Filnix wiki

⇒

∀reg, object_regionb m_regionsm = Somereg → object_regionb m_regionsm′ = Somereg

PByteb o

⇒

∀reg, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm′ b + o = m_bytesm b + o

PAuxb o

⇒

∀reg, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⇒

True

The assertion P is stable: it survives any change that keeps its pieces and moves objects only forward. Every assertion built here is.

90Definition stableP : hprop : Prop ≔

∀S m m′, PS m → same_onS m m′ → growsm m′ → PS m′

Every piece of S belongs to an object of m. Every assertion built here owns only such pieces, so a fresh identity is owned by no one.

96Definition registeredS : fp m : mem : Prop ≔

∀p, Sp → object_regionpiece_idp m_regionsm ≠ None

Assertions

Owns nothing.

102Definition emp: hprop ≔

λS _ ⇒ onlyS λ_ ⇒ False

Owns nothing, and phi holds.

105Definition purephi : Prop : hprop ≔

λS _ ⇒ onlyS λ_ ⇒ False ∧ phi

P and Q hold of disjoint parts of the footprint.

108Definition starP Q : hprop : hprop ≔

λS m ⇒ ∃S₁ S₂, ∀p, Sp ↔ S₁p ∨ S₂p ∧ ∀p, ¬S₁p ∧ S₂p ∧ PS₁ m ∧ QS₂ m

P x holds for some x.

113Definition hexA : Type P : A → hprop : hprop ≔

λS m ⇒ ∃x, Px S m

Declare Scope hprop_scope

Delimit Scope hprop_scope with h

117Infix ** ≔ star (at level 41 , right associativity) : hprop_scope

The persistent fact that b is an object of kind k whose bounds, while it is live, are n bytes: the metameta nanofilA meta fact, metab n k, says that the object of identity b was allocated with extent n bytes and kind k (heap, global data, stack). It is the persistent half of owning an object in the planned program logic: once true it stays true, so it can be copied and shared freely, because nothing after an allocation changes what was allocated. With the pointer's offset from b it decides a check's bounds by arithmetic alone; whether the object is still there is the live token's part. of docs/logic.md. Owns nothing, and no step takes it back.

122Definition metab n : Z k : kind : hprop ≔

λS m ⇒ onlyS λ_ ⇒ False ∧ ∃reg, object_regionb m_regionsm = Somereg ∧ r_kindreg = k ∧ r_lifereg = Live → r_endreg = b + n

The object b is live, and only the owner of this may end it: the livelive nanofilA live token, liveb, is permission to rely on the object of identity b not being freed. It is the temporal half of a check: the bounds come from b's meta fact, and the free flag passes as long as the token is held. Free consumes it, so whoever frees an object must own it, and an object no one else owns cannot be freed behind the owner's back. For a heap object it is exclusive, or split into fractions for readers; for global data, which is never freed, it is persistent. token.

129Definition liveb : Z : hprop ≔

λS m ⇒ onlyS eqPLiveb ∧ ∃reg, live_atm b reg

The eight bytes at offset o of the object b.

133Definition bytes8b o : Z p : piece : Prop ≔

∃i, 0 ≤ i < 8 ∧ p = PByteb o + i

The eight bytes at offset o of b hold the integer v, while b is live; b is an object, and o is in its bounds.

138Definition icellb o v : Z : hprop ≔

λS m ⇒ onlyS bytes8b o ∧ object_regionb m_regionsm ≠ None ∧ ∀reg, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

The pointer slot at offset o of b holds the pointer x, its address in the bytes and its capability in the aux (aux_holds), while b is live.

146Definition pcellb o : Z x : ptr : hprop ≔

λS m ⇒ onlyS λp ⇒ bytes8b o p ∨ p = PAuxb o ∧ object_regionb m_regionsm ≠ None ∧ ∀reg, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

A list node at b: a 16-byte heap object, live, whose first slot points to next and whose second holds v (C's struct node {struct node *next; long v;}).

156Definition nodeb : Z next : ptr v : Z : hprop ≔

metab 16 Heap ** liveb ** pcellb 0 next ** icellb 8 v%h

The list at p holds the values xs: null for none, else a pointer to a node with its own capability, at an 8-aligned address (a pointer load checks the alignment of its slot), whose next pointer is the rest.

163Fixpoint lstp : ptr xs : listZ : hprop ≔

match xs with

[ ]

⇒

purep = null

v :: xs′

⇒

hexλnext ⇒ purep = mkPtrptr_addrp Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs′%h

One node of a nonempty list at p: its value v, its next pointer next and the rest xs, the body of lst's second case.

173Definition lst_consp : ptr v : Z next : ptr xs : listZ : hprop ≔

purep = mkPtrptr_addrp Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h

More ways memory may change

The assertion P survives what a safepoint may do (safepoint_shape): the same objects, the same bytes, and aux slots changed only as aux_moves allows.

182Definition sp_stableP : hprop : Prop ≔

∀S m m′, PS m → same_regionsm m′ → m_bytesm′ = m_bytesm → aux_movesm m′ → PS m′

The assertion P owns only pieces of objects of the memory.

186Definition owns_registeredP : hprop : Prop ≔

∀S m, PS m → registeredS m

Anything owned: the affine assertion into which pieces no longer needed are dropped.

190Definition htrue: hprop ≔

λS m ⇒ registeredS m

The pieces a pointer slot at offset o of b owns.

193Definition pcell_piecesb o : Z p : piece : Prop ≔

bytes8b o p ∨ p = PAuxb o

The pieces a node at b owns.

196Definition node_piecesb : Z p : piece : Prop ≔

p = PLiveb ∨ bytes8b 0 p ∨ p = PAuxb 0 ∨ bytes8b 8 p

From m to m', every footprint owning nothing of W is kept: what a write of the pieces W does to everyone else.

201Definition keepsW : piece → Prop m m′ : mem : Prop ≔

∀S, ∀p, Sp → ¬Wp → same_onS m m′

From m to m', P becomes P' on the same footprint, which owns the written pieces W: the rule of one write for the owner of what it writes.

207Definition writesW : piece → Prop m m′ : mem P P′ : hprop : Prop ≔

∀S, PS m → P′S m′ ∧ ∀p, Wp → Sp

Facts about objects and bytes

The region object_region finds for b has b for its base.

213Lemma object_region_base

∀ b rs reg

object_regionb rs = Somereg

r_basereg = b

Explore proof 3 tactics

Initial goal

⊢

∀b : Z rs : listregion reg : region, object_regionb rs = Somereg → r_basereg = b

intros b rs reg

b :

rs :

listregion

reg :

⊢

object_regionb rs = Somereg → r_basereg = b

induction rs as | r rs IH ; cbn ; discriminate |

b :

r :

rs :

listregion

reg :

IH :

object_regionb rs = Somereg → r_basereg = b

⊢

r_baser =? b

→

Somer

else

object_regionb rs

Somereg

→

r_basereg = b

destruct Z.eqb_specr_baser b as E | _ ; intros H ; injection H as ← ; exact E | exact IH

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b rs reg

induction rs as | r rs IH ; cbn ; discriminate |

destruct Z.eqb_specr_baser b as E | _ ; intros H ; injection H as ← ; exact E | exact IH

An object live after a change that moves objects only forward was live, with the same region, before it.

221Lemma grows_live_at

∀ m m′ b reg

growsm m′

object_regionb m_regionsm ≠ None

live_atm′ b reg

live_atm b reg

Explore proof 5 tactics

Initial goal

⊢

∀m m′ : mem b : Z reg : region, growsm m′ → object_regionb m_regionsm ≠ None → live_atm′ b reg → live_atm b reg

intros m m′ b reg Hg Hb E L

m, m′ :

b :

reg :

Hg :

growsm m′

Hb :

object_regionb m_regionsm ≠ None

E :

object_regionb m_regionsm′ = Somereg

L :

r_lifereg = Live

⊢

live_atm b reg

destruct object_regionb m_regionsm as reg₀ | eqn: E₀ ; | congruence

m, m′ :

b :

reg :

Hg :

growsm m′

reg₀ :

E₀ :

object_regionb m_regionsm = Somereg₀

Hb :

Somereg₀ ≠ None

E :

object_regionb m_regionsm′ = Somereg

L :

r_lifereg = Live

⊢

live_atm b reg

destruct Hgb reg₀ E₀ as E₁ | L₀ & E₁ ; rewrite E₁ in E ; injection E as ←

2 open

m, m′ :

b :

Hg :

growsm m′

reg₀ :

E₀ :

object_regionb m_regionsm = Somereg₀

Hb :

Somereg₀ ≠ None

L :

r_lifereg₀ = Live

E₁ :

object_regionb m_regionsm′ = Somereg₀

⊢

live_atm b reg₀

focused goal

m, m′ :

b :

Hg :

growsm m′

reg₀ :

E₀ :

object_regionb m_regionsm = Somereg₀

Hb :

Somereg₀ ≠ None

L :

r_lifer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg₀; r_life ≔ Freed = Live

L₀ :

r_lifereg₀ = Live

E₁ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg₀; r_life ≔ Freed

⊢

live_atm b r_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg₀; r_life ≔ Freed

–split ; assumption

deferred goal

m, m′ :

b :

Hg :

growsm m′

reg₀ :

E₀ :

object_regionb m_regionsm = Somereg₀

Hb :

Somereg₀ ≠ None

L :

r_lifer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg₀; r_life ≔ Freed = Live

L₀ :

r_lifereg₀ = Live

E₁ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg₀; r_life ≔ Freed

⊢

live_atm b r_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg₀; r_life ≔ Freed

–discriminate L

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ b reg Hg Hb E L

destruct object_regionb m_regionsm as reg₀ | eqn: E₀ ; | congruence

destruct Hgb reg₀ E₀ as E₁ | L₀ & E₁ ; rewrite E₁ in E ; injection E as ←

–split ; assumption

–discriminate L

A footprint of objects stays one when objects move only forward.

232Lemma grows_registered

∀ m m′ S

growsm m′

registeredS m′

Explore proof 4 tactics

Initial goal

⊢

∀m m′ : mem S : fp, growsm m′ → registeredS m → registeredS m′

intros m m′ S Hg Hr p Hp

m, m′ :

S :

Hg :

growsm m′

Hr :

p :

Hp :

⊢

object_regionpiece_idp m_regionsm′ ≠ None

specialize Hrp Hp

m, m′ :

S :

Hg :

growsm m′

p :

Hr :

object_regionpiece_idp m_regionsm ≠ None

Hp :

⊢

object_regionpiece_idp m_regionsm′ ≠ None

destruct object_regionpiece_idp m_regionsm as reg | eqn: E ; | congruence

m, m′ :

S :

Hg :

growsm m′

p :

reg :

E :

object_regionpiece_idp m_regionsm = Somereg

Hr :

Somereg ≠ None

Hp :

⊢

object_regionpiece_idp m_regionsm′ ≠ None

destruct Hg_ _ E as E′ | _ & E′ ; rewrite E' ; discriminate

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ S Hg Hr p Hp

specialize Hrp Hp

destruct object_regionpiece_idp m_regionsm as reg | eqn: E ; | congruence

destruct Hg_ _ E as E′ | _ & E′ ; rewrite E' ; discriminate

A footprint of objects stays one while objects keep their regions.

240Lemma registered_same

∀ m m′ S

same_regionsm m′

registeredS m′

Explore proof 3 tactics

Initial goal

⊢

∀m m′ : mem S : fp, same_regionsm m′ → registeredS m → registeredS m′

intros m m′ S Hr H p Hp

m, m′ :

S :

Hr :

same_regionsm m′

H :

p :

Hp :

⊢

object_regionpiece_idp m_regionsm′ ≠ None

rewrite Hr

m, m′ :

S :

Hr :

same_regionsm m′

H :

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

exact Hp Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ S Hr H p Hp

rewrite Hr

exact Hp Hp

A freed object stays freed when objects move only forward.

244Lemma freed_in_grows

∀ m m′ c

growsm m′

freed_inm_regionsm c

freed_inm_regionsm′ c

Explore proof 4 tactics

Initial goal

⊢

∀m m′ : mem c : cap, growsm m′ → freed_inm_regionsm c → freed_inm_regionsm′ c

intros m m′ c Hg b & reg & Hc & E & L

m, m′ :

c :

Hg :

growsm m′

b :

reg :

Hc :

c = Objb ∨ c = Rob

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Freed

⊢

freed_inm_regionsm′ c

exists b, reg

m, m′ :

c :

Hg :

growsm m′

b :

reg :

Hc :

c = Objb ∨ c = Rob

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Freed

⊢

c = Objb ∨ c = Rob ∧ object_regionb m_regionsm′ = Somereg ∧ r_lifereg = Freed

split ; exact Hc |

m, m′ :

c :

Hg :

growsm m′

b :

reg :

Hc :

c = Objb ∨ c = Rob

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Freed

⊢

object_regionb m_regionsm′ = Somereg ∧ r_lifereg = Freed

destruct Hgb reg E as E′ | L′ & _ ; split ; assumption | congruence

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ c Hg b & reg & Hc & E & L

exists b, reg

split ; exact Hc |

destruct Hgb reg E as E′ | L′ & _ ; split ; assumption | congruence

A capability that traps as a freed one keeps doing so when objects move only forward: an object that ends has no bounds left.

253Lemma traps_as_freed_grows

∀ m m′ c

growsm m′

traps_as_freedm_regionsm c

traps_as_freedm_regionsm′ c

Explore proof 3 tactics

Initial goal

⊢

∀m m′ : mem c : cap, growsm m′ → traps_as_freedm_regionsm c → traps_as_freedm_regionsm′ c

intros m m′ c Hg H a size r align Hs

m, m′ :

c :

Hg :

growsm m′

H :

traps_as_freedm_regionsm c

a, size :

r :

rights

align :

Hs :

0 < size

⊢

cap_access_resc m_regionsm′ a size r align = SomeRTrapOutOfBounds

specialize Ha size r align Hs

m, m′ :

c :

Hg :

growsm m′

a, size :

r :

rights

align :

H :

cap_access_resc m_regionsm a size r align = SomeRTrapOutOfBounds

Hs :

0 < size

⊢

cap_access_resc m_regionsm′ a size r align = SomeRTrapOutOfBounds

destruct c as | b | b | f | n ; cbn in H |- * ; try exact H ; destruct object_regionb m_regionsm as reg | eqn: E ; try discriminate H ; destruct Hgb reg E as E′ | _ & E′ ; rewrite E' ; try exact H ; cbn [ r_end ] ; destruct Z.leb_specb a ; rewrite proj2Z.leb_gta + size b by lia | ; reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ c Hg H a size r align Hs

specialize Ha size r align Hs

The eight bytes at a read the same where each of them is the same.

264Lemma load_bytes_ext8

∀ m m′ a

∀i, 0 ≤ i < 8 → m_bytesm′ a + i = m_bytesm a + i

load_bytesm′ a 8 = load_bytesm a 8

Explore proof 5 tactics

Initial goal

⊢

∀m m′ : mem a : Z, ∀i : Z, 0 ≤ i < 8 → m_bytesm′ a + i = m_bytesm a + i → load_bytesm′ a 8 = load_bytesm a 8

intros m m′ a H

m, m′ :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm′ a + i = m_bytesm a + i

⊢

load_bytesm′ a 8 = load_bytesm a 8

unfold load_bytes

m, m′ :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm′ a + i = m_bytesm a + i

⊢

fix go n : nat acc : Z {struct n} : Z ≔

match n with

0%nat

⇒

acc

Sn′

⇒

gon′ acc × 256 + m_bytesm′ a + Z.of_natn′

Z.to_nat8 0

fix go n : nat acc : Z {struct n} : Z ≔

match n with

0%nat

⇒

acc

Sn′

⇒

gon′ acc × 256 + m_bytesm a + Z.of_natn′

Z.to_nat8 0

simpl

m, m′ :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm′ a + i = m_bytesm a + i

⊢

m_bytesm′ a + 7 × 256 + m_bytesm′ a + 6 × 256 + m_bytesm′ a + 5 × 256 + m_bytesm′ a + 4 × 256 + m_bytesm′ a + 3 × 256 + m_bytesm′ a + 2 × 256 + m_bytesm′ a + 1 × 256 + m_bytesm′ a + 0 = m_bytesm a + 7 × 256 + m_bytesm a + 6 × 256 + m_bytesm a + 5 × 256 + m_bytesm a + 4 × 256 + m_bytesm a + 3 × 256 + m_bytesm a + 2 × 256 + m_bytesm a + 1 × 256 + m_bytesm a + 0

rewrite ! H by lia

m, m′ :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm′ a + i = m_bytesm a + i

⊢

m_bytesm a + 7 × 256 + m_bytesm a + 6 × 256 + m_bytesm a + 5 × 256 + m_bytesm a + 4 × 256 + m_bytesm a + 3 × 256 + m_bytesm a + 2 × 256 + m_bytesm a + 1 × 256 + m_bytesm a + 0 = m_bytesm a + 7 × 256 + m_bytesm a + 6 × 256 + m_bytesm a + 5 × 256 + m_bytesm a + 4 × 256 + m_bytesm a + 3 × 256 + m_bytesm a + 2 × 256 + m_bytesm a + 1 × 256 + m_bytesm a + 0

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ a H

unfold load_bytes

simpl

rewrite ! H by lia

reflexivity

Bytes read the same in a memory with the same bytes.

272Lemma load_bytes_same

∀ m m′ a n

m_bytesm′ = m_bytesm

load_bytesm′ a n = load_bytesm a n

Explore proof 4 tactics

Initial goal

⊢

∀m m′ : mem a n : Z, m_bytesm′ = m_bytesm → load_bytesm′ a n = load_bytesm a n

intros m m′ a n H

m, m′ :

a, n :

H :

m_bytesm′ = m_bytesm

⊢

load_bytesm′ a n = load_bytesm a n

unfold load_bytes

m, m′ :

a, n :

H :

m_bytesm′ = m_bytesm

⊢

fix go n₀ : nat acc : Z {struct n0} : Z ≔

match n₀ with

0%nat

⇒

acc

Sn′

⇒

gon′ acc × 256 + m_bytesm′ a + Z.of_natn′

Z.to_natn 0

fix go n₀ : nat acc : Z {struct n0} : Z ≔

match n₀ with

0%nat

⇒

acc

Sn′

⇒

gon′ acc × 256 + m_bytesm a + Z.of_natn′

Z.to_natn 0

rewrite H

m, m′ :

a, n :

H :

m_bytesm′ = m_bytesm

⊢

fix go n₀ : nat acc : Z {struct n0} : Z ≔

match n₀ with

0%nat

⇒

acc

Sn′

⇒

gon′ acc × 256 + m_bytesm a + Z.of_natn′

Z.to_natn 0

fix go n₀ : nat acc : Z {struct n0} : Z ≔

match n₀ with

0%nat

⇒

acc

Sn′

⇒

gon′ acc × 256 + m_bytesm a + Z.of_natn′

Z.to_natn 0

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ a n H

unfold load_bytes

rewrite H

reflexivity

Eight zero bytes read as zero.

276Lemma load_bytes_zero

∀ m a

∀i, 0 ≤ i < 8 → m_bytesm a + i = 0

load_bytesm a 8 = 0

Explore proof 5 tactics

Initial goal

⊢

∀m : mem a : Z, ∀i : Z, 0 ≤ i < 8 → m_bytesm a + i = 0 → load_bytesm a 8 = 0

intros m a H

m :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm a + i = 0

⊢

load_bytesm a 8 = 0

unfold load_bytes

m :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm a + i = 0

⊢

fix go n : nat acc : Z {struct n} : Z ≔

match n with

0%nat

⇒

acc

Sn′

⇒

gon′ acc × 256 + m_bytesm a + Z.of_natn′

Z.to_nat8 0

simpl

m :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm a + i = 0

⊢

m_bytesm a + 7 × 256 + m_bytesm a + 6 × 256 + m_bytesm a + 5 × 256 + m_bytesm a + 4 × 256 + m_bytesm a + 3 × 256 + m_bytesm a + 2 × 256 + m_bytesm a + 1 × 256 + m_bytesm a + 0 = 0

rewrite ! H by lia

m :

a :

H :

∀i : Z, 0 ≤ i < 8 → m_bytesm a + i = 0

⊢

0 × 256 + 0 × 256 + 0 × 256 + 0 × 256 + 0 × 256 + 0 × 256 + 0 × 256 + 0 = 0

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m a H

unfold load_bytes

simpl

rewrite ! H by lia

reflexivity

Live objects stay apart while objects keep their regions.

283Lemma live_disjoint_same

∀ m m′

m_regionsm′ = m_regionsm

live_disjointm′

Explore proof 4 tactics

Initial goal

⊢

∀m m′ : mem, m_regionsm′ = m_regionsm → live_disjointm → live_disjointm′

intros m m′ E H b₁ r₁ b₂ r₂

m, m′ :

E :

m_regionsm′ = m_regionsm

H :

b₁ :

r₁ :

b₂ :

r₂ :

⊢

live_atm′ b₁ r₁ → live_atm′ b₂ r₂ → b₁ ≠ b₂ → r_endr₁ ≤ b₂ ∨ r_endr₂ ≤ b₁

unfold live_at

m, m′ :

E :

m_regionsm′ = m_regionsm

H :

b₁ :

r₁ :

b₂ :

r₂ :

⊢

object_regionb₁ m_regionsm′ = Somer₁ ∧ r_lifer₁ = Live → object_regionb₂ m_regionsm′ = Somer₂ ∧ r_lifer₂ = Live → b₁ ≠ b₂ → r_endr₁ ≤ b₂ ∨ r_endr₂ ≤ b₁

rewrite E

m, m′ :

E :

m_regionsm′ = m_regionsm

H :

b₁ :

r₁ :

b₂ :

r₂ :

⊢

object_regionb₁ m_regionsm = Somer₁ ∧ r_lifer₁ = Live → object_regionb₂ m_regionsm = Somer₂ ∧ r_lifer₂ = Live → b₁ ≠ b₂ → r_endr₁ ≤ b₂ ∨ r_endr₂ ≤ b₁

apply H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ E H b₁ r₁ b₂ r₂

unfold live_at

rewrite E

apply H

A memory with the same objects only moves them forward.

