Admitted.  (* This is an exercise in Verified Functional Algorithms *)
Definition tmap_rep (m: total_map val) (p: val) : mpred :=
EX t: tree val, !! Abs t m && treebox_rep t p.
Definition abs_insert_spec :=
DECLARE _insert
WITH b: val, x: Z, v: val, m: total_map val
PRE  [ _t OF (tptr (tptr t_struct_tree)), _x OF tint,
_value OF (tptr Tvoid)   ]
PROP( Int.min_signed <= x <= Int.max_signed; is_pointer_or_null v)
LOCAL(temp _t b; temp _x (Vint (Int.repr x)); temp _value v)
SEP (tmap_rep m b)
POST [ Tvoid ]
PROP()
LOCAL()
SEP (tmap_rep (t_update m x v) b).
Definition abs_treebox_new_spec :=
DECLARE _treebox_new
WITH u : unit
PRE  [  ]
PROP() LOCAL() SEP ()
POST [ tptr (tptr t_struct_tree) ]
EX v:val,
PROP()
LOCAL(temp ret_temp v)
SEP (tmap_rep (t_empty nullval) v).
Definition abs_treebox_free_spec :=
DECLARE _treebox_free
WITH m: total_map val, p: val
PRE  [ _b OF (tptr (tptr t_struct_tree)) ]
PROP() LOCAL(temp _b p) SEP (tmap_rep m p)
POST [ Tvoid ]
PROP()
LOCAL()
SEP (emp).
Definition main_spec :=
DECLARE _main
WITH gv : globals
PRE  [] main_pre prog nil gv
POST [ tint ] main_post prog nil gv.

(* Specifications: *)
Lemma subsume_insert:
subsume_funspec (snd insert_spec) (snd abs_insert_spec).
Lemma subsume_treebox_new:
subsume_funspec (snd treebox_new_spec) (snd abs_treebox_new_spec).
Lemma subsume_treebox_free:
subsume_funspec (snd treebox_free_spec) (snd abs_treebox_free_spec).
Lemma body_main: semax_body Vprog Gprog f_main main_spec.
End TREE_ABS.