intros. rewrite lseg_unroll.
apply pred_ext. apply orp_left; auto.
rewrite andp_assoc.
do 2 (apply derives_extract_prop; intro).
congruence.
apply orp_right2. auto.
Qed.

(* Specifications: *)
Lemma lseg_nonnull (ls: listspec list_structid list_link list_token):
forall dsh psh s v,
typed_true (tptr list_struct) v ->
lseg ls dsh psh s v nullval = lseg_cons ls dsh psh s v nullval.
Lemma unfold_lseg_neq (ls: listspec list_structid list_link list_token):
forall P Q1 Q R (v v2: val) dsh psh (s: list (val * elemtype ls)),
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls dsh psh s v v2 :: R))) |--
!! (ptr_neq v v2) ->
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls dsh psh s v v2 :: R))) |--
EX hryp: elemtype ls * list (val * elemtype ls) * val * val,
match hryp with (h,r,y,p) =>
!! (s=(p,h)::r /\ is_pointer_or_null y) &&
!! (p=v) &&
PROPx P (LOCALx Q
(SEPx (list_token dsh v :: list_cell ls dsh h v::
field_at psh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) v ::
lseg ls dsh psh r y v2 ::
R)))
end.
Lemma unfold_lseg_cons (ls: listspec list_structid list_link list_token):
forall P Q1 Q R e dsh psh s,
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls dsh psh s e nullval :: R))) |--
!! (typed_true (tptr list_struct) e) ->
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls dsh psh s e nullval :: R))) |--
EX hryp: elemtype ls * list (val * elemtype ls) * val * val,
match hryp with (h,r,y,p) =>
!! (s=(p,h)::r /\ is_pointer_or_null y) &&
!! (p=e)&&
PROPx P (LOCALx Q
(SEPx (list_token dsh e :: list_cell ls dsh h e ::
field_at psh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) e ::
lseg ls dsh psh r y nullval ::
R)))
end.
Lemma semax_lseg_neq (ls: listspec list_structid list_link list_token):
forall (Espec: OracleKind)
Delta P Q dsh psh s v v2 R c Post,
~ (ptr_eq v v2) ->
(forall (h: elemtype ls) (r: list (val * elemtype ls)) (y: val),
s=(v,h)::r -> is_pointer_or_null y ->
semax Delta
(PROPx P (LOCALx Q
(SEPx (list_token dsh v :: list_cell ls dsh h v ::
field_at psh list_struct (StructField list_link :: nil)
(valinject (nested_field_type list_struct (StructField list_link :: nil)) y) v ::
lseg ls dsh psh r y v2 ::
R)))) c Post) ->
semax Delta
(PROPx P (LOCALx Q (SEPx (lseg ls dsh psh s v v2 :: R))))
c Post.
Lemma semax_lseg_nonnull (ls: listspec list_structid list_link list_token):
forall (Espec: OracleKind)
Delta P Q dsh psh s v R c Post,
ENTAIL Delta, PROPx P (LOCALx Q
(SEPx (lseg ls dsh psh s v nullval :: R))) |--
!!(typed_true (tptr list_struct) v)  ->
(forall (h: elemtype ls) (r: list (val * elemtype ls)) (y: val),
s=(v,h)::r -> is_pointer_or_null y ->
semax Delta
(PROPx P (LOCALx Q
(SEPx (list_token dsh v :: list_cell ls dsh h v ::
field_at psh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) v ::
lseg ls dsh psh r y nullval ::
R)))) c Post) ->
semax Delta
(PROPx P (LOCALx Q (SEPx (lseg ls dsh psh s v nullval :: R))))
c Post.
Lemma lseg_nil_eq (ls: listspec list_structid list_link list_token):
forall dsh psh p q, lseg ls dsh psh nil p q = !! (ptr_eq p q) && emp.
