(************************************************************************)
(*         *      The Rocq Prover / The Rocq Development Team           *)
(*  v      *         Copyright INRIA, CNRS and contributors             *)
(* <O___,, * (see version control and CREDITS file for authors & dates) *)
(*   \VV/  **************************************************************)
(*    //   *    This file is distributed under the terms of the         *)
(*         *     GNU Lesser General Public License Version 2.1          *)
(*         *     (see LICENSE file for the text of the license)         *)
(************************************************************************)
(* Finite map library.  *)
(** * FMapAVL *)
(** This module implements maps using AVL trees. It follows the implementation from Ocaml's standard library.  See the comments at the beginning of FSetAVL for more details. *)
Set Implicit Arguments.
Unset Strict Implicit.
(** Notations and helper lemma about pairs *)
Declare Scope pair_scope.
Notation "s #1" := (fst s) (at level 9, format "s '#1'") : pair_scope.
Notation "s #2" := (snd s) (at level 9, format "s '#2'") : pair_scope.
(** * The Raw functor  Functor of pure functions + separate proofs of invariant preservation *)
Module Raw (Import I:Int)(X: OrderedType).
Local Open Scope pair_scope.
Local Open Scope lazy_bool_scope.
Local Open Scope Int_scope.
Local Notation int := I.t.
Definition key := X.t.
#[global]
Hint Transparent key : core.
(** * Trees *)
(** * Trees  The fifth field of [Node] is the height of the tree *)
#[universes(template)]
Inductive tree {elt : Type} :=
| Leaf : tree
| Node : tree -> key -> elt -> tree -> int -> tree.
Arguments tree : clear implicits.
Section Elt.
Variable elt : Type.
Notation t := (tree elt).
Implicit Types m : t.
(** * Basic functions on trees: height and cardinal *)
Definition height (m : t) : int :=
match m with
| Leaf => 0
| Node _ _ _ _ h => h
end.
Fixpoint cardinal (m : t) : nat :=
match m with
| Leaf => 0%nat
| Node l _ _ r _ => S (cardinal l + cardinal r)
end.
(** * Empty Map *)
Definition empty : t := Leaf.
(** * Emptyness test *)
Definition is_empty m := match m with Leaf => true | _ => false end.
(** * Membership *)
(** The [mem] function is deciding membership. It exploits the [bst] property to achieve logarithmic complexity. *)
Fixpoint mem x m : bool :=
match m with
|  Leaf => false
|  Node l y _ r _ => match X.compare x y with
| LT _ => mem x l
| EQ _ => true
| GT _ => mem x r
end
end.
Fixpoint find x m : option elt :=
match m with
|  Leaf => None
|  Node l y d r _ => match X.compare x y with
| LT _ => find x l
| EQ _ => Some d
| GT _ => find x r
end
end.
(** * Helper functions *)
(** [create l x r] creates a node, assuming [l] and [r] to be balanced and [|height l - height r| <= 2]. *)
Definition create l x e r :=
Node l x e r (max (height l) (height r) + 1).
(** [bal l x e r] acts as [create], but performs one step of rebalancing if necessary, i.e. assumes [|height l - height r| <= 3]. *)
Definition assert_false := create.
Definition bal l x d r :=
let hl := height l in
let hr := height r in
if gt_le_dec hl (hr+2) then
match l with
| Leaf => assert_false l x d r
| Node ll lx ld lr _ =>
if ge_lt_dec (height ll) (height lr) then
create ll lx ld (create lr x d r)
else
match lr with
| Leaf => assert_false l x d r
| Node lrl lrx lrd lrr _ =>
create (create ll lx ld lrl) lrx lrd (create lrr x d r)
end
end
else
if gt_le_dec hr (hl+2) then
match r with
| Leaf => assert_false l x d r
| Node rl rx rd rr _ =>
if ge_lt_dec (height rr) (height rl) then
create (create l x d rl) rx rd rr
else
match rl with
| Leaf => assert_false l x d r
| Node rll rlx rld rlr _ =>
create (create l x d rll) rlx rld (create rlr rx rd rr)
end
end
else
create l x d r.
(** * Insertion *)
Fixpoint add x d m :=
match m with
| Leaf => Node Leaf x d Leaf 1
| Node l y d' r h =>
match X.compare x y with
| LT _ => bal (add x d l) y d' r
| EQ _ => Node l y d r h
| GT _ => bal l y d' (add x d r)
end
end.
