(* The following four lemmas is not now used. but after deep embedded hoare logic (SL_as_Logic) is ported, the frame does not need to be quantified in the semantic definition of semax. Then, these two lemmas can replace the other two afterwards. *)

(* Specifications: *)
Lemma assert_safe_bupd':
forall {Espec: OracleKind} gx vx tx rho (P: environ -> pred rmap) Delta f k,
let PP1 := !! guard_environ Delta f rho in
let PP2 := funassert Delta rho in
PP1 && (P rho) && PP2 >=>
assert_safe Espec gx vx tx k rho =
PP1 && (bupd (P rho)) && PP2 >=>
assert_safe Espec gx vx tx k rho.
Lemma _guard_bupd':
forall {Espec: OracleKind} ge Delta (P: environ -> pred rmap) f k,
_guard Espec ge Delta P f k = _guard Espec ge Delta (fun rho => bupd (P rho)) f k.
Lemma guard_bupd':
forall {Espec: OracleKind} ge Delta (P: environ -> pred rmap) k,
guard Espec ge Delta P k = guard Espec ge Delta (fun rho => bupd (P rho)) k.
Lemma rguard_bupd':
forall {Espec: OracleKind} ge Delta (P: ret_assert) k,
rguard Espec ge Delta P k = rguard Espec ge Delta (bupd_ret_assert P) k.
Lemma assert_safe_bupd:
forall {Espec: OracleKind} gx vx tx rho (F P: environ -> pred rmap) Delta f k,
let PP1 := !! guard_environ Delta f rho in
let PP2 := funassert Delta rho in
PP1 && (F rho * P rho) && PP2 >=>
assert_safe Espec gx vx tx k rho =
PP1 && (F rho * bupd (P rho)) && PP2 >=>
assert_safe Espec gx vx tx k rho.
Lemma _guard_bupd:
forall {Espec: OracleKind} ge Delta (F P: environ -> pred rmap) f k,
_guard Espec ge Delta (fun rho => F rho * P rho) f k = _guard Espec ge Delta (fun rho => F rho * bupd (P rho)) f k.
Lemma guard_bupd:
forall {Espec: OracleKind} ge Delta (F P: environ -> pred rmap) k,
guard Espec ge Delta (fun rho => F rho * P rho) k = guard Espec ge Delta (fun rho => F rho * bupd (P rho)) k.
Lemma rguard_bupd:
forall {Espec: OracleKind} ge Delta F (P: ret_assert) k,
rguard Espec ge Delta (frame_ret_assert P F) k = rguard Espec ge Delta (frame_ret_assert (bupd_ret_assert P) F) k.