_refl.
Qed.

End IterSepCon2.

Section IterPredSepCon.

  Context {A : Type}.
  Context {B : Type}.
  Context {ND : NatDed A}.
  Context {SL : SepLog A}.
  Context {ClS: ClassicalSep A}.

Definition pred_sepcon (p: B -> A) (P: B -> Prop): A :=
  EX l: list B, !! (forall x, In x l <-> P x) && !! NoDup l && iter_sepcon p l.

Lemma pred_sepcon_eq: forall (P: B -> Prop) (p: B -> A),
    pred_sepcon p P = 
    (EX l: list B, !! ((forall x, In x l <-> P x) /\ NoDup l) && iter_sepcon p l).
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros. unfold pred_sepcon. f_equal. extensionality l. rewrite prop_and. auto.
Qed.

Lemma pred_sepcon_strong_proper: forall P1 P2 p1 p2,
  (forall x, P1 x <-> P2 x) ->
  (forall x, P1 x -> P2 x -> p1 x = p2 x) ->
  pred_sepcon p1 P1 = pred_sepcon p2 P2.
Proof.
  assert (forall P1 P2 p1 p2,
    (forall x, P1 x <-> P2 x) ->
    (forall x, P1 x -> P2 x -> p1 x = p2 x) ->
    pred_sepcon p1 P1 |-- pred_sepcon p2 P2).
  2: intros; apply pred_ext; apply H; [auto | auto | symmetry; auto | symmetry; auto].
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  unfold pred_sepcon.
  apply exp_left; intro l; apply (exp_right l).
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
  normalize.
  assert (forall x : B, In x l <-> P2 x) by (intros; rewrite H1, H; reflexivity).
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
  normalize.
  erewrite iter_sepcon_func_strong; [apply derives_refl |].
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
  specialize (H1 x); specialize (H3 x).
(* Goal: P v *)
  apply H0; tauto.
Qed.

Instance pred_sepcon_proper: Proper (pointwise_relation B eq ==> pointwise_relation B iff ==> eq) pred_sepcon.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @Proper (forall (_ : forall _ : B, A) (_ : forall _ : B, Prop), A) (@respectful (forall _ : B, A) (forall _ : forall _ : B, Prop, A) (@pointwise_relation B A (@eq A)) (@respectful (forall _ : B, Prop) A (@pointwise_relation B Prop iff) (@eq A))) pred_sepcon *)
  do 2 (hnf; intros).
(* Goal: P v *)
  apply pred_sepcon_strong_proper; intros; auto.
Defined.

Global Existing Instance pred_sepcon_proper.

Lemma pred_sepcon1: forall p x0,
  pred_sepcon p (fun x => x = x0) = p x0.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  unfold pred_sepcon.
(* Goal: @eq A (@exp A ND (list B) (fun l : list B => @andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x l) False)) (@prop A ND (@NoDup B l))) (@iter_sepcon A B ND SL p l))) (@emp A ND SL) *)
  apply pred_ext.
  + apply exp_left; intro l.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
    normalize.
(* Goal: @derives A ND (@iter_sepcon A B ND SL p l) (p x0) *)
    destruct l as [| ? [|]].
    - specialize (H x0); simpl in H.
(* Goal: P v *)
      tauto.
    - specialize (H x0); simpl in H.
(* Goal: @derives A ND (@iter_sepcon A B ND SL p (@cons B b (@nil B))) (p x0) *)
      assert (b = x0) by tauto; subst b.
(* Goal: @derives A ND (p x0) (@iter_sepcon A B ND SL p (@cons B x0 (@nil B))) *)
      simpl.
(* Goal: P v *)
      rewrite sepcon_emp; auto.
    - pose proof proj1 (H b) as HH; simpl in HH.
(* Goal: @derives A ND (@iter_sepcon A B ND SL p (@cons B x0 (@cons B b0 l))) (p x0) *)
      spec HH; [auto |].
(* Goal: @derives A ND (@iter_sepcon A B ND SL p (@cons B b (@cons B b0 l))) (p x0) *)
      subst b.
(* Goal: @derives A ND (@iter_sepcon A B ND SL p (@cons B x0 (@cons B b0 l))) (p x0) *)
      pose proof proj1 (H b0) as HH; simpl in HH.
(* Goal: @derives A ND (@iter_sepcon A B ND SL p (@cons B x0 (@cons B b0 l))) (p x0) *)
      spec HH; [auto |].
(* Goal: @derives A ND (@iter_sepcon A B ND SL p (@cons B x0 (@cons B b0 l))) (p x0) *)
      subst b0.
      clear - H0.
(* Goal: @derives A ND (iter_sepcon l) (iter_sepcon (@cons B a l')) *)
      inversion H0; subst.
(* Goal: P v *)
      simpl in H2; tauto.
  + apply (exp_right (x0 :: nil)).
(* Goal: @derives A ND (p x0) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@cons B x0 (@nil B))) (@eq B x x0))) (@prop A ND (@NoDup B (@cons B x0 (@nil B))))) (@iter_sepcon A B ND SL p (@cons B x0 (@nil B)))) *)
    repeat apply andp_right.
    - apply prop_right.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
      intros.
(* Goal: @derives A ND (p x0) (@iter_sepcon A B ND SL p (@cons B x0 (@nil B))) *)
      simpl.
(* Goal: iff (or (@eq B x0 x) False) (@eq B x x0) *)
      split; [intros [? | ?]; [congruence | tauto] | left; congruence].
    - apply prop_right.
(* Goal: @NoDup B (@cons B x0 (@nil B)) *)
      constructor; [simpl; tauto | constructor].
    - simpl.
(* Goal: P v *)
      rewrite sepcon_emp; auto.
Qed.

