From Stdlib Require Import Strings.String.
From Stdlib Require Import String Ascii.
From Stdlib Require Arith.
From stdpp Require Import base.
From stdpp Require Import fin_maps.
From stdpp Require Import gmap.
From stdpp Require Import base gmultiset.
From Stdlib Require Classical.
From Stdlib Require Import ZArith.
From stdpp.bitvector Require Import definitions tactics.
From Stdlib Require Import Sorting.Sorted.
From Stdlib Require Import Reals.Rbasic_fun.
From Stdlib Require Import Reals.Abstract.ConstructiveAbs.
From Stdlib Require Import Reals.Rdefinitions.
From stdpp Require Import list_relations.
From stdpp Require Import list_numbers.
From stdpp Require Import functions.
From Stdlib Require Import ClassicalEpsilon.
From stdpp Require Import base decidable.
From Stdlib Require Import ZArith.Zeuclid.
From Stdlib Require Import ZArith.Znumtheory.
From stdpp Require Import propset.
From Stdlib Require Import Reals.
Require Import Why3.Base.
Require Import Why3.why3.Ref.Ref.
Require Import Why3.map.Const.
Require Import Why3.map.MapEq.
Require Import Why3.mach.int.Unsigned.
Require Import Why3.mach.c.C.
Require Import Why3.mach.c.UChar.
Require Import multiprecision.types.Config.
Require Import multiprecision.types.Types.
Require Import multiprecision.types.Int32Eq.
Require Import multiprecision.types.UInt64Eq.
Require Import multiprecision.lemmas.Lemmas.
Require Import multiprecision.powm.Powm.
Require Import multiprecision.compare.Compare.
Require Import multiprecision.valuation.Valuation.
Require Import multiprecision.util.Util.
Require Import multiprecision.ptralias.Alias.
Require Import multiprecision.util.UtilOld.
Require Import multiprecision.add.Add.
Require Import multiprecision.add.AddOld.
Require Import multiprecision.sub.SubOld.
Require Import multiprecision.mul.Mul.
Require Import multiprecision.mul.Mul_basecase.
Require Import multiprecision.logical.LogicalUtil.
Require Import multiprecision.logical.Logical.
Require Import multiprecision.logical.LogicalOld.
Require Import multiprecision.div.Div.
Require Import multiprecision.toom.Toom.
Require Import multiprecision.add_1.Add_1.
Require Import multiprecision.sub_1.Sub_1.
Require Import multiprecision.stringlemmas.String_lemmas.
Require Import multiprecision.base_info.BaseInfo.
Open Scope Z_scope.
Theorem wmpn_get_str_other'vc (up : ptr (bv 64%N)) (un : bv 32%N) (info : wmpn_base_info) (base : bv 32%N) (sp : ptr (bv 8%N)) (sz : bv 32%N) (fact0 : valid up (bv_signed un)) (fact1 : 1%Z ≤ bv_signed un) (fact2 : b info = bv_signed base) (fact3 : writable up = true) (fact4 : writable sp = true) (fact5 : 0%Z < bv_unsigned (pelts up (offset up + bv_signed un - 1%Z))) (fact6 : 0%Z < bv_signed sz) (fact7 : valid sp (bv_signed sz)) (fact8 : value up (bv_signed un) < Z.pow (bv_signed base) (bv_signed sz - 1%Z)) : 0%Z ≤ bv_signed base ∧ (∀(o1 : bv 64%N), bv_unsigned o1 = bv_signed base -> 0%Z < bv_unsigned o1 ∧ (∀(o2 : bv 32%N), Z.pow 2%Z (bv_signed o2) * bv_unsigned o1 ≤ 18446744073709551615%Z ∧ 18446744073709551615%Z < 2%Z * Z.pow 2%Z (bv_signed o2) * bv_unsigned o1 ∧ 0%Z ≤ bv_signed o2 ∧ bv_signed o2 < 64%Z -> 0%Z ≤ bv_signed o2 ∧ (∀(shift : bv 64%N), bv_unsigned shift = bv_signed o2 -> 0%Z ≤ bv_signed base ∧ (∀(o3 : bv 64%N), bv_unsigned o3 = bv_signed base -> ((0%Z ≤ bv_unsigned shift ∧ bv_unsigned shift < 64%Z) ∧ Z.pow 2%Z (bv_unsigned shift) * bv_unsigned o3 ≤ 18446744073709551615%Z) ∧ (∀(d1 : bv 64%N), bv_unsigned d1 = Z.pow 2%Z (bv_unsigned shift) * bv_unsigned o3 -> ZEuclid.div (18446744073709551615%Z + 1%Z) 2%Z ≤ bv_unsigned d1 ∧ (∀(di : bv 64%N), reciprocal di d1 -> (let vu : Z := value up (bv_signed un) in (if decide (1%Z < bv_signed un) then 0%Z ≤ bv_signed un ∧ (∀(o4 : bv 32%N), bv_unsigned o4 = bv_signed un -> 0%Z ≤ bv_unsigned o4 ∧ (∀(tp : ptr (bv 64%N)), plength tp = bv_unsigned o4 ∧ offset tp = 0%Z ∧ min tp = 0%Z ∧ C.max tp = bv_unsigned o4 ∧ writable tp = true -> (svalue_le (bv_signed base) sp 0%Z + Z.pow (bv_signed base) 0%Z * value up (bv_signed un) = vu ∧ (1%Z ≤ bv_signed un ∧ bv_signed un ≤ bv_signed un) ∧ bv_signed un - bv_signed un ≤ 0%Z ∧ (0%Z ≤ 0%Z ∧ 0%Z < bv_signed sz) ∧ 0%Z = 0%Z * bv_unsigned (BaseInfo.exp info) ∧ in_base (bv_signed base) (pelts sp) (offset sp) (offset sp + 0%Z) ∧ 0%Z < bv_unsigned (pelts up (offset up + bv_signed un - 1%Z))) ∧ (∀(loopi : Z) (tp1 : ptr (bv 64%N)) (n : bv 32%N) (sn : bv 32%N) (up1 : ptr (bv 64%N)) (sp1 : ptr (bv 8%N)), length (data tp1) = length (data tp) ∧ offset tp1 = offset tp ∧ min tp1 = min tp ∧ C.max tp1 = C.max tp ∧ writable tp1 = writable tp ∧ zone1 tp1 = zone1 tp -> length (data up1) = length (data up) ∧ offset up1 = offset up ∧ min up1 = min up ∧ C.max up1 = C.max up ∧ writable up1 = writable up ∧ zone1 up1 = zone1 up -> length (data sp1) = length (data sp) ∧ offset sp1 = offset sp ∧ min sp1 = min sp ∧ C.max sp1 = C.max sp ∧ writable sp1 = writable sp ∧ zone1 sp1 = zone1 sp -> svalue_le (bv_signed base) sp1 (bv_signed sn) + Z.pow (bv_signed base) (bv_signed sn) * value up1 (bv_signed n) = vu ∧ (1%Z ≤ bv_signed n ∧ bv_signed n ≤ bv_signed un) ∧ bv_signed un - bv_signed n ≤ loopi ∧ (0%Z ≤ bv_