Attention une mise à jour du service Gitlab va être effectuée le mardi 18 janvier (et non lundi 17 comme annoncé précédemment) entre 18h00 et 18h30. Cette mise à jour va générer une interruption du service dont nous ne maîtrisons pas complètement la durée mais qui ne devrait pas excéder quelques minutes.

Commit 58d81b49 authored by MARCHE Claude's avatar MARCHE Claude
Browse files

treedel example: a few renamings

type point -> loc
predicate tree -> istree
post-condition: t -> t'
parent 6847fe50
......@@ -12,7 +12,7 @@ Iterative deletion in a binary search tree - 90 minutes
VERIFICATION TASK
-----------------
Given: a pointer t to the root of a non-empty binary search tree (not
Given: a loc t to the root of a non-empty binary search tree (not
necessarily balanced). Verify that the following procedure removes the
node with the minimal key from the tree. After removal, the data
structure should again be a binary search tree.
......@@ -38,30 +38,30 @@ Note: When implementing in a garbage-collected language, the call to
dispose() is superfluous.
*)
(* Why3 has no pointer data structures, so we model the heap *)
(* Why3 has no loc data structures, so we model the heap *)
module Memory
use export map.Map
use export ref.Ref
type pointer
constant null: pointer
type node = { left: pointer; right: pointer; data: int; }
type memory = map pointer node
type loc
constant null: loc
type node = { left: loc; right: loc; data: int; }
type memory = map loc node
(* the global variable mem contains the current state of the memory *)
val mem: ref memory
(* accessor functions to ensure safety i.e. no null pointer dereference *)
let get_left (p: pointer) : pointer =
(* accessor functions to ensure safety i.e. no null loc dereference *)
let get_left (p: loc) : loc =
requires { p <> null }
ensures { result = !mem[p].left }
!mem[p].left
let get_right (p: pointer) : pointer =
let get_right (p: loc) : loc =
requires { p <> null }
ensures { result = !mem[p].right }
!mem[p].right
let get_data (p: pointer) : int =
let get_data (p: loc) : int =
requires { p <> null }
ensures { result = !mem[p].data }
!mem[p].data
......@@ -76,14 +76,14 @@ module Treedel
use import list.Distinct
(* there is a binary tree t rooted at p in memory m *)
inductive tree (m: memory) (p: pointer) (t: tree pointer) =
inductive istree (m: memory) (p: loc) (t: tree loc) =
| leaf: forall m: memory.
tree m null Empty
| node: forall m: memory, p: pointer, l r: tree pointer.
istree m null Empty
| node: forall m: memory, p: loc, l r: tree loc.
p <> null ->
tree m m[p].left l ->
tree m m[p].right r ->
tree m p (Node l p r)
istree m m[p].left l ->
istree m m[p].right r ->
istree m p (Node l p r)
(* degenerated zipper for a left descent (= list of pairs) *)
type zipper 'a =
......@@ -99,32 +99,32 @@ module Treedel
forall z "induction": zipper 'a, x: 'a, l r: tree 'a.
inorder (zip (Node l x r) z) = inorder l ++ Cons x (inorder (zip r z))
let ghost left (t: tree pointer) =
let ghost left (t: tree loc) =
requires { t <> Empty }
ensures { match t with Empty -> false | Node l _ _ -> result = l end }
match t with Empty -> absurd | Node l _ _ -> l end
let ghost right (t: tree pointer) =
let ghost right (t: tree loc) =
requires { t <> Empty }
ensures { match t with Empty -> false | Node _ _ r -> result = r end }
match t with Empty -> absurd | Node _ _ r -> r end
lemma main_lemma:
forall m: memory, t pp p: pointer, ppr pr: tree pointer, z: zipper pointer.
forall m: memory, t pp p: loc, ppr pr: tree loc, z: zipper loc.