(** * Extraction of minimum binding  Morally, [remove_min] is to be applied to a non-empty tree [t = Node l x e r h]. Since we can't deal here with [assert false] for [t=Leaf], we pre-unpack [t] (and forget about [h]). *)
Fixpoint remove_min l x d r : t*(key*elt) :=
match l with
| Leaf => (r,(x,d))
| Node ll lx ld lr lh =>
let (l',m) := remove_min ll lx ld lr in
(bal l' x d r, m)
end.
(** * Merging two trees  [merge t1 t2] builds the union of [t1] and [t2] assuming all elements of [t1] to be smaller than all elements of [t2], and [|height t1 - height t2| <= 2]. *)
Definition merge s1 s2 :=  match s1,s2 with
| Leaf, _ => s2
| _, Leaf => s1
| _, Node l2 x2 d2 r2 h2 =>
match remove_min l2 x2 d2 r2 with
(s2',(x,d)) => bal s1 x d s2'
end
end.
(** * Deletion *)
Fixpoint remove x m := match m with
| Leaf => Leaf
| Node l y d r h =>
match X.compare x y with
| LT _ => bal (remove x l) y d r
| EQ _ => merge l r
| GT _ => bal l y d (remove x r)
end
end.
(** * join  Same as [bal] but does not assume anything regarding heights of [l] and [r]. *)
Fixpoint join l : key -> elt -> t -> t :=
match l with
| Leaf => add
| Node ll lx ld lr lh => fun x d =>
fix join_aux (r:t) : t := match r with
| Leaf =>  add x d l
| Node rl rx rd rr rh =>
if gt_le_dec lh (rh+2) then bal ll lx ld (join lr x d r)
else if gt_le_dec rh (lh+2) then bal (join_aux rl) rx rd rr
else create l x d r
end
end.
(** * Splitting  [split x m] returns a triple [(l, o, r)] where - [l] is the set of elements of [m] that are [< x] - [r] is the set of elements of [m] that are [> x] - [o] is the result of [find x m]. *)
Record triple := mktriple { t_left:t; t_opt:option elt; t_right:t }.
Notation "<< l , b , r >>" := (mktriple l b r) (at level 9).
Fixpoint split x m : triple := match m with
| Leaf => << Leaf, None, Leaf >>
| Node l y d r h =>
match X.compare x y with
| LT _ => let (ll,o,rl) := split x l in << ll, o, join rl y d r >>
| EQ _ => << l, Some d, r >>
| GT _ => let (rl,o,rr) := split x r in << join l y d rl, o, rr >>
end
end.
(** * Concatenation  Same as [merge] but does not assume anything about heights. *)
Definition concat m1 m2 :=
match m1, m2 with
| Leaf, _ => m2
| _ , Leaf => m1
| _, Node l2 x2 d2 r2 _ =>
let (m2',xd) := remove_min l2 x2 d2 r2 in
join m1 xd#1 xd#2 m2'
end.
(** * Elements *)
(** [elements_tree_aux acc t] catenates the elements of [t] in infix order to the list [acc] *)
Fixpoint elements_aux (acc : list (key*elt)) m : list (key*elt) :=
match m with
| Leaf => acc
| Node l x d r _ => elements_aux ((x,d) :: elements_aux acc r) l
end.
(** then [elements] is an instantiation with an empty [acc] *)
Definition elements := elements_aux nil.
(** * Fold *)
Fixpoint fold (A : Type) (f : key -> elt -> A -> A) (m : t) : A -> A :=
fun a => match m with
| Leaf => a
| Node l x d r _ => fold f r (f x d (fold f l a))
end.
(** * Comparison *)
Variable cmp : elt->elt->bool.
(** ** Enumeration of the elements of a tree *)
Inductive enumeration :=
| End : enumeration
| More : key -> elt -> t -> enumeration -> enumeration.
(** [cons m e] adds the elements of tree [m] on the head of enumeration [e]. *)
Fixpoint cons m e : enumeration :=
match m with
| Leaf => e
| Node l x d r h => cons l (More x d r e)
end.
