Local Open Scope logic.
Definition int_type_min_max (type_i type_hi: type): option (Z * Z) :=
match type_i, type_hi with
| Tint I32 s_i _, Tint i_hi s_hi _ =>
Some match s_i with
| Signed => (match i_hi, s_hi with
| I32, Unsigned => 0
| _, _ => Int.min_signed
end, Int.max_signed)
| Unsigned => (0, Int.max_unsigned)
end
| Tint I32 s_i _, Tlong s_hi _ =>
Some match s_i with
| Signed => match s_hi with
| Unsigned => (0, Int.max_signed)
| _ => (Int.min_signed, Int.max_signed)
end
| Unsigned => (0, Int.max_unsigned)
end
| _, _ => None
end.
Inductive range_init_hl (type_lo type_i type_hi: type): (Z -> Z -> Prop) -> Prop :=
| construct_range_init_hl:
forall int_min int_max,
is_int_type type_lo = true ->
int_type_min_max type_i type_hi = Some (int_min, int_max) ->
range_init_hl type_lo type_i type_hi (fun m n => int_min <= m <= n /\ n <= int_max).
(* Lemma range_init_hl_spec: forall (type_lo type_i type_hi: type) range, range_init_hl type_lo type_i type_hi range -> exists int_min_lo int_max_lo int_min_i int_max_i int_min_hi int_max_hi int_min int_max, is_int32_type type_lo = true /\ is_int32_type type_i = true /\ int_type_min_max type_lo = Some (int_min_lo, int_max_lo) /\ int_type_min_max type_i = Some (int_min_i, int_max_i) /\ int_type_min_max type_hi = Some (int_min_hi, int_max_hi) /\ int_min = Z.max (Z.max int_min_lo int_min_i) int_min_hi /\ int_max = Z.min int_max_i int_max_hi /\ forall m n, range m n -> m <= int_max_lo /\ int_min <= m <= n /\ int_min_hi <= n <= int_max. *)
Inductive range_init_h (type_i type_hi: type): Z -> (Z -> Prop) -> Prop :=
| construct_range_init_h:
forall int_min int_max,
int_type_min_max type_i type_hi = Some (int_min, int_max) ->
range_init_h type_i type_hi int_min (fun n =>
int_min <= n <= int_max).
Inductive Int_eqm_unsigned: int -> Z -> Prop :=
| Int_eqm_unsigned_repr: forall z, Int_eqm_unsigned (Int.repr z) z.
Inductive Int64_eqm_unsigned: int64 -> Z -> Prop :=
| Int64_eqm_unsigned_repr: forall z, Int64_eqm_unsigned (Int64.repr z) z.
Inductive Int6432_val: type -> val -> Z -> Prop :=
| Int_64_eqm_unsigned_repr: forall s i64 z,
Int64_eqm_unsigned i64 z ->
Int6432_val (Tlong s noattr) (Vlong i64) z
| Int_32_eqm_unsigned_repr: forall s i i32 z,
Int_eqm_unsigned i32 z ->
Int6432_val (Tint s i noattr) (Vint i32) z.
Inductive Sfor_inv_rec {cs: compspecs} (Delta: tycontext): ident -> Z -> Z -> expr -> Z -> (environ -> mpred) -> (environ -> mpred) -> (environ -> mpred) -> Prop :=
| Sfor_inv_rec_step': forall A _i i m hi n assert_callee inv0 inv1,
(forall x: A,
Sfor_inv_rec Delta _i i m hi n (assert_callee x) (inv0 x) (inv1 x)) ->
Sfor_inv_rec Delta _i i m hi n (exp assert_callee) (exp inv0) (exp inv1)
| Sfor_inv_rec_end: forall _i i m hi n' n P Q R T1 T2 GV (*tactic callee*),
local2ptree Q = (T1, T2, nil, GV) ->
T1 ! _i = None ->
msubst_eval_expr Delta T1 T2 GV hi = Some n' ->
Int6432_val (typeof hi) n' n ->
ENTAIL Delta, PROPx P (LOCALx Q (SEPx R)) |-- tc_expr Delta hi ->
Sfor_inv_rec Delta _i i m hi n
(PROPx P (LOCALx Q (SEPx R)))
(PROPx ((m <= i <= n) :: P) (LOCALx (temp _i (Vint (Int.repr i)) :: Q) (SEPx R)))
(PROPx P (LOCALx (temp _i (Vint (Int.repr i)) :: Q) (SEPx R))).

Lemma Sfor_inv_rec_step {cs: compspecs} (Delta: tycontext): forall A _i i m hi n assert_callee inv0 inv1,
(forall x: A, exists inv0' inv1',
Sfor_inv_rec Delta _i i m hi n (assert_callee x) inv0' inv1' /\
inv0 x = inv0' /\ inv1 x = inv1') ->
Sfor_inv_rec Delta _i i m hi n (exp assert_callee) (exp inv0) (exp inv1).