287Lemma grows_same

∀ m m′

m_regionsm′ = m_regionsm

growsm m′

Explore proof 4 tactics

Initial goal

⊢

∀m m′ : mem, m_regionsm′ = m_regionsm → growsm m′

intros m m′ E b reg H

m, m′ :

E :

m_regionsm′ = m_regionsm

b :

reg :

H :

object_regionb m_regionsm = Somereg

⊢

object_regionb m_regionsm′ = Somereg ∨ r_lifereg = Live ∧ object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

left

m, m′ :

E :

m_regionsm′ = m_regionsm

b :

reg :

H :

object_regionb m_regionsm = Somereg

⊢

object_regionb m_regionsm′ = Somereg

rewrite E

m, m′ :

E :

m_regionsm′ = m_regionsm

b :

reg :

H :

object_regionb m_regionsm = Somereg

⊢

object_regionb m_regionsm = Somereg

exact H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m m′ E b reg H

left

rewrite E

exact H

A footprint's parts are kept where it is.

291Lemma same_on_sub

∀ S S′ m m′

∀p, S′p → Sp

same_onS m m′

same_onS′ m m′

Explore proof 2 tactics

Initial goal

⊢

∀S S′ : piece → Prop m m′ : mem, ∀p : piece, S′p → Sp → same_onS m m′ → same_onS′ m m′

intros S S′ m m′ H Hs p Hp

S, S′ :

piece → Prop

m, m′ :

H :

∀p : piece, S′p → Sp

Hs :

same_onS m m′

p :

Hp :

S′p

⊢

match p with

⇒

∀reg : region, object_regionb m_regionsm = Somereg → object_regionb m_regionsm′ = Somereg

PByteb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm′ b + o = m_bytesm b + o

PAuxb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⇒

True

exact Hsp Hp Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S S′ m m′ H Hs p Hp

exact Hsp Hp Hp

Kept through two changes is kept through both, when the second keeps every object's region.

296Lemma same_on_trans

∀ S m₁ m₂ m₃

m_regionsm₃ = m_regionsm₂

same_onS m₁ m₂

same_onS m₂ m₃

same_onS m₁ m₃

Explore proof 19 tactics

Initial goal

⊢

∀S : fp m₁ m₂ m₃ : mem, m_regionsm₃ = m_regionsm₂ → same_onS m₁ m₂ → same_onS m₂ m₃ → same_onS m₁ m₃

intros S m₁ m₂ m₃ Hr H₁₂ H₂₃ p Hp

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

H₁₂ :

same_onS m₁ m₂

H₂₃ :

same_onS m₂ m₃

p :

Hp :

⊢

match p with

⇒

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₃ = Somereg

PByteb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₁ b + o

PAuxb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

⇒

True

specialize H₁₂p Hp

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

p :

H₁₂ :

match p with

⇒

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₂ = Somereg

PByteb o

⇒

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

PAuxb o

⇒

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

⇒

True

H₂₃ :

same_onS m₂ m₃

Hp :

⊢

match p with

⇒

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₃ = Somereg

PByteb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₁ b + o

PAuxb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

⇒

True

specialize H₂₃p Hp

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

p :

H₁₂ :

match p with

⇒

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₂ = Somereg

PByteb o

⇒

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

PAuxb o

⇒

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

⇒

True

H₂₃ :

match p with

⇒

∀reg : region, object_regionb m_regionsm₂ = Somereg → object_regionb m_regionsm₃ = Somereg

PByteb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

PAuxb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

⇒

True

Hp :

⊢

match p with

⇒

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₃ = Somereg

PByteb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₁ b + o

PAuxb o

⇒

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

⇒

True

destruct p ; cbn iota beta in H₁₂ , H₂₃ |- *

4 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b :

H₁₂ :

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₂ = Somereg

H₂₃ :

∀reg : region, object_regionb m_regionsm₂ = Somereg → object_regionb m_regionsm₃ = Somereg

Hp :

SPLiveb

⊢

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₃ = Somereg

focused goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₁ b + o

focused goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

focused goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

–intros reg E

4 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b :

H₁₂ :

∀reg : region, object_regionb m_regionsm₁ = Somereg → object_regionb m_regionsm₂ = Somereg

H₂₃ :

∀reg : region, object_regionb m_regionsm₂ = Somereg → object_regionb m_regionsm₃ = Somereg

Hp :

SPLiveb

reg :

E :

object_regionb m_regionsm₁ = Somereg

⊢

object_regionb m_regionsm₃ = Somereg

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

apply H₂₃ , H₁₂ , E

3 open

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

–intros reg Hl Ho He

3 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

reg :

Hl :

live_atm₃ b reg

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

m_bytesm₃ b + o = m_bytesm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

rewrite H₂₃reg Hl Ho He

3 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

reg :

Hl :

live_atm₃ b reg

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

m_bytesm₂ b + o = m_bytesm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

apply H₁₂reg ; | assumption | assumption

3 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

reg :

Hl :

live_atm₃ b reg

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

live_atm₂ b reg

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

unfold live_at in *

3 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, object_regionb m_regionsm₂ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

reg :

Hl :

object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

object_regionb m_regionsm₂ = Somereg ∧ r_lifereg = Live

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

rewrite <- Hr

3 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, object_regionb m_regionsm₂ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_bytesm₂ b + o = m_bytesm₁ b + o

H₂₃ :

∀reg : region, object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_bytesm₃ b + o = m_bytesm₂ b + o

Hp :

SPByteb o

reg :

Hl :

object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

exact Hl

2 open

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

⊢

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

–intros reg Hl Ho He

2 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

reg :

Hl :

live_atm₃ b reg

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

m_auxm₃ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

rewrite H₂₃reg Hl Ho He

2 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

reg :

Hl :

live_atm₃ b reg

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

m_auxm₂ b + o = m_auxm₁ b + o

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

apply H₁₂reg ; | assumption | assumption

2 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, live_atm₂ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, live_atm₃ b reg → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

reg :

Hl :

live_atm₃ b reg

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

live_atm₂ b reg

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

unfold live_at in *

2 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, object_regionb m_regionsm₂ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

reg :

Hl :

object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

object_regionb m_regionsm₂ = Somereg ∧ r_lifereg = Live

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

rewrite <- Hr

2 open

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

b, o :

H₁₂ :

∀reg : region, object_regionb m_regionsm₂ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_auxm₂ b + o = m_auxm₁ b + o

H₂₃ :

∀reg : region, object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live → 0 ≤ o → b + o < r_endreg → m_auxm₃ b + o = m_auxm₂ b + o

Hp :

SPAuxb o

reg :

Hl :

object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o < r_endreg

⊢

object_regionb m_regionsm₃ = Somereg ∧ r_lifereg = Live

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

exact Hl

deferred goal

S :

m₁, m₂, m₃ :

Hr :

m_regionsm₃ = m_regionsm₂

k :

H₁₂, H₂₃ :

True

Hp :

⊢

True

–exact I

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m₁ m₂ m₃ Hr H₁₂ H₂₃ p Hp

specialize H₁₂p Hp

specialize H₂₃p Hp

destruct p ; cbn iota beta in H₁₂ , H₂₃ |- *

–intros reg E

apply H₂₃ , H₁₂ , E

–intros reg Hl Ho He

rewrite H₂₃reg Hl Ho He

apply H₁₂reg ; | assumption | assumption

unfold live_at in *

rewrite <- Hr

exact Hl

–intros reg Hl Ho He

rewrite H₂₃reg Hl Ho He

apply H₁₂reg ; | assumption | assumption

unfold live_at in *

rewrite <- Hr

exact Hl

–exact I

The algebra of `star`

star commutes.

312Lemma star_comm

∀ P Q S m

P ** Q%hS m

Q ** P%hS m

Explore proof 5 tactics

Initial goal

⊢

∀P Q : hprop S : fp m : mem, P ** Q%hS m → Q ** P%hS m

intros P Q S m S₁ & S₂ & HS & Hd & H₁ & H₂

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

Q ** P%hS m

exists S₂, S₁

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

∀p : piece, Sp ↔ S₂p ∨ S₁p ∧ ∀p : piece, ¬S₂p ∧ S₁p ∧ QS₂ m ∧ PS₁ m

split ; intros p ; specialize HSp ; tauto |

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

∀p : piece, ¬S₂p ∧ S₁p ∧ QS₂ m ∧ PS₁ m

split ; intros p ; specialize Hdp ; tauto |

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

QS₂ m ∧ PS₁ m

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q S m S₁ & S₂ & HS & Hd & H₁ & H₂

exists S₂, S₁

split ; intros p ; specialize HSp ; tauto |

split ; intros p ; specialize Hdp ; tauto |

auto

star associates, to the left.

319Lemma star_assoc_l

∀ P Q R S m

P ** Q ** R%hS m

Explore proof 9 tactics

Initial goal

⊢

∀P Q R : hprop S : fp m : mem, P ** Q ** R%hS m → P ** Q ** R%hS m

intros P Q R S m S₁ & S₂₃ & HS & Hd & H₁ & S₂ & S₃ & HS₂₃ & Hd₂₃ & H₂ & H₃

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

P ** Q ** R%hS m

exists λp ⇒ S₁p ∨ S₂p, S₃

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∨ S₃p ∧ ∀p : piece, ¬S₁p ∨ S₂p ∧ S₃p ∧ P ** Q%hλp : piece ⇒ S₁p ∨ S₂p m ∧ RS₃ m

split ; intros p ; specialize HSp ; specialize HS₂₃p ; tauto |

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, ¬S₁p ∨ S₂p ∧ S₃p ∧ P ** Q%hλp : piece ⇒ S₁p ∨ S₂p m ∧ RS₃ m

split ; intros p ; specialize Hdp ; specialize Hd₂₃p ; specialize HS₂₃p ; tauto |

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

P ** Q%hλp : piece ⇒ S₁p ∨ S₂p m ∧ RS₃ m

split ; | exact H₃

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

P ** Q%hλp : piece ⇒ S₁p ∨ S₂p m

exists S₁, S₂

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, S₁p ∨ S₂p ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ PS₁ m ∧ QS₂ m

split ; intros p ; tauto |

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ PS₁ m ∧ QS₂ m

split ; intros p ; specialize Hdp ; specialize HS₂₃p ; tauto |

P, Q, R :

S :

m :

S₁, S₂₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂₃p

Hd :

∀p : piece, ¬S₁p ∧ S₂₃p

H₁ :

PS₁ m

S₂, S₃ :

piece → Prop

HS₂₃ :

∀p : piece, S₂₃p ↔ S₂p ∨ S₃p

Hd₂₃ :

∀p : piece, ¬S₂p ∧ S₃p

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

PS₁ m ∧ QS₂ m

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q R S m S₁ & S₂₃ & HS & Hd & H₁ & S₂ & S₃ & HS₂₃ & Hd₂₃ & H₂ & H₃

exists λp ⇒ S₁p ∨ S₂p, S₃

split ; intros p ; specialize HSp ; specialize HS₂₃p ; tauto |

split ; intros p ; specialize Hdp ; specialize Hd₂₃p ; specialize HS₂₃p ; tauto |

split ; | exact H₃

exists S₁, S₂

split ; intros p ; tauto |

split ; intros p ; specialize Hdp ; specialize HS₂₃p ; tauto |

auto

star associates, to the right.

330Lemma star_assoc_r

∀ P Q R S m

P ** Q ** R%hS m

Explore proof 9 tactics

Initial goal

⊢

∀P Q R : hprop S : fp m : mem, P ** Q ** R%hS m → P ** Q ** R%hS m

intros P Q R S m S₁₂ & S₃ & HS & Hd & S₁ & S₂ & HS₁₂ & Hd₁₂ & H₁ & H₂ & H₃

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

P ** Q ** R%hS m

exists S₁, λp ⇒ S₂p ∨ S₃p

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∨ S₃p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∨ S₃p ∧ PS₁ m ∧ Q ** R%hλp : piece ⇒ S₂p ∨ S₃p m

split ; intros p ; specialize HSp ; specialize HS₁₂p ; tauto |

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, ¬S₁p ∧ S₂p ∨ S₃p ∧ PS₁ m ∧ Q ** R%hλp : piece ⇒ S₂p ∨ S₃p m

split ; intros p ; specialize Hdp ; specialize Hd₁₂p ; specialize HS₁₂p ; tauto |

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

PS₁ m ∧ Q ** R%hλp : piece ⇒ S₂p ∨ S₃p m

split ; exact H₁ |

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

Q ** R%hλp : piece ⇒ S₂p ∨ S₃p m

exists S₂, S₃

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, S₂p ∨ S₃p ↔ S₂p ∨ S₃p ∧ ∀p : piece, ¬S₂p ∧ S₃p ∧ QS₂ m ∧ RS₃ m

split ; intros p ; tauto |

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

∀p : piece, ¬S₂p ∧ S₃p ∧ QS₂ m ∧ RS₃ m

split ; intros p ; specialize Hdp ; specialize HS₁₂p ; tauto |

P, Q, R :

S :

m :

S₁₂, S₃ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁₂p ∨ S₃p

Hd :

∀p : piece, ¬S₁₂p ∧ S₃p

S₁, S₂ :

piece → Prop

HS₁₂ :

∀p : piece, S₁₂p ↔ S₁p ∨ S₂p

Hd₁₂ :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₃ :

RS₃ m

⊢

QS₂ m ∧ RS₃ m

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q R S m S₁₂ & S₃ & HS & Hd & S₁ & S₂ & HS₁₂ & Hd₁₂ & H₁ & H₂ & H₃

exists S₁, λp ⇒ S₂p ∨ S₃p

split ; intros p ; specialize HSp ; specialize HS₁₂p ; tauto |

split ; intros p ; specialize Hdp ; specialize Hd₁₂p ; specialize HS₁₂p ; tauto |

split ; exact H₁ |

exists S₂, S₃

split ; intros p ; tauto |

split ; intros p ; specialize Hdp ; specialize HS₁₂p ; tauto |

auto

The frame rule's monotonicity, on the left.

341Lemma star_mono_l

∀ P P′ Q : hprop S m

∀S m, PS m → P′S m

P ** Q%hS m

P′ ** Q%hS m

Explore proof 3 tactics

Initial goal

⊢

∀P P′ Q : hprop S : fp m : mem, ∀S₀ : fp m₀ : mem, PS₀ m₀ → P′S₀ m₀ → P ** Q%hS m → P′ ** Q%hS m

intros P P′ Q S m H S₁ & S₂ & HS & Hd & H₁ & H₂

P, P′, Q :

S :

m :

H :

∀S : fp m : mem, PS m → P′S m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

P′ ** Q%hS m

exists S₁, S₂

P, P′, Q :

S :

m :

H :

∀S : fp m : mem, PS m → P′S m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ P′S₁ m ∧ QS₂ m

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P P′ Q S m H S₁ & S₂ & HS & Hd & H₁ & H₂

exists S₁, S₂

auto

The frame rule's monotonicity, on the right.

346Lemma star_mono_r

∀ P Q Q′ : hprop S m

∀S m, QS m → Q′S m

P ** Q%hS m

P ** Q′%hS m

Explore proof 3 tactics

Initial goal

⊢

∀P Q Q′ : hprop S : fp m : mem, ∀S₀ : fp m₀ : mem, QS₀ m₀ → Q′S₀ m₀ → P ** Q%hS m → P ** Q′%hS m

intros P Q Q′ S m H S₁ & S₂ & HS & Hd & H₁ & H₂

P, Q, Q′ :

S :

m :

H :

∀S : fp m : mem, QS m → Q′S m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

P ** Q′%hS m

exists S₁, S₂

P, Q, Q′ :

S :

m :

H :

∀S : fp m : mem, QS m → Q′S m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ PS₁ m ∧ Q′S₂ m

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q Q′ S m H S₁ & S₂ & HS & Hd & H₁ & H₂

exists S₁, S₂

auto

The first two parts of a star trade places.

351Lemma star_swap

∀ P Q R S m

P ** Q ** R%hS m

Q ** P ** R%hS m

Explore proof 6 tactics

Initial goal

⊢

∀P Q R : hprop S : fp m : mem, P ** Q ** R%hS m → Q ** P ** R%hS m

intros P Q R S m H

P, Q, R :

S :

m :

H :

P ** Q ** R%hS m

⊢

Q ** P ** R%hS m

apply star_assoc_r

P, Q, R :

S :

m :

H :

P ** Q ** R%hS m

⊢

Q ** P ** R%hS m

apply star_assoc_l in H

P, Q, R :

S :

m :

H :

P ** Q ** R%hS m

⊢

Q ** P ** R%hS m

revert H

P, Q, R :

S :

m :

⊢

P ** Q ** R%hS m → Q ** P ** R%hS m

apply star_mono_l

P, Q, R :

S :

m :

⊢

∀S₀ : fp m₀ : mem, P ** Q%hS₀ m₀ → Q ** P%hS₀ m₀

apply star_comm

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q R S m H

apply star_assoc_r

apply star_assoc_l in H

revert H

apply star_mono_l

apply star_comm

emp is a unit, on the right.

358Lemma star_emp_r

∀ P S m

PS m

P ** emp%hS m

Explore proof 5 tactics

Initial goal

⊢

∀P : fp → mem → Prop S : fp m : mem, PS m → P ** emp%hS m

intros P S m H

P :

fp → mem → Prop

S :

m :

H :

PS m

⊢

P ** emp%hS m

exists S, λ_ ⇒ False

P :

fp → mem → Prop

S :

m :

H :

PS m

⊢

∀p : piece, Sp ↔ Sp ∨ False ∧ ∀p : piece, ¬Sp ∧ False ∧ PS m ∧ empλ_ : piece ⇒ False m

split ; intros p ; tauto |

P :

fp → mem → Prop

S :

m :

H :

PS m

⊢

∀p : piece, ¬Sp ∧ False ∧ PS m ∧ empλ_ : piece ⇒ False m

split ; intros p ; tauto |

P :

fp → mem → Prop

S :

m :

H :

PS m

⊢

PS m ∧ empλ_ : piece ⇒ False m

split ; exact H | intros p ; tauto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P S m H

exists S, λ_ ⇒ False

split ; intros p ; tauto |

split ; exact H | intros p ; tauto

emp is a unit, on the left.

365Lemma star_emp_l

∀ P S m

PS m

emp ** P%hS m

Explore proof 2 tactics

Initial goal

⊢

∀P : fp → mem → Prop S : fp m : mem, PS m → emp ** P%hS m

intros P S m H

P :

fp → mem → Prop

S :

m :

H :

PS m

⊢

emp ** P%hS m

apply star_comm , star_emp_r , H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P S m H

apply star_comm , star_emp_r , H

And back: without emp, P holds of a footprint with the same pieces. Footprints are predicates, so this is as close as the logic gets to equality of footprints without extensionality.

371Lemma star_emp_elim

∀ P S m

emp ** P%hS m

∃S′, ∀p, Sp ↔ S′p ∧ PS′ m

Explore proof 7 tactics

Initial goal

⊢

∀P : hprop S : fp m : mem, emp ** P%hS m → ∃S′ : piece → Prop, ∀p : piece, Sp ↔ S′p ∧ PS′ m

intros P S m S₁ & S₂ & HS & _ & H₁ & H₂

P :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

H₁ :

empS₁ m

H₂ :

PS₂ m

⊢

∃S′ : piece → Prop, ∀p : piece, Sp ↔ S′p ∧ PS′ m

exists S₂

P :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

H₁ :

empS₁ m

H₂ :

PS₂ m

⊢

∀p : piece, Sp ↔ S₂p ∧ PS₂ m

split ; | exact H₂

P :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

H₁ :

empS₁ m

H₂ :

PS₂ m

⊢

∀p : piece, Sp ↔ S₂p

intros p

P :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

H₁ :

empS₁ m

H₂ :

PS₂ m

p :

⊢

Sp ↔ S₂p

specialize HSp

P :

S :

m :

S₁, S₂ :

piece → Prop

p :

HS :

Sp ↔ S₁p ∨ S₂p

H₁ :

empS₁ m

H₂ :

PS₂ m

⊢

Sp ↔ S₂p

specialize H₁p

P :

S :

m :

S₁, S₂ :

piece → Prop

p :

HS :

Sp ↔ S₁p ∨ S₂p

H₁ :

S₁p ↔ λ_ : piece ⇒ Falsep

H₂ :

PS₂ m

⊢

Sp ↔ S₂p

tauto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P S m S₁ & S₂ & HS & _ & H₁ & H₂

exists S₂

split ; | exact H₂

intros p

specialize HSp

specialize H₁p

tauto

A pure fact on no footprint may be added.

378Lemma star_pure_intro

∀ phi : Prop Q S m

phi

QS m

purephi ** Q%hS m

Explore proof 8 tactics

Initial goal

⊢

∀phi : Prop Q : fp → mem → Prop S : fp m : mem, phi → QS m → purephi ** Q%hS m

intros phi Q S m Hp H

phi :

Prop

Q :

fp → mem → Prop

S :

m :

Hp :

phi

H :

QS m

⊢

purephi ** Q%hS m

apply star_comm

phi :

Prop

Q :

fp → mem → Prop

S :

m :

Hp :

phi

H :

QS m

⊢

Q ** purephi%hS m

destruct star_emp_rQ S m H as S₁ & S₂ & HS & Hd & H₁ & H₂

phi :

Prop

Q :

fp → mem → Prop

S :

m :

Hp :

phi

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

Q ** purephi%hS m

exists S₁, S₂

phi :

Prop

Q :

fp → mem → Prop

S :

m :

Hp :

phi

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ QS₁ m ∧ purephi S₂ m

split ; exact HS |

phi :

Prop

Q :

fp → mem → Prop

S :

m :

Hp :

phi

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ QS₁ m ∧ purephi S₂ m

split ; exact Hd |

phi :

Prop

Q :

fp → mem → Prop

S :

m :

Hp :

phi

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

QS₁ m ∧ purephi S₂ m

split ; exact H₁ |

phi :

Prop

Q :

fp → mem → Prop

S :

m :

Hp :

phi

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

purephi S₂ m

split ; exact H₂ | exact Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros phi Q S m Hp H

apply star_comm

destruct star_emp_rQ S m H as S₁ & S₂ & HS & Hd & H₁ & H₂

exists S₁, S₂

split ; exact HS |

split ; exact Hd |

split ; exact H₁ |

split ; exact H₂ | exact Hp

The left part of a star holds of part of the footprint.