Lemma lseg_cons_eq (ls: listspec list_structid list_link list_token):
forall dsh psh h r x z ,
lseg ls dsh psh (h::r) x z =
!!(x = fst h /\ ~ ptr_eq x z) &&
(EX  y : val,
!!(is_pointer_or_null y) &&
list_token dsh x * list_cell ls dsh (snd h) x * field_at psh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) x *
lseg ls dsh psh r y z).
Lemma lseg_nonnull (ls: listspec list_structid list_link list_token):
forall sh s v,
typed_true (tptr list_struct) v ->
lseg ls sh s v nullval = lseg_cons ls sh s v nullval.
Lemma unfold_lseg_neq (ls: listspec list_structid list_link list_token):
forall P Q1 Q R (v v2: val) sh (s: list (elemtype ls)),
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls sh s v v2 :: R))) |--
!! (ptr_neq v v2) ->
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls sh s v v2 :: R))) |--
EX hryp: elemtype ls * list (elemtype ls) * val,
match hryp with (h,r,y) =>
!! (s=h::r /\ is_pointer_or_null y) &&
PROPx P (LOCALx Q
(SEPx (list_token sh v :: list_cell ls sh h v::
field_at sh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) v ::
lseg ls sh r y v2 ::
R)))
end.
Lemma unfold_lseg_cons (ls: listspec list_structid list_link list_token):
forall P Q1 Q R e sh s,
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls sh s e nullval :: R))) |--
!!(typed_true (tptr list_struct) e) ->
PROPx P (LOCALx (Q1::Q) (SEPx (lseg ls sh s e nullval :: R))) |--
EX hryp: elemtype ls * list (elemtype ls) * val,
match hryp with (h,r,y) =>
!! (s=h::r /\ is_pointer_or_null y) &&
PROPx P (LOCALx Q
(SEPx (list_token sh e :: list_cell ls sh h e ::
field_at sh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) e ::
lseg ls sh r y nullval ::
R)))
end.
Lemma semax_lseg_neq (ls: listspec list_structid list_link list_token):
forall (Espec: OracleKind)
Delta P Q sh s v v2 R c Post,
~ (ptr_eq v v2) ->
(forall (h: elemtype ls) (r: list (elemtype ls)) (y: val),
s=h::r -> is_pointer_or_null y ->
semax Delta
(PROPx P (LOCALx Q
(SEPx (list_token sh v :: list_cell ls sh h v ::
field_at sh list_struct (StructField list_link :: nil)
(valinject (nested_field_type list_struct (StructField list_link :: nil)) y) v ::
lseg ls sh r y v2 ::
R)))) c Post) ->
semax Delta
(PROPx P (LOCALx Q (SEPx (lseg ls sh s v v2 :: R))))
c Post.
Lemma semax_lseg_nonnull (ls: listspec list_structid list_link list_token):
forall (Espec: OracleKind)
Delta P Q sh s v R c Post,
ENTAIL Delta, PROPx P (LOCALx Q
(SEPx (lseg ls sh s v nullval :: R))) |--
!!(typed_true (tptr list_struct) v)  ->
(forall (h: elemtype ls) (r: list (elemtype ls)) (y: val),
s=h::r -> is_pointer_or_null y ->
semax Delta
(PROPx P (LOCALx Q
(SEPx (list_token sh v :: list_cell ls sh h v ::
field_at sh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) v ::
lseg ls sh r y nullval ::
R)))) c Post) ->
semax Delta
(PROPx P (LOCALx Q (SEPx (lseg ls sh s v nullval :: R))))
c Post.
Lemma lseg_nil_eq (ls: listspec list_structid list_link list_token):
forall sh p q, lseg ls sh nil p q = !! (ptr_eq p q) && emp.
Lemma lseg_cons_eq (ls: listspec list_structid list_link list_token):
forall sh h r x z ,
lseg ls sh (h::r) x z =
!!(~ ptr_eq x z) &&
(EX  y : val,
!!(is_pointer_or_null y) &&
list_token sh x * list_cell ls sh h x * field_at sh list_struct (StructField list_link :: nil) (valinject (nested_field_type list_struct (StructField list_link :: nil)) y) x *
lseg ls sh r y z).