Prove correctness of tree compiler