(*
Lemma pred_sepcon_sepcon: forall (P Q R: B -> Prop) p,
  Prop_join P Q R ->
  pred_sepcon P p * pred_sepcon Q p = pred_sepcon R p.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @derives A ND (@sepcon A ND SL (p a b) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l)) (@exp A ND (list (prod B1 B2)) (fun l : list (prod B1 B2) => @andp A ND (@prop A ND (and (@eq (list B1) (@cons B1 a l1) (@map (prod B1 B2) B1 (@fst B1 B2) l)) (@eq (list B2) (@cons B2 b l2) (@map (prod B1 B2) B2 (@snd B1 B2) l)))) (@iter_sepcon A (prod B1 B2) ND SL (@uncurry B1 B2 A p) l))) *)
  destruct H.
(* Goal: @eq A (@exp A ND (list B) (fun l : list B => @andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x l) False)) (@prop A ND (@NoDup B l))) (@iter_sepcon A B ND SL p l))) (@emp A ND SL) *)
  unfold pred_sepcon; apply pred_ext.
  + rewrite exp_sepcon1. apply exp_left; intro lP.
    rewrite exp_sepcon2. apply exp_left; intro lQ.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
    normalize.
    apply (exp_right (lP ++ lQ)).
    apply andp_right; [apply andp_right |].
    - apply prop_right.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
      intros.
(* Goal: @In B x (@app B l1 l2) *)
      rewrite in_app_iff.
      firstorder.
    - apply prop_right.
(* Goal: P v *)
      apply NoDup_app_inv; auto.
      firstorder.
    - rewrite <- iter_sepcon_app; auto.
  + apply exp_left; intro l.
    rewrite andp_assoc.
    do 2 (apply derives_extract_prop; intro).
    destruct (spec_list_split l P Q R H2 H1 (conj H H0)) as [lp [lq [? [? [? [? ?]]]]]].
    rewrite exp_sepcon1. apply (exp_right lp).
    rewrite exp_sepcon2. apply (exp_right lq).
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
    normalize.
(* Goal: P v *)
    rewrite H7, iter_sepcon_app; auto.
Qed.

Lemma pred_sepcon_sepcon1: forall (P P': B -> Prop) p x0,
  (forall x, P' x <-> P x \/ x = x0) ->
  ~ P x0 ->
  pred_sepcon P' p = pred_sepcon P p * p x0.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
  rewrite <- pred_sepcon_sepcon with (Q := fun x => x = x0) (P := P).
  + f_equal.
    apply pred_sepcon1.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  + split; intros.
    - specialize (H a).
      assert (a = x0 -> ~ P a) by (intro; subst; auto).
(* Goal: P v *)
      tauto.
    - subst.
      specialize (H x0).
(* Goal: P v *)
      tauto.
Qed.
*)

Lemma pred_sepcon_unique_sepcon1: forall (P: B -> Prop) p x0,
  sepcon_unique1 p ->
  pred_sepcon p P * p x0 |-- !! (~ P x0).
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @derives A ND (@sepcon A ND SL (pred_sepcon p P) (p x0)) (@prop A ND (not (P x0))) *)
  apply not_prop_right; intro.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
  unfold pred_sepcon; normalize.
  rewrite <- H1 in H0.
(* Goal: @derives A ND (@sepcon A ND SL (@iter_sepcon A B ND SL p l) (p x0)) (@FF A ND) *)
  eapply derives_trans; [apply sepcon_derives; [apply iter_sepcon_in_true; eauto| apply derives_refl] |].
  rewrite sepcon_comm, <- sepcon_assoc.
(* Goal: @derives A ND (@sepcon A ND SL (@sepcon A ND SL (p x0) (p x0)) (@TT A ND)) (@FF A ND) *)
  eapply derives_trans; [apply sepcon_derives; [apply H | apply derives_refl] |].
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
  normalize.
Qed.

