Definition while_Inv contents tgt sh a := EX lo : Z, EX hi : Z,
PROP  (readable_share sh; Zlength contents <= Int.max_signed;
0 <= lo <= Int.max_signed; Int.min_signed <= hi <= Int.max_signed / 2;
hi <= Zlength contents;
In tgt contents -> In tgt (sublist lo hi contents))
LOCAL (temp _a a; temp _tgt (Vint (Int.repr tgt));
temp _lo (Vint (Int.repr lo)); temp _hi (Vint (Int.repr hi)))
SEP   (data_at sh (tarray tint (Zlength contents))
(map Vint (map Int.repr contents)) a).
Definition while_Inv' contents tgt sh a := EX lo : Z, EX hi : Z,
PROP  (readable_share sh; Zlength contents <= Int.max_signed;
0 <= lo < hi; Int.min_signed <= hi <= Int.max_signed / 2;
hi <= Zlength contents;
In tgt contents -> In tgt (sublist lo hi contents))
LOCAL (temp _a a; temp _tgt (Vint (Int.repr tgt));
temp _lo (Vint (Int.repr lo)); temp _hi (Vint (Int.repr hi)))
SEP   (data_at sh (tarray tint (Zlength contents))
(map Vint (map Int.repr contents)) a).

Lemma body_search: semax_body Vprog Gprog f_search search_spec.
Definition four_contents := [1; 2; 3; 4].