(*invariant { not L.mem !t !stackNodes }*) (* this will be usefull to prove that !t is in graph after the push ---> but this is false! think of the case when the graph is cyclic *)
(* I4d from Hubert and Marché's paper and something related to line 63-65 from Leino's *)
invariant { forall n : loc. S.mem n graph /\ n <> null /\ not L.mem n !stackNodes ->
...
...
@@ -222,6 +229,8 @@ module SchorrWaite
let first = hd (reverse !stackNodes) in
if !c[first] then !right[first] = null
else !left[first] = null }
invariant { !stackNodes <> Nil ->
hd (reverse !stackNodes) = root }
(* something like lines 75-76 from Leino's paper --> with this invariant I believe there
* is no need to use 'stack_form' *)
invariant { forall k : int. 0 <= k < length !stackNodes - 1->
...
...
@@ -254,7 +263,6 @@ module SchorrWaite
(* help establishing the previous invariant when p = null, ie