Fixpoint statement_ind (s: statement): P s :=
  match s as s0 return (P s0) with
  | Sskip => Hskip
  | Sassign e e0 => Hassign e e0
  | Sset i e => Hset i e
  | Scall o e l => Hcall o e l
  | Sbuiltin o e t l => Hbuiltin o e t l
  | Ssequence s0 s1 => Hsequence s0 (statement_ind s0) s1 (statement_ind s1)
  | Sifthenelse e s0 s1 => Hifthenelse e s0 (statement_ind s0) s1 (statement_ind s1)
  | Sloop s0 s1 => Hloop s0 (statement_ind s0) s1 (statement_ind s1)
  | Sbreak => Hbreak
  | Scontinue => Hcontinue
  | Sreturn o => Hreturn o
  | Sswitch e l => Hswitch e l (labeled_statements_ind l)
  | Slabel l s0 => Hlabel l s0 (statement_ind s0)
  | Sgoto l => Hgoto l
  end
with labeled_statements_ind (L: labeled_statements): all_suf_of_labeled_statements (fun L => P (seq_of_labeled_statement L)) L :=
  match L with
  | LSnil => Hskip
  | LScons _ s L' => conj (Hsequence _ (statement_ind s) _ (all_suf_self _ _ (labeled_statements_ind L'))) (labeled_statements_ind L')
  end.Ltac induction_stmt s :=
  revert dependent s;
  let s1 := fresh s "1" in
  let s2 := fresh s "2" in
  let IHs := fresh "IH" s in
  let IHs1 := fresh "IH" s1 in
  let IHs2 := fresh "IH" s2 in
  refine (statement_ind _ _ _ _ _ _ _ _ _ _ _ _ _ _ _);
  [
  | intros ?e ?e
  | intros ?i ?e
  | intros ?o ?e ?l
  | intros ?o ?e ?t ?l
  | intros s1 IHs1 s2 IHs2
  | intros ?e s1 IHs1 s2 IHs2
  | intros s1 IHs1 s2 IHs2
  |
  |
  | intros ?o
  | intros ?e ?l ?IH; specialize (all_suf_select_switch _ _ IH); clear IH; intro IH; cbv beta in IH
  | intros ?l s IHs
  | intros ?l ].Definition semax_body
       (V: varspecs) (G: funspecs) {C: compspecs} (f: function) (spec: ident * funspec): Prop :=
  match spec with (_, mk_funspec _ cc A P Q NEP NEQ) =>
    forall Espec ts x, (*exists Ann,*)
      @semax C Espec (func_tycontext f V G nil (*Ann*))
          (P ts x *  stackframe_of f)
          (Ssequence f.(fn_body) (Sreturn None))
          (frame_ret_assert (function_body_ret_assert (fn_return f) (Q ts x)) (stackframe_of f))
 end.Definition semax := @AuxDefs.semax.Definition semax_func := @AuxDefs.semax_func (@Def.semax_external).Definition semax_external := @Def.semax_external.Module DeepEmbeddedDefs := DerivedDefs (DeepEmbeddedDef).Module CSHL_Def := DeepEmbeddedDef.Definition semax_conseq := @AuxDefs.semax_conseq.Module CConseqFacts := GenCConseqFacts (DeepEmbeddedDef) (CConseq).Module Conseq := GenConseq (DeepEmbeddedDef) (CConseq).Module ConseqFacts := GenConseqFacts (DeepEmbeddedDef) (Conseq).

(* Specifications: *)
Lemma semax_seq_inv: forall {CS: compspecs} {Espec: OracleKind} Delta P R h t, @semax CS Espec Delta P (Ssequence h t) R -> exists Q, @semax CS Espec Delta P h (overridePost Q R) /\ @semax CS Espec Delta Q t R.
Lemma tc_fn_return_temp_guard_opt: forall ret retsig Delta, tc_fn_return Delta ret retsig -> temp_guard_opt Delta ret.
Lemma semax_Slabel_inv: forall {CS: compspecs} {Espec: OracleKind} Delta P R l c, @semax CS Espec Delta P (Slabel l c) R -> @semax CS Espec Delta P c R.