let it = zip (Node (Node Empty p pr) pp ppr) z in
tree m t it -> distinct (inorder it) ->
istree m t it -> distinct (inorder it) ->
let m' = m[pp <- { m[pp] with left = m[p].right }] in
tree m' t (zip (Node pr pp ppr) z)
istree m' t (zip (Node pr pp ppr) z)
(* specification is as follows: if t is a tree and its list of pointers
(* specification is as follows: if t is a tree and its list of locs
is x::l then, at the end of execution, its list is l and m = x.data *)
let search_tree_delete_min
(t: pointer) (ghost it: tree pointer) (ghost ot: ref (tree pointer))
: (pointer, int)
(t: loc) (ghost it: tree loc) (ghost ot: ref (tree loc))
: (loc, int)
requires { t <> null }
requires { tree !mem t it }
requires { istree !mem t it }
requires { distinct (inorder it) }
ensures { let (t, m) = result in tree !mem t !ot /\
ensures { let (t', m) = result in istree !mem t' !ot /\
match inorder it with
| Nil -> false
| Cons p l -> m = !mem[p].data /\ inorder !ot = l end }
......@@ -146,8 +146,8 @@ module Treedel
invariant { !pp <> null /\ !mem[!pp].left = !p }
invariant { !p <> null /\ !mem[!p].left = !tt }
invariant { let pt = Node !subtree !pp !ppr in
tree !mem !pp pt /\ zip pt !zipper = it }
assert { tree !mem !p !subtree };
istree !mem !pp pt /\ zip pt !zipper = it }
assert { istree !mem !p !subtree };
ghost zipper := Left !zipper !pp !ppr;
ghost ppr := right !subtree;
ghost subtree := left !subtree;
......@@ -155,7 +155,7 @@ module Treedel
p := !tt;
tt := get_left !p
done;
assert { tree !mem !p !subtree };
assert { istree !mem !p !subtree };
assert { !pp <> !p };
let m = get_data !p in
tt := get_right !p;
......
......@@ -21,15 +21,15 @@ Definition contents {a:Type} {a_WT:WhyType a} (v:(ref a)): a :=
| (mk_ref x) => x
end.
Axiom pointer : Type.
Parameter pointer_WhyType : WhyType pointer.
Existing Instance pointer_WhyType.
Axiom loc : Type.
Parameter loc_WhyType : WhyType loc.
Existing Instance loc_WhyType.
Parameter null: pointer.
Parameter null: loc.
(* Why3 assumption *)
Inductive node :=
| mk_node : pointer -> pointer -> Z -> node.
| mk_node : loc -> loc -> Z -> node.
Axiom node_WhyType : WhyType node.
Existing Instance node_WhyType.
......@@ -39,19 +39,19 @@ Definition data (v:node): Z := match v with
end.
(* Why3 assumption *)
Definition right1 (v:node): pointer :=
Definition right1 (v:node): loc :=
match v with
| (mk_node x x1 x2) => x1
end.
(* Why3 assumption *)
Definition left1 (v:node): pointer :=
Definition left1 (v:node): loc :=
match v with
| (mk_node x x1 x2) => x
end.
(* Why3 assumption *)
Definition memory := (map.Map.map pointer node).
Definition memory := (map.Map.map loc node).
(* Why3 assumption *)
Inductive tree
......@@ -140,12 +140,12 @@ Axiom distinct_append : forall {a:Type} {a_WT:WhyType a}, forall (l1:(list
x l1) -> ~ (mem x l2)) -> (distinct (infix_plpl l1 l2)))).
(* Why3 assumption *)
Inductive tree1 : (map.Map.map pointer node) -> pointer -> (tree
pointer) -> Prop :=
| leaf : forall (m:(map.Map.map pointer node)), (tree1 m null (Empty :(tree
pointer)))
| node1 : forall (m:(map.Map.map pointer node)) (p:pointer) (l:(tree
pointer)) (r:(tree pointer)), (~ (p = null)) -> ((tree1 m
Inductive tree1 : (map.Map.map loc node) -> loc -> (tree
loc) -> Prop :=
| leaf : forall (m:(map.Map.map loc node)), (tree1 m null (Empty :(tree
loc)))
| node1 : forall (m:(map.Map.map loc node)) (p:loc) (l:(tree
loc)) (r:(tree loc)), (~ (p = null)) -> ((tree1 m
(left1 (map.Map.get m p)) l) -> ((tree1 m (right1 (map.Map.get m p))
r) -> (tree1 m p (Node l p r)))).
......@@ -171,9 +171,9 @@ Axiom inorder_zip : forall {a:Type} {a_WT:WhyType a}, forall (z:(zipper a))
(x:a) (l:(tree a)) (r:(tree a)), ((inorder (zip (Node l x r)
z)) = (infix_plpl (inorder l) (Cons x (inorder (zip r z))))).
