| # vtbl1 = m0 + 1, n = ENCODED_VOLID_SIZE, is-encoded((m0 + 1) + # vtbl, subarray(buf, 0, ENCODED_NAT_SIZE)), is-encoded(vtbl0, buf), is-encoded(v, subarray(buf, ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), ENCODED_VOLID_SIZE)), is-encoded-rec (vtbl1, subarray (buf, ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) * m0 + ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE)), is-encoded-rec(vtbl, subarray(buf, ENCODED_NAT_SIZE, # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))), 2 * ENCODED_NAT_SIZE + (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) * (m0 + # vtbl) + ENCODED_VOLID_SIZE ≤ # buf, ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) + ENCODED_VOLID_SIZE ≤ # buf, vtbl ⊥ vtbl1, err0 = ESUCCESS → ENCODED_NAT_SIZE ≤ # buf ∧ n3 = ENCODED_NAT_SIZE, err0 = ESUCCESS ∨ ⌊err0⌋ ⊦ ∀ m, n, err. (err = ESUCCESS ∨ ⌊err⌋ ) ∧ ( err = ESUCCESS → is-encoded (m, subarray(buf, (ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE)) + ENCODED_VOLID_SIZE, ENCODED_NAT_SIZE)) ∧ 2 * ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) + ENCODED_VOLID_SIZE ≤ # buf ∧ n = ENCODED_NAT_SIZE) → ⟪n5 := (m0 + 1) + # vtbl; n0 := (ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE)) + ENCODED_VOLID_SIZE; if err = ESUCCESS then {n0 := n0 + n; vtbl[v] := m}; n1 := m0⟫ ( (err = ESUCCESS ∨ ⌊err⌋ ) ∧ ( err = ESUCCESS → (∃ vtbl2. vtbl ⊥ vtbl2 ∧ # vtbl2 + # vtbl = n5 ∧ # vtbl2 = n1 ∧ ENCODED_NAT_SIZE + (# vtbl2 + # vtbl) * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ≤ # buf ∧ n0 = ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ is-encoded(# vtbl2 + # vtbl, subarray(buf, 0, ENCODED_NAT_SIZE)) ∧ is-encoded-rec(vtbl, subarray(buf, ENCODED_NAT_SIZE, # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))) ∧ is-encoded-rec (vtbl2, subarray (buf, ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), # vtbl2 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))))) ∧ n1 < # vtbl1), vtbl1 = ∅ |
# vtbl1 = m0 + 1, vtbl1 ≠ ∅, is-encoded(v, subarray(buf, ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), ENCODED_VOLID_SIZE)), is-encoded(vtbl0, buf), is-encoded((m0 + 1) + # vtbl, subarray(buf, 0, ENCODED_NAT_SIZE)), is-encoded-rec(vtbl, subarray(buf, ENCODED_NAT_SIZE, # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))), is-encoded-rec (vtbl1, subarray (buf, ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) * m0 + ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE)), ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) + ENCODED_VOLID_SIZE ≤ # buf, 2 * ENCODED_NAT_SIZE + (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) * (m0 + # vtbl) + ENCODED_VOLID_SIZE ≤ # buf, vtbl ⊥ vtbl1, err = ESUCCESS → is-encoded(m, subarray(buf, (ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE)) + ENCODED_VOLID_SIZE, ENCODED_NAT_SIZE)) ∧ 2 * ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) + ENCODED_VOLID_SIZE ≤ # buf ∧ n2 = ENCODED_NAT_SIZE, err0 = ESUCCESS → ENCODED_NAT_SIZE ≤ # buf ∧ n3 = ENCODED_NAT_SIZE, err = ESUCCESS ∨ ⌊err⌋ , err0 = ESUCCESS ∨ ⌊err0⌋ ⊦ ⟪n5 := (m0 + 1) + # vtbl; n0 := (ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE)) + ENCODED_VOLID_SIZE; if err = ESUCCESS then {n0 := n0 + n2; vtbl[v] := m}; n1 := m0⟫ ( (err = ESUCCESS ∨ ⌊err⌋ ) ∧ ( err = ESUCCESS → (∃ vtbl2. vtbl ⊥ vtbl2 ∧ # vtbl2 + # vtbl = n5 ∧ # vtbl2 = n1 ∧ ENCODED_NAT_SIZE + (# vtbl2 + # vtbl) * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ≤ # buf ∧ n0 = ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ is-encoded(# vtbl2 + # vtbl, subarray(buf, 0, ENCODED_NAT_SIZE)) ∧ is-encoded-rec(vtbl, subarray(buf, ENCODED_NAT_SIZE, # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))) ∧ is-encoded-rec (vtbl2, subarray (buf, ENCODED_NAT_SIZE + # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), # vtbl2 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE))))) ∧ n1 < # vtbl1)