Instance CompSpecs : compspecs.Definition Vprog : varspecs.(* TODO 
Initially I imagined the constants would be defined as 
parameters (with suitable assumptions, e.g., BIGBLOCK
needs to be big enough for at least one chunk of the largest size,
because fill_bin unconditionally initializes the last chunk. 
*)
Definition WORD: Z := 4.(* sizeof(size_t) 4 for 32bit Clight; 8 in clang *)
Definition ALIGN: Z := 2.Definition BINS: Z := 8.Parameter BIGBLOCK: Z.Parameter BIGBLOCK_def: 
  Int.repr BIGBLOCK = Int.mul (Int.shl (Int.repr 2) (Int.repr 16)) (Int.repr WORD).Definition bin2sizeZ := fun b: Z => (Z.mul ((Z.mul (b+1) ALIGN)-1) WORD).Definition size2binZ : Z -> Z := fun s => 
   if zlt (bin2sizeZ(BINS-1)) s then -1 
   else (s+(Z.mul WORD (ALIGN-1))-1) / (Z.mul WORD ALIGN).Example bin2sizeBINS: bin2sizeZ (BINS-1) = 60.

(* Specifications: *)
Lemma claim1: forall s, 0 <= s <= bin2sizeZ(BINS-1) -> s <= bin2sizeZ(size2binZ s).
Lemma claim2: forall s, 0 <= s <= bin2sizeZ(BINS-1) -> 0 <= size2binZ s < BINS.
Lemma claim3: forall s, 0 <= s <= bin2sizeZ(BINS-1) -> size2binZ(bin2sizeZ(size2binZ(s))) = size2binZ(s).
Lemma claim4: forall b, 0 <= b < BINS -> Z.rem (bin2sizeZ b + WORD) (Z.mul WORD ALIGN) = 0.
Lemma claim5: forall b, 0 <= b < BINS -> size2binZ(bin2sizeZ(b)) = b.