Axiom main_lemma : forall (m:(map.Map.map pointer node)) (t:pointer)
(pp:pointer) (p:pointer) (ppr:(tree pointer)) (pr:(tree pointer))
(z:(zipper pointer)), let it := (zip (Node (Node (Empty :(tree pointer)) p
Axiom main_lemma : forall (m:(map.Map.map loc node)) (t:loc)
(pp:loc) (p:loc) (ppr:(tree loc)) (pr:(tree loc))
(z:(zipper loc)), let it := (zip (Node (Node (Empty :(tree loc)) p
pr) pp ppr) z) in ((tree1 m t it) -> ((distinct (inorder it)) -> (tree1
(map.Map.set m pp (mk_node (right1 (map.Map.get m p))
(right1 (map.Map.get m pp)) (data (map.Map.get m pp)))) t (zip (Node pr pp
......@@ -182,39 +182,39 @@ Axiom main_lemma : forall (m:(map.Map.map pointer node)) (t:pointer)
Require Import Why3. Ltac ae := why3 "alt-ergo" timelimit 3.
(* Why3 goal *)
Theorem WP_parameter_search_tree_delete_min : forall (t:pointer) (it:(tree
pointer)), forall (mem1:(map.Map.map pointer node)), (((~ (t = null)) /\
Theorem WP_parameter_search_tree_delete_min : forall (t:loc) (it:(tree
loc)), forall (mem1:(map.Map.map loc node)), (((~ (t = null)) /\
(tree1 mem1 t it)) /\ (distinct (inorder it))) -> ((~ (t = null)) ->
((~ ((left1 (map.Map.get mem1 t)) = null)) -> ((~ ((left1 (map.Map.get mem1
t)) = null)) -> ((~ (it = (Empty :(tree pointer)))) -> forall (o:(tree
pointer)), match it with
t)) = null)) -> ((~ (it = (Empty :(tree loc)))) -> forall (o:(tree
loc)), match it with
| Empty => False
| (Node _ _ r) => (o = r)
end -> ((~ (it = (Empty :(tree pointer)))) -> forall (o1:(tree pointer)),
end -> ((~ (it = (Empty :(tree loc)))) -> forall (o1:(tree loc)),
match it with
| Empty => False
| (Node l _ _) => (o1 = l)
end -> forall (subtree:(tree pointer)) (ppr:(tree pointer))
(zipper1:(zipper pointer)) (tt:pointer) (pp:pointer) (p:pointer),
end -> forall (subtree:(tree loc)) (ppr:(tree loc))
(zipper1:(zipper loc)) (tt:loc) (pp:loc) (p:loc),
((((~ (pp = null)) /\ ((left1 (map.Map.get mem1 pp)) = p)) /\
((~ (p = null)) /\ ((left1 (map.Map.get mem1 p)) = tt))) /\ let pt :=
(Node subtree pp ppr) in ((tree1 mem1 pp pt) /\ ((zip pt
zipper1) = it))) -> ((tt = null) -> ((tree1 mem1 p subtree) ->
((~ (pp = p)) -> ((~ (p = null)) -> ((~ (p = null)) ->
forall (tt1:pointer), (tt1 = (right1 (map.Map.get mem1 p))) ->
forall (mem2:(map.Map.map pointer node)), (mem2 = (map.Map.set mem1 pp
forall (tt1:loc), (tt1 = (right1 (map.Map.get mem1 p))) ->
forall (mem2:(map.Map.map loc node)), (mem2 = (map.Map.set mem1 pp
(mk_node tt1 (right1 (map.Map.get mem1 pp)) (data (map.Map.get mem1
pp))))) -> ((~ (subtree = (Empty :(tree pointer)))) -> forall (pl:(tree
pointer)),
pp))))) -> ((~ (subtree = (Empty :(tree loc)))) -> forall (pl:(tree
loc)),
match subtree with
| Empty => False
| (Node l _ _) => (pl = l)
end -> ((pl = (Empty :(tree pointer))) -> ((~ (subtree = (Empty :(tree
pointer)))) -> forall (o2:(tree pointer)),
end -> ((pl = (Empty :(tree loc))) -> ((~ (subtree = (Empty :(tree
loc)))) -> forall (o2:(tree loc)),
match subtree with
| Empty => False
| (Node _ _ r) => (o2 = r)
end -> forall (ot:(tree pointer)), (ot = (zip o2 (Left zipper1 pp ppr))) ->
end -> forall (ot:(tree loc)), (ot = (zip o2 (Left zipper1 pp ppr))) ->
match (inorder it) with
| Nil => True
| (Cons p1 l) => ((inorder ot) = l)
......
......@@ -2,11 +2,35 @@
(* Beware! Only edit allowed sections below *)
Require Import BuiltIn.
Require BuiltIn.