Lemma prop_forall_allp: forall (P: B -> Prop),
  !! (forall x, P x) = ALL x: B, !! P x.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @eq A (@exp A ND (list B) (fun l : list B => @andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x l) False)) (@prop A ND (@NoDup B l))) (@iter_sepcon A B ND SL p l))) (@emp A ND SL) *)
  apply pred_ext.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  + apply allp_right; intros.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
    apply prop_derives; intros.
(* Goal: P v *)
    auto.
  + apply allp_prop_left.
Qed.

Lemma prop_impl_imp: forall (P Q: Prop),
  !! (P -> Q) = !! P --> !! Q.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @eq A (@exp A ND (list B) (fun l : list B => @andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x l) False)) (@prop A ND (@NoDup B l))) (@iter_sepcon A B ND SL p l))) (@emp A ND SL) *)
  apply pred_ext.
  + apply imp_andp_adjoint.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
    normalize.
  + apply prop_imp_prop_left.
Qed.

Lemma pred_sepcon_prop_true: forall (P: B -> Prop) p x,
  P x ->
  pred_sepcon p P |-- p x * TT.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
  unfold pred_sepcon; normalize.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
  normalize.
(* Goal: @derives A ND (@iter_sepcon A B ND SL p x0) (@sepcon A ND SL (p x) (@TT A ND)) *)
  rename x0 into l.
  rewrite <- H0 in H.
(* Goal: P v *)
  eapply iter_sepcon_in_true; auto.
Qed.

(*
Lemma pred_sepcon_prop_true_weak:
  forall (P Q: B -> Prop) (qdec: forall x, Decidable (Q x)) p,
    (forall x, Q x -> P x) -> pred_sepcon P p |-- pred_sepcon Q p * TT.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros. unfold pred_sepcon. normalize.
  apply (exp_right (filter (fun x => if (qdec x) then true else false) l)).
  rewrite <- prop_and, sepcon_andp_prop'.
  remember (filter (fun x0 : B => if qdec x0 then true else false) l) as l'.
  assert (forall x : B, In x l' <-> Q x). {
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
    intros. subst l'. rewrite filter_In. destruct (qdec x); split; intros; auto.
    - split; auto. apply H in H2. rewrite H0. auto.
    - destruct H2; inversion H3.
    - exfalso; auto.
  } assert (NoDup l') by (subst l'; apply NoDup_filter; auto). apply andp_right.
  - apply prop_right. split; auto.
  - apply iter_sepcon_incl_true; auto. intro. rewrite H0, H2. apply H.
Qed.
*)
Lemma pred_sepcon_False: forall p,
  pred_sepcon p (fun _ => False) = emp.
Proof.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  intros.
(* Goal: @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  unfold pred_sepcon.
(* Goal: @eq A (@exp A ND (list B) (fun l : list B => @andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x l) False)) (@prop A ND (@NoDup B l))) (@iter_sepcon A B ND SL p l))) (@emp A ND SL) *)
  apply pred_ext.
(* Goal: forall p : forall _ : B, A, @eq A (pred_sepcon p (fun _ : B => False)) (@emp A ND SL) *)
  + apply exp_left; intros.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
    normalize.
(* Goal: @derives A ND (@iter_sepcon A B ND SL p x) (@emp A ND SL) *)
    destruct x; [apply derives_refl |].
(* Goal: P v *)
    specialize (H b); simpl in H; tauto.
  + apply (exp_right nil).
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@andp A ND (@prop A ND (forall x : B, iff (@In B x (@nil B)) False)) (@prop A ND (@NoDup B (@nil B)))) (@iter_sepcon A B ND SL p (@nil B))) *)
    normalize.
(* Goal: @derives A ND (@emp A ND SL) (@andp A ND (@prop A ND (@NoDup B (@nil B))) (@iter_sepcon A B ND SL p (@nil B))) *)
    apply andp_right.
(* Goal: @NoDup B (@nil B) *)
    apply prop_right; constructor.
(* Goal: @derives A ND (@emp A ND SL) (@iter_sepcon A B ND SL p (@nil B)) *)
    apply derives_refl.
Qed.

End IterPredSepCon.

