(* What can a thread know? At least certain keys exist, and whatever it did last took effect. It can even rely on the indices of known keys. *)
Definition set_item_spec :=
DECLARE _set_item
WITH key : Z, value : Z, p : val, sh : share, entries : list val, h : list (hist * hist), l : Z
PRE [ _key OF tint, _value OF tint ]
PROP (repable_signed key; repable_signed value; readable_share sh; key <> 0; Forall isptr entries;
Zlength h = 20; wf_hists h l)
LOCAL (temp _key (vint key); temp _value (vint value); gvar _m_entries p)
SEP (data_at sh (tarray (tptr tentry) 20) entries p;
fold_right_sepcon (map (atomic_entry sh) entries);
entry_hists entries h)
POST [ tvoid ]
EX i : Z, EX h' : list (hist * hist),
PROP (set_item_trace h key value i h')
LOCAL ()
SEP (data_at sh (tarray (tptr tentry) 20) entries p;
fold_right_sepcon (map (atomic_entry sh) entries);
entry_hists entries h').
(* set_item_trace_map describes the properties on the resulting map. *)
Definition failed_load k (a b : hist * hist) := exists t r, Forall (fun x => fst x < t)%nat (fst a) /\
fst b = fst a ++ [(t, Load (Vint r))] /\ r <> Int.zero /\ r <> Int.repr k /\ snd b = snd a /\
(let v := value_of_hist (fst a) in v <> vint 0 -> v = Vint r).
(* get_item can return 0 in two cases: if the key is not in the map, or if its value is 0. In correct use, the latter should only occur if the value has not been initialized. Conceptually, this is still linearizable because we could have just checked before the key was added, but at a finer-grained level we can tell the difference from the history, so we might as well keep this information. *)
Definition get_item_trace (h : list (hist * hist)) k v i h' := 0 <= i < Zlength h /\
Forall2 (failed_load k) (sublist 0 i h) (sublist 0 i h') /\
(let '(hk, hv) := Znth i h ([], []) in exists t r, Forall (fun x => fst x < t)%nat hk /\
fst (Znth i h' ([], [])) = hk ++ [(t, Load (vint r))] /\
(v = 0 /\ r = 0 /\ snd (Znth i h' ([], [])) = hv \/
r = k /\ exists tv, Forall (fun x => fst x < tv)%nat hv /\
snd (Znth i h' ([], [])) = hv ++ [(tv, Load (vint v))]) /\
(let v := value_of_hist hk in v <> vint 0 -> v = vint r)) /\
sublist (i + 1) (Zlength h) h = sublist (i + 1) (Zlength h') h'.

Lemma index_of_iff_out : forall m k, index_of m k = None <-> ~In k (map fst m).