(** One step of comparison of elements *)
Definition equal_more x1 d1 (cont:enumeration->bool) e2 :=
match e2 with
| End => false
| More x2 d2 r2 e2 =>
match X.compare x1 x2 with
| EQ _ => cmp d1 d2 &&& cont (cons r2 e2)
| _ => false
end
end.
(** Comparison of left tree, middle element, then right tree *)
Fixpoint equal_cont m1 (cont:enumeration->bool) e2 :=
match m1 with
| Leaf => cont e2
| Node l1 x1 d1 r1 _ =>
equal_cont l1 (equal_more x1 d1 (equal_cont r1 cont)) e2
end.
(** Initial continuation *)
Definition equal_end e2 := match e2 with End => true | _ => false end.
(** The complete comparison *)
Definition equal m1 m2 := equal_cont m1 equal_end (cons m2 End).
End Elt.
Notation t := tree.
Arguments Leaf : clear implicits.
Arguments Node [elt].
Notation "<< l , b , r >>" := (mktriple l b r) (at level 9).
Notation "t #l" := (t_left t) (at level 9, format "t '#l'").
Notation "t #o" := (t_opt t) (at level 9, format "t '#o'").
Notation "t #r" := (t_right t) (at level 9, format "t '#r'").
(** * Map *)
Fixpoint map (elt elt' : Type)(f : elt -> elt')(m : t elt) : t elt' :=
match m with
| Leaf _   => Leaf _
| Node l x d r h => Node (map f l) x (f d) (map f r) h
end.
(* * Mapi *)
Fixpoint mapi (elt elt' : Type)(f : key -> elt -> elt')(m : t elt) : t elt' :=
match m with
| Leaf _ => Leaf _
| Node l x d r h => Node (mapi f l) x (f x d) (mapi f r) h
end.
(** * Map with removal *)
Fixpoint map_option (elt elt' : Type)(f : key -> elt -> option elt')(m : t elt)
: t elt' :=
match m with
| Leaf _ => Leaf _
| Node l x d r h =>
match f x d with
| Some d' => join (map_option f l) x d' (map_option f r)
| None => concat (map_option f l) (map_option f r)
end
end.
(** * Optimized map2  Suggestion by B. Gregoire: a [map2] function with specialized arguments that allows bypassing some tree traversal. Instead of one [f0] of type [key -> option elt -> option elt' -> option elt''], we ask here for: - [f] which is a specialisation of [f0] when first option isn't [None] - [mapl] treats a [tree elt] with [f0] when second option is [None] - [mapr] treats a [tree elt'] with [f0] when first option is [None]  The idea is that [mapl] and [mapr] can be instantaneous (e.g. the identity or some constant function). *)
Section Map2_opt.
Variable elt elt' elt'' : Type.
Variable f : key -> elt -> option elt' -> option elt''.
Variable mapl : t elt -> t elt''.
Variable mapr : t elt' -> t elt''.
Fixpoint map2_opt m1 m2 :=
match m1, m2 with
| Leaf _, _ => mapr m2
| _, Leaf _ => mapl m1
| Node l1 x1 d1 r1 h1, _ =>
let (l2',o2,r2') := split x1 m2 in
match f x1 d1 o2 with
| Some e => join (map2_opt l1 l2') x1 e (map2_opt r1 r2')
| None => concat (map2_opt l1 l2') (map2_opt r1 r2')
end
end.
End Map2_opt.
(** * Map2  The [map2] function of the Map interface can be implemented via [map2_opt] and [map_option]. *)
Section Map2.
Variable elt elt' elt'' : Type.
Variable f : option elt -> option elt' -> option elt''.
Definition map2 : t elt -> t elt' -> t elt'' :=
map2_opt
(fun _ d o => f (Some d) o)
(map_option (fun _ d => f (Some d) None))
(map_option (fun _ d' => f None (Some d'))).
End Map2.
(** * Invariants *)
Section Invariants.
Variable elt : Type.
(** ** Occurrence in a tree *)
Inductive MapsTo (x : key)(e : elt) : t elt -> Prop :=
| MapsRoot : forall l r h y,
X.eq x y -> MapsTo x e (Node l y e r h)
| MapsLeft : forall l r h y e',
MapsTo x e l -> MapsTo x e (Node l y e' r h)
| MapsRight : forall l r h y e',
MapsTo x e r -> MapsTo x e (Node l y e' r h).
