Local Open Scope logic.
Opaque Snuffle.Snuffle. Opaque prepare_data.
(*TODO: eliminate*)
Ltac canon_load_result ::= idtac.
Definition HTrue_inv1 l i ys xs : Prop :=
Zlength l = 16 /\ exists ints, l=map Vint ints /\
forall j, 0<=j<16 -> exists xj,
Znth j xs = Vint xj
/\ (j<i -> exists yj, Znth j ys = Vint yj /\
Znth j l = Vint (Int.add yj xj))
/\ (i<=j ->  Znth j l = Vint xj).
Definition htrue_loop1_statement:=
Sfor (Sset _i (Econst_int (Int.repr 0) tint))
(Ebinop Olt (Etempvar _i tint) (Econst_int (Int.repr 16) tint) tint)
(Ssequence
(Sset _t'17
(Ederef
(Ebinop Oadd (Evar _x (tarray tuint 16)) (Etempvar _i tint)
(tptr tuint)) tuint))
(Ssequence
(Sset _t'18
(Ederef
(Ebinop Oadd (Evar _y (tarray tuint 16)) (Etempvar _i tint)
(tptr tuint)) tuint))
(Sassign
(Ederef
(Ebinop Oadd (Evar _x (tarray tuint 16)) (Etempvar _i tint)
(tptr tuint)) tuint)
(Ebinop Oadd (Etempvar _t'17 tuint) (Etempvar _t'18 tuint)
tuint))))
(Sset _i
(Ebinop Oadd (Etempvar _i tint) (Econst_int (Int.repr 1) tint) tint)).

Lemma HTrue_loop1 Espec (FR:mpred) t y x w nonce out c k h (xs ys: list int):
@semax CompSpecs Espec
(func_tycontext f_core SalsaVarSpecs SalsaFunSpecs nil)
(PROP  ()
LOCAL  (temp _i (Vint (Int.repr 20)); lvar _t (tarray tuint 4) t;
lvar _y (tarray tuint 16) y; lvar _x (tarray tuint 16) x;
lvar _w (tarray tuint 16) w; temp _in nonce; temp _out out; temp _c c;
temp _k k; temp _h (Vint (Int.repr h)))
SEP  (FR; data_at Tsh (tarray tuint 16) (map Vint ys) y;
data_at Tsh (tarray tuint 16) (map Vint xs) x))
htrue_loop1_statement
(normal_ret_assert
(PROP  ()
LOCAL  (temp _i (Vint (Int.repr 16)); lvar _t (tarray tuint 4) t;
lvar _y (tarray tuint 16) y; lvar _x (tarray tuint 16) x;
lvar _w (tarray tuint 16) w; temp _in nonce; temp _out out;
temp _c c; temp _k k; temp _h (Vint (Int.repr h)))
SEP (FR; data_at Tsh (tarray tuint 16) (map Vint ys) y;
EX  l : list val, !!HTrue_inv1 l 16 (map Vint ys) (map Vint xs) &&
data_at Tsh (tarray tuint 16) l x))).