Merge sort correctness proof