Inductive In (x : key) : t elt -> Prop :=
| InRoot : forall l r h y e,
X.eq x y -> In x (Node l y e r h)
| InLeft : forall l r h y e',
In x l -> In x (Node l y e' r h)
| InRight : forall l r h y e',
In x r -> In x (Node l y e' r h).
Definition In0 k m := exists e:elt, MapsTo k e m.
(** ** Binary search trees *)
(** [lt_tree x s]: all elements in [s] are smaller than [x] (resp. greater for [gt_tree]) *)
Definition lt_tree x m := forall y, In y m -> X.lt y x.
Definition gt_tree x m := forall y, In y m -> X.lt x y.
(** [bst t] : [t] is a binary search tree *)
Inductive bst : t elt -> Prop :=
| BSLeaf : bst (Leaf _)
| BSNode : forall x e l r h, bst l -> bst r ->
lt_tree x l -> gt_tree x r -> bst (Node l x e r h).
End Invariants.
(** * Correctness proofs, isolated in a sub-module *)
Module Proofs.
Module MX := OrderedTypeFacts X.
Module PX := KeyOrderedType X.
Module L := FMapList.Raw X.
#[local] Ltac caseq :=
match goal with [ |- context [match ?t with _ => _ end] ] =>
let cmp := fresh in
let H := fresh in
remember t as cmp eqn:H; symmetry in H; destruct cmp
end.

(* Specifications: *)
Lemma mem_ind [elt : Type] [x : X.t] [P : t elt -> bool -> Prop] :
(forall m : t elt, m = Leaf elt -> P (Leaf elt) false) ->
(forall (m l : t elt) (y : key) (_x : elt) (r : t elt) (_x0 : int),
m = Node l y _x r _x0 ->
forall _x1 : X.lt x y,
X.compare x y = LT _x1 -> P l (mem x l) -> P (Node l y _x r _x0) (mem x l)) ->
(forall (m l : t elt) (y : key) (_x : elt) (r : t elt) (_x0 : int),
m = Node l y _x r _x0 ->
forall _x1 : X.eq x y, X.compare x y = EQ _x1 -> P (Node l y _x r _x0) true) ->
(forall (m l : t elt) (y : key) (_x : elt) (r : t elt) (_x0 : int),
m = Node l y _x r _x0 ->
forall _x1 : X.lt y x,
X.compare x y = GT _x1 -> P r (mem x r) -> P (Node l y _x r _x0) (mem x r)) ->
forall m : t elt, P m (mem x m).
Lemma find_ind [elt : Type] [x : X.t] [P : t elt -> option elt -> Prop] :
(forall m : t elt, m = Leaf elt -> P (Leaf elt) None) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.lt x y,
X.compare x y = LT _x0 -> P l (find x l) -> P (Node l y d r _x) (find x l)) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.eq x y, X.compare x y = EQ _x0 -> P (Node l y d r _x) (Some d)) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.lt y x,
X.compare x y = GT _x0 -> P r (find x r) -> P (Node l y d r _x) (find x r)) ->
forall m : t elt, P m (find x m).
