Section CORRECTNESS_EXPR_EFF.
Variable sp: val.
Variable e: env.
Variable m: mem.
Definition Efftransl_expr_prop
(le: letenv) (a: expr) (v: val) : Prop :=
forall j tm cs f map pr ns nd rd rs dst
(*NEW:*)(PG: meminj_preserves_globals ge j) sp' (SP: sp_preserved j sp sp')  (MWF: map_wf map) (TE: tr_expr f.(fn_code) map pr a ns nd rd dst) (ME: match_env j map e le rs) (EXT: Mem.inject j m tm), exists rs', exists tm', effstep_star rtl_eff_sem tge EmptyEffect (RTL_State cs f sp' ns rs) tm (RTL_State cs f sp' nd rs') tm' /\ match_env j map (set_optvar dst v e) le rs' /\ val_inject j v rs'#rd /\ (forall r, In r pr -> rs'#r = rs#r) /\ Mem.inject j m tm' /\ tm=tm'.  Definition Efftransl_exprlist_prop (le: letenv) (al: exprlist) (vl: list val) : Prop := forall j tm cs f map pr ns nd rl rs (*NEW:*)(PG: meminj_preserves_globals ge j) sp' (SP: sp_preserved j sp sp')  (MWF: map_wf map) (TE: tr_exprlist f.(fn_code) map pr al ns nd rl) (ME: match_env j map e le rs) (EXT: Mem.inject j m tm), exists rs', exists tm', effstep_star rtl_eff_sem tge EmptyEffect (RTL_State cs f sp' ns rs) tm (RTL_State cs f sp' nd rs') tm' /\ match_env j map e le rs' /\ val_list_inject j vl rs'##rl /\ (forall r, In r pr -> rs'#r = rs#r) /\ Mem.inject j m tm' /\ tm=tm'.  Definition Efftransl_condexpr_prop (le: letenv) (a: condexpr) (v: bool) : Prop := forall j tm cs f map pr ns ntrue nfalse rs (*NEW:*)(PG: meminj_preserves_globals ge j) sp' (SP: sp_preserved j sp sp')  (MWF: map_wf map) (TE: tr_condition f.(fn_code) map pr a ns ntrue nfalse) (ME: match_env j map e le rs) (EXT: Mem.inject j m tm), exists rs', exists tm', effstep_plus rtl_eff_sem tge EmptyEffect (RTL_State cs f sp' ns rs) tm (RTL_State cs f sp' (if v then ntrue else nfalse) rs') tm' /\ match_env j map e le rs' /\ (forall r, In r pr -> rs'#r = rs#r) /\ Mem.inject j m tm' /\ tm=tm'.  (** The correctness of the translation is a huge induction over the Cminor evaluation derivation for the source program.  To keep the proof manageable, we put each case of the proof in a separate lemma.  There is one lemma for each Cminor evaluation rule. It takes as hypotheses the premises of the Cminor evaluation rule, plus the induction hypotheses, that is, the [transl_expr_prop], etc, corresponding to the evaluations of sub-expressions or sub-statements. *)
(*Proof. intros; red; intros. inv TE. exploit H0; eauto. intros [rs1 [tm1 [EX1 [ME1 [RR1 [RO1 EXT1]]]]]]. (*WAS: exploit external_call_mem_extends; eauto. intros [v' [tm2 [A [B [C [D E]]]]]].*)
exploit external_call_mem_inject; eauto.
intros [j' [v' [tm2 [A [B [C [D [E [F G]]]]]]]]].
exists (rs1#rd <- v'); exists tm2.
(* Exec *)
split. eapply effstep_star_trans. eexact EX1.
apply effstep_star_one. eapply rtl_effstep_exec_Ibuiltin; eauto.
eapply external_call_symbols_preserved; eauto. exact symbols_preserved. exact varinfo_preserved.
(* Match-env *)
split. eapply match_env_update_dest; try eassumption.
eapply val_inject_incr. eassumption. split; intros.  eexists. eauto with rtlg.
(* Result reg *)
split. intros. rewrite Regmap.gss. auto.
(* Other regs *)
split. intros. rewrite Regmap.gso. auto. intuition congruence.
(* Mem *)
auto.
Qed.
*)
(*LENB: Lemma should not be needed any more since external calls are handled by effsemantics interface now. We can probably eliminate external expressions from CminorSel.v, but that's a language definieiotn modification*)
(*Proof. intros; red; intros. inv TE. exploit H3; eauto. intros [rs1 [tm1 [EX1 [ME1 [RR1 [RO1 EXT1]]]]]]. exploit external_call_mem_extends; eauto. intros [v' [tm2 [A [B [C [D E]]]]]]. exploit function_ptr_translated; eauto. simpl. intros [tf [P Q]]. inv Q. exists (rs1#rd <- v'); exists tm2. (* Exec *)
split. eapply star_trans. eexact EX1.
eapply star_left. eapply exec_Icall; eauto.
simpl. rewrite symbols_preserved. rewrite H. eauto. auto.
eapply star_left. eapply exec_function_external.
eapply external_call_symbols_preserved; eauto. exact symbols_preserved. exact varinfo_preserved.
apply star_one. apply exec_return.
reflexivity. reflexivity. reflexivity.
(* Match-env *)
split. eauto with rtlg.
(* Result reg *)
split. rewrite Regmap.gss. auto.
(* Other regs *)
split. intros. rewrite Regmap.gso. auto. intuition congruence.
(* Mem *)
auto.
Qed.
*)
Proof
(eval_expr_ind3 ge sp e m
Efftransl_expr_prop
Efftransl_exprlist_prop
Efftransl_condexpr_prop
Efftransl_expr_Evar_correct
Efftransl_expr_Eop_correct
Efftransl_expr_Eload_correct
Efftransl_expr_Econdition_correct
Efftransl_expr_Elet_correct
Efftransl_expr_Eletvar_correct
Efftransl_expr_Ebuiltin_correct
Efftransl_expr_Eexternal_correct
Efftransl_exprlist_Enil_correct
Efftransl_exprlist_Econs_correct
Efftransl_condexpr_CEcond_correct
Efftransl_condexpr_CEcondition_correct
Efftransl_condexpr_CElet_correct).

Theorem Efftransl_exprlist_correct:
forall le a v,
eval_exprlist ge sp e m le a v ->
Efftransl_exprlist_prop le a v.