Require map.Map.
Require int.Int.
(* Why3 assumption *)
Definition unit := unit.
Definition unit := unit.
Axiom map : forall (a:Type) {a_WT:WhyType a} (b:Type) {b_WT:WhyType b}, Type.
Parameter map_WhyType : forall (a:Type) {a_WT:WhyType a}
(b:Type) {b_WT:WhyType b}, WhyType (map a b).
Existing Instance map_WhyType.
Parameter get: forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b},
(map a b) -> a -> b.
Parameter set: forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b},
(map a b) -> a -> b -> (map a b).
Axiom Select_eq : forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b},
forall (m:(map a b)), forall (a1:a) (a2:a), forall (b1:b), (a1 = a2) ->
((get (set m a1 b1) a2) = b1).
Axiom Select_neq : forall {a:Type} {a_WT:WhyType a}
{b:Type} {b_WT:WhyType b}, forall (m:(map a b)), forall (a1:a) (a2:a),
forall (b1:b), (~ (a1 = a2)) -> ((get (set m a1 b1) a2) = (get m a2)).
Parameter const: forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b},
b -> (map a b).
Axiom Const : forall {a:Type} {a_WT:WhyType a} {b:Type} {b_WT:WhyType b},
forall (b1:b) (a1:a), ((get (const b1:(map a b)) a1) = b1).
(* Why3 assumption *)
Inductive ref (a:Type) {a_WT:WhyType a} :=
......@@ -16,46 +40,43 @@ Existing Instance ref_WhyType.
Implicit Arguments mk_ref [[a] [a_WT]].
(* Why3 assumption *)
Definition contents {a:Type} {a_WT:WhyType a} (v:(ref a)): a :=
Definition contents {a:Type} {a_WT:WhyType a}(v:(ref a)): a :=
match v with
| (mk_ref x) => x
end.
Axiom pointer : Type.
Parameter pointer_WhyType : WhyType pointer.
Existing Instance pointer_WhyType.
Axiom loc : Type.
Parameter loc_WhyType : WhyType loc.
Existing Instance loc_WhyType.
Parameter null: pointer.
Parameter null: loc.
(* Why3 assumption *)
Inductive node :=
| mk_node : pointer -> pointer -> Z -> node.
Inductive node :=
| mk_node : loc -> loc -> Z -> node .
Axiom node_WhyType : WhyType node.
Existing Instance node_WhyType.
(* Why3 assumption *)
Definition data (v:node): Z := match v with
Definition data(v:node): Z := match v with
| (mk_node x x1 x2) => x2
end.
(* Why3 assumption *)
Definition right1 (v:node): pointer :=
match v with
Definition right1(v:node): loc := match v with
| (mk_node x x1 x2) => x1
end.
(* Why3 assumption *)
Definition left1 (v:node): pointer :=
match v with
Definition left1(v:node): loc := match v with
| (mk_node x x1 x2) => x
end.
(* Why3 assumption *)
Definition memory := (map.Map.map pointer node).
Definition memory := (map loc node).
(* Why3 assumption *)
Inductive tree
(a:Type) {a_WT:WhyType a} :=
Inductive tree (a:Type) {a_WT:WhyType a} :=
| Empty : tree a
| Node : (tree a) -> a -> (tree a) -> tree a.
Axiom tree_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (tree a).
......@@ -64,8 +85,7 @@ Implicit Arguments Empty [[a] [a_WT]].
Implicit Arguments Node [[a] [a_WT]].
(* Why3 assumption *)
Inductive list
(a:Type) {a_WT:WhyType a} :=
Inductive list (a:Type) {a_WT:WhyType a} :=
| Nil : list a
| Cons : a -> (list a) -> list a.
Axiom list_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (list a).
......@@ -74,7 +94,7 @@ Implicit Arguments Nil [[a] [a_WT]].
Implicit Arguments Cons [[a] [a_WT]].
(* Why3 assumption *)
Fixpoint infix_plpl {a:Type} {a_WT:WhyType a} (l1:(list a)) (l2:(list
Fixpoint infix_plpl {a:Type} {a_WT:WhyType a}(l1:(list a)) (l2:(list
a)) {struct l1}: (list a) :=
match l1 with
| Nil => l2
......@@ -89,7 +109,7 @@ Axiom Append_l_nil : forall {a:Type} {a_WT:WhyType a}, forall (l:(list a)),
((infix_plpl l (Nil :(list a))) = l).