Lemma bal_ind [elt : Type] [P : t elt -> key -> elt -> t elt -> t elt -> Prop] :
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl > hr + 2,
gt_le_dec hl (hr + 2) = left _x -> l = Leaf elt -> P (Leaf elt) x d r (assert_false l x d r)) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl > hr + 2,
gt_le_dec hl (hr + 2) = left _x ->
forall (ll : t elt) (lx : key) (ld : elt) (lr : t elt) (_x0 : int),
l = Node ll lx ld lr _x0 ->
forall _x1 : height ll >= height lr,
ge_lt_dec (height ll) (height lr) = left _x1 ->
P (Node ll lx ld lr _x0) x d r (create ll lx ld (create lr x d r))) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl > hr + 2,
gt_le_dec hl (hr + 2) = left _x ->
forall (ll : t elt) (lx : key) (ld : elt) (lr : t elt) (_x0 : int),
l = Node ll lx ld lr _x0 ->
forall _x1 : height ll < height lr,
ge_lt_dec (height ll) (height lr) = right _x1 ->
lr = Leaf elt -> P (Node ll lx ld (Leaf elt) _x0) x d r (assert_false l x d r)) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl > hr + 2,
gt_le_dec hl (hr + 2) = left _x ->
forall (ll : t elt) (lx : key) (ld : elt) (lr : t elt) (_x0 : int),
l = Node ll lx ld lr _x0 ->
forall _x1 : height ll < height lr,
ge_lt_dec (height ll) (height lr) = right _x1 ->
forall (lrl : t elt) (lrx : key) (lrd : elt) (lrr : t elt) (_x2 : int),
lr = Node lrl lrx lrd lrr _x2 ->
P (Node ll lx ld (Node lrl lrx lrd lrr _x2) _x0) x d r
(create (create ll lx ld lrl) lrx lrd (create lrr x d r))) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl <= hr + 2,
gt_le_dec hl (hr + 2) = right _x ->
forall _x0 : hr > hl + 2,
gt_le_dec hr (hl + 2) = left _x0 -> r = Leaf elt -> P l x d (Leaf elt) (assert_false l x d r)) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl <= hr + 2,
gt_le_dec hl (hr + 2) = right _x ->
forall _x0 : hr > hl + 2,
gt_le_dec hr (hl + 2) = left _x0 ->
forall (rl : t elt) (rx : key) (rd : elt) (rr : t elt) (_x1 : int),
r = Node rl rx rd rr _x1 ->
forall _x2 : height rr >= height rl,
ge_lt_dec (height rr) (height rl) = left _x2 ->
P l x d (Node rl rx rd rr _x1) (create (create l x d rl) rx rd rr)) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl <= hr + 2,
gt_le_dec hl (hr + 2) = right _x ->
forall _x0 : hr > hl + 2,
gt_le_dec hr (hl + 2) = left _x0 ->
forall (rl : t elt) (rx : key) (rd : elt) (rr : t elt) (_x1 : int),
r = Node rl rx rd rr _x1 ->
forall _x2 : height rr < height rl,
ge_lt_dec (height rr) (height rl) = right _x2 ->
rl = Leaf elt -> P l x d (Node (Leaf elt) rx rd rr _x1) (assert_false l x d r)) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl <= hr + 2,
gt_le_dec hl (hr + 2) = right _x ->
forall _x0 : hr > hl + 2,
gt_le_dec hr (hl + 2) = left _x0 ->
forall (rl : t elt) (rx : key) (rd : elt) (rr : t elt) (_x1 : int),
r = Node rl rx rd rr _x1 ->
forall _x2 : height rr < height rl,
ge_lt_dec (height rr) (height rl) = right _x2 ->
forall (rll : t elt) (rlx : key) (rld : elt) (rlr : t elt) (_x3 : int),
rl = Node rll rlx rld rlr _x3 ->
P l x d (Node (Node rll rlx rld rlr _x3) rx rd rr _x1)
(create (create l x d rll) rlx rld (create rlr rx rd rr))) ->
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
let hl := height l in
let hr := height r in
forall _x : hl <= hr + 2,
gt_le_dec hl (hr + 2) = right _x ->
forall _x0 : hr <= hl + 2, gt_le_dec hr (hl + 2) = right _x0 -> P l x d r (create l x d r)) ->
forall (l : t elt) (x : key) (d : elt) (r : t elt), P l x d r (bal l x d r).
Lemma add_ind [elt : Type] [x : key] [d : elt] [P : t elt -> t elt -> Prop] :
(forall m : t elt, m = Leaf elt -> P (Leaf elt) (Node (Leaf elt) x d (Leaf elt) 1)) ->
(forall (m l : t elt) (y : key) (d' : elt) (r : t elt) (h : int),
m = Node l y d' r h ->
forall _x : X.lt x y,
X.compare x y = LT _x -> P l (add x d l) -> P (Node l y d' r h) (bal (add x d l) y d' r)) ->
(forall (m l : t elt) (y : key) (d' : elt) (r : t elt) (h : int),
m = Node l y d' r h ->
forall _x : X.eq x y, X.compare x y = EQ _x -> P (Node l y d' r h) (Node l y d r h)) ->
(forall (m l : t elt) (y : key) (d' : elt) (r : t elt) (h : int),
m = Node l y d' r h ->
forall _x : X.lt y x,
X.compare x y = GT _x -> P r (add x d r) -> P (Node l y d' r h) (bal l y d' (add x d r))) ->
forall m : t elt, P m (add x d m).
