(** Semantic correctness proof for validation. *)

(* Specifications: *)
Lemma split_eq_prop:
forall v default n cases optact cases',
split_eq n cases = (optact, cases') ->
switch_target v default cases =
(if zeq v n
then match optact with Some act => act | None => default end
else switch_target v default cases').
Lemma split_lt_prop:
forall v default n cases lcases rcases,
split_lt n cases = (lcases, rcases) ->
switch_target v default cases =
(if zlt v n
then switch_target v default lcases
else switch_target v default rcases).
Lemma split_between_prop:
forall v default ofs sz cases inside outside,
split_between default ofs sz cases = (inside, outside) ->
switch_target v default cases =
(if zlt ((v - ofs) mod modulus) sz
then ZMap.get v inside
else switch_target v default outside).
Lemma validate_jumptable_correct_rec:
forall cases tbl base v,
validate_jumptable cases tbl base = true ->
0 <= v < list_length_z tbl ->
list_nth_z tbl v = Some(ZMap.get (base + v) cases).
Lemma validate_jumptable_correct:
forall cases tbl ofs v sz,
validate_jumptable cases tbl ofs = true ->
(v - ofs) mod modulus < sz ->
0 <= sz -> 0 <= ofs -> ofs + sz <= modulus ->
0 <= v < modulus ->
sz <= list_length_z tbl ->
list_nth_z tbl ((v - ofs) mod modulus) = Some(ZMap.get v cases).
Lemma validate_correct_rec:
forall default v,
0 <= v < modulus ->
forall t cases lo hi,
validate default cases t lo hi = true ->
lo <= v <= hi ->
comptree_match v t = Some (switch_target v default cases).
Lemma split_eq_prop:
forall v default n cases optact cases',
split_eq n cases = (optact, cases') ->
switch_target v default cases =
(if zeq v n
then match optact with Some act => act | None => default end
else switch_target v default cases').
Lemma split_lt_prop:
forall v default n cases lcases rcases,
split_lt n cases = (lcases, rcases) ->
switch_target v default cases =
(if zlt v n
then switch_target v default lcases
else switch_target v default rcases).
Lemma split_between_prop:
forall v default ofs sz cases inside outside,
split_between default ofs sz cases = (inside, outside) ->
switch_target v default cases =
(if zlt ((v - ofs) mod modulus) sz
then ZMap.get v inside
else switch_target v default outside).
Lemma validate_jumptable_correct_rec:
forall cases tbl base v,
validate_jumptable cases tbl base = true ->
0 <= v < list_length_z tbl ->
list_nth_z tbl v = Some(ZMap.get (base + v) cases).
Lemma validate_jumptable_correct:
forall cases tbl ofs v sz,
validate_jumptable cases tbl ofs = true ->
(v - ofs) mod modulus < sz ->
0 <= sz -> 0 <= ofs -> ofs + sz <= modulus ->
0 <= v < modulus ->
sz <= list_length_z tbl ->
list_nth_z tbl ((v - ofs) mod modulus) = Some(ZMap.get v cases).
Lemma validate_correct_rec:
forall default v,
0 <= v < modulus ->
forall t cases lo hi,
validate default cases t lo hi = true ->
lo <= v <= hi ->
comptree_match v t = Some (switch_target v default cases).