| # buf = m * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), # buf3 = ENCODED_NAT_SIZE, # buf4 = ENCODED_VOLID_SIZE, # buf2 = ENCODED_VOLID_SIZE, # buf1 = ENCODED_NAT_SIZE, # buf0 = # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), # vtbl1 = m + 1, buf2 + buf1 + buf0 = buf4 + buf3 + buf, ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE + # buf0 = # vtbl1 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), # vtbl + 1 = # vtbl1, is-encoded(v1, buf4), is-encoded(vtbl1[v1], buf3), is-encoded(vtbl[v, n][v0], buf1), is-encoded(v0, buf2), is-encoded-rec(vtbl1 -- v1, buf), is-encoded-rec(vtbl[v, n] -- v0, buf0), v1 ∈ vtbl1, v0 ∈ vtbl[v, n], ∀ vtbl2, buf, vtbl1. # vtbl2 < # vtbl[v, n] → # buf = # vtbl1 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ # buf = # vtbl2 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ is-encoded-rec(vtbl2, buf) ∧ is-encoded-rec(vtbl1, buf) → vtbl2 = vtbl1 ⊦ # vtbl1 = 0, ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE = 0, vtbl[v, n] = vtbl1, vtbl1 = ∅, v ∈ vtbl |
# vtbl1 = # vtbl + 1, # buf0 = # vtbl * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE), # buf1 = ENCODED_NAT_SIZE, # buf2 = ENCODED_VOLID_SIZE, # buf4 = ENCODED_VOLID_SIZE, # buf3 = ENCODED_NAT_SIZE, # buf = # buf0, buf2 + buf1 + buf0 = buf4 + buf3 + buf, is-encoded(v0, buf2), is-encoded(vtbl[v, n][v0], buf1), is-encoded(vtbl1[v1], buf3), is-encoded(v1, buf4), is-encoded-rec(vtbl[v, n] -- v0, buf0), is-encoded-rec(vtbl1 -- v1, buf), v0 ∈ vtbl[v, n], v1 ∈ vtbl1, ∀ vtbl2, buf, vtbl1. # vtbl2 < # vtbl[v, n] → # buf = # vtbl1 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ # buf = # vtbl2 * (ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE) ∧ is-encoded-rec(vtbl2, buf) ∧ is-encoded-rec(vtbl1, buf) → vtbl2 = vtbl1 ⊦ ENCODED_VOLID_SIZE + ENCODED_NAT_SIZE = 0, vtbl[v, n] = vtbl1, vtbl1 = ∅, v ∈ vtbl
Used simplifier rules: ⊦ m + n = m + n0 ↔ n = n0; (s)%mult-c: ⊦ m * n = n * m; from specification nat-mult%mult-a: ⊦ m0 * m * n = (m0 * m) * n; from specification nat-mult%c: ⊦ m + n = n + m; from specification nat-basic%a: ⊦ (m + n0) + n1 = m + n0 + n1; from specification nat-basic% ⊦ m * (n + 1) = m * n + m; (s)% ⊦ # vtbl = 0 ↔ vtbl = ∅; (s)