Proof
(eval_condexpr_ind3 ge sp e m
Efftransl_expr_prop
Efftransl_exprlist_prop
Efftransl_condexpr_prop
Efftransl_expr_Evar_correct
Efftransl_expr_Eop_correct
Efftransl_expr_Eload_correct
Efftransl_expr_Econdition_correct
Efftransl_expr_Elet_correct
Efftransl_expr_Eletvar_correct
Efftransl_expr_Ebuiltin_correct
Efftransl_expr_Eexternal_correct
Efftransl_exprlist_Enil_correct
Efftransl_exprlist_Econs_correct
Efftransl_condexpr_CEcond_correct
Efftransl_condexpr_CEcondition_correct
Efftransl_condexpr_CElet_correct).
End CORRECTNESS_EXPR_EFF.
(** ** Measure over CminorSel states *)
Open Local Scope nat_scope.
Fixpoint size_stmt (s: stmt) : nat :=
match s with
| Sskip => 0
| Sseq s1 s2 => (size_stmt s1 + size_stmt s2 + 1)
| Sifthenelse c s1 s2 => (size_stmt s1 + size_stmt s2 + 1)
| Sloop s1 => (size_stmt s1 + 1)
| Sblock s1 => (size_stmt s1 + 1)
| Sexit n => 0
| Slabel lbl s1 => (size_stmt s1 + 1)
| _ => 1
end.
Fixpoint size_cont (k: cont) : nat :=
match k with
| Kseq s k1 => (size_stmt s + size_cont k1 + 1)
| Kblock k1 => (size_cont k1 + 1)
| _ => 0%nat
end.
Definition measure_state (S: CMinSel_core) :=
match S with
| CMinSel_State _ s k _ _ => (size_stmt s + size_cont k, size_stmt s)
| _                           => (0, 0)
end.
Definition lt_state (S1 S2: CMinSel_core) :=
lex_ord lt lt (measure_state S1) (measure_state S2).

(* Specifications: *)
Lemma lt_state_intro:
forall f1 s1 k1 sp1 e1 f2 s2 k2 sp2 e2,
size_stmt s1 + size_cont k1 < size_stmt s2 + size_cont k2
\/ (size_stmt s1 + size_cont k1 = size_stmt s2 + size_cont k2
/\ size_stmt s1 < size_stmt s2) ->
lt_state (CMinSel_State f1 s1 k1 sp1 e1)
(CMinSel_State f2 s2 k2 sp2 e2).