(**  Here begins an alternate proof of the "for" loop. Instead of using forward_for_simple_bound, we use the general-case loop tactic, forward_for.  To understand this verification, let's take the program,  int sumarray(int a[], int n) { int i,s,x; s=0; for (i=0; i<n; i++) { x = a[i]; s += x; } return s; }  and annotate with assertions:   int sumarray(int a[], int n) { int i,s,x; s=0; for (i=0; i<n; i++) { assert (sumarray_Inv(i)); x = a[i]; s += x; assert (sumarray_PostBody(i)); } return s; }  The assertions are defined in these definitions: *)
Definition sumarray_Inv a sh contents size i :=
PROP  (0 <= i <= size)
LOCAL (temp _a a;
temp _i (Vint (Int.repr i));
temp _n (Vint (Int.repr size));
temp _s (Vint (Int.repr (sum_Z (sublist 0 i contents)))))
SEP   (data_at sh (tarray tuint size) (map Vint (map Int.repr contents)) a).
Definition sumarray_PostBody a sh contents size i :=
PROP  (0 <= i < size)
LOCAL (temp _a a;
temp _i (Vint (Int.repr i));
temp _n (Vint (Int.repr size));
temp _s (Vint (Int.repr (sum_Z (sublist 0 (i+1) contents)))))
SEP   (data_at sh (tarray tuint size) (map Vint (map Int.repr contents)) a).
(* . . . and now you can see how these assertions are used in the proof, using the semax_loop rule. *)

(* Specifications: *)
Lemma body_sumarray_alt: semax_body Vprog Gprog f_sumarray sumarray_spec.