(* Why3 assumption *)
Fixpoint length {a:Type} {a_WT:WhyType a} (l:(list a)) {struct l}: Z :=
Fixpoint length {a:Type} {a_WT:WhyType a}(l:(list a)) {struct l}: Z :=
match l with
| Nil => 0%Z
| (Cons _ r) => (1%Z + (length r))%Z
......@@ -106,7 +126,7 @@ Axiom Append_length : forall {a:Type} {a_WT:WhyType a}, forall (l1:(list a))
l2)) = ((length l1) + (length l2))%Z).
(* Why3 assumption *)
Fixpoint mem {a:Type} {a_WT:WhyType a} (x:a) (l:(list a)) {struct l}: Prop :=
Fixpoint mem {a:Type} {a_WT:WhyType a}(x:a) (l:(list a)) {struct l}: Prop :=
match l with
| Nil => False
| (Cons y r) => (x = y) \/ (mem x r)
......@@ -121,7 +141,7 @@ Axiom mem_decomp : forall {a:Type} {a_WT:WhyType a}, forall (x:a) (l:(list
(l = (infix_plpl l1 (Cons x l2))).
(* Why3 assumption *)
Fixpoint inorder {a:Type} {a_WT:WhyType a} (t:(tree a)) {struct t}: (list
Fixpoint inorder {a:Type} {a_WT:WhyType a}(t:(tree a)) {struct t}: (list
a) :=
match t with
| Empty => (Nil :(list a))
......@@ -132,26 +152,22 @@ Fixpoint inorder {a:Type} {a_WT:WhyType a} (t:(tree a)) {struct t}: (list
Inductive distinct{a:Type} {a_WT:WhyType a} : (list a) -> Prop :=
| distinct_zero : (distinct (Nil :(list a)))
| distinct_one : forall (x:a), (distinct (Cons x (Nil :(list a))))
| distinct_many : forall (x:a) (l:(list a)), (~ (mem x l)) -> ((distinct
l) -> (distinct (Cons x l))).
| distinct_many : forall (x:a) (l:(list a)), (~ (mem x l)) ->
((distinct l) -> (distinct (Cons x l))).
Axiom distinct_append : forall {a:Type} {a_WT:WhyType a}, forall (l1:(list
a)) (l2:(list a)), (distinct l1) -> ((distinct l2) -> ((forall (x:a), (mem
x l1) -> ~ (mem x l2)) -> (distinct (infix_plpl l1 l2)))).
a)) (l2:(list a)), (distinct l1) -> ((distinct l2) -> ((forall (x:a),
(mem x l1) -> ~ (mem x l2)) -> (distinct (infix_plpl l1 l2)))).
(* Why3 assumption *)
Inductive tree1 : (map.Map.map pointer node) -> pointer -> (tree
pointer) -> Prop :=
| leaf : forall (m:(map.Map.map pointer node)), (tree1 m null (Empty :(tree
pointer)))
| node1 : forall (m:(map.Map.map pointer node)) (p:pointer) (l:(tree
pointer)) (r:(tree pointer)), (~ (p = null)) -> ((tree1 m
(left1 (map.Map.get m p)) l) -> ((tree1 m (right1 (map.Map.get m p))
r) -> (tree1 m p (Node l p r)))).
Inductive istree : (map loc node) -> loc -> (tree loc) -> Prop :=
| leaf : forall (m:(map loc node)), (istree m null (Empty :(tree loc)))
| node1 : forall (m:(map loc node)) (p:loc) (l:(tree loc)) (r:(tree loc)),
(~ (p = null)) -> ((istree m (left1 (get m p)) l) -> ((istree m
(right1 (get m p)) r) -> (istree m p (Node l p r)))).
(* Why3 assumption *)
Inductive zipper
(a:Type) {a_WT:WhyType a} :=
Inductive zipper (a:Type) {a_WT:WhyType a} :=
| Top : zipper a
| Left : (zipper a) -> a -> (tree a) -> zipper a.
Axiom zipper_WhyType : forall (a:Type) {a_WT:WhyType a}, WhyType (zipper a).
......@@ -160,7 +176,7 @@ Implicit Arguments Top [[a] [a_WT]].
Implicit Arguments Left [[a] [a_WT]].
(* Why3 assumption *)
Fixpoint zip {a:Type} {a_WT:WhyType a} (t:(tree a)) (z:(zipper
Fixpoint zip {a:Type} {a_WT:WhyType a}(t:(tree a)) (z:(zipper
a)) {struct z}: (tree a) :=
match z with
| Top => t
......@@ -177,7 +193,7 @@ Require Import Why3.
