Inductive Sfor_inv_rec {cs: compspecs} (Delta: tycontext): ident -> Z -> Z -> expr -> Z -> (environ -> mpred) -> (environ -> mpred) -> (environ -> mpred) -> Prop :=
| Sfor_inv_rec_step': forall A _i i m hi n assert_callee inv0 inv1,
(forall x: A,
Sfor_inv_rec Delta _i i m hi n (assert_callee x) (inv0 x) (inv1 x)) ->
Sfor_inv_rec Delta _i i m hi n (exp assert_callee) (exp inv0) (exp inv1)
| Sfor_inv_rec_end: forall _i i m hi n' n P Q R T1 T2 GV (*tactic callee*),
local2ptree Q = (T1, T2, nil, GV) ->
T1 ! _i = None ->
msubst_eval_expr Delta T1 T2 GV hi = Some n' ->
Int6432_val (typeof hi) n' n ->
ENTAIL Delta, PROPx P (LOCALx Q (SEPx R)) |-- tc_expr Delta hi ->
Sfor_inv_rec Delta _i i m hi n
(PROPx P (LOCALx Q (SEPx R)))
(PROPx ((m <= i <= n) :: P) (LOCALx (temp _i (Vint (Int.repr i)) :: Q) (SEPx R)))
(PROPx P (LOCALx (temp _i (Vint (Int.repr i)) :: Q) (SEPx R))).

Lemma Sfor_inv_rec_step {cs: compspecs} (Delta: tycontext): forall A _i i m hi n assert_callee inv0 inv1,
(forall x: A, exists inv0' inv1',
Sfor_inv_rec Delta _i i m hi n (assert_callee x) inv0' inv1' /\
inv0 x = inv0' /\ inv1 x = inv1') ->
Sfor_inv_rec Delta _i i m hi n (exp assert_callee) (exp inv0) (exp inv1).