Definition i_8_16_inv F x z c b m nonce k zbytes gv: environ -> mpred :=
EX i:_,
(PROP  ()
LOCAL  (temp _u (Vint (fst (ZZ zbytes (Z.to_nat (i-8)))));
lvar _x (Tarray tuchar 64 noattr) x;
lvar _z (Tarray tuchar 16 noattr) z; temp _c c; temp _m m;
temp _b b; temp _n nonce; temp _k k; gvars gv)
SEP  (F; data_at Tsh (Tarray tuchar 16 noattr) (Bl2VL (snd (ZZ zbytes (Z.to_nat (i-8))))) z)).
Definition for_loop_statement:=
Sfor (Sset _i (Econst_int (Int.repr 8) tint))
(Ebinop Olt (Etempvar _i tuint) (Econst_int (Int.repr 16) tint) tint)
(Ssequence
(Ssequence
(Sset _t'5
(Ederef
(Ebinop Oadd (Evar _z (tarray tuchar 16))
(Etempvar _i tuint) (tptr tuchar)) tuchar))
(Sset _u
(Ebinop Oadd (Etempvar _u tuint)
(Ecast (Etempvar _t'5 tuchar) tuint) tuint)))
(Ssequence
(Sassign
(Ederef
(Ebinop Oadd (Evar _z (tarray tuchar 16))
(Etempvar _i tuint) (tptr tuchar)) tuchar)
(Etempvar _u tuint))
(Sset _u
(Ebinop Oshr (Etempvar _u tuint) (Econst_int (Int.repr 8) tint)
tuint))))
(Sset _i
(Ebinop Oadd (Etempvar _i tuint) (Econst_int (Int.repr 1) tint) tuint)).

Lemma For_i_8_16_loop Espec F x z c m b nonce k zbytes gv:
@semax CompSpecs Espec
(func_tycontext f_crypto_stream_salsa20_tweet_xor SalsaVarSpecs SalsaFunSpecs nil)
(PROP  ()
LOCAL  (temp _u (Vint (Int.repr 1)); lvar _x (Tarray tuchar 64 noattr) x;
lvar _z (Tarray tuchar 16 noattr) z; temp _c c; temp _m m;
temp _b b; temp _n nonce;
temp _k k; gvars gv)
SEP  (F; data_at Tsh (Tarray tuchar 16 noattr) (Bl2VL zbytes) z))
for_loop_statement
(normal_ret_assert
( PROP ()
LOCAL (lvar _x (Tarray tuchar 64 noattr) x;
lvar _z (Tarray tuchar 16 noattr) z; temp _c c; temp _m m;
temp _b b; temp _n nonce; temp _k k; gvars gv)
SEP (F; data_at Tsh (Tarray tuchar 16 noattr) (Bl2VL (snd (ZZ zbytes 8))) z))).