382Lemma star_elim_l

∀ P Q S m

P ** Q%hS m

∃S₁, PS₁ m

Explore proof 3 tactics

Initial goal

⊢

∀P Q : hprop S : fp m : mem, P ** Q%hS m → ∃S₁ : fp, PS₁ m

intros P Q S m S₁ & S₂ & _ & _ & H₁ & _

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

H₁ :

PS₁ m

⊢

∃S₀ : fp, PS₀ m

exists S₁

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

H₁ :

PS₁ m

⊢

PS₁ m

exact H₁

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q S m S₁ & S₂ & _ & _ & H₁ & _

exists S₁

exact H₁

The right part of a star holds of part of the footprint.

386Lemma star_elim_r

∀ P Q S m

P ** Q%hS m

∃S₂, QS₂ m

Explore proof 3 tactics

Initial goal

⊢

∀P Q : hprop S : fp m : mem, P ** Q%hS m → ∃S₂ : fp, QS₂ m

intros P Q S m S₁ & S₂ & _ & _ & _ & H₂

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

H₂ :

QS₂ m

⊢

∃S₀ : fp, QS₀ m

exists S₂

P, Q :

S :

m :

S₁, S₂ :

piece → Prop

H₂ :

QS₂ m

⊢

QS₂ m

exact H₂

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q S m S₁ & S₂ & _ & _ & _ & H₂

exists S₂

exact H₂

An existential on the left of a star comes out.

390Lemma star_hex_l

∀ A : Type P : A → hprop Q S m

hexP ** Q%hS m ↔ ∃x, Px ** Q%hS m

Explore proof 10 tactics

Initial goal

⊢

∀A : Type P : A → hprop Q : hprop S : fp m : mem, hexP ** Q%hS m ↔ ∃x : A, Px ** Q%hS m

intros A P Q S m

A :

Type

P :

A → hprop

Q :

S :

m :

⊢

hexP ** Q%hS m ↔ ∃x : A, Px ** Q%hS m

split

2 open

A :

Type

P :

A → hprop

Q :

S :

m :

⊢

hexP ** Q%hS m → ∃x : A, Px ** Q%hS m

focused goal

A :

Type

P :

A → hprop

Q :

S :

m :

⊢

∃x : A, Px ** Q%hS m → hexP ** Q%hS m

–intros S₁ & S₂ & HS & Hd & x & H₁ & H₂

2 open

A :

Type

P :

A → hprop

Q :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

x :

H₁ :

Px S₁ m

H₂ :

QS₂ m

⊢

∃x₀ : A, Px₀ ** Q%hS m

deferred goal

A :

Type

P :

A → hprop

Q :

S :

m :

⊢

∃x : A, Px ** Q%hS m → hexP ** Q%hS m

exists x, S₁, S₂

2 open

A :

Type

P :

A → hprop

Q :

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

x :

H₁ :

Px S₁ m

H₂ :

QS₂ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ Px S₁ m ∧ QS₂ m

deferred goal

A :

Type

P :

A → hprop

Q :

S :

m :

⊢

∃x : A, Px ** Q%hS m → hexP ** Q%hS m

auto

deferred goal

A :

Type

P :

A → hprop

Q :

S :

m :

⊢

∃x : A, Px ** Q%hS m → hexP ** Q%hS m

–intros x & S₁ & S₂ & HS & Hd & H₁ & H₂

A :

Type

P :

A → hprop

Q :

S :

m :

x :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

Px S₁ m

H₂ :

QS₂ m

⊢

hexP ** Q%hS m

exists S₁, S₂

A :

Type

P :

A → hprop

Q :

S :

m :

x :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

Px S₁ m

H₂ :

QS₂ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ hexP S₁ m ∧ QS₂ m

split ; exact HS |

A :

Type

P :

A → hprop

Q :

S :

m :

x :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

Px S₁ m

H₂ :

QS₂ m

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ hexP S₁ m ∧ QS₂ m

split ; exact Hd |

A :

Type

P :

A → hprop

Q :

S :

m :

x :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

Px S₁ m

H₂ :

QS₂ m

⊢

hexP S₁ m ∧ QS₂ m

split ; exists x ; exact H₁ | exact H₂

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros A P Q S m

split

–intros S₁ & S₂ & HS & Hd & x & H₁ & H₂

exists x, S₁, S₂

auto

–intros x & S₁ & S₂ & HS & Hd & H₁ & H₂

exists S₁, S₂

split ; exact HS |

split ; exact Hd |

split ; exists x ; exact H₁ | exact H₂

htrue holds of no footprint, so it may be added.

399Lemma htrue_intro

∀ Q S m

QS m

htrue ** Q%hS m

Explore proof 9 tactics

Initial goal

⊢

∀Q : fp → mem → Prop S : fp m : mem, QS m → htrue ** Q%hS m

intros Q S m H

Q :

fp → mem → Prop

S :

m :

H :

QS m

⊢

htrue ** Q%hS m

apply star_comm

Q :

fp → mem → Prop

S :

m :

H :

QS m

⊢

Q ** htrue%hS m

destruct star_emp_rQ S m H as S₁ & S₂ & HS & Hd & H₁ & H₂

Q :

fp → mem → Prop

S :

m :

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

Q ** htrue%hS m

exists S₁, S₂

Q :

fp → mem → Prop

S :

m :

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ QS₁ m ∧ htrueS₂ m

split ; exact HS |

Q :

fp → mem → Prop

S :

m :

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ QS₁ m ∧ htrueS₂ m

split ; exact Hd |

Q :

fp → mem → Prop

S :

m :

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

QS₁ m ∧ htrueS₂ m

split ; exact H₁ |

Q :

fp → mem → Prop

S :

m :

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

⊢

htrueS₂ m

intros p Hp

Q :

fp → mem → Prop

S :

m :

H :

QS m

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

empS₂ m

p :

Hp :

S₂p

⊢

object_regionpiece_idp m_regionsm ≠ None

destruct proj1H₂p Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros Q S m H

apply star_comm

destruct star_emp_rQ S m H as S₁ & S₂ & HS & Hd & H₁ & H₂

exists S₁, S₂

split ; exact HS |

split ; exact Hd |

split ; exact H₁ |

intros p Hp

destruct proj1H₂p Hp

What owns only pieces of objects can be dropped into htrue.

406Lemma star_drop

∀ P Q S m

P ** Q%hS m

htrue ** Q%hS m

Explore proof 3 tactics

Initial goal

⊢

∀P Q : hprop S : fp m : mem, owns_registeredP → P ** Q%hS m → htrue ** Q%hS m

intros P Q S m HP

P, Q :

S :

m :

HP :

⊢

P ** Q%hS m → htrue ** Q%hS m

apply star_mono_l

P, Q :

S :

m :

HP :

⊢

∀S₀ : fp m₀ : mem, PS₀ m₀ → htrueS₀ m₀

exact HP

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q S m HP

apply star_mono_l

exact HP

htrue absorbs what owns only pieces of objects.

410Lemma htrue_absorb

∀ P R S m

P ** htrue ** R%hS m

htrue ** R%hS m

Explore proof 6 tactics

Initial goal

⊢

∀P R : hprop S : fp m : mem, owns_registeredP → P ** htrue ** R%hS m → htrue ** R%hS m

intros P R S m HP H

P, R :

S :

m :

HP :

H :

P ** htrue ** R%hS m

⊢

htrue ** R%hS m

apply star_assoc_l in H

P, R :

S :

m :

HP :

H :

P ** htrue ** R%hS m

⊢

htrue ** R%hS m

revert H

P, R :

S :

m :

HP :

⊢

P ** htrue ** R%hS m → htrue ** R%hS m

apply star_mono_l

P, R :

S :

m :

HP :

⊢

∀S₀ : fp m₀ : mem, P ** htrue%hS₀ m₀ → htrueS₀ m₀

intros S₀ m₀ S₁ & S₂ & HS & _ & H₁ & H₂ p Hp

P, R :

S :

m :

HP :

S₀ :

m₀ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, S₀p ↔ S₁p ∨ S₂p

H₁ :

PS₁ m₀

H₂ :

htrueS₂ m₀

p :

Hp :

S₀p

⊢

object_regionpiece_idp m_regionsm₀ ≠ None

apply HS in Hp as Hp | Hp ; exact HP_ _ H₁ p Hp | exact H₂p Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P R S m HP H

apply star_assoc_l in H

revert H

apply star_mono_l

intros S₀ m₀ S₁ & S₂ & HS & _ & H₁ & H₂ p Hp

apply HS in Hp as Hp | Hp ; exact HP_ _ H₁ p Hp | exact H₂p Hp

htrue absorbs a part that owns only pieces of objects from in front of another.

418Lemma star_absorb

∀ P Q R S m

P ** Q ** htrue ** R%hS m

Q ** htrue ** R%hS m

Explore proof 6 tactics

Initial goal

⊢

∀P Q R : hprop S : fp m : mem, owns_registeredP → P ** Q ** htrue ** R%hS m → Q ** htrue ** R%hS m

intros P Q R S m HP H

P, Q, R :

S :

m :

HP :

H :

P ** Q ** htrue ** R%hS m

⊢

Q ** htrue ** R%hS m

apply star_swap in H

P, Q, R :

S :

m :

HP :

H :

Q ** P ** htrue ** R%hS m

⊢

Q ** htrue ** R%hS m

revert H

P, Q, R :

S :

m :

HP :

⊢

Q ** P ** htrue ** R%hS m → Q ** htrue ** R%hS m

apply star_mono_r

P, Q, R :

S :

m :

HP :

⊢

∀S₀ : fp m₀ : mem, P ** htrue ** R%hS₀ m₀ → htrue ** R%hS₀ m₀

intros S₀ m₀

P, Q, R :

S :

m :

HP :

S₀ :

m₀ :

⊢

P ** htrue ** R%hS₀ m₀ → htrue ** R%hS₀ m₀

apply htrue_absorb , HP

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q R S m HP H

apply star_swap in H

revert H

apply star_mono_r

intros S₀ m₀

apply htrue_absorb , HP

Stability of each assertion

A star is stable if its parts are.

428Lemma star_stable

∀ P Q

stableP ** Q%h

Explore proof 9 tactics

Initial goal

⊢

∀P Q : hprop, stableP → stableQ → stableP ** Q%h

intros P Q HP HQ S m m′ S₁ & S₂ & HS & Hd & H₁ & H₂ Hs Hg

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

P ** Q%hS m′

exists S₁, S₂

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ PS₁ m′ ∧ QS₂ m′

split ; exact HS |

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ PS₁ m′ ∧ QS₂ m′

split ; exact Hd |

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

PS₁ m′ ∧ QS₂ m′

split

2 open

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

PS₁ m′

focused goal

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

QS₂ m′

–apply HPS₁ m m′ H₁ ; | exact Hg

2 open

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

same_onS₁ m m′

deferred goal

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

QS₂ m′

apply same_on_subS ; intros p Hp ; apply HS ; left ; exact Hp | exact Hs

deferred goal

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

QS₂ m′

–apply HQS₂ m m′ H₂ ; | exact Hg

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

same_onS₂ m m′

apply same_on_subS ; intros p Hp ; apply HS ; right ; exact Hp | exact Hs

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q HP HQ S m m′ S₁ & S₂ & HS & Hd & H₁ & H₂ Hs Hg

exists S₁, S₂

split ; exact HS |

split ; exact Hd |

split

–apply HPS₁ m m′ H₁ ; | exact Hg

apply same_on_subS ; intros p Hp ; apply HS ; left ; exact Hp | exact Hs

–apply HQS₂ m m′ H₂ ; | exact Hg

apply same_on_subS ; intros p Hp ; apply HS ; right ; exact Hp | exact Hs

A star survives a safepoint if its parts do.

437Lemma star_sp_stable

∀ P Q

sp_stableP ** Q%h

Explore proof 5 tactics

Initial goal

⊢

∀P Q : hprop, sp_stableP → sp_stableQ → sp_stableP ** Q%h

intros P Q HP HQ S m m′ S₁ & S₂ & HS & Hd & H₁ & H₂ Hr Hb Ha

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hr :

same_regionsm m′

Hb :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

P ** Q%hS m′

exists S₁, S₂

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hr :

same_regionsm m′

Hb :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ PS₁ m′ ∧ QS₂ m′

split ; exact HS |

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hr :

same_regionsm m′

Hb :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ PS₁ m′ ∧ QS₂ m′

split ; exact Hd |

P, Q :

HP :

HQ :

S :

m, m′ :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

Hr :

same_regionsm m′

Hb :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

PS₁ m′ ∧ QS₂ m′

split ; exact HP_ _ _ H₁ Hr Hb Ha | exact HQ_ _ _ H₂ Hr Hb Ha

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q HP HQ S m m′ S₁ & S₂ & HS & Hd & H₁ & H₂ Hr Hb Ha

exists S₁, S₂

split ; exact HS |

split ; exact Hd |

split ; exact HP_ _ _ H₁ Hr Hb Ha | exact HQ_ _ _ H₂ Hr Hb Ha

A star owns pieces of objects if its parts do.

444Lemma star_registered

∀ P Q

owns_registeredQ

owns_registeredP ** Q%h

Explore proof 2 tactics

Initial goal

⊢

∀P Q : hprop, owns_registeredP → owns_registeredQ → owns_registeredP ** Q%h

intros P Q HP HQ S m S₁ & S₂ & HS & Hd & H₁ & H₂ p Hp

P, Q :

HP :

HQ :

owns_registeredQ

S :

m :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

apply HS in Hp as Hp | Hp ; exact HP_ _ H₁ p Hp | exact HQ_ _ H₂ p Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros P Q HP HQ S m S₁ & S₂ & HS & Hd & H₁ & H₂ p Hp

apply HS in Hp as Hp | Hp ; exact HP_ _ H₁ p Hp | exact HQ_ _ H₂ p Hp

hex is stable if each instance is.

451Lemma hex_stable

∀ A : Type P : A → hprop

∀x, stablePx

stablehexP

Explore proof 3 tactics

Initial goal

⊢

∀A : Type P : A → hprop, ∀x : A, stablePx → stablehexP

intros A P HP S m m′ x & H Hs Hg

A :

Type

P :

A → hprop

HP :

∀x : A, stablePx

S :

m, m′ :

x :

H :

Px S m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

hexP S m′

exists x

A :

Type

P :

A → hprop

HP :

∀x : A, stablePx

S :

m, m′ :

x :

H :

Px S m

Hs :

same_onS m m′

Hg :

growsm m′

⊢

Px S m′

exact HPx _ _ _ H Hs Hg

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros A P HP S m m′ x & H Hs Hg

exists x

exact HPx _ _ _ H Hs Hg

hex survives a safepoint if each instance does.

455Lemma hex_sp_stable

∀ A : Type P : A → hprop

∀x, sp_stablePx

sp_stablehexP

Explore proof 3 tactics

Initial goal

⊢

∀A : Type P : A → hprop, ∀x : A, sp_stablePx → sp_stablehexP

intros A P HP S m m′ x & H Hr Hb Ha

A :

Type

P :

A → hprop

HP :

∀x : A, sp_stablePx

S :

m, m′ :

x :

H :

Px S m

Hr :

same_regionsm m′

Hb :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

hexP S m′

exists x

A :

Type

P :

A → hprop

HP :

∀x : A, sp_stablePx

S :

m, m′ :

x :

H :

Px S m

Hr :

same_regionsm m′

Hb :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

Px S m′

exact HPx _ _ _ H Hr Hb Ha

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros A P HP S m m′ x & H Hr Hb Ha

exists x

exact HPx _ _ _ H Hr Hb Ha

hex owns pieces of objects if each instance does.

459Lemma hex_registered

∀ A : Type P : A → hprop

∀x, owns_registeredPx

owns_registeredhexP

Explore proof 2 tactics

Initial goal

⊢

∀A : Type P : A → hprop, ∀x : A, owns_registeredPx → owns_registeredhexP

intros A P HP S m x & H

A :

Type

P :

A → hprop

HP :

∀x : A, owns_registeredPx

S :

m :

x :

H :

Px S m

⊢

exact HPx _ _ H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros A P HP S m x & H

exact HPx _ _ H

emp is stable.

463Lemma emp_stable

stableemp

Explore proof 2 tactics

Initial goal

⊢

stableemp

intros S m m′ H _ _

S :

m, m′ :

H :

empS m

⊢

empS m′

exact H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m m′ H _ _

exact H

emp survives a safepoint.

467Lemma emp_sp_stable

sp_stableemp

Explore proof 2 tactics

Initial goal

⊢

sp_stableemp

intros S m m′ H _ _ _

S :

m, m′ :

H :

empS m

⊢

empS m′

exact H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m m′ H _ _ _

exact H

emp owns nothing.

471Lemma emp_registered

owns_registeredemp

Explore proof 2 tactics

Initial goal

⊢

owns_registeredemp

intros S m H p Hp

S :

m :

H :

empS m

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

destruct proj1Hp Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m H p Hp

destruct proj1Hp Hp

pure is stable.

475Lemma pure_stable

∀ phi

stablepurephi

Explore proof 2 tactics

Initial goal

⊢

∀phi : Prop, stablepurephi

intros phi S m m′ H _ _

phi :

Prop

S :

m, m′ :

H :

purephi S m

⊢

purephi S m′

exact H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros phi S m m′ H _ _

exact H

pure survives a safepoint.

479Lemma pure_sp_stable

∀ phi

sp_stablepurephi

Explore proof 2 tactics

Initial goal

⊢

∀phi : Prop, sp_stablepurephi

intros phi S m m′ H _ _ _

phi :

Prop

S :

m, m′ :

H :

purephi S m

⊢

purephi S m′

exact H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros phi S m m′ H _ _ _

exact H

pure owns nothing.

483Lemma pure_registered

∀ phi

owns_registeredpurephi

Explore proof 2 tactics

Initial goal

⊢

∀phi : Prop, owns_registeredpurephi

intros phi S m H _ p Hp

phi :

Prop

S :

m :

H :

onlyS λ_ : piece ⇒ False

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

destruct proj1Hp Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros phi S m H _ p Hp

destruct proj1Hp Hp

htrue is stable.

487Lemma htrue_stable

stablehtrue

Explore proof 2 tactics

Initial goal

⊢

stablehtrue

intros S m m′ H _ Hg

S :

m, m′ :

H :

htrueS m

Hg :

growsm m′

⊢

htrueS m′

exact grows_registered_ _ _ Hg H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m m′ H _ Hg

exact grows_registered_ _ _ Hg H

htrue survives a safepoint.

491Lemma htrue_sp_stable

sp_stablehtrue

Explore proof 2 tactics

Initial goal

⊢

sp_stablehtrue

intros S m m′ H Hr _ _

S :

m, m′ :

H :

htrueS m

Hr :

same_regionsm m′

⊢

htrueS m′

exact registered_same_ _ _ Hr H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m m′ H Hr _ _

exact registered_same_ _ _ Hr H

htrue owns pieces of objects.

495Lemma htrue_registered

owns_registeredhtrue

Explore proof 2 tactics

Initial goal

⊢

owns_registeredhtrue

intros S m H

S :

m :

H :

htrueS m

⊢

exact H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m H

exact H

meta is stable: an object that ends keeps its kind, and has no bounds to speak of.

500Lemma meta_stable

∀ b n k

stablemetab n k

Explore proof 8 tactics

Initial goal

⊢

∀b n : Z k : kind, stablemetab n k

intros b n k S m m′ HS & reg & E & Hk & Hl _ Hg

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

⊢

metab n k S m′

split ; exact HS |

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

⊢

∃reg₀ : region, object_regionb m_regionsm′ = Somereg₀ ∧ r_kindreg₀ = k ∧ r_lifereg₀ = Live → r_endreg₀ = b + n

destruct Hgb reg E as E′ | L & E′

2 open

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

E′ :

object_regionb m_regionsm′ = Somereg

⊢

∃reg₀ : region, object_regionb m_regionsm′ = Somereg₀ ∧ r_kindreg₀ = k ∧ r_lifereg₀ = Live → r_endreg₀ = b + n

focused goal

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

L :

r_lifereg = Live

E′ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

⊢

∃reg₀ : region, object_regionb m_regionsm′ = Somereg₀ ∧ r_kindreg₀ = k ∧ r_lifereg₀ = Live → r_endreg₀ = b + n

–exists reg

2 open

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

E′ :

object_regionb m_regionsm′ = Somereg

⊢

object_regionb m_regionsm′ = Somereg ∧ r_kindreg = k ∧ r_lifereg = Live → r_endreg = b + n

deferred goal

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

L :

r_lifereg = Live

E′ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

⊢

∃reg₀ : region, object_regionb m_regionsm′ = Somereg₀ ∧ r_kindreg₀ = k ∧ r_lifereg₀ = Live → r_endreg₀ = b + n

auto

deferred goal

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

L :

r_lifereg = Live

E′ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

⊢

∃reg₀ : region, object_regionb m_regionsm′ = Somereg₀ ∧ r_kindreg₀ = k ∧ r_lifereg₀ = Live → r_endreg₀ = b + n

–eexists

2 open

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

L :

r_lifereg = Live

E′ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

⊢

object_regionb m_regionsm′ = Some?reg ∧ r_kind?reg = k ∧ r_life?reg = Live → r_end?reg = b + n

shelved goal

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

L :

r_lifereg = Live

E′ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

⊢

split ; exact E′ |

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hg :

growsm m′

L :

r_lifereg = Live

E′ :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

⊢

r_kindr_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed = k ∧ r_lifer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed = Live → r_endr_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed = b + n

split ; exact Hk | discriminate

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b n k S m m′ HS & reg & E & Hk & Hl _ Hg

split ; exact HS |

destruct Hgb reg E as E′ | L & E′

–exists reg

auto

–eexists

split ; exact E′ |

split ; exact Hk | discriminate

meta survives a safepoint.