Ltac ae := why3 "Alt-Ergo,0.95," timelimit 3.
Lemma distinct1:
forall (p pp: pointer) (pr ppr: tree pointer),
forall (p pp: loc) (pr ppr: tree loc),
distinct (Cons p (infix_plpl (inorder pr) (Cons pp (inorder ppr)))) ->
p <> pp.
Proof.
......@@ -187,7 +203,7 @@ Lemma distinct1:
Lemma distinct2:
forall m p p' n t,
let m' := Map.set m p' n in
tree1 m p t -> ~ (mem p' (inorder t)) -> tree1 m' p t.
istree m p t -> ~ (mem p' (inorder t)) -> istree m' p t.
Proof.
induction 1; simpl.
ae.
......@@ -202,27 +218,27 @@ Lemma distinct2:
Qed.
Lemma distinct3:
forall (pp: pointer) (l1 l2: list pointer),
forall (pp: loc) (l1 l2: list loc),
distinct (infix_plpl l1 (Cons pp l2)) -> ~ (mem pp l1).
Proof.
induction l1; simpl; ae.
Qed.
Lemma distinct4:
forall (pp: pointer) (l1 l2: list pointer),
forall (pp: loc) (l1 l2: list loc),
distinct (infix_plpl l1 (Cons pp l2)) -> ~ (mem pp l2).
Proof.
induction l1; simpl; ae.
Qed.
Lemma distinct_append1:
forall (l1 l2: list pointer), distinct (infix_plpl l1 l2) -> distinct l1.
forall (l1 l2: list loc), distinct (infix_plpl l1 l2) -> distinct l1.
Proof.
induction l1; simpl; ae.
Qed.
Lemma distinct5:
forall z (p: pointer) (l r: tree pointer),
forall z (p: loc) (l r: tree loc),
distinct (inorder (zip (Node l p r) z)) -> distinct (inorder (Node l p r)).
Proof.
induction z.
......@@ -233,9 +249,9 @@ generalize (IHz a (Node l p r) t); clear IHz.
ae.
Qed.
Lemma tree1_zip:
Lemma istree_zip:
forall m t z l r pp,
tree1 m t (zip (Node l pp r) z) -> tree1 m pp (Node l pp r).
istree m t (zip (Node l pp r) z) -> istree m pp (Node l pp r).
Proof.
induction z; simpl.
ae.
......@@ -245,13 +261,13 @@ generalize (IHz (Node l pp r) t0 a).
ae.
Qed.
Lemma tree1_zip_2:
Lemma istree_zip_2:
forall m n a z t pp l r tr',
tree1 m t (zip (Node l pp r) z) ->
istree m t (zip (Node l pp r) z) ->
distinct (inorder (zip (Node l pp r) z)) ->
mem a (inorder (Node l pp r)) -> let m' := Map.set m a n in
tree1 m' pp tr' ->
tree1 m' t (zip tr' z).
istree m' pp tr' ->
istree m' t (zip tr' z).
Proof.
induction z; simpl.
ae.
......@@ -265,20 +281,20 @@ apply node1.
why3 "cvc3".
assert (left1 (Map.get (Map.set m a n) a0) = pp).
rewrite Map.Select_neq.
generalize (tree1_zip _ _ _ _ _ _ H).
generalize (istree_zip _ _ _ _ _ _ H).
inversion 1.
inversion H11; auto.
assumption.
ae.
assert (right1 (Map.get (Map.set m a n) a0) = right1 (Map.get m a0)).
rewrite Map.Select_neq.
generalize (tree1_zip _ _ _ _ _ _ H).
generalize (istree_zip _ _ _ _ _ _ H).
inversion 1.
inversion H11; auto.
assumption.
rewrite H5; clear H5.
apply distinct2.
generalize (tree1_zip _ _ _ _ _ _ H).
generalize (istree_zip _ _ _ _ _ _ H).
inversion 1.
ae.
clear H4 H2 H H3.
......@@ -297,20 +313,19 @@ ae.
Qed.
(* Why3 goal *)
Theorem main_lemma : forall (m:(map.Map.map pointer node)) (t:pointer)
(pp:pointer) (p:pointer) (ppr:(tree pointer)) (pr:(tree pointer))
(z:(zipper pointer)), let it := (zip (Node (Node (Empty :(tree pointer)) p
pr) pp ppr) z) in ((tree1 m t it) -> ((distinct (inorder it)) -> (tree1