(*Require Import Recdef.*)
Local Open Scope logic.
Definition Y_content (y: list val)
(i:Z) (l X:list val) : Prop :=
exists l1 l2 yy xx, l = l1 ++ l2 /\
l1++yy=y /\ xx++l2=X /\
Zlength l1=i /\ Zlength xx =i.

(* Specifications: *)
Lemma f_core_loop2: forall (Espec : OracleKind) FR c k h nonce out w x y t
(data : SixteenByte * SixteenByte * (SixteenByte * SixteenByte))
(Delta := func_tycontext f_core SalsaVarSpecs SalsaFunSpecs nil)
(xInit : list val)
(XInit : xInit = upd_upto data 4 (list_repeat 16 Vundef)),
@semax CompSpecs Espec
Delta
(PROP  ()
LOCAL  (temp _i (Vint (Int.repr 4)); lvar _t (tarray tuint 4) t;
lvar _y (tarray tuint 16) y; lvar _x (tarray tuint 16) x;
lvar _w (tarray tuint 16) w; temp _in nonce; temp _out out; temp _c c;
temp _k k; temp _h (Vint (Int.repr h)))
SEP  (FR; data_at_ Tsh (tarray tuint 16) y;
data_at Tsh (tarray tuint 16) xInit x))(Sfor (Sset _i (Econst_int (Int.repr 0) tint))
(Ebinop Olt (Etempvar _i tint) (Econst_int (Int.repr 16) tint) tint)
(Ssequence
(Sset _t'34
(Ederef
(Ebinop Oadd (Evar _x (tarray tuint 16)) (Etempvar _i tint)
(tptr tuint)) tuint))
(Sassign
(Ederef
(Ebinop Oadd (Evar _y (tarray tuint 16)) (Etempvar _i tint)
(tptr tuint)) tuint) (Etempvar _t'34 tuint)))
(Sset _i
(Ebinop Oadd (Etempvar _i tint) (Econst_int (Int.repr 1) tint) tint)))
(normal_ret_assert
(PROP  ()
LOCAL  (temp _i (Vint (Int.repr 16)); lvar _t (tarray tuint 4) t;
lvar _y (tarray tuint 16) y; lvar _x (tarray tuint 16) x;
lvar _w (tarray tuint 16) w; temp _in nonce; temp _out out; temp _c c;
temp _k k; temp _h (Vint (Int.repr h)))
SEP  (FR; data_at Tsh (tarray tuint 16) xInit x;
EX  l : list val,
!!Y_content xInit 16 l
[Vundef; Vundef; Vundef; Vundef; Vundef; Vundef; Vundef; Vundef;
Vundef; Vundef; Vundef; Vundef; Vundef; Vundef; Vundef; Vundef] &&
data_at Tsh (tarray tuint 16) l y))).