(* First draft specs.  Not specifying that chunks are aligned. *)
Instance CompSpecs : compspecs. make_compspecs prog. Defined.
Definition Vprog : varspecs. mk_varspecs prog. Defined.
Local Open Scope Z.
Local Open Scope logic.
(* TODO Initially I imagined the constants would be defined as parameters (with suitable assumptions, e.g., BIGBLOCK needs to be big enough for at least one chunk of the largest size, because fill_bin unconditionally initializes the last chunk. *)
Definition WORD: Z := 4. (* sizeof(size_t) 4 for 32bit Clight; 8 in clang *)
Definition ALIGN: Z := 2.
Definition BINS: Z := 8.
Parameter BIGBLOCK: Z.
Parameter BIGBLOCK_def:
Int.repr BIGBLOCK = Int.mul (Int.shl (Int.repr 2) (Int.repr 16)) (Int.repr WORD).
Definition bin2sizeZ := fun b: Z => (Z.mul ((Z.mul (b+1) ALIGN)-1) WORD).
Definition size2binZ : Z -> Z := fun s =>
if zlt (bin2sizeZ(BINS-1)) s then -1
else (s+(Z.mul WORD (ALIGN-1))-1) / (Z.mul WORD ALIGN).
Eval compute in bin2sizeZ (BINS-1).
Example bin2sizeBINS: bin2sizeZ (BINS-1) = 60. Proof. reflexivity. Qed.
(* Hint Unfold WORD ALIGN : myDB. auto with myDB *)
(* Some sanity checks; may not be needed for code verification. *)

(* Specifications: *)
Lemma claim1: forall s,
0 <= s <= bin2sizeZ(BINS-1) -> s <= bin2sizeZ(size2binZ s).
Lemma claim2: forall s,
0 <= s <= bin2sizeZ(BINS-1) -> 0 <= size2binZ s < BINS.
Lemma claim3: forall s, 0 <= s <= bin2sizeZ(BINS-1)
-> size2binZ(bin2sizeZ(size2binZ(s))) = size2binZ(s).
Lemma claim4: forall b,
0 <= b < BINS -> Z.rem (bin2sizeZ b + WORD) (Z.mul WORD ALIGN) = 0.
Lemma claim5: forall b,
0 <= b < BINS -> size2binZ(bin2sizeZ(b)) = b.