509Lemma meta_sp_stable

∀ b n k

sp_stablemetab n k

Explore proof 5 tactics

Initial goal

⊢

∀b n : Z k : kind, sp_stablemetab n k

intros b n k S m m′ HS & reg & E & Hk & Hl Hr _ _

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hr :

same_regionsm m′

⊢

metab n k S m′

split ; exact HS |

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hr :

same_regionsm m′

⊢

∃reg₀ : region, object_regionb m_regionsm′ = Somereg₀ ∧ r_kindreg₀ = k ∧ r_lifereg₀ = Live → r_endreg₀ = b + n

exists reg

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hr :

same_regionsm m′

⊢

object_regionb m_regionsm′ = Somereg ∧ r_kindreg = k ∧ r_lifereg = Live → r_endreg = b + n

rewrite Hr

b, n :

k :

S :

m, m′ :

HS :

onlyS λ_ : piece ⇒ False

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = k

Hl :

r_lifereg = Live → r_endreg = b + n

Hr :

same_regionsm m′

⊢

object_regionb m_regionsm = Somereg ∧ r_kindreg = k ∧ r_lifereg = Live → r_endreg = b + n

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b n k S m m′ HS & reg & E & Hk & Hl Hr _ _

split ; exact HS |

exists reg

rewrite Hr

auto

meta owns nothing.

513Lemma meta_registered

∀ b n k

owns_registeredmetab n k

Explore proof 2 tactics

Initial goal

⊢

∀b n : Z k : kind, owns_registeredmetab n k

intros b n k S m H _ p Hp

b, n :

k :

S :

m :

H :

onlyS λ_ : piece ⇒ False

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

destruct proj1Hp Hp

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b n k S m H _ p Hp

destruct proj1Hp Hp

live is stable: its owner keeps the object's region.

517Lemma live_stable

∀ b

stableliveb

Explore proof 5 tactics

Initial goal

⊢

∀b : Z, stableliveb

intros b S m m′ HS & reg & E & L Hs _

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hs :

same_onS m m′

⊢

liveb S m′

split ; exact HS |

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hs :

same_onS m m′

⊢

∃reg₀ : region, live_atm′ b reg₀

exists reg

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hs :

same_onS m m′

⊢

live_atm′ b reg

split ; | exact L

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hs :

same_onS m m′

⊢

object_regionb m_regionsm′ = Somereg

exact HsPLiveb proj2HS_ eq_refl reg E

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b S m m′ HS & reg & E & L Hs _

split ; exact HS |

exists reg

split ; | exact L

exact HsPLiveb proj2HS_ eq_refl reg E

live survives a safepoint.

524Lemma live_sp_stable

∀ b

sp_stableliveb

Explore proof 6 tactics

Initial goal

⊢

∀b : Z, sp_stableliveb

intros b S m m′ HS & reg & E & L Hr _ _

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hr :

same_regionsm m′

⊢

liveb S m′

split ; exact HS |

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hr :

same_regionsm m′

⊢

∃reg₀ : region, live_atm′ b reg₀

exists reg

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hr :

same_regionsm m′

⊢

live_atm′ b reg

unfold live_at

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hr :

same_regionsm m′

⊢

object_regionb m_regionsm′ = Somereg ∧ r_lifereg = Live

rewrite Hr

b :

S :

m, m′ :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

Hr :

same_regionsm m′

⊢

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b S m m′ HS & reg & E & L Hr _ _

split ; exact HS |

exists reg

unfold live_at

rewrite Hr

auto

live owns a piece of its object.

528Lemma live_registered

∀ b

owns_registeredliveb

Explore proof 5 tactics

Initial goal

⊢

∀b : Z, owns_registeredliveb

intros b S m HS & reg & E & L p Hp

b :

S :

m :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

apply HS in Hp

b :

S :

m :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

p :

Hp :

PLiveb = p

⊢

object_regionpiece_idp m_regionsm ≠ None

subst p

b :

S :

m :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

⊢

object_regionpiece_idPLiveb m_regionsm ≠ None

cbn

b :

S :

m :

HS :

onlyS eqPLiveb

reg :

E :

object_regionb m_regionsm = Somereg

L :

r_lifereg = Live

⊢

object_regionb m_regionsm ≠ None

congruence

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b S m HS & reg & E & L p Hp

apply HS in Hp

subst p

cbn

congruence

icell is stable: while the object is live it is the same object, and its owned bytes are kept.

533Lemma icell_stable

∀ b o v

stableicellb o v

Explore proof 17 tactics

Initial goal

⊢

∀b o v : Z, stableicellb o v

intros b o v S m m′ HS & Hb & H Hs Hg

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

⊢

icellb o v S m′

split ; exact HS |

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

⊢

object_regionb m_regionsm′ ≠ None ∧ ∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

split

2 open

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

⊢

object_regionb m_regionsm′ ≠ None

focused goal

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

–destruct object_regionb m_regionsm as reg | eqn: E₀ ; | congruence

2 open

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

reg :

E₀ :

object_regionb m_regionsm = Somereg

Hb :

Somereg ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

⊢

object_regionb m_regionsm′ ≠ None

deferred goal

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

destruct Hg_ _ E₀ as E₁ | _ & E₁ ; congruence

deferred goal

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

–intros reg Hl

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

destruct Hreg grows_live_at_ _ _ _ Hg Hb Hl as Ho & He & Hv

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

split ; exact Ho |

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

split ; exact He |

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

load_bytesm′ b + o 8 = v

rewrite <- Hv

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

load_bytesm′ b + o 8 = load_bytesm b + o 8

apply load_bytes_ext8

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

∀i : Z, 0 ≤ i < 8 → m_bytesm′ b + o + i = m_bytesm b + o + i

intros i Hi

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

i :

Hi :

0 ≤ i < 8

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

assert Hp : SPByteb o + i by apply HS ; exists i ; split ; exact Hi | reflexivity

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

pose proof Hs_ Hp as Hs′

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

Hs′ :

match PByteb o + i with

⇒

∀reg : region, object_regionb m_regionsm = Somereg → object_regionb m_regionsm′ = Somereg

PByteb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm′ b + o = m_bytesm b + o

PAuxb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⇒

True

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

cbn iota beta in Hs′

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o + i → b + o + i < r_endreg → m_bytesm′ b + o + i = m_bytesm b + o + i

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

rewrite <- Z.add_assoc

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o + i → b + o + i < r_endreg → m_bytesm′ b + o + i = m_bytesm b + o + i

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

apply Hs′reg ; exact Hl | lia | lia

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b o v S m m′ HS & Hb & H Hs Hg

split ; exact HS |

split

–destruct object_regionb m_regionsm as reg | eqn: E₀ ; | congruence

destruct Hg_ _ E₀ as E₁ | _ & E₁ ; congruence

–intros reg Hl

destruct Hreg grows_live_at_ _ _ _ Hg Hb Hl as Ho & He & Hv

split ; exact Ho |

split ; exact He |

rewrite <- Hv

apply load_bytes_ext8

intros i Hi

assert Hp : SPByteb o + i by apply HS ; exists i ; split ; exact Hi | reflexivity

pose proof Hs_ Hp as Hs′

cbn iota beta in Hs′

rewrite <- Z.add_assoc

apply Hs′reg ; exact Hl | lia | lia

icell survives a safepoint.

545Lemma icell_sp_stable

∀ b o v

sp_stableicellb o v

Explore proof 11 tactics

Initial goal

⊢

∀b o v : Z, sp_stableicellb o v

intros b o v S m m′ HS & Hb & H Hr Hbytes _

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

⊢

icellb o v S m′

split ; exact HS |

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

⊢

object_regionb m_regionsm′ ≠ None ∧ ∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

split ; rewrite Hr ; exact Hb |

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

intros reg Hl

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

reg :

Hl :

live_atm′ b reg

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

unfold live_at in Hl

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

reg :

Hl :

object_regionb m_regionsm′ = Somereg ∧ r_lifereg = Live

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

rewrite Hr in Hl

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

destruct Hreg Hl as Ho & He & Hv

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

split ; exact Ho |

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = v

split ; exact He |

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

load_bytesm′ b + o 8 = v

rewrite load_bytes_samem m′ _ _ Hbytes

b, o, v :

S :

m, m′ :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = v

⊢

load_bytesm b + o 8 = v

exact Hv

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b o v S m m′ HS & Hb & H Hr Hbytes _

split ; exact HS |

split ; rewrite Hr ; exact Hb |

intros reg Hl

unfold live_at in Hl

rewrite Hr in Hl

destruct Hreg Hl as Ho & He & Hv

split ; exact Ho |

split ; exact He |

rewrite load_bytes_samem m′ _ _ Hbytes

exact Hv

icell owns pieces of its object.

553Lemma icell_registered

∀ b o v

owns_registeredicellb o v

Explore proof 3 tactics

Initial goal

⊢

∀b o v : Z, owns_registeredicellb o v

intros b o v S m HS & Hb & _ p Hp

b, o, v :

S :

m :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

apply HS in Hp as i & _ & →

b, o, v :

S :

m :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

i :

⊢

object_regionpiece_idPByteb o + i m_regionsm ≠ None

exact Hb

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b o v S m HS & Hb & _ p Hp

apply HS in Hp as i & _ & →

exact Hb

pcell is stable: as icell, and its aux slot is kept, or what it is known to hold names a freed object, which stays freed.

558Lemma pcell_stable

∀ b o x

stablepcellb o x

Explore proof 26 tactics

Initial goal

⊢

∀b o : Z x : ptr, stablepcellb o x

intros b o x S m m′ HS & Hb & H Hs Hg

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

⊢

pcellb o x S m′

split ; exact HS |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

⊢

object_regionb m_regionsm′ ≠ None ∧ ∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

⊢

object_regionb m_regionsm′ ≠ None

focused goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

–destruct object_regionb m_regionsm as reg | eqn: E₀ ; | congruence

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

reg :

E₀ :

object_regionb m_regionsm = Somereg

Hb :

Somereg ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

⊢

object_regionb m_regionsm′ ≠ None

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

destruct Hg_ _ E₀ as E₁ | _ & E₁ ; congruence

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

–intros reg Hl

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

destruct Hreg grows_live_at_ _ _ _ Hg Hb Hl as Ho & He & Hv & Ha

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split ; exact Ho |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split ; exact He |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

load_bytesm′ b + o 8 = ptr_addrx

focused goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

+rewrite <- Hv

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

load_bytesm′ b + o 8 = load_bytesm b + o 8

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

apply load_bytes_ext8

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

∀i : Z, 0 ≤ i < 8 → m_bytesm′ b + o + i = m_bytesm b + o + i

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

intros i Hi

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

i :

Hi :

0 ≤ i < 8

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

assert Hp : SPByteb o + i by apply HS ; left ; exists i ; split ; exact Hi | reflexivity

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

pose proof Hs_ Hp as Hs′

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

Hs′ :

match PByteb o + i with

⇒

∀reg : region, object_regionb m_regionsm = Somereg → object_regionb m_regionsm′ = Somereg

PByteb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm′ b + o = m_bytesm b + o

PAuxb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⇒

True

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

cbn iota beta in Hs′

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o + i → b + o + i < r_endreg → m_bytesm′ b + o + i = m_bytesm b + o + i

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

rewrite <- Z.add_assoc

2 open

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

i :

Hi :

0 ≤ i < 8

Hp :

SPByteb o + i

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o + i → b + o + i < r_endreg → m_bytesm′ b + o + i = m_bytesm b + o + i

⊢

m_bytesm′ b + o + i = m_bytesm b + o + i

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

apply Hs′reg ; exact Hl | lia | lia

deferred goal

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

+assert Hp : SPAuxb o by apply HS ; right ; reflexivity

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

Hp :

SPAuxb o

⊢

aux_holdsm′ b + o ptr_capx

pose proof Hs_ Hp as Hs′

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

Hp :

SPAuxb o

Hs′ :

match PAuxb o with

⇒

∀reg : region, object_regionb m_regionsm = Somereg → object_regionb m_regionsm′ = Somereg

PByteb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_bytesm′ b + o = m_bytesm b + o

PAuxb o

⇒

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⇒

True

⊢

aux_holdsm′ b + o ptr_capx

cbn iota beta in Hs′

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

Hp :

SPAuxb o

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⊢

aux_holdsm′ b + o ptr_capx

unfold aux_holds

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

Hp :

SPAuxb o

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⊢

m_auxm′ b + o = ptr_capx ∨ freed_inm_regionsm′ ptr_capx ∧ traps_as_freedm_regionsm′ m_auxm′ b + o

rewrite Hs′reg Hl Ho ltac:lia

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Ha :

aux_holdsm b + o ptr_capx

Hp :

SPAuxb o

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⊢

m_auxm b + o = ptr_capx ∨ freed_inm_regionsm′ ptr_capx ∧ traps_as_freedm_regionsm′ m_auxm b + o

destruct Ha as E | Hf & Ht ; left ; exact E |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Hf :

freed_inm_regionsm ptr_capx

Ht :

traps_as_freedm_regionsm m_auxm b + o

Hp :

SPAuxb o

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⊢

m_auxm b + o = ptr_capx ∨ freed_inm_regionsm′ ptr_capx ∧ traps_as_freedm_regionsm′ m_auxm b + o

right

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hs :

same_onS m m′

Hg :

growsm m′

reg :

Hl :

live_atm′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Hf :

freed_inm_regionsm ptr_capx

Ht :

traps_as_freedm_regionsm m_auxm b + o

Hp :

SPAuxb o

Hs′ :

∀reg : region, live_atm′ b reg → 0 ≤ o → b + o < r_endreg → m_auxm′ b + o = m_auxm b + o

⊢

freed_inm_regionsm′ ptr_capx ∧ traps_as_freedm_regionsm′ m_auxm b + o

split ; exact freed_in_grows_ _ _ Hg Hf | exact traps_as_freed_grows_ _ _ Hg Ht

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b o x S m m′ HS & Hb & H Hs Hg

split ; exact HS |

split

–destruct object_regionb m_regionsm as reg | eqn: E₀ ; | congruence

destruct Hg_ _ E₀ as E₁ | _ & E₁ ; congruence

–intros reg Hl

destruct Hreg grows_live_at_ _ _ _ Hg Hb Hl as Ho & He & Hv & Ha

split ; exact Ho |

split ; exact He |

split

+rewrite <- Hv

apply load_bytes_ext8

intros i Hi

assert Hp : SPByteb o + i by apply HS ; left ; exists i ; split ; exact Hi | reflexivity

pose proof Hs_ Hp as Hs′

cbn iota beta in Hs′

rewrite <- Z.add_assoc

apply Hs′reg ; exact Hl | lia | lia

+assert Hp : SPAuxb o by apply HS ; right ; reflexivity

pose proof Hs_ Hp as Hs′

cbn iota beta in Hs′

unfold aux_holds

rewrite Hs′reg Hl Ho ltac:lia

destruct Ha as E | Hf & Ht ; left ; exact E |

right

split ; exact freed_in_grows_ _ _ Hg Hf | exact traps_as_freed_grows_ _ _ Hg Ht

pcell survives a safepoint (aux_holds_moves).

575Lemma pcell_sp_stable

∀ b o x

sp_stablepcellb o x

Explore proof 11 tactics

Initial goal

⊢

∀b o : Z x : ptr, sp_stablepcellb o x

intros b o x S m m′ HS & Hb & H Hr Hbytes Ha

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

pcellb o x S m′

split ; exact HS |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

object_regionb m_regionsm′ ≠ None ∧ ∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split ; rewrite Hr ; exact Hb |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

⊢

∀reg : region, live_atm′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

intros reg Hl

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

reg :

Hl :

live_atm′ b reg

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

unfold live_at in Hl

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

reg :

Hl :

object_regionb m_regionsm′ = Somereg ∧ r_lifereg = Live

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

rewrite Hr in Hl

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

destruct Hreg Hl as Ho & He & Hv & Hx

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Hx :

aux_holdsm b + o ptr_capx

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split ; exact Ho |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Hx :

aux_holdsm b + o ptr_capx

⊢

b + o + 8 ≤ r_endreg ∧ load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split ; exact He |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Hx :

aux_holdsm b + o ptr_capx

⊢

load_bytesm′ b + o 8 = ptr_addrx ∧ aux_holdsm′ b + o ptr_capx

split ; rewrite load_bytes_samem m′ _ _ Hbytes ; exact Hv |

b, o :

x :

S :

m, m′ :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

Hr :

same_regionsm m′

Hbytes :

m_bytesm′ = m_bytesm

Ha :

aux_movesm m′

reg :

Hl :

object_regionb m_regionsm = Somereg ∧ r_lifereg = Live

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

Hv :

load_bytesm b + o 8 = ptr_addrx

Hx :

aux_holdsm b + o ptr_capx

⊢

aux_holdsm′ b + o ptr_capx

exact aux_holds_moves_ _ _ _ Hr Ha Hx

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b o x S m m′ HS & Hb & H Hr Hbytes Ha

split ; exact HS |

split ; rewrite Hr ; exact Hb |

intros reg Hl

unfold live_at in Hl

rewrite Hr in Hl

destruct Hreg Hl as Ho & He & Hv & Hx

split ; exact Ho |

split ; exact He |

split ; rewrite load_bytes_samem m′ _ _ Hbytes ; exact Hv |

exact aux_holds_moves_ _ _ _ Hr Ha Hx

pcell owns pieces of its object.

584Lemma pcell_registered

∀ b o x

owns_registeredpcellb o x

Explore proof 2 tactics

Initial goal

⊢

∀b o : Z x : ptr, owns_registeredpcellb o x

intros b o x S m HS & Hb & _ p Hp

b, o :

x :

S :

m :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

p :

Hp :

⊢

object_regionpiece_idp m_regionsm ≠ None

apply HS in Hp as i & _ & → | → ; exact Hb

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b o x S m HS & Hb & _ p Hp

apply HS in Hp as i & _ & → | → ; exact Hb

node is stable.

588Lemma node_stable

∀ b next v

stablenodeb next v

Explore proof 3 tactics

Initial goal

⊢

∀b : Z next : ptr v : Z, stablenodeb next v

intros

b :

v :

⊢

stablenodeb next v

unfold node

b :

v :

⊢

stablemetab 16 Heap ** liveb ** pcellb 0 next ** icellb 8 v%h

repeat apply star_stable ; auto using meta_stable , live_stable , pcell_stable , icell_stable

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros

unfold node

repeat apply star_stable ; auto using meta_stable , live_stable , pcell_stable , icell_stable

node survives a safepoint.

595Lemma node_sp_stable

∀ b next v

sp_stablenodeb next v

Explore proof 3 tactics

Initial goal

⊢

∀b : Z next : ptr v : Z, sp_stablenodeb next v

intros

b :

v :

⊢

sp_stablenodeb next v

unfold node

b :

v :

⊢

sp_stablemetab 16 Heap ** liveb ** pcellb 0 next ** icellb 8 v%h

repeat apply star_sp_stable ; auto using meta_sp_stable , live_sp_stable , pcell_sp_stable , icell_sp_stable

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros

unfold node

repeat apply star_sp_stable ; auto using meta_sp_stable , live_sp_stable , pcell_sp_stable , icell_sp_stable

node owns pieces of its object.

602Lemma node_registered

∀ b next v

owns_registerednodeb next v

Explore proof 3 tactics

Initial goal

⊢

∀b : Z next : ptr v : Z, owns_registerednodeb next v

intros

b :

v :

⊢

owns_registerednodeb next v

unfold node

b :

v :

⊢

owns_registeredmetab 16 Heap ** liveb ** pcellb 0 next ** icellb 8 v%h

repeat apply star_registered ; auto using meta_registered , live_registered , pcell_registered , icell_registered

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros

unfold node

repeat apply star_registered ; auto using meta_registered , live_registered , pcell_registered , icell_registered

lst is stable.

609Lemma lst_stable

∀ xs p

stablelstp xs

Explore proof 5 tactics

Initial goal

⊢

∀xs : listZ p : ptr, stablelstp xs

induction xs as | v xs IH ; intros p ; cbn [ lst ] ; apply pure_stable |

v :

xs :

listZ

IH :

∀p : ptr, stablelstp xs

p :

⊢

stablehexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h

apply hex_stable

v :

xs :

listZ

IH :

∀p : ptr, stablelstp xs

p :

⊢

∀x : ptr, stablepurep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp x v ** lstx xs%h

intros next

v :

xs :

listZ

IH :

∀p : ptr, stablelstp xs

p, next :

⊢

stablepurep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h

apply star_stable ; apply pure_stable |

v :

xs :

listZ

IH :

∀p : ptr, stablelstp xs

p, next :

⊢

stablenodeptr_addrp next v ** lstnext xs%h

apply star_stable ; apply node_stable | apply IH

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

induction xs as | v xs IH ; intros p ; cbn [ lst ] ; apply pure_stable |

apply hex_stable

intros next

apply star_stable ; apply pure_stable |

apply star_stable ; apply node_stable | apply IH

lst survives a safepoint: the list never stores the capability of a freed object, and what it stores is known up to the collector's rewriting anyway.

