| # apebs = # wlar, recs[VTBL_VOLID × VTBL_LNUM] = recovery-entry(m0, m1), apebs[m0] = mkpeb(aehdr, avhdr, buf, m, boolvar), m0 < # wlar, is-encoded(vtbl, buf), valid-recs(apebs, wlar, recs), valid-vtbl-weak(apebs, m0), VTBL_VOLID × VTBL_LNUM ∈ recs ⊦ ⟪vols := ∅; while vtbl ≠ ∅ do {/* (prepost-init-vols-sizes : invariant to-vtbl(vols) ⊥ vtbl ∧ is-encoded(to-vtbl(vols) ∪ vtbl, apebs[recs[VTBL_VOLID × VTBL_LNUM].pnum].data) ∧ valid-vtbl-weak(apebs, recs[VTBL_VOLID × VTBL_LNUM].pnum) ∧ valid-recs(apebs, wlar, recs) ∧ recs[VTBL_VOLID × VTBL_LNUM].pnum < # apebs ∧ VTBL_VOLID × VTBL_LNUM ∈ recs ∧ unmapped-vols(vols) ∧ # apebs = # wlar wfbound # vtbl) */; choose v with v ∈ vtbl in {vols[v] := mkebatbl(vtbl[v]); vols[v] := fill(vols[v], unmapped); vtbl := vtbl -- v}}⟫ (valid-vtbl(apebs, vols, wlar, m0) ∧ unmapped-vols(vols) ∧ ¬ VTBL_VOLID ∈ vols) |
# apebs = # wlar, apebs[m0] = mkpeb(aehdr, avhdr, buf, m, boolvar), recs[VTBL_VOLID × VTBL_LNUM] = recovery-entry(m0, m1), vols = ∅, m0 < # wlar, is-encoded(vtbl, buf), valid-recs(apebs, wlar, recs), valid-vtbl-weak(apebs, m0), VTBL_VOLID × VTBL_LNUM ∈ recs ⊦ ⟪while vtbl ≠ ∅ do {/* (prepost-init-vols-sizes : invariant to-vtbl(vols) ⊥ vtbl ∧ is-encoded(to-vtbl(vols) ∪ vtbl, apebs[recs[VTBL_VOLID × VTBL_LNUM].pnum].data) ∧ valid-vtbl-weak(apebs, recs[VTBL_VOLID × VTBL_LNUM].pnum) ∧ valid-recs(apebs, wlar, recs) ∧ recs[VTBL_VOLID × VTBL_LNUM].pnum < # apebs ∧ VTBL_VOLID × VTBL_LNUM ∈ recs ∧ unmapped-vols(vols) ∧ # apebs = # wlar wfbound # vtbl) */; choose v with v ∈ vtbl in {vols[v] := mkebatbl(vtbl[v]); vols[v] := fill(vols[v], unmapped); vtbl := vtbl -- v}}⟫ (valid-vtbl(apebs, vols, wlar, m0) ∧ unmapped-vols(vols) ∧ ¬ VTBL_VOLID ∈ vols)