End Sfor.

Lemma semax_for :
forall (Inv: environ->mpred) (n: Z) Espec {cs: compspecs} Delta
(Pre: environ->mpred)
(_i: ident) (init: statement) (m: Z) (hi: expr) (body MORE_COMMAND: statement) (Post: ret_assert)
(type_i: type)
(assert_callee: Z -> environ -> mpred)
(inv0: environ -> mpred)
(inv1 inv2: Z -> environ -> mpred) s
(TI: (temp_types Delta) ! _i = Some type_i)
(CALLEE: Inv = exp assert_callee)
(INV: Sfor_inv Delta _i m hi n assert_callee inv0 inv1 inv2)
(SETUP: Sfor_setup Delta _i Pre init hi type_i m n assert_callee inv0),
(forall i, m <= i < n ->
@semax cs Espec Delta (inv1 i)
body
(for_ret_assert (inv2 i) Post)) ->
@semax cs Espec Delta
(inv1 n) MORE_COMMAND Post ->
@semax cs Espec Delta Pre
(Ssequence
(Sfor init
(Ebinop Olt (Etempvar _i type_i) hi (Tint I32 Signed noattr))
body
(Sset _i (Ebinop Oadd (Etempvar _i type_i) (Econst_int (Int.repr 1) (Tint I32 s noattr)) type_i)))
MORE_COMMAND) Post.