Opaque combine.

(* Specifications: *)
Lemma body_main : semax_body Vprog Gprog f_main main_spec.
(* Given the relations on histories, what can we actually conclude about the maps? *)
Lemma make_map_eq : forall h h', Forall2 (fun a b => value_of_hist (fst a) = value_of_hist (fst b) /\
value_of_hist (snd a) = value_of_hist (snd b)) h h' -> make_map h = make_map h'.
Lemma make_map_no_key : forall h k (Hout : Forall (fun x => make_int (value_of_hist (fst x)) <> k) h),
Forall (fun x => fst x <> k) (make_map h).
(* It would be nice if we could maintain the invariant that the map has no duplicates and is well-chained, and indeed, the algorithm should maintain these properties. However, the per-slot histories do not obviously present a way to prove this: if a new key has "mysteriously appeared" (i.e., been added by another thread), we don't have a good way of knowing that it's well-chained. *)
(* We can, however, allow for the possibility that there is garbage in the map, and consider the abstract map to be those elements that can be successfully looked up, rather than all pairs in the map. In practice, this *should* come down to the same thing, but how could we prove it? *)
Lemma set_item_trace_map : forall h k v i h' (Hwf : wf_hists h) (Hlenh : Zlength h = size)
(Htrace : set_item_trace h k v i h') (Hk : k <> 0) (Hrepk : repable_signed k) (Hrepv : repable_signed v),
wf_hists h' /\ let m' := make_map (upd_Znth i h' (Znth i h ([], []))) in
map_incl (make_map h) m' /\ set m' k v = Some (make_map h').
Lemma get_item_trace_map : forall h k v i h' (Hwf : wf_hists h) (Hlenh : Zlength h = size)
(Htrace : get_item_trace h k v i h') (Hk : k <> 0) (Hrepk : repable_signed k) (Hrepv : repable_signed v),
wf_hists h' /\ match get (make_map h') k with
| Some v' => v' = v /\ map_incl (upd_Znth i (make_map h) (k, v)) (make_map h')
| None => v = 0 /\ map_incl (make_map h) (make_map h') end.