Lemma remove_min_ind [elt : Type] [P : t elt -> key -> elt -> t elt -> t elt * (key * elt) -> Prop] :
(forall (l : t elt) (x : key) (d : elt) (r : t elt),
l = Leaf elt -> P (Leaf elt) x d r (r, (x, d))) ->
(forall (l : t elt) (x : key) (d : elt) (r ll : t elt) (lx : key)
(ld : elt) (lr : t elt) (_x : int),
l = Node ll lx ld lr _x ->
P ll lx ld lr (remove_min ll lx ld lr) ->
forall (l' : t elt) (m : key * elt),
remove_min ll lx ld lr = (l', m) -> P (Node ll lx ld lr _x) x d r (bal l' x d r, m)) ->
forall (l : t elt) (x : key) (d : elt) (r : t elt), P l x d r (remove_min l x d r).
Lemma merge_ind [elt : Type] [P : t elt -> t elt -> t elt -> Prop] :
(forall s1 s2 : t elt, s1 = Leaf elt -> P (Leaf elt) s2 s2) ->
(forall (s1 s2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int),
s1 = Node _x _x0 _x1 _x2 _x3 -> s2 = Leaf elt -> P (Node _x _x0 _x1 _x2 _x3) (Leaf elt) s1) ->
(forall (s1 s2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int),
s1 = Node _x _x0 _x1 _x2 _x3 ->
forall (l2 : t elt) (x2 : key) (d2 : elt) (r2 : t elt) (_x4 : int),
s2 = Node l2 x2 d2 r2 _x4 ->
forall (s2' : t elt) (p : key * elt),
remove_min l2 x2 d2 r2 = (s2', p) ->
forall (x : key) (d : elt),
p = (x, d) -> P (Node _x _x0 _x1 _x2 _x3) (Node l2 x2 d2 r2 _x4) (bal s1 x d s2')) ->
forall s1 s2 : t elt, P s1 s2 (merge s1 s2).
Lemma remove_ind [elt : Type] [x : X.t] [P : t elt -> t elt -> Prop] :
(forall m : t elt, m = Leaf elt -> P (Leaf elt) (Leaf elt)) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.lt x y,
X.compare x y = LT _x0 -> P l (remove x l) -> P (Node l y d r _x) (bal (remove x l) y d r)) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.eq x y, X.compare x y = EQ _x0 -> P (Node l y d r _x) (merge l r)) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.lt y x,
X.compare x y = GT _x0 -> P r (remove x r) -> P (Node l y d r _x) (bal l y d (remove x r))) ->
forall m : t elt, P m (remove x m).
Lemma concat_ind [elt : Type] [P : t elt -> t elt -> t elt -> Prop] :
(forall m1 m2 : t elt, m1 = Leaf elt -> P (Leaf elt) m2 m2) ->
(forall (m1 m2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int),
m1 = Node _x _x0 _x1 _x2 _x3 -> m2 = Leaf elt -> P (Node _x _x0 _x1 _x2 _x3) (Leaf elt) m1) ->
(forall (m1 m2 _x : t elt) (_x0 : key) (_x1 : elt) (_x2 : t elt) (_x3 : int),
m1 = Node _x _x0 _x1 _x2 _x3 ->
forall (l2 : t elt) (x2 : key) (d2 : elt) (r2 : t elt) (_x4 : int),
m2 = Node l2 x2 d2 r2 _x4 ->
forall (m2' : t elt) (xd : key * elt),
remove_min l2 x2 d2 r2 = (m2', xd) ->
P (Node _x _x0 _x1 _x2 _x3) (Node l2 x2 d2 r2 _x4) (join m1 xd#1 xd#2 m2')) ->
forall m1 m2 : t elt, P m1 m2 (concat m1 m2).