619Lemma lst_safepoint

∀ xs p

sp_stablelstp xs

Explore proof 5 tactics

Initial goal

⊢

∀xs : listZ p : ptr, sp_stablelstp xs

induction xs as | v xs IH ; intros p ; cbn [ lst ] ; apply pure_sp_stable |

v :

xs :

listZ

IH :

∀p : ptr, sp_stablelstp xs

p :

⊢

sp_stablehexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h

apply hex_sp_stable

v :

xs :

listZ

IH :

∀p : ptr, sp_stablelstp xs

p :

⊢

∀x : ptr, sp_stablepurep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp x v ** lstx xs%h

intros next

v :

xs :

listZ

IH :

∀p : ptr, sp_stablelstp xs

p, next :

⊢

sp_stablepurep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h

apply star_sp_stable ; apply pure_sp_stable |

v :

xs :

listZ

IH :

∀p : ptr, sp_stablelstp xs

p, next :

⊢

sp_stablenodeptr_addrp next v ** lstnext xs%h

apply star_sp_stable ; apply node_sp_stable | apply IH

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

induction xs as | v xs IH ; intros p ; cbn [ lst ] ; apply pure_sp_stable |

apply hex_sp_stable

intros next

apply star_sp_stable ; apply pure_sp_stable |

apply star_sp_stable ; apply node_sp_stable | apply IH

lst owns pieces of objects.

627Lemma lst_registered

∀ xs p

owns_registeredlstp xs

Explore proof 5 tactics

Initial goal

⊢

∀xs : listZ p : ptr, owns_registeredlstp xs

induction xs as | v xs IH ; intros p ; cbn [ lst ] ; apply pure_registered |

v :

xs :

listZ

IH :

∀p : ptr, owns_registeredlstp xs

p :

⊢

owns_registeredhexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h

apply hex_registered

v :

xs :

listZ

IH :

∀p : ptr, owns_registeredlstp xs

p :

⊢

∀x : ptr, owns_registeredpurep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp x v ** lstx xs%h

intros next

v :

xs :

listZ

IH :

∀p : ptr, owns_registeredlstp xs

p, next :

⊢

owns_registeredpurep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h

apply star_registered ; apply pure_registered |

v :

xs :

listZ

IH :

∀p : ptr, owns_registeredlstp xs

p, next :

⊢

owns_registerednodeptr_addrp next v ** lstnext xs%h

apply star_registered ; apply node_registered | apply IH

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

induction xs as | v xs IH ; intros p ; cbn [ lst ] ; apply pure_registered |

apply hex_registered

intros next

apply star_registered ; apply pure_registered |

apply star_registered ; apply node_registered | apply IH

The steps that change memory

An 8-byte store at offset o of the live object b, in bounds, keeps every footprint that owns none of those bytes: other live objects do not overlap b.

639Lemma store_same_on

∀ m b o reg x

live_atm b reg

0 ≤ o

b + o + 8 ≤ r_endreg

keepsbytes8b o m store_bytesm b + o 8 x

Explore proof 19 tactics

Initial goal

⊢

∀m : mem b o : Z reg : region x : Z, live_disjointm → live_atm b reg → 0 ≤ o → b + o + 8 ≤ r_endreg → keepsbytes8b o m store_bytesm b + o 8 x

intros m b o reg x Hd Hl Ho He S HS p Hp

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬bytes8b o p

p :

Hp :

⊢

match p with

PLiveb₀

⇒

∀reg₀ : region, object_regionb₀ m_regionsm = Somereg₀ → object_regionb₀ m_regionsstore_bytesm b + o 8 x = Somereg₀

PByteb₀ o₀

⇒

∀reg₀ : region, live_atstore_bytesm b + o 8 x b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_bytesstore_bytesm b + o 8 x b₀ + o₀ = m_bytesm b₀ + o₀

PAuxb₀ o₀

⇒

∀reg₀ : region, live_atstore_bytesm b + o 8 x b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b₀ + o₀ = m_auxm b₀ + o₀

⇒

True

specialize HSp Hp

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

p :

HS :

¬bytes8b o p

Hp :

⊢

match p with

PLiveb₀

⇒

∀reg₀ : region, object_regionb₀ m_regionsm = Somereg₀ → object_regionb₀ m_regionsstore_bytesm b + o 8 x = Somereg₀

PByteb₀ o₀

⇒

∀reg₀ : region, live_atstore_bytesm b + o 8 x b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_bytesstore_bytesm b + o 8 x b₀ + o₀ = m_bytesm b₀ + o₀

PAuxb₀ o₀

⇒

∀reg₀ : region, live_atstore_bytesm b + o 8 x b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b₀ + o₀ = m_auxm b₀ + o₀

⇒

True

destruct p as b′ | b′ o′ | b′ o′ | k ; cbn iota beta ; | | | exact I

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′ :

HS :

¬bytes8b o PLiveb′

Hp :

SPLiveb′

⊢

∀reg₀ : region, object_regionb′ m_regionsm = Somereg₀ → object_regionb′ m_regionsstore_bytesm b + o 8 x = Somereg₀

focused goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_bytesstore_bytesm b + o 8 x b′ + o′ = m_bytesm b′ + o′

focused goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

–intros reg′ E

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′ :

HS :

¬bytes8b o PLiveb′

Hp :

SPLiveb′

reg′ :

E :

object_regionb′ m_regionsm = Somereg′

⊢

object_regionb′ m_regionsstore_bytesm b + o 8 x = Somereg′

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_bytesstore_bytesm b + o 8 x b′ + o′ = m_bytesm b′ + o′

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

exact E

2 open

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_bytesstore_bytesm b + o 8 x b′ + o′ = m_bytesm b′ + o′

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

–intros reg′ Hl′ Ho′ He′

2 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atstore_bytesm b + o 8 x b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

⊢

m_bytesstore_bytesm b + o 8 x b′ + o′ = m_bytesm b′ + o′

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

apply store_bytes_other

2 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atstore_bytesm b + o 8 x b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

⊢

¬b + o ≤ b′ + o′ < b + o + 8

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

intros Ha

2 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atstore_bytesm b + o 8 x b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

change live_atm b′ reg′ in Hl′

2 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

destruct Z.eq_decb′ b as [ ->| Hne ]

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPByteb o′

HS :

¬bytes8b o PByteb o′

reg′ :

Hl′ :

live_atm b reg′

Ho′ :

0 ≤ o′

Ha :

b + o ≤ b + o′ < b + o + 8

He′ :

b + o′ < r_endreg′

⊢

False

focused goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

Hne :

b′ ≠ b

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

+assert reg′ = reg as → by destruct Hl , Hl′ ; congruence

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPByteb o′

HS :

¬bytes8b o PByteb o′

Hl′ :

live_atm b reg

Ho′ :

0 ≤ o′

Ha :

b + o ≤ b + o′ < b + o + 8

He′ :

b + o′ < r_endreg

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

Hne :

b′ ≠ b

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

apply HS

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPByteb o′

HS :

¬bytes8b o PByteb o′

Hl′ :

live_atm b reg

Ho′ :

0 ≤ o′

Ha :

b + o ≤ b + o′ < b + o + 8

He′ :

b + o′ < r_endreg

⊢

bytes8b o PByteb o′

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

Hne :

b′ ≠ b

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

exists o′ − o

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPByteb o′

HS :

¬bytes8b o PByteb o′

Hl′ :

live_atm b reg

Ho′ :

0 ≤ o′

Ha :

b + o ≤ b + o′ < b + o + 8

He′ :

b + o′ < r_endreg

⊢

0 ≤ o′ − o < 8 ∧ PByteb o′ = PByteb o + o′ − o

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

Hne :

b′ ≠ b

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

split ; lia |

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPByteb o′

HS :

¬bytes8b o PByteb o′

Hl′ :

live_atm b reg

Ho′ :

0 ≤ o′

Ha :

b + o ≤ b + o′ < b + o + 8

He′ :

b + o′ < r_endreg

⊢

PByteb o′ = PByteb o + o′ − o

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

Hne :

b′ ≠ b

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

f_equal

3 open

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPByteb o′

HS :

¬bytes8b o PByteb o′

Hl′ :

live_atm b reg

Ho′ :

0 ≤ o′

Ha :

b + o ≤ b + o′ < b + o + 8

He′ :

b + o′ < r_endreg

⊢

o′ = o + o′ − o

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

Hne :

b′ ≠ b

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

lia

2 open

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PByteb′ o′

Hp :

SPByteb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b + o ≤ b′ + o′ < b + o + 8

Hne :

b′ ≠ b

⊢

False

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

+destruct Hdb′ reg′ b reg Hl′ Hl Hne ; lia

deferred goal

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_bytesm b + o 8 x b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

–intros

m :

b, o :

reg :

x :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

¬bytes8b o PAuxb′ o′

Hp :

SPAuxb′ o′

reg₀ :

H :

live_atstore_bytesm b + o 8 x b′ reg₀

H₀ :

0 ≤ o′

H₁ :

b′ + o′ < r_endreg₀

⊢

m_auxstore_bytesm b + o 8 x b′ + o′ = m_auxm b′ + o′

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b o reg x Hd Hl Ho He S HS p Hp

specialize HSp Hp

–intros reg′ E

exact E

–intros reg′ Hl′ Ho′ He′

apply store_bytes_other

intros Ha

change live_atm b′ reg′ in Hl′

destruct Z.eq_decb′ b as [ ->| Hne ]

+assert reg′ = reg as → by destruct Hl , Hl′ ; congruence

apply HS

exists o′ − o

split ; lia |

f_equal

lia

+destruct Hdb′ reg′ b reg Hl′ Hl Hne ; lia

–intros

reflexivity

An aux store at offset o of the live object b, in bounds, keeps every footprint that does not own that slot.

655Lemma aux_store_same_on

∀ m b o reg c

live_atm b reg

0 ≤ o

b + o + 8 ≤ r_endreg

keepseqPAuxb o m store_auxm b + o c

Explore proof 16 tactics

Initial goal

⊢

∀m : mem b o : Z reg : region c : cap, live_disjointm → live_atm b reg → 0 ≤ o → b + o + 8 ≤ r_endreg → keepseqPAuxb o m store_auxm b + o c

intros m b o reg c Hd Hl Ho He S HS p Hp

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → PAuxb o ≠ p

p :

Hp :

⊢

match p with

PLiveb₀

⇒

∀reg₀ : region, object_regionb₀ m_regionsm = Somereg₀ → object_regionb₀ m_regionsstore_auxm b + o c = Somereg₀

PByteb₀ o₀

⇒

∀reg₀ : region, live_atstore_auxm b + o c b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_bytesstore_auxm b + o c b₀ + o₀ = m_bytesm b₀ + o₀

PAuxb₀ o₀

⇒

∀reg₀ : region, live_atstore_auxm b + o c b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_auxstore_auxm b + o c b₀ + o₀ = m_auxm b₀ + o₀

⇒

True

specialize HSp Hp

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

p :

HS :

PAuxb o ≠ p

Hp :

⊢

match p with

PLiveb₀

⇒

∀reg₀ : region, object_regionb₀ m_regionsm = Somereg₀ → object_regionb₀ m_regionsstore_auxm b + o c = Somereg₀

PByteb₀ o₀

⇒

∀reg₀ : region, live_atstore_auxm b + o c b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_bytesstore_auxm b + o c b₀ + o₀ = m_bytesm b₀ + o₀

PAuxb₀ o₀

⇒

∀reg₀ : region, live_atstore_auxm b + o c b₀ reg₀ → 0 ≤ o₀ → b₀ + o₀ < r_endreg₀ → m_auxstore_auxm b + o c b₀ + o₀ = m_auxm b₀ + o₀

⇒

True

destruct p as b′ | b′ o′ | b′ o′ | k ; cbn iota beta ; | | | exact I

3 open

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′ :

HS :

PAuxb o ≠ PLiveb′

Hp :

SPLiveb′

⊢

∀reg₀ : region, object_regionb′ m_regionsm = Somereg₀ → object_regionb′ m_regionsstore_auxm b + o c = Somereg₀

focused goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PByteb′ o′

Hp :

SPByteb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_bytesstore_auxm b + o c b′ + o′ = m_bytesm b′ + o′

focused goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_auxm b + o c b′ + o′ = m_auxm b′ + o′

–intros reg′ E

3 open

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′ :

HS :

PAuxb o ≠ PLiveb′

Hp :

SPLiveb′

reg′ :

E :

object_regionb′ m_regionsm = Somereg′

⊢

object_regionb′ m_regionsstore_auxm b + o c = Somereg′

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PByteb′ o′

Hp :

SPByteb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_bytesstore_auxm b + o c b′ + o′ = m_bytesm b′ + o′

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_auxm b + o c b′ + o′ = m_auxm b′ + o′

exact E

2 open

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PByteb′ o′

Hp :

SPByteb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_bytesstore_auxm b + o c b′ + o′ = m_bytesm b′ + o′

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_auxm b + o c b′ + o′ = m_auxm b′ + o′

–intros

2 open

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PByteb′ o′

Hp :

SPByteb′ o′

reg₀ :

H :

live_atstore_auxm b + o c b′ reg₀

H₀ :

0 ≤ o′

H₁ :

b′ + o′ < r_endreg₀

⊢

m_bytesstore_auxm b + o c b′ + o′ = m_bytesm b′ + o′

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_auxm b + o c b′ + o′ = m_auxm b′ + o′

reflexivity

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

⊢

∀reg₀ : region, live_atstore_auxm b + o c b′ reg₀ → 0 ≤ o′ → b′ + o′ < r_endreg₀ → m_auxstore_auxm b + o c b′ + o′ = m_auxm b′ + o′

–intros reg′ Hl′ Ho′ He′

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atstore_auxm b + o c b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

⊢

m_auxstore_auxm b + o c b′ + o′ = m_auxm b′ + o′

change live_atm b′ reg′ in Hl′

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

⊢

m_auxstore_auxm b + o c b′ + o′ = m_auxm b′ + o′

cbn [ m_aux store_aux ]

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

⊢

b′ + o′ =? b + o

→

else

m_auxm b′ + o′

destruct Z.eqb_specb′ + o′ b + o as Ha | _ ; exfalso | reflexivity

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b′ + o′ = b + o

⊢

False

destruct Z.eq_decb′ b as [ ->| Hne ]

2 open

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPAuxb o′

HS :

PAuxb o ≠ PAuxb o′

reg′ :

Hl′ :

live_atm b reg′

Ho′ :

0 ≤ o′

Ha :

b + o′ = b + o

He′ :

b + o′ < r_endreg′

⊢

False

focused goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b′ + o′ = b + o

Hne :

b′ ≠ b

⊢

False

+apply HS

2 open

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPAuxb o′

HS :

PAuxb o ≠ PAuxb o′

reg′ :

Hl′ :

live_atm b reg′

Ho′ :

0 ≤ o′

Ha :

b + o′ = b + o

He′ :

b + o′ < r_endreg′

⊢

PAuxb o = PAuxb o′

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b′ + o′ = b + o

Hne :

b′ ≠ b

⊢

False

f_equal

2 open

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

o′ :

Hp :

SPAuxb o′

HS :

PAuxb o ≠ PAuxb o′

reg′ :

Hl′ :

live_atm b reg′

Ho′ :

0 ≤ o′

Ha :

b + o′ = b + o

He′ :

b + o′ < r_endreg′

⊢

o = o′

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b′ + o′ = b + o

Hne :

b′ ≠ b

⊢

False

lia

deferred goal

m :

b, o :

reg :

c :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

b′, o′ :

HS :

PAuxb o ≠ PAuxb′ o′

Hp :

SPAuxb′ o′

reg′ :

Hl′ :

live_atm b′ reg′

Ho′ :

0 ≤ o′

He′ :

b′ + o′ < r_endreg′

Ha :

b′ + o′ = b + o

Hne :

b′ ≠ b

⊢

False

+destruct Hdb′ reg′ b reg Hl′ Hl Hne ; lia

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b o reg c Hd Hl Ho He S HS p Hp

specialize HSp Hp

–intros reg′ E

exact E

–intros

reflexivity

–intros reg′ Hl′ Ho′ He′

change live_atm b′ reg′ in Hl′

cbn [ m_aux store_aux ]

destruct Z.eqb_specb′ + o′ b + o as Ha | _ ; exfalso | reflexivity

destruct Z.eq_decb′ b as [ ->| Hne ]

+apply HS

f_equal

lia

+destruct Hdb′ reg′ b reg Hl′ Hl Hne ; lia

The pointer store's protocol in listsum.c (ensure, barrier, reload, then the capability and the address) is an aux store and then an 8-byte store.

672Lemma pointer_store_protocol

∀ a x m

pointer_store_effectsa x m AuxEnsure; LowerBarrier; RootedReload; LowerWrite; AddressWrite = Somestore_bytesstore_auxm a ptr_capx a 8 ptr_addrx

Explore proof 1 tactics

Initial goal

⊢

∀a : Z x : ptr m : mem, pointer_store_effectsa x m AuxEnsure; LowerBarrier; RootedReload; LowerWrite; AddressWrite = Somestore_bytesstore_auxm a ptr_capx a 8 ptr_addrx

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

reflexivity

That pointer store at offset o of the live object b, in bounds, keeps every footprint that owns none of the slot's pieces.

679Lemma pointer_store_same_on

∀ m b o reg c v

live_atm b reg

0 ≤ o

b + o + 8 ≤ r_endreg

keepspcell_piecesb o m store_bytesstore_auxm b + o c b + o 8 v

Explore proof 14 tactics

Initial goal

⊢

∀m : mem b o : Z reg : region c : cap v : Z, live_disjointm → live_atm b reg → 0 ≤ o → b + o + 8 ≤ r_endreg → keepspcell_piecesb o m store_bytesstore_auxm b + o c b + o 8 v

intros m b o reg c v Hd Hl Ho He S HS

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS m store_bytesstore_auxm b + o c b + o 8 v

apply same_on_trans with store_auxm b + o c ; reflexivity | |

2 open

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS m store_auxm b + o c

focused goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS store_auxm b + o c store_bytesstore_auxm b + o c b + o 8 v

–apply aux_store_same_onm b o reg c Hd Hl Ho He

2 open

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

∀p : piece, Sp → PAuxb o ≠ p

deferred goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS store_auxm b + o c store_bytesstore_auxm b + o c b + o 8 v

intros p Hp E

2 open

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

p :

Hp :

E :

PAuxb o = p

⊢

False

deferred goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS store_auxm b + o c store_bytesstore_auxm b + o c b + o 8 v

apply HSp Hp

2 open

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

p :

Hp :

E :

PAuxb o = p

⊢

pcell_piecesb o p

deferred goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS store_auxm b + o c store_bytesstore_auxm b + o c b + o 8 v

right

2 open

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

p :

Hp :

E :

PAuxb o = p

⊢

p = PAuxb o

deferred goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS store_auxm b + o c store_bytesstore_auxm b + o c b + o 8 v

symmetry

2 open

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

p :

Hp :

E :

PAuxb o = p

⊢

PAuxb o = p

deferred goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS store_auxm b + o c store_bytesstore_auxm b + o c b + o 8 v

exact E

deferred goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

same_onS store_auxm b + o c store_bytesstore_auxm b + o c b + o 8 v

–apply store_same_onstore_auxm b + o c b o reg v ; | exact Hl | exact Ho | exact He |

2 open

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

live_disjointstore_auxm b + o c

focused goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

∀p : piece, Sp → ¬bytes8b o p

+exact live_disjoint_samem _ eq_refl Hd

deferred goal

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

⊢

∀p : piece, Sp → ¬bytes8b o p

+intros p Hp E

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

p :

Hp :

E :

bytes8b o p

⊢

False

apply HSp Hp

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

p :

Hp :

E :

bytes8b o p

⊢

pcell_piecesb o p

left

m :

b, o :

reg :

c :

v :

Hd :

Hl :

live_atm b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

S :

piece → Prop

HS :

∀p : piece, Sp → ¬pcell_piecesb o p

p :

Hp :

E :

bytes8b o p

⊢

bytes8b o p

exact E

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b o reg c v Hd Hl Ho He S HS

apply same_on_trans with store_auxm b + o c ; reflexivity | |

–apply aux_store_same_onm b o reg c Hd Hl Ho He

intros p Hp E

apply HSp Hp

right

symmetry

exact E

–apply store_same_onstore_auxm b + o c b o reg v ; | exact Hl | exact Ho | exact He |

+exact live_disjoint_samem _ eq_refl Hd

+intros p Hp E

apply HSp Hp

left

exact E

Allocating at a fresh base keeps every footprint: no one owns the new identity, and no byte changes.

691Lemma alloc_same_on

∀ S m q base

freshm q base

same_onS m allocatedm q base

Explore proof 9 tactics

Initial goal

⊢

∀S : fp m : mem q : alloc_req base : Z, freshm q base → same_onS m allocatedm q base

intros S m q base _ & _ & _ & Hn & _ p _

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

p :

⊢

match p with

⇒

∀reg : region, object_regionb m_regionsm = Somereg → object_regionb m_regionsallocatedm q base = Somereg

PByteb o

⇒

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_bytesallocatedm q base b + o = m_bytesm b + o

PAuxb o

⇒

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_auxallocatedm q base b + o = m_auxm b + o

⇒

True

destruct p as b | b o | b o | k ; cbn iota beta ; | | | exact I

3 open

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b :

⊢

∀reg : region, object_regionb m_regionsm = Somereg → object_regionb m_regionsallocatedm q base = Somereg

focused goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_bytesallocatedm q base b + o = m_bytesm b + o

focused goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_auxallocatedm q base b + o = m_auxm b + o

–intros reg E

3 open

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b :

reg :

E :

object_regionb m_regionsm = Somereg

⊢

object_regionb m_regionsallocatedm q base = Somereg

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_bytesallocatedm q base b + o = m_bytesm b + o

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_auxallocatedm q base b + o = m_auxm b + o

rewrite object_region_allocated

3 open

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b :

reg :

E :

object_regionb m_regionsm = Somereg

⊢

base =? b

→

Somer_base ≔ base; r_end ≔ base + req_extentq; r_kind ≔ req_kindq; r_life ≔ Live

else

object_regionb m_regionsm

Somereg

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_bytesallocatedm q base b + o = m_bytesm b + o

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_auxallocatedm q base b + o = m_auxm b + o

destruct Z.eqb_specbase b as [ <-| _ ] ; congruence | exact E

2 open

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_bytesallocatedm q base b + o = m_bytesm b + o

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_auxallocatedm q base b + o = m_auxm b + o

–intros

2 open

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

reg :

H :

live_atallocatedm q base b reg

H₀ :

0 ≤ o

H₁ :

b + o < r_endreg

⊢

m_bytesallocatedm q base b + o = m_bytesm b + o

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_auxallocatedm q base b + o = m_auxm b + o

reflexivity

deferred goal

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

⊢

∀reg : region, live_atallocatedm q base b reg → 0 ≤ o → b + o < r_endreg → m_auxallocatedm q base b + o = m_auxm b + o

–intros

S :

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b, o :

reg :

H :

live_atallocatedm q base b reg

H₀ :

0 ≤ o

H₁ :

b + o < r_endreg

⊢

m_auxallocatedm q base b + o = m_auxm b + o

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m q base _ & _ & _ & Hn & _ p _

–intros reg E

rewrite object_region_allocated

destruct Z.eqb_specbase b as [ <-| _ ] ; congruence | exact E

–intros

reflexivity

–intros

reflexivity

Allocating at a fresh base moves no object.

