Instance CompSpecs : compspecs.Definition Vprog : varspecs.Instance LS: listspec _list _tail (fun _ _ => emp).Definition t_struct_list := Tstruct _list noattr.(* Specification of the function *)

Fixpoint merge l1 :=
  match l1 with
  | nil => (fun l2 => l2)
  | h1 :: t1 =>
      let fix merge_aux l2 :=
        match l2 with
        | nil => l1
        | h2 :: t2 =>
           if Int.cmp Cle h1 h2
           then h1 :: merge t1 l2
           else h2 :: merge_aux t2
        end
      in merge_aux
  end.Definition tlist := tptr t_struct_list.

(* Specifications: *)
Lemma merge_nil_r a : merge a nil = a.
Lemma merge_nil_l a : merge nil a = a.
Lemma body_merge: semax_body Vprog Gprog f_merge merge_spec.