Lemma split_ind [elt : Type] [x : X.t] [P : t elt -> triple elt -> Prop] :
(forall m : t elt, m = Leaf elt -> P (Leaf elt) << Leaf elt, None, Leaf elt >>) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.lt x y,
X.compare x y = LT _x0 ->
P l (split x l) ->
forall (ll : t elt) (o : option elt) (rl : t elt),
split x l = << ll, o, rl >> -> P (Node l y d r _x) << ll, o, join rl y d r >>) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.eq x y, X.compare x y = EQ _x0 -> P (Node l y d r _x) << l, Some d, r >>) ->
(forall (m l : t elt) (y : key) (d : elt) (r : t elt) (_x : int),
m = Node l y d r _x ->
forall _x0 : X.lt y x,
X.compare x y = GT _x0 ->
P r (split x r) ->
forall (rl : t elt) (o : option elt) (rr : t elt),
split x r = << rl, o, rr >> -> P (Node l y d r _x) << join l y d rl, o, rr >>) ->
forall m : t elt, P m (split x m).
Lemma map_option_ind [elt elt' : Type] [f : key -> elt -> option elt'] [P : t elt -> t elt' -> Prop] :
(forall m : t elt, m = Leaf elt -> P (Leaf elt) (Leaf elt')) ->
(forall (m l : t elt) (x : key) (d : elt) (r : t elt) (_x : int),
m = Node l x d r _x ->
forall d' : elt',
f x d = Some d' ->
P l (map_option f l) ->
P r (map_option f r) -> P (Node l x d r _x) (join (map_option f l) x d' (map_option f r))) ->
(forall (m l : t elt) (x : key) (d : elt) (r : t elt) (_x : int),
m = Node l x d r _x ->
f x d = None ->
P l (map_option f l) ->
P r (map_option f r) -> P (Node l x d r _x) (concat (map_option f l) (map_option f r))) ->
forall m : t elt, P m (map_option f m).
Lemma map2_opt_ind [elt elt' elt'' : Type] [f : key -> elt -> option elt' -> option elt'']
[mapl : t elt -> t elt''] [mapr : t elt' -> t elt'']
[P : t elt -> t elt' -> t elt'' -> Prop] :
(forall (m1 : t elt) (m2 : t elt'), m1 = Leaf elt -> P (Leaf elt) m2 (mapr m2)) ->
(forall (m1 : t elt) (m2 : t elt') (l1 : t elt) (x1 : key) (d1 : elt) (r1 : t elt) (_x : int),
m1 = Node l1 x1 d1 r1 _x -> m2 = Leaf elt' -> P (Node l1 x1 d1 r1 _x) (Leaf elt') (mapl m1)) ->
(forall (m1 : t elt) (m2 : t elt') (l1 : t elt) (x1 : key) (d1 : elt) (r1 : t elt) (_x : int),
m1 = Node l1 x1 d1 r1 _x ->
forall (_x0 : t elt') (_x1 : key) (_x2 : elt') (_x3 : t elt') (_x4 : int),
m2 = Node _x0 _x1 _x2 _x3 _x4 ->
forall (l2' : t elt') (o2 : option elt') (r2' : t elt'),
split x1 m2 = << l2', o2, r2' >> ->
forall e : elt'',
f x1 d1 o2 = Some e ->
P l1 l2' (map2_opt f mapl mapr l1 l2') ->
P r1 r2' (map2_opt f mapl mapr r1 r2') ->
P (Node l1 x1 d1 r1 _x) (Node _x0 _x1 _x2 _x3 _x4)
(join (map2_opt f mapl mapr l1 l2') x1 e (map2_opt f mapl mapr r1 r2'))) ->
(forall (m1 : t elt) (m2 : t elt') (l1 : t elt) (x1 : key) (d1 : elt) (r1 : t elt) (_x : int),
m1 = Node l1 x1 d1 r1 _x ->
forall (_x0 : t elt') (_x1 : key) (_x2 : elt') (_x3 : t elt') (_x4 : int),
m2 = Node _x0 _x1 _x2 _x3 _x4 ->
forall (l2' : t elt') (o2 : option elt') (r2' : t elt'),
split x1 m2 = << l2', o2, r2' >> ->
f x1 d1 o2 = None ->
P l1 l2' (map2_opt f mapl mapr l1 l2') ->
P r1 r2' (map2_opt f mapl mapr r1 r2') ->
P (Node l1 x1 d1 r1 _x) (Node _x0 _x1 _x2 _x3 _x4)
(concat (map2_opt f mapl mapr l1 l2') (map2_opt f mapl mapr r1 r2'))) ->
forall (m1 : t elt) (m2 : t elt'), P m1 m2 (map2_opt f mapl mapr m1 m2).