700Lemma alloc_grows

∀ m q base

freshm q base

growsm allocatedm q base

Explore proof 4 tactics

Initial goal

⊢

∀m : mem q : alloc_req base : Z, freshm q base → growsm allocatedm q base

intros m q base _ & _ & _ & Hn & _ b reg E

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b :

reg :

E :

object_regionb m_regionsm = Somereg

⊢

object_regionb m_regionsallocatedm q base = Somereg ∨ r_lifereg = Live ∧ object_regionb m_regionsallocatedm q base = Somer_base ≔ b; r_end ≔ b; r_kind ≔ r_kindreg; r_life ≔ Freed

left

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b :

reg :

E :

object_regionb m_regionsm = Somereg

⊢

object_regionb m_regionsallocatedm q base = Somereg

rewrite object_region_allocated

m :

q :

base :

Hn :

object_regionbase m_regionsm = None

b :

reg :

E :

object_regionb m_regionsm = Somereg

⊢

base =? b

→

Somer_base ≔ base; r_end ≔ base + req_extentq; r_kind ≔ req_kindq; r_life ≔ Live

else

object_regionb m_regionsm

Somereg

destruct Z.eqb_specbase b as [ <-| _ ] ; congruence | exact E

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m q base _ & _ & _ & Hn & _ b reg E

left

rewrite object_region_allocated

destruct Z.eqb_specbase b as [ <-| _ ] ; congruence | exact E

A footprint of objects of m owns nothing of a fresh base.

707Lemma registered_fresh

∀ S m q base p

freshm q base

piece_idp ≠ base

Explore proof 4 tactics

Initial goal

⊢

∀S : fp m : mem q : alloc_req base : Z p : piece, registeredS m → freshm q base → Sp → piece_idp ≠ base

intros S m q base p Hr _ & _ & _ & Hn & _ Hp E

S :

m :

q :

base :

p :

Hr :

Hn :

object_regionbase m_regionsm = None

Hp :

E :

piece_idp = base

⊢

False

apply Hrp Hp

S :

m :

q :

base :

p :

Hr :

Hn :

object_regionbase m_regionsm = None

Hp :

E :

piece_idp = base

⊢

object_regionpiece_idp m_regionsm = None

rewrite E

S :

m :

q :

base :

p :

Hr :

Hn :

object_regionbase m_regionsm = None

Hp :

E :

piece_idp = base

⊢

object_regionbase m_regionsm = None

exact Hn

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros S m q base p Hr _ & _ & _ & Hn & _ Hp E

apply Hrp Hp

rewrite E

exact Hn

Updating the owned cell

A write rule carries over a frame on the right that does not own what is written.

714Lemma writes_star_l

∀ W m m′ P P′ Q

keepsW m m′

growsm m′

writesW m m′ P P′

writesW m m′ P ** Q%h P′ ** Q%h

Explore proof 16 tactics

Initial goal

⊢

∀W : piece → Prop m m′ : mem P P′ Q : hprop, keepsW m m′ → growsm m′ → stableQ → writesW m m′ P P′ → writesW m m′ P ** Q%h P′ ** Q%h

intros W m m′ P P′ Q Hk Hg HQ HP S S₁ & S₂ & HS & Hd & H₁ & H₂

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

⊢

P′ ** Q%hS m′ ∧ ∀p : piece, Wp → Sp

destruct HPS₁ H₁ as H₁′ HW

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

P′ ** Q%hS m′ ∧ ∀p : piece, Wp → Sp

split

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

P′ ** Q%hS m′

focused goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

–exists S₁, S₂

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ P′S₁ m′ ∧ QS₂ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

split ; exact HS |

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ P′S₁ m′ ∧ QS₂ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

split ; exact Hd |

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

P′S₁ m′ ∧ QS₂ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

split ; exact H₁′ |

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

QS₂ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

apply HQS₂ m m′ H₂ ; | exact Hg

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

same_onS₂ m m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

apply Hk

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, S₂p → ¬Wp

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

intros p Hp Hw

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

p :

Hp :

S₂p

Hw :

⊢

False

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

apply Hdp

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

p :

Hp :

S₂p

Hw :

⊢

S₁p ∧ S₂p

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

split ; apply HW , Hw | exact Hp

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

⊢

∀p : piece, Wp → Sp

–intros p Hw

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

p :

Hw :

⊢

apply HS

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

p :

Hw :

⊢

S₁p ∨ S₂p

left

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

PS₁ m

H₂ :

QS₂ m

H₁′ :

P′S₁ m′

HW :

∀p : piece, Wp → S₁p

p :

Hw :

⊢

S₁p

apply HW , Hw

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros W m m′ P P′ Q Hk Hg HQ HP S S₁ & S₂ & HS & Hd & H₁ & H₂

destruct HPS₁ H₁ as H₁′ HW

split

–exists S₁, S₂

split ; exact HS |

split ; exact Hd |

split ; exact H₁′ |

apply HQS₂ m m′ H₂ ; | exact Hg

apply Hk

intros p Hp Hw

apply Hdp

split ; apply HW , Hw | exact Hp

–intros p Hw

apply HS

left

apply HW , Hw

A write rule carries over a frame on the left.

725Lemma writes_star_r

∀ W m m′ P P′ Q

keepsW m m′

growsm m′

writesW m m′ P P′

writesW m m′ Q ** P%h Q ** P′%h

Explore proof 16 tactics

Initial goal

⊢

∀W : piece → Prop m m′ : mem P P′ Q : hprop, keepsW m m′ → growsm m′ → stableQ → writesW m m′ P P′ → writesW m m′ Q ** P%h Q ** P′%h

intros W m m′ P P′ Q Hk Hg HQ HP S S₁ & S₂ & HS & Hd & H₁ & H₂

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

⊢

Q ** P′%hS m′ ∧ ∀p : piece, Wp → Sp

destruct HPS₂ H₂ as H₂′ HW

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

Q ** P′%hS m′ ∧ ∀p : piece, Wp → Sp

split

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

Q ** P′%hS m′

focused goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

–exists S₁, S₂

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Sp ↔ S₁p ∨ S₂p ∧ ∀p : piece, ¬S₁p ∧ S₂p ∧ QS₁ m′ ∧ P′S₂ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

split ; exact HS |

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, ¬S₁p ∧ S₂p ∧ QS₁ m′ ∧ P′S₂ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

split ; exact Hd |

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

QS₁ m′ ∧ P′S₂ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

split ; | exact H₂′

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

QS₁ m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

apply HQS₁ m m′ H₁ ; | exact Hg

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

same_onS₁ m m′

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

apply Hk

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, S₁p → ¬Wp

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

intros p Hp Hw

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

p :

Hp :

S₁p

Hw :

⊢

False

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

apply Hdp

2 open

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

p :

Hp :

S₁p

Hw :

⊢

S₁p ∧ S₂p

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

split ; exact Hp | apply HW , Hw

deferred goal

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

⊢

∀p : piece, Wp → Sp

–intros p Hw

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

p :

Hw :

⊢

apply HS

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

p :

Hw :

⊢

S₁p ∨ S₂p

right

W :

piece → Prop

m, m′ :

P, P′, Q :

Hk :

keepsW m m′

Hg :

growsm m′

HQ :

HP :

writesW m m′ P P′

S :

S₁, S₂ :

piece → Prop

HS :

∀p : piece, Sp ↔ S₁p ∨ S₂p

Hd :

∀p : piece, ¬S₁p ∧ S₂p

H₁ :

QS₁ m

H₂ :

PS₂ m

H₂′ :

P′S₂ m′

HW :

∀p : piece, Wp → S₂p

p :

Hw :

⊢

S₂p

apply HW , Hw

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros W m m′ P P′ Q Hk Hg HQ HP S S₁ & S₂ & HS & Hd & H₁ & H₂

destruct HPS₂ H₂ as H₂′ HW

split

–exists S₁, S₂

split ; exact HS |

split ; exact Hd |

split ; | exact H₂′

apply HQS₁ m m′ H₁ ; | exact Hg

apply Hk

intros p Hp Hw

apply Hdp

split ; exact Hp | apply HW , Hw

–intros p Hw

apply HS

right

apply HW , Hw

After an 8-byte store of an unsigned x at offset o of b, the owned cell there holds x.

737Lemma icell_writes

∀ m b o v x

0 ≤ x < 2 ^ 64

writesbytes8b o m store_bytesm b + o 8 x icellb o v icellb o x

Explore proof 9 tactics

Initial goal

⊢

∀m : mem b o v x : Z, 0 ≤ x < 2 ^ 64 → writesbytes8b o m store_bytesm b + o 8 x icellb o v icellb o x

intros m b o v x Hx S HS & Hb & H

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

⊢

icellb o x S store_bytesm b + o 8 x ∧ ∀p : piece, bytes8b o p → Sp

split ; | intros p Hp ; apply HS , Hp

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

⊢

icellb o x S store_bytesm b + o 8 x

split ; exact HS |

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

⊢

object_regionb m_regionsstore_bytesm b + o 8 x ≠ None ∧ ∀reg : region, live_atstore_bytesm b + o 8 x b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesm b + o 8 x b + o 8 = x

split ; exact Hb |

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

⊢

∀reg : region, live_atstore_bytesm b + o 8 x b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesm b + o 8 x b + o 8 = x

intros reg Hl

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

reg :

Hl :

live_atstore_bytesm b + o 8 x b reg

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesm b + o 8 x b + o 8 = x

destruct Hreg Hl as Ho & He & _

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

reg :

Hl :

live_atstore_bytesm b + o 8 x b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesm b + o 8 x b + o 8 = x

split ; exact Ho |

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

reg :

Hl :

live_atstore_bytesm b + o 8 x b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesm b + o 8 x b + o 8 = x

split ; exact He |

m :

b, o, v, x :

Hx :

0 ≤ x < 2 ^ 64

S :

HS :

onlyS bytes8b o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = v

reg :

Hl :

live_atstore_bytesm b + o 8 x b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

load_bytesstore_bytesm b + o 8 x b + o 8 = x

apply load_store_bytes , Hx

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b o v x Hx S HS & Hb & H

split ; | intros p Hp ; apply HS , Hp

split ; exact HS |

split ; exact Hb |

intros reg Hl

destruct Hreg Hl as Ho & He & _

split ; exact Ho |

split ; exact He |

apply load_store_bytes , Hx

After the pointer store of x' at offset o of b, the owned slot there holds x'.

747Lemma pcell_writes

∀ m b o x x′

0 ≤ ptr_addrx′ < 2 ^ 64

writespcell_piecesb o m store_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ pcellb o x pcellb o x′

Explore proof 13 tactics

Initial goal

⊢

∀m : mem b o : Z x x′ : ptr, 0 ≤ ptr_addrx′ < 2 ^ 64 → writespcell_piecesb o m store_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ pcellb o x pcellb o x′

intros m b o x x′ Hx S HS & Hb & H

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

⊢

pcellb o x′ S store_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ ∧ ∀p : piece, pcell_piecesb o p → Sp

split ; | intros p Hp ; apply HS , Hp

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

⊢

pcellb o x′ S store_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′

split ; exact HS |

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

⊢

object_regionb m_regionsstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ ≠ None ∧ ∀reg : region, live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o 8 = ptr_addrx′ ∧ aux_holdsstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o ptr_capx′

split ; exact Hb |

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

⊢

∀reg : region, live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o 8 = ptr_addrx′ ∧ aux_holdsstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o ptr_capx′

intros reg Hl

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

⊢

0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o 8 = ptr_addrx′ ∧ aux_holdsstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o ptr_capx′

destruct Hreg Hl as Ho & He & _

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

split ; exact Ho |

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

b + o + 8 ≤ r_endreg ∧ load_bytesstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o 8 = ptr_addrx′ ∧ aux_holdsstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o ptr_capx′

split ; exact He |

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

load_bytesstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o 8 = ptr_addrx′ ∧ aux_holdsstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o ptr_capx′

split ; apply load_store_bytes , Hx |

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

aux_holdsstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o ptr_capx′

left

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

m_auxstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b + o = ptr_capx′

cbn [ m_aux store_bytes store_aux ]

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

b + o =? b + o

→

ptr_capx′

else

m_auxm b + o

ptr_capx′

rewrite Z.eqb_refl

m :

b, o :

x, x′ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

S :

HS :

onlyS λp : piece ⇒ bytes8b o p ∨ p = PAuxb o

Hb :

object_regionb m_regionsm ≠ None

H :

∀reg : region, live_atm b reg → 0 ≤ o ∧ b + o + 8 ≤ r_endreg ∧ load_bytesm b + o 8 = ptr_addrx ∧ aux_holdsm b + o ptr_capx

reg :

Hl :

live_atstore_bytesstore_auxm b + o ptr_capx′ b + o 8 ptr_addrx′ b reg

Ho :

0 ≤ o

He :

b + o + 8 ≤ r_endreg

⊢

ptr_capx′ = ptr_capx′

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b o x x′ Hx S HS & Hb & H

split ; | intros p Hp ; apply HS , Hp

split ; exact HS |

split ; exact Hb |

intros reg Hl

destruct Hreg Hl as Ho & He & _

split ; exact Ho |

split ; exact He |

split ; apply load_store_bytes , Hx |

left

cbn [ m_aux store_bytes store_aux ]

rewrite Z.eqb_refl

reflexivity

A node's object is live, a heap object of 16 bytes.

758Lemma node_region

∀ b x v S m

nodeb x v S m

object_regionb m_regionsm = SomemkRegionb b + 16 Heap Live

Explore proof 8 tactics

Initial goal

⊢

∀b : Z x : ptr v : Z S : fp m : mem, nodeb x v S m → object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

intros b x v S m S₁ & S₂ & _ & _ & _ & reg & E & Hk & Hl & S₃ & S₄ & _ & _ & _ & reg′ & E′ & L′ & _

b :

x :

v :

S :

m :

S₁, S₂ :

piece → Prop

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = Heap

Hl :

r_lifereg = Live → r_endreg = b + 16

S₃, S₄ :

piece → Prop

reg′ :

E′ :

object_regionb m_regionsm = Somereg′

L′ :

r_lifereg′ = Live

⊢

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

rewrite E in E′

b :

x :

v :

S :

m :

S₁, S₂ :

piece → Prop

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = Heap

Hl :

r_lifereg = Live → r_endreg = b + 16

S₃, S₄ :

piece → Prop

reg′ :

E′ :

Somereg = Somereg′

L′ :

r_lifereg′ = Live

⊢

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

injection E′ as ←

b :

x :

v :

S :

m :

S₁, S₂ :

piece → Prop

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = Heap

Hl :

r_lifereg = Live → r_endreg = b + 16

S₃, S₄ :

piece → Prop

L′ :

r_lifereg = Live

⊢

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

specialize HlL′

b :

x :

v :

S :

m :

S₁, S₂ :

piece → Prop

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = Heap

Hl :

r_endreg = b + 16

S₃, S₄ :

piece → Prop

L′ :

r_lifereg = Live

⊢

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

pose proof object_region_base_ _ _ E as Hb

b :

x :

v :

S :

m :

S₁, S₂ :

piece → Prop

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = Heap

Hl :

r_endreg = b + 16

S₃, S₄ :

piece → Prop

L′ :

r_lifereg = Live

Hb :

r_basereg = b

⊢

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

rewrite E

b :

x :

v :

S :

m :

S₁, S₂ :

piece → Prop

reg :

E :

object_regionb m_regionsm = Somereg

Hk :

r_kindreg = Heap

Hl :

r_endreg = b + 16

S₃, S₄ :

piece → Prop

L′ :

r_lifereg = Live

Hb :

r_basereg = b

⊢

Somereg = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

destruct reg as rb re rk rl ; cbn in * ; subst

b :

x :

v :

S :

m :

S₁, S₂ :

piece → Prop

E :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

S₃, S₄ :

piece → Prop

⊢

Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b x v S m S₁ & S₂ & _ & _ & _ & reg & E & Hk & Hl & S₃ & S₄ & _ & _ & _ & reg′ & E′ & L′ & _

rewrite E in E′

injection E′ as ←

specialize HlL′

pose proof object_region_base_ _ _ E as Hb

rewrite E

destruct reg as rb re rk rl ; cbn in * ; subst

reflexivity

A node's next slot reads as its next pointer.

767Lemma node_next

∀ b x v S m

nodeb x v S m

load_bytesm b 8 = ptr_addrx ∧ aux_holdsm b ptr_capx

Explore proof 6 tactics

Initial goal

⊢

∀b : Z x : ptr v : Z S : fp m : mem, nodeb x v S m → load_bytesm b 8 = ptr_addrx ∧ aux_holdsm b ptr_capx

intros b x v S m H

b :

x :

v :

S :

m :

H :

nodeb x v S m

⊢

load_bytesm b 8 = ptr_addrx ∧ aux_holdsm b ptr_capx

pose proof node_region_ _ _ _ _ H as Hr

b :

x :

v :

S :

m :

H :

nodeb x v S m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

⊢

load_bytesm b 8 = ptr_addrx ∧ aux_holdsm b ptr_capx

destruct H as S₁ & S₂ & _ & _ & _ & S₃ & S₄ & _ & _ & _ & S₅ & S₆ & _ & _ & _ & _ & Hp & _

b :

x :

v :

S :

m :

S₁, S₂, S₃, S₄, S₅, S₆ :

piece → Prop

Hp :

∀reg : region, live_atm b reg → 0 ≤ 0 ∧ b + 0 + 8 ≤ r_endreg ∧ load_bytesm b + 0 8 = ptr_addrx ∧ aux_holdsm b + 0 ptr_capx

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

⊢

load_bytesm b 8 = ptr_addrx ∧ aux_holdsm b ptr_capx

destruct Hp_ conjHr eq_refl as _ & _ & Hv & Ha

b :

x :

v :

S :

m :

S₁, S₂, S₃, S₄, S₅, S₆ :

piece → Prop

Hp :

∀reg : region, live_atm b reg → 0 ≤ 0 ∧ b + 0 + 8 ≤ r_endreg ∧ load_bytesm b + 0 8 = ptr_addrx ∧ aux_holdsm b + 0 ptr_capx

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm b + 0 8 = ptr_addrx

Ha :

aux_holdsm b + 0 ptr_capx

⊢

load_bytesm b 8 = ptr_addrx ∧ aux_holdsm b ptr_capx

rewrite Z.add_0_r in Hv , Ha

b :

x :

v :

S :

m :

S₁, S₂, S₃, S₄, S₅, S₆ :

piece → Prop

Hp :

∀reg : region, live_atm b reg → 0 ≤ 0 ∧ b + 0 + 8 ≤ r_endreg ∧ load_bytesm b + 0 8 = ptr_addrx ∧ aux_holdsm b + 0 ptr_capx

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm b 8 = ptr_addrx

Ha :

aux_holdsm b ptr_capx

⊢

load_bytesm b 8 = ptr_addrx ∧ aux_holdsm b ptr_capx

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b x v S m H

pose proof node_region_ _ _ _ _ H as Hr

destruct H as S₁ & S₂ & _ & _ & _ & S₃ & S₄ & _ & _ & _ & S₅ & S₆ & _ & _ & _ & _ & Hp & _

destruct Hp_ conjHr eq_refl as _ & _ & Hv & Ha

rewrite Z.add_0_r in Hv , Ha

auto

The pointer store of x' into the next slot of the node at b, which the assertion owns, makes x' its next pointer, and keeps the frame Q.

