| buf1 = mkempbuf(# buf1), m0 ≤ # buf1 ⊦ # buf0 + datasize(buf1, m0) = datasize(buf0, # buf0), m0 = 0, ∀ n. n < m0 → buf1[n] = empty |
buf1 = mkempbuf(# buf1), n < m0, n < # buf1, m0 ≤ # buf1 ⊦ # buf0 + datasize(buf1, m0) = datasize(buf0, # buf0), buf1[n] = empty
Used simplifier rules: fle: ⊦ m < n ∧ n ≤ n0 → m < n0; (forward) from specification nat%f: ⊦ m < n → n ≠ 0; (forward) from specification nat-basic% ⊦ m < n → n ≠ 0; (s)