778Lemma node_store_next

∀ m b x x′ v Q S

0 ≤ ptr_addrx′ < 2 ^ 64

nodeb x v ** Q%hS m

nodeb x′ v ** Q%hS store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

Explore proof 17 tactics

Initial goal

⊢

∀m : mem b : Z x x′ : ptr v : Z Q : hprop S : fp, live_disjointm → stableQ → 0 ≤ ptr_addrx′ < 2 ^ 64 → nodeb x v ** Q%hS m → nodeb x′ v ** Q%hS store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

intros m b x x′ v Q S Hd HQ Hx H

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

⊢

nodeb x′ v ** Q%hS store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

destruct star_elim_l_ _ _ _ H as S₀ & H₀

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

⊢

nodeb x′ v ** Q%hS store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

pose proof node_region_ _ _ _ _ H₀ as Hr

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

⊢

nodeb x′ v ** Q%hS store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

set m′ := store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

⊢

nodeb x′ v ** Q%hS m′

assert Hk : keepspcell_piecesb 0 m m′

2 open

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

⊢

keepspcell_piecesb 0 m m′

focused goal

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

⊢

nodeb x′ v ** Q%hS m′

{pose proof pointer_store_same_onm b 0 _ ptr_capx′ ptr_addrx′ Hd conjHr eq_refl as K

2 open

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

K :

0 ≤ 0 → b + 0 + 8 ≤ r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live → keepspcell_piecesb 0 m store_bytesstore_auxm b + 0 ptr_capx′ b + 0 8 ptr_addrx′

⊢

keepspcell_piecesb 0 m m′

deferred goal

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

⊢

nodeb x′ v ** Q%hS m′

rewrite Z.add_0_r in K

2 open

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

K :

0 ≤ 0 → b + 8 ≤ r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live → keepspcell_piecesb 0 m store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

⊢

keepspcell_piecesb 0 m m′

deferred goal

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

⊢

nodeb x′ v ** Q%hS m′

apply K ; cbn ; lia

deferred goal

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

⊢

nodeb x′ v ** Q%hS m′

assert Hg : growsm m′ by apply grows_same ; reflexivity

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

⊢

nodeb x′ v ** Q%hS m′

refine proj1writes_star_l_ _ _ _ _ Q Hk Hg HQ _ S H

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

⊢

writespcell_piecesb 0 m m′ nodeb x v nodeb x′ v

unfold node

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

⊢

writespcell_piecesb 0 m m′ metab 16 Heap ** liveb ** pcellb 0 x ** icellb 8 v%h metab 16 Heap ** liveb ** pcellb 0 x′ ** icellb 8 v%h

apply writes_star_r ; exact Hk | exact Hg | apply meta_stable |

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

⊢

writespcell_piecesb 0 m m′ liveb ** pcellb 0 x ** icellb 8 v%h liveb ** pcellb 0 x′ ** icellb 8 v%h

apply writes_star_r ; exact Hk | exact Hg | apply live_stable |

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

⊢

writespcell_piecesb 0 m m′ pcellb 0 x ** icellb 8 v%h pcellb 0 x′ ** icellb 8 v%h

apply writes_star_l ; exact Hk | exact Hg | apply icell_stable |

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

⊢

writespcell_piecesb 0 m m′ pcellb 0 x pcellb 0 x′

pose proof pcell_writesm b 0 x x′ Hx as W

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

W :

writespcell_piecesb 0 m store_bytesstore_auxm b + 0 ptr_capx′ b + 0 8 ptr_addrx′ pcellb 0 x pcellb 0 x′

⊢

writespcell_piecesb 0 m m′ pcellb 0 x pcellb 0 x′

rewrite Z.add_0_r in W

m :

b :

x, x′ :

v :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ ptr_addrx′ < 2 ^ 64

H :

nodeb x v ** Q%hS m

S₀ :

H₀ :

nodeb x v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

m′ :=

store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ : mem

Hk :

keepspcell_piecesb 0 m m′

Hg :

growsm m′

W :

writespcell_piecesb 0 m store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′ pcellb 0 x pcellb 0 x′

⊢

writespcell_piecesb 0 m m′ pcellb 0 x pcellb 0 x′

exact W

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b x x′ v Q S Hd HQ Hx H

destruct star_elim_l_ _ _ _ H as S₀ & H₀

pose proof node_region_ _ _ _ _ H₀ as Hr

set m′ := store_bytesstore_auxm b ptr_capx′ b 8 ptr_addrx′

assert Hk : keepspcell_piecesb 0 m m′

{pose proof pointer_store_same_onm b 0 _ ptr_capx′ ptr_addrx′ Hd conjHr eq_refl as K

rewrite Z.add_0_r in K

apply K ; cbn ; lia

assert Hg : growsm m′ by apply grows_same ; reflexivity

refine proj1writes_star_l_ _ _ _ _ Q Hk Hg HQ _ S H

unfold node

apply writes_star_r ; exact Hk | exact Hg | apply meta_stable |

apply writes_star_r ; exact Hk | exact Hg | apply live_stable |

apply writes_star_l ; exact Hk | exact Hg | apply icell_stable |

pose proof pcell_writesm b 0 x x′ Hx as W

rewrite Z.add_0_r in W

exact W

The 8-byte store of an unsigned x into the value slot of the node at b, which the assertion owns, makes x its value, and keeps the frame Q.

799Lemma node_store_value

∀ m b next v x Q S

0 ≤ x < 2 ^ 64

nodeb next v ** Q%hS m

nodeb next x ** Q%hS store_bytesm b + 8 8 x

Explore proof 11 tactics

Initial goal

⊢

∀m : mem b : Z next : ptr v x : Z Q : hprop S : fp, live_disjointm → stableQ → 0 ≤ x < 2 ^ 64 → nodeb next v ** Q%hS m → nodeb next x ** Q%hS store_bytesm b + 8 8 x

intros m b next v x Q S Hd HQ Hx H

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

⊢

nodeb next x ** Q%hS store_bytesm b + 8 8 x

destruct star_elim_l_ _ _ _ H as S₀ & H₀

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

⊢

nodeb next x ** Q%hS store_bytesm b + 8 8 x

pose proof node_region_ _ _ _ _ H₀ as Hr

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

⊢

nodeb next x ** Q%hS store_bytesm b + 8 8 x

assert Hk : keepsbytes8b 8 m store_bytesm b + 8 8 x by apply store_same_onm b 8 _ x Hd conjHr eq_refl ; cbn ; lia

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hk :

keepsbytes8b 8 m store_bytesm b + 8 8 x

⊢

nodeb next x ** Q%hS store_bytesm b + 8 8 x

assert Hg : growsm store_bytesm b + 8 8 x by apply grows_same ; reflexivity

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hk :

keepsbytes8b 8 m store_bytesm b + 8 8 x

Hg :

growsm store_bytesm b + 8 8 x

⊢

nodeb next x ** Q%hS store_bytesm b + 8 8 x

refine proj1writes_star_l_ _ _ _ _ Q Hk Hg HQ _ S H

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hk :

keepsbytes8b 8 m store_bytesm b + 8 8 x

Hg :

growsm store_bytesm b + 8 8 x

⊢

writesbytes8b 8 m store_bytesm b + 8 8 x nodeb next v nodeb next x

unfold node

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hk :

keepsbytes8b 8 m store_bytesm b + 8 8 x

Hg :

growsm store_bytesm b + 8 8 x

⊢

writesbytes8b 8 m store_bytesm b + 8 8 x metab 16 Heap ** liveb ** pcellb 0 next ** icellb 8 v%h metab 16 Heap ** liveb ** pcellb 0 next ** icellb 8 x%h

apply writes_star_r ; exact Hk | exact Hg | apply meta_stable |

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hk :

keepsbytes8b 8 m store_bytesm b + 8 8 x

Hg :

growsm store_bytesm b + 8 8 x

⊢

writesbytes8b 8 m store_bytesm b + 8 8 x liveb ** pcellb 0 next ** icellb 8 v%h liveb ** pcellb 0 next ** icellb 8 x%h

apply writes_star_r ; exact Hk | exact Hg | apply live_stable |

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hk :

keepsbytes8b 8 m store_bytesm b + 8 8 x

Hg :

growsm store_bytesm b + 8 8 x

⊢

writesbytes8b 8 m store_bytesm b + 8 8 x pcellb 0 next ** icellb 8 v%h pcellb 0 next ** icellb 8 x%h

apply writes_star_r ; exact Hk | exact Hg | apply pcell_stable |

m :

b :

v, x :

Q :

S :

Hd :

HQ :

Hx :

0 ≤ x < 2 ^ 64

H :

nodeb next v ** Q%hS m

S₀ :

H₀ :

nodeb next v S₀ m

Hr :

object_regionb m_regionsm = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hk :

keepsbytes8b 8 m store_bytesm b + 8 8 x

Hg :

growsm store_bytesm b + 8 8 x

⊢

writesbytes8b 8 m store_bytesm b + 8 8 x icellb 8 v icellb 8 x

apply icell_writes , Hx

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b next v x Q S Hd HQ Hx H

destruct star_elim_l_ _ _ _ H as S₀ & H₀

pose proof node_region_ _ _ _ _ H₀ as Hr

assert Hk : keepsbytes8b 8 m store_bytesm b + 8 8 x by apply store_same_onm b 8 _ x Hd conjHr eq_refl ; cbn ; lia

assert Hg : growsm store_bytesm b + 8 8 x by apply grows_same ; reflexivity

refine proj1writes_star_l_ _ _ _ _ Q Hk Hg HQ _ S H

unfold node

apply writes_star_r ; exact Hk | exact Hg | apply meta_stable |

apply writes_star_r ; exact Hk | exact Hg | apply live_stable |

apply writes_star_r ; exact Hk | exact Hg | apply pcell_stable |

apply icell_writes , Hx

After allocating a 16-byte heap object at a fresh base b, the pieces node_pieces of b make a node with a null next pointer and the value 0: Fil-C's allocation reads as zero, with no stored capability.

818Lemma alloc_node

∀ m b

freshm heap_req16 16 b

nodeb null 0 node_piecesb allocatedm heap_req16 16 b

Explore proof 49 tactics

Initial goal

⊢

∀m : mem b : Z, freshm heap_req16 16 b → nodeb null 0 node_piecesb allocatedm heap_req16 16 b

intros m b Hf

m :

b :

Hf :

freshm heap_req16 16 b

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b

pose proof Hf as _ & _ & _ & _ & _ & Hz

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + req_extentheap_req16 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b

cbn [ req_extent heap_req ] in Hz

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 + 15 / 16 × 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b

change 16 + 15 / 16 × 16 with 16 in Hz

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b

set m′ := allocatedm heap_req16 16 b

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

⊢

nodeb null 0 node_piecesb m′

assert Hr : object_regionb m_regionsm′ = SomemkRegionb b + 16 Heap Live by cbn ; rewrite Z.eqb_refl ; reflexivity

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

⊢

nodeb null 0 node_piecesb m′

assert Hl : ∀reg, live_atm′ b reg → reg = mkRegionb b + 16 Heap Live by intros reg E _ ; rewrite Hr in E ; injection E as ← ; reflexivity

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

⊢

nodeb null 0 node_piecesb m′

assert Hn : object_regionb m_regionsm′ ≠ None by rewrite Hr ; discriminate

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

nodeb null 0 node_piecesb m′

exists λ_ ⇒ False, node_piecesb

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀p : piece, node_piecesb p ↔ False ∨ node_piecesb p ∧ ∀p : piece, ¬False ∧ node_piecesb p ∧ metab 16 Heap λ_ : piece ⇒ False m′ ∧ liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

split ; intros p ; tauto |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀p : piece, ¬False ∧ node_piecesb p ∧ metab 16 Heap λ_ : piece ⇒ False m′ ∧ liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

split ; intros p ; tauto |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

metab 16 Heap λ_ : piece ⇒ False m′ ∧ liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

split

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

metab 16 Heap λ_ : piece ⇒ False m′

focused goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

{split ; intros p ; tauto |

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∃reg : region, object_regionb m_regionsm′ = Somereg ∧ r_kindreg = Heap ∧ r_lifereg = Live → r_endreg = b + 16

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

exists mkRegionb b + 16 Heap Live

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live ∧ r_kindr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live = Heap ∧ r_lifer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live = Live → r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live = b + 16

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

split ; exact Hr |

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

r_kindr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live = Heap ∧ r_lifer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live = Live → r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live = b + 16

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

split ; reflexivity

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

liveb ** pcellb 0 null ** icellb 8 0%hnode_piecesb m′

exists eqPLiveb, λp ⇒ pcell_piecesb 0 p ∨ bytes8b 8 p

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀p : piece, node_piecesb p ↔ PLiveb = p ∨ pcell_piecesb 0 p ∨ bytes8b 8 p ∧ ∀p : piece, ¬PLiveb = p ∧ pcell_piecesb 0 p ∨ bytes8b 8 p ∧ liveb eqPLiveb m′ ∧ pcellb 0 null ** icellb 8 0%hλp : piece ⇒ pcell_piecesb 0 p ∨ bytes8b 8 p m′

split ; intros p ; unfold node_pieces , pcell_pieces ; split ; intros H ; destruct H as [ <-| [ H | [ H | H ] ] ] | destruct H as [ <-| [ [ H | H ] | H ] ] ; tauto |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀p : piece, ¬PLiveb = p ∧ pcell_piecesb 0 p ∨ bytes8b 8 p ∧ liveb eqPLiveb m′ ∧ pcellb 0 null ** icellb 8 0%hλp : piece ⇒ pcell_piecesb 0 p ∨ bytes8b 8 p m′

split ; intros p ← i & _ & E | E | i & _ & E ; discriminate |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

liveb eqPLiveb m′ ∧ pcellb 0 null ** icellb 8 0%hλp : piece ⇒ pcell_piecesb 0 p ∨ bytes8b 8 p m′

split ; split ; intros p ; tauto | exists mkRegionb b + 16 Heap Live ; split ; exact Hr | reflexivity |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

pcellb 0 null ** icellb 8 0%hλp : piece ⇒ pcell_piecesb 0 p ∨ bytes8b 8 p m′

exists pcell_piecesb 0, bytes8b 8

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀p : piece, pcell_piecesb 0 p ∨ bytes8b 8 p ↔ pcell_piecesb 0 p ∨ bytes8b 8 p ∧ ∀p : piece, ¬pcell_piecesb 0 p ∧ bytes8b 8 p ∧ pcellb 0 null pcell_piecesb 0 m′ ∧ icellb 8 0 bytes8b 8 m′

split ; intros p ; tauto |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀p : piece, ¬pcell_piecesb 0 p ∧ bytes8b 8 p ∧ pcellb 0 null pcell_piecesb 0 m′ ∧ icellb 8 0 bytes8b 8 m′

split ; intros p i & Hi & → | → j & Hj & E′ ; assert 0 + i = 8 + j by congruence ; lia | discriminate |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

pcellb 0 null pcell_piecesb 0 m′ ∧ icellb 8 0 bytes8b 8 m′

split

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

pcellb 0 null pcell_piecesb 0 m′

focused goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

–split ; intros p ; apply iff_refl |

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

object_regionb m_regionsm′ ≠ None ∧ ∀reg : region, live_atm′ b reg → 0 ≤ 0 ∧ b + 0 + 8 ≤ r_endreg ∧ load_bytesm′ b + 0 8 = ptr_addrnull ∧ aux_holdsm′ b + 0 ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

split ; exact Hn |

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀reg : region, live_atm′ b reg → 0 ≤ 0 ∧ b + 0 + 8 ≤ r_endreg ∧ load_bytesm′ b + 0 8 = ptr_addrnull ∧ aux_holdsm′ b + 0 ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

intros reg Hreg

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

reg :

Hreg :

live_atm′ b reg

⊢

0 ≤ 0 ∧ b + 0 + 8 ≤ r_endreg ∧ load_bytesm′ b + 0 8 = ptr_addrnull ∧ aux_holdsm′ b + 0 ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

apply Hl in Hreg as →

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

0 ≤ 0 ∧ b + 0 + 8 ≤ r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm′ b + 0 8 = ptr_addrnull ∧ aux_holdsm′ b + 0 ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

split ; lia |

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

b + 0 + 8 ≤ r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm′ b + 0 8 = ptr_addrnull ∧ aux_holdsm′ b + 0 ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

split ; cbn ; lia |

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

load_bytesm′ b + 0 8 = ptr_addrnull ∧ aux_holdsm′ b + 0 ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

rewrite Z.add_0_r

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

load_bytesm′ b 8 = ptr_addrnull ∧ aux_holdsm′ b ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

split

3 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

load_bytesm′ b 8 = ptr_addrnull

focused goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

+apply load_bytes_zero

3 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀i : Z, 0 ≤ i < 8 → m_bytesm′ b + i = 0

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

intros i Hi

3 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

i :

Hi :

0 ≤ i < 8

⊢

m_bytesm′ b + i = 0

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

apply Hzb + i

3 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

i :

Hi :

0 ≤ i < 8

⊢

b ≤ b + i < b + 16

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

lia

2 open

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

+left

2 open

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

m_auxm′ b = ptr_capnull

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

exact proj2Hzb ltac:lia

deferred goal

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

icellb 8 0 bytes8b 8 m′

–split ; intros p ; tauto |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

object_regionb m_regionsm′ ≠ None ∧ ∀reg : region, live_atm′ b reg → 0 ≤ 8 ∧ b + 8 + 8 ≤ r_endreg ∧ load_bytesm′ b + 8 8 = 0

split ; exact Hn |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀reg : region, live_atm′ b reg → 0 ≤ 8 ∧ b + 8 + 8 ≤ r_endreg ∧ load_bytesm′ b + 8 8 = 0

intros reg Hreg

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

reg :

Hreg :

live_atm′ b reg

⊢

0 ≤ 8 ∧ b + 8 + 8 ≤ r_endreg ∧ load_bytesm′ b + 8 8 = 0

apply Hl in Hreg as →

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

0 ≤ 8 ∧ b + 8 + 8 ≤ r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm′ b + 8 8 = 0

split ; lia |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

b + 8 + 8 ≤ r_endr_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm′ b + 8 8 = 0

split ; cbn ; lia |

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

load_bytesm′ b + 8 8 = 0

apply load_bytes_zero

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

⊢

∀i : Z, 0 ≤ i < 8 → m_bytesm′ b + 8 + i = 0

intros i Hi

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

i :

Hi :

0 ≤ i < 8

⊢

m_bytesm′ b + 8 + i = 0

rewrite <- Z.add_assoc

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

i :

Hi :

0 ≤ i < 8

⊢

m_bytesm′ b + 8 + i = 0

apply Hzb + 8 + i

m :

b :

Hf :

freshm heap_req16 16 b

Hz :

∀a : Z, b ≤ a < b + 16 → m_bytesm a = 0 ∧ m_auxm a = CNone

m′ :=

allocatedm heap_req16 16 b : mem

Hr :

object_regionb m_regionsm′ = Somer_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hl :

∀reg : region, live_atm′ b reg → reg = r_base ≔ b; r_end ≔ b + 16; r_kind ≔ Heap; r_life ≔ Live

Hn :

object_regionb m_regionsm′ ≠ None

i :

Hi :

0 ≤ i < 8

⊢

b ≤ b + 8 + i < b + 16

lia

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b Hf

pose proof Hf as _ & _ & _ & _ & _ & Hz

cbn [ req_extent heap_req ] in Hz

change 16 + 15 / 16 × 16 with 16 in Hz

set m′ := allocatedm heap_req16 16 b

assert Hr : object_regionb m_regionsm′ = SomemkRegionb b + 16 Heap Live by cbn ; rewrite Z.eqb_refl ; reflexivity

assert Hl : ∀reg, live_atm′ b reg → reg = mkRegionb b + 16 Heap Live by intros reg E _ ; rewrite Hr in E ; injection E as ← ; reflexivity

assert Hn : object_regionb m_regionsm′ ≠ None by rewrite Hr ; discriminate

exists λ_ ⇒ False, node_piecesb

split ; intros p ; tauto |

split

{split ; intros p ; tauto |

exists mkRegionb b + 16 Heap Live

split ; exact Hr |

split ; reflexivity

exists eqPLiveb, λp ⇒ pcell_piecesb 0 p ∨ bytes8b 8 p

split ; intros p ; unfold node_pieces , pcell_pieces ; split ; intros H ; destruct H as [ <-| [ H | [ H | H ] ] ] | destruct H as [ <-| [ [ H | H ] | H ] ] ; tauto |

split ; intros p ← i & _ & E | E | i & _ & E ; discriminate |

split ; split ; intros p ; tauto | exists mkRegionb b + 16 Heap Live ; split ; exact Hr | reflexivity |

exists pcell_piecesb 0, bytes8b 8

split ; intros p ; tauto |

split ; intros p i & Hi & → | → j & Hj & E′ ; assert 0 + i = 8 + j by congruence ; lia | discriminate |

split

–split ; intros p ; apply iff_refl |

split ; exact Hn |

intros reg Hreg

apply Hl in Hreg as →

split ; lia |

split ; cbn ; lia |

rewrite Z.add_0_r

split

+apply load_bytes_zero

intros i Hi

apply Hzb + i

lia

+left

exact proj2Hzb ltac:lia

–split ; intros p ; tauto |

split ; exact Hn |

intros reg Hreg

apply Hl in Hreg as →

split ; lia |

split ; cbn ; lia |

apply load_bytes_zero

intros i Hi

rewrite <- Z.add_assoc

apply Hzb + 8 + i

lia

Allocating a node at a fresh base adds it to any stable assertion P of pieces of objects: the new pieces are disjoint from P's, since no one owned the new identity.

851Lemma alloc_frame

∀ m b P S

freshm heap_req16 16 b

PS m

nodeb null 0 ** P%hλp ⇒ node_piecesb p ∨ Sp allocatedm heap_req16 16 b

Explore proof 9 tactics

Initial goal

⊢

∀m : mem b : Z P : hprop S : fp, freshm heap_req16 16 b → stableP → owns_registeredP → PS m → nodeb null 0 ** P%hλp : piece ⇒ node_piecesb p ∨ Sp allocatedm heap_req16 16 b

intros m b P S Hf HP Hreg H

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

nodeb null 0 ** P%hλp : piece ⇒ node_piecesb p ∨ Sp allocatedm heap_req16 16 b

exists node_piecesb, S

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

∀p : piece, node_piecesb p ∨ Sp ↔ node_piecesb p ∨ Sp ∧ ∀p : piece, ¬node_piecesb p ∧ Sp ∧ nodeb null 0 node_piecesb allocatedm heap_req16 16 b ∧ PS allocatedm heap_req16 16 b

split ; intros p ; tauto |

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

∀p : piece, ¬node_piecesb p ∧ Sp ∧ nodeb null 0 node_piecesb allocatedm heap_req16 16 b ∧ PS allocatedm heap_req16 16 b

split

2 open

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

∀p : piece, ¬node_piecesb p ∧ Sp

focused goal

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b ∧ PS allocatedm heap_req16 16 b

–intros p Hn Hs

2 open

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

p :

Hn :

node_piecesb p

Hs :

⊢

False

deferred goal

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b ∧ PS allocatedm heap_req16 16 b

apply registered_freshS m _ b p Hreg_ _ H Hf Hs

2 open

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

p :

Hn :

node_piecesb p

Hs :

⊢

piece_idp = b

deferred goal

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b ∧ PS allocatedm heap_req16 16 b

destruct Hn as [ ->| [ ( i & _ & -> ) | [ ->| ( i & _ & -> ) ] ] ] ; reflexivity

deferred goal

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

nodeb null 0 node_piecesb allocatedm heap_req16 16 b ∧ PS allocatedm heap_req16 16 b

–split ; exact alloc_nodem b Hf |

m :

b :

P :

S :

Hf :

freshm heap_req16 16 b

HP :

Hreg :

H :

PS m

⊢

PS allocatedm heap_req16 16 b

exact HPS m _ H alloc_same_onS m _ b Hf alloc_growsm _ b Hf

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m b P S Hf HP Hreg H

exists node_piecesb, S

split ; intros p ; tauto |

split

–intros p Hn Hs

apply registered_freshS m _ b p Hreg_ _ H Hf Hs

destruct Hn as [ ->| [ ( i & _ & -> ) | [ ->| ( i & _ & -> ) ] ] ] ; reflexivity

–split ; exact alloc_nodem b Hf |

exact HPS m _ H alloc_same_onS m _ b Hf alloc_growsm _ b Hf

The list

The empty list at null owns nothing.

863Lemma lst_nil

∀ m

lstnull [ ] λ_ ⇒ False m

Explore proof 2 tactics

Initial goal

⊢

∀m : mem, lstnull [ ] λ_ : piece ⇒ False m

intros m

m :

⊢

lstnull [ ] λ_ : piece ⇒ False m

split ; intros p ; tauto | reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros m

split ; intros p ; tauto | reflexivity

A nonempty list is a lst_cons for some next pointer.

867Lemma lst_cons_iff

∀ p v xs S m

lstp v :: xs S m ↔ ∃next, lst_consp v next xs S m

Explore proof 2 tactics

Initial goal

⊢

∀p : ptr v : Z xs : listZ S : fp m : mem, lstp v :: xs S m ↔ ∃next : ptr, lst_consp v next xs S m

intros

p :

v :

xs :

listZ

S :

m :

⊢

lstp v :: xs S m ↔ ∃next : ptr, lst_consp v next xs S m

reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros

reflexivity

A list's pointer is null, or a live object's capability.

871Lemma lst_cap

∀ xs p S m

lstp xs S m

ptr_capp = CNone ∨ ∃b reg, ptr_capp = Objb ∧ live_atm b reg

Explore proof 11 tactics

Initial goal

⊢

∀xs : listZ p : ptr S : fp m : mem, lstp xs S m → ptr_capp = CNone ∨ ∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

intros | v xs p S m H ; cbn [ lst ] in H

2 open

p :

S :

m :

H :

purep = null S m

⊢

ptr_capp = CNone ∨ ∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

focused goal

v :

xs :

listZ

p :

S :

m :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

ptr_capp = CNone ∨ ∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

–destruct H as _ →

2 open

S :

m :

⊢

ptr_capnull = CNone ∨ ∃b : Z reg : region, ptr_capnull = Objb ∧ live_atm b reg

deferred goal

v :

xs :

listZ

p :

S :

m :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

ptr_capp = CNone ∨ ∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

left

2 open

S :

m :

⊢

ptr_capnull = CNone

deferred goal

v :

xs :

listZ

p :

S :

m :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

ptr_capp = CNone ∨ ∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

reflexivity

deferred goal

v :

xs :

listZ

p :

S :

m :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

ptr_capp = CNone ∨ ∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

–destruct H as next & S₁ & S₂ & _ & _ & _ & Hp & _ & H₂

v :

xs :

listZ

p :

S :

m :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

⊢

ptr_capp = CNone ∨ ∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

right

v :

xs :

listZ

p :

S :

m :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

⊢

∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

destruct star_elim_l_ _ _ _ H₂ as S₃ & H₃

v :

xs :

listZ

p :

S :

m :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

⊢

∃b : Z reg : region, ptr_capp = Objb ∧ live_atm b reg

exists ptr_addrp, mkRegionptr_addrp ptr_addrp + 16 Heap Live

v :

xs :

listZ

p :

S :

m :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

⊢

ptr_capp = Objptr_addrp ∧ live_atm ptr_addrp r_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

rewrite Hp at 1

v :

xs :

listZ

p :

S :

m :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

⊢

ptr_capptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp = Objptr_addrp ∧ live_atm ptr_addrp r_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

split ; reflexivity |

v :

xs :

listZ

p :

S :

m :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

⊢

live_atm ptr_addrp r_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

split ; exact node_region_ _ _ _ _ H₃ | reflexivity

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros | v xs p S m H ; cbn [ lst ] in H

–destruct H as _ →

left

reflexivity

–destruct H as next & S₁ & S₂ & _ & _ & _ & Hp & _ & H₂

right

destruct star_elim_l_ _ _ _ H₂ as S₃ & H₃

exists ptr_addrp, mkRegionptr_addrp ptr_addrp + 16 Heap Live

rewrite Hp at 1

split ; reflexivity |

split ; exact node_region_ _ _ _ _ H₃ | reflexivity

A list's address is 0 or a node's, inside the address space when every object is (objects_fit).

883Lemma lst_range

∀ xs p S m

lstp xs S m

0 ≤ ptr_addrp < 2 ^ 48

Explore proof 9 tactics

Initial goal

⊢

∀xs : listZ p : ptr S : fp m : mem, objects_fitm_regionsm → lstp xs S m → 0 ≤ ptr_addrp < 2 ^ 48

intros | v xs p S m Hfit H ; cbn [ lst ] in H

2 open

p :

S :

m :

Hfit :

H :

purep = null S m

⊢

0 ≤ ptr_addrp < 2 ^ 48

focused goal

v :

xs :

listZ

p :

S :

m :

Hfit :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

0 ≤ ptr_addrp < 2 ^ 48

–destruct H as _ →

2 open

S :

m :

Hfit :

⊢

0 ≤ ptr_addrnull < 2 ^ 48

deferred goal

v :

xs :

listZ

p :

S :

m :

Hfit :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

0 ≤ ptr_addrp < 2 ^ 48

cbn

2 open

S :

m :

Hfit :

⊢

0 ≤ 0 < 281474976710656

deferred goal

v :

xs :

listZ

p :

S :

m :

Hfit :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

0 ≤ ptr_addrp < 2 ^ 48

lia

deferred goal

v :

xs :

listZ

p :

S :

m :

Hfit :

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs%h S m

⊢

0 ≤ ptr_addrp < 2 ^ 48

–destruct H as next & S₁ & S₂ & _ & _ & _ & _ & Hpos & _ & H₂

v :

xs :

listZ

p :

S :

m :

Hfit :

S₁, S₂ :

piece → Prop

Hpos :

0 < ptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

⊢

0 ≤ ptr_addrp < 2 ^ 48

destruct star_elim_l_ _ _ _ H₂ as S₃ & H₃

v :

xs :

listZ

p :

S :

m :

Hfit :

S₁, S₂ :

piece → Prop

Hpos :

0 < ptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

⊢

0 ≤ ptr_addrp < 2 ^ 48

destruct Hfit_ _ node_region_ _ _ _ _ H₃

v :

xs :

listZ

p :

S :

m :

Hfit :

S₁, S₂ :

piece → Prop

Hpos :

0 < ptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

H :

0 ≤ ptr_addrp

H₀ :

r_endr_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live ≤ 2 ^ 48

⊢

0 ≤ ptr_addrp < 2 ^ 48

cbn in *

v :

xs :

listZ

p :

S :

m :

Hfit :

S₁, S₂ :

piece → Prop

Hpos :

0 < ptr_addrp

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

H :

0 ≤ ptr_addrp

H₀ :

ptr_addrp + 16 ≤ 281474976710656

⊢

0 ≤ ptr_addrp < 281474976710656

lia

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros | v xs p S m Hfit H ; cbn [ lst ] in H

–destruct H as _ →

cbn

lia

–destruct H as next & S₁ & S₂ & _ & _ & _ & _ & Hpos & _ & H₂

destruct star_elim_l_ _ _ _ H₂ as S₃ & H₃

destruct Hfit_ _ node_region_ _ _ _ _ H₃

cbn in *

lia

A list at a nonzero address is a node and the rest.

892Lemma lst_nonnull

∀ xs p R S m

ptr_addrp ≠ 0

lstp xs ** R%hS m

∃v next xs′, lst_consp v next xs′ ** R%hS m

Explore proof 8 tactics

Initial goal

⊢

∀xs : listZ p : ptr R : hprop S : fp m : mem, ptr_addrp ≠ 0 → lstp xs ** R%hS m → ∃v : Z next : ptr xs′ : listZ, lst_consp v next xs′ ** R%hS m

intros | v xs p R S m Hp H

2 open

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

lstp [ ] ** R%hS m

⊢

∃v : Z next : ptr xs′ : listZ, lst_consp v next xs′ ** R%hS m

focused goal

v :

xs :

listZ

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

lstp v :: xs ** R%hS m

⊢

∃v₀ : Z next : ptr xs′ : listZ, lst_consp v₀ next xs′ ** R%hS m

–destruct star_elim_l_ _ _ _ H as S₁ & _ & →

2 open

R :

S :

m :

H :

lstnull [ ] ** R%hS m

Hp :

ptr_addrnull ≠ 0

S₁ :

⊢

∃v : Z next : ptr xs′ : listZ, lst_consnull v next xs′ ** R%hS m

deferred goal

v :

xs :

listZ

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

lstp v :: xs ** R%hS m

⊢

∃v₀ : Z next : ptr xs′ : listZ, lst_consp v₀ next xs′ ** R%hS m

cbn in Hp

2 open

R :

S :

m :

H :

lstnull [ ] ** R%hS m

Hp :

0 ≠ 0

S₁ :

⊢

∃v : Z next : ptr xs′ : listZ, lst_consnull v next xs′ ** R%hS m

deferred goal

v :

xs :

listZ

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

lstp v :: xs ** R%hS m

⊢

∃v₀ : Z next : ptr xs′ : listZ, lst_consp v₀ next xs′ ** R%hS m

lia

deferred goal

v :

xs :

listZ

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

lstp v :: xs ** R%hS m

⊢

∃v₀ : Z next : ptr xs′ : listZ, lst_consp v₀ next xs′ ** R%hS m

–cbn [ lst ] in H

v :

xs :

listZ

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

hexλnext : ptr ⇒ purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs ** R%hS m

⊢

∃v₀ : Z next : ptr xs′ : listZ, lst_consp v₀ next xs′ ** R%hS m

apply star_hex_l in H as next & H

v :

xs :

listZ

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs ** R%hS m

⊢

∃v₀ : Z next₀ : ptr xs′ : listZ, lst_consp v₀ next₀ xs′ ** R%hS m

exists v, next, xs

v :

xs :

listZ

p :

R :

S :

m :

Hp :

ptr_addrp ≠ 0

H :

purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs ** R%hS m

⊢

lst_consp v next xs ** R%hS m

exact H

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros | v xs p R S m Hp H

–destruct star_elim_l_ _ _ _ H as S₁ & _ & →

cbn in Hp

lia

–cbn [ lst ] in H

apply star_hex_l in H as next & H

exists v, next, xs

exact H

What a node of a list gives a step that reads it: its address a, aligned, inside the address space, a live 16-byte heap object whose next slot holds next, address in the bytes and capability, exactly, in the aux.

904Lemma lst_cons_facts

∀ p v next xs R S m

lst_consp v next xs ** R%hS m

∃a, p = mkPtra Obja ∧ 0 < a ∧ a mod 8 = 0 ∧ a + 16 ≤ 2 ^ 48 ∧ object_regiona m_regionsm = SomemkRegiona a + 16 Heap Live ∧ load_bytesm a 8 = ptr_addrnext ∧ m_auxm a = ptr_capnext

Explore proof 15 tactics

Initial goal

⊢

∀p : ptr v : Z next : ptr xs : listZ R : hprop S : fp m : mem, objects_fitm_regionsm → lst_consp v next xs ** R%hS m → ∃a : Z, p = ptr_addr ≔ a; ptr_cap ≔ Obja ∧ 0 < a ∧ a mod 8 = 0 ∧ a + 16 ≤ 2 ^ 48 ∧ object_regiona m_regionsm = Somer_base ≔ a; r_end ≔ a + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm a 8 = ptr_addrnext ∧ m_auxm a = ptr_capnext

intros p v next xs R S m Hfit H

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

⊢

∃a : Z, p = ptr_addr ≔ a; ptr_cap ≔ Obja ∧ 0 < a ∧ a mod 8 = 0 ∧ a + 16 ≤ 2 ^ 48 ∧ object_regiona m_regionsm = Somer_base ≔ a; r_end ≔ a + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm a 8 = ptr_addrnext ∧ m_auxm a = ptr_capnext

destruct star_elim_l_ _ _ _ H as S₀ & S₁ & S₂ & _ & _ & _ & Hp & Hpos & Hal & H₂

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

⊢

destruct star_elim_l_ _ _ _ H₂ as S₃ & H₃

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

⊢

destruct star_elim_r_ _ _ _ H₂ as S₄ & H₄

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

⊢

pose proof node_region_ _ _ _ _ H₃ as Hr

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

⊢

destruct node_next_ _ _ _ _ H₃ as Hv Ha

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

exists ptr_addrp

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ∧ ptr_addrp + 16 ≤ 2 ^ 48 ∧ object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm ptr_addrp 8 = ptr_addrnext ∧ m_auxm ptr_addrp = ptr_capnext

split ; exact Hp |

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ∧ ptr_addrp + 16 ≤ 2 ^ 48 ∧ object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm ptr_addrp 8 = ptr_addrnext ∧ m_auxm ptr_addrp = ptr_capnext

split ; exact Hpos |

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

ptr_addrp mod 8 = 0 ∧ ptr_addrp + 16 ≤ 2 ^ 48 ∧ object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm ptr_addrp 8 = ptr_addrnext ∧ m_auxm ptr_addrp = ptr_capnext

split ; exact Hal |

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

ptr_addrp + 16 ≤ 2 ^ 48 ∧ object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm ptr_addrp 8 = ptr_addrnext ∧ m_auxm ptr_addrp = ptr_capnext

split ; destruct Hfit_ _ Hr ; cbn in * ; lia |

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live ∧ load_bytesm ptr_addrp 8 = ptr_addrnext ∧ m_auxm ptr_addrp = ptr_capnext

split ; exact Hr |

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

load_bytesm ptr_addrp 8 = ptr_addrnext ∧ m_auxm ptr_addrp = ptr_capnext

split ; exact Hv |

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

m_auxm ptr_addrp = ptr_capnext

apply aux_holds_live_ _ _ Ha

p :

v :

xs :

listZ

R :

S :

m :

Hfit :

H :

lst_consp v next xs ** R%hS m

S₀ :

S₁, S₂ :

piece → Prop

Hp :

p = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp

Hpos :

0 < ptr_addrp

Hal :

ptr_addrp mod 8 = 0

H₂ :

nodeptr_addrp next v ** lstnext xs%hS₂ m

S₃ :

H₃ :

nodeptr_addrp next v S₃ m

S₄ :

H₄ :

lstnext xs S₄ m

Hr :

object_regionptr_addrp m_regionsm = Somer_base ≔ ptr_addrp; r_end ≔ ptr_addrp + 16; r_kind ≔ Heap; r_life ≔ Live

Hv :

load_bytesm ptr_addrp 8 = ptr_addrnext

Ha :

⊢

ptr_capnext = CNone ∨ ∃b : Z reg : region, ptr_capnext = Objb ∧ live_atm b reg

exact lst_cap_ _ _ _ H₄

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros p v next xs R S m Hfit H

destruct star_elim_l_ _ _ _ H as S₀ & S₁ & S₂ & _ & _ & _ & Hp & Hpos & Hal & H₂

destruct star_elim_l_ _ _ _ H₂ as S₃ & H₃

destruct star_elim_r_ _ _ _ H₂ as S₄ & H₄

pose proof node_region_ _ _ _ _ H₃ as Hr

destruct node_next_ _ _ _ _ H₃ as Hv Ha

exists ptr_addrp

split ; exact Hp |

split ; exact Hpos |

split ; exact Hal |

split ; destruct Hfit_ _ Hr ; cbn in * ; lia |

split ; exact Hr |

split ; exact Hv |

apply aux_holds_live_ _ _ Ha

exact lst_cap_ _ _ _ H₄

A node and the rest of a list make a list one longer.

918Lemma lst_cons_intro

∀ b h v xs S m

0 < b

b mod 8 = 0

nodeb h v ** lsth xs%hS m

lstmkPtrb Objb v :: xs S m

Explore proof 6 tactics

Initial goal

⊢

∀b : Z h : ptr v : Z xs : listZ S : fp m : mem, 0 < b → b mod 8 = 0 → nodeb h v ** lsth xs%hS m → lstptr_addr ≔ b; ptr_cap ≔ Objb v :: xs S m

intros b h v xs S m Hb Hal H

b :

h :

v :

xs :

listZ

S :

m :

Hb :

0 < b

Hal :

b mod 8 = 0

H :

nodeb h v ** lsth xs%hS m

⊢

lstptr_addr ≔ b; ptr_cap ≔ Objb v :: xs S m

cbn [ lst ]

b :

h :

v :

xs :

listZ

S :

m :

Hb :

0 < b

Hal :

b mod 8 = 0

H :

nodeb h v ** lsth xs%hS m

⊢

hexλnext : ptr ⇒ pureptr_addr ≔ b; ptr_cap ≔ Objb = ptr_addr ≔ ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb; ptr_cap ≔ Objptr_addrptr_addr ≔ b; ptr_cap ≔ Objb ∧ 0 < ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb ∧ ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb mod 8 = 0 ** nodeptr_addrptr_addr ≔ b; ptr_cap ≔ Objb next v ** lstnext xs%h S m

exists h

b :

h :

v :

xs :

listZ

S :

m :

Hb :

0 < b

Hal :

b mod 8 = 0

H :

nodeb h v ** lsth xs%hS m

⊢

pureptr_addr ≔ b; ptr_cap ≔ Objb = ptr_addr ≔ ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb; ptr_cap ≔ Objptr_addrptr_addr ≔ b; ptr_cap ≔ Objb ∧ 0 < ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb ∧ ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb mod 8 = 0 ** nodeptr_addrptr_addr ≔ b; ptr_cap ≔ Objb h v ** lsth xs%hS m

apply star_pure_intro ; | exact H

b :

h :

v :

xs :

listZ

S :

m :

Hb :

0 < b

Hal :

b mod 8 = 0

H :

nodeb h v ** lsth xs%hS m

⊢

ptr_addr ≔ b; ptr_cap ≔ Objb = ptr_addr ≔ ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb; ptr_cap ≔ Objptr_addrptr_addr ≔ b; ptr_cap ≔ Objb ∧ 0 < ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb ∧ ptr_addrptr_addr ≔ b; ptr_cap ≔ Objb mod 8 = 0

cbn

b :

h :

v :

xs :

listZ

S :

m :

Hb :

0 < b

Hal :

b mod 8 = 0

H :

nodeb h v ** lsth xs%hS m

⊢

ptr_addr ≔ b; ptr_cap ≔ Objb = ptr_addr ≔ b; ptr_cap ≔ Objb ∧ 0 < b ∧ b mod 8 = 0

auto

No remaining goals.

Qed

✓ Proof checked and closed by Rocq.

Source script

intros b h v xs S m Hb Hal H

cbn [ lst ]

exists h

apply star_pure_intro ; | exact H

cbn

auto

Walking past a node drops it, and its pure facts, into htrue.

926Lemma lst_cons_drop

∀ p v next xs F S m

lst_consp v next xs ** htrue ** F%hS m

lstnext xs ** htrue ** F%hS m

Explore proof 11 tactics

Initial goal

⊢

∀p : ptr v : Z next : ptr xs : listZ F : hprop S : fp m : mem, lst_consp v next xs ** htrue ** F%hS m → lstnext xs ** htrue ** F%hS m

intros p v next xs F S m H

p :

v :

xs :

listZ

F :

S :

m :

H :

lst_consp v next xs ** htrue ** F%hS m

⊢

lstnext xs ** htrue ** F%hS m

unfold lst_cons in H

p :

v :

xs :

listZ

F :

S :

m :

H :

purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs ** htrue ** F%hS m

⊢

lstnext xs ** htrue ** F%hS m

apply star_assoc_r in H

p :

v :

xs :

listZ

F :

S :

m :

H :

purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs ** htrue ** F%hS m

⊢

lstnext xs ** htrue ** F%hS m

apply star_mono_r_ _ _ _ _ star_assoc_r_ _ _ in H

p :

v :

xs :

listZ

F :

S :

m :

H :

purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** lstnext xs ** htrue ** F%hS m

⊢

lstnext xs ** htrue ** F%hS m

apply star_mono_r_ _ _ _ _ star_swap_ _ _ in H

p :

v :

xs :

listZ

F :

S :

m :

H :

purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** lstnext xs ** nodeptr_addrp next v ** htrue ** F%hS m

⊢

lstnext xs ** htrue ** F%hS m

apply star_swap in H

p :

v :

xs :

listZ

F :

S :

m :

H :

lstnext xs ** purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** htrue ** F%hS m

⊢

lstnext xs ** htrue ** F%hS m

revert H

p :

v :

xs :

listZ

F :

S :

m :

⊢

lstnext xs ** purep = ptr_addr ≔ ptr_addrp; ptr_cap ≔ Objptr_addrp ∧ 0 < ptr_addrp ∧ ptr_addrp mod 8 = 0 ** nodeptr_addrp next v ** htrue ** F%hS m → lstnext xs ** htrue ** F%hS m

apply star_mono_r

p :

v :

xs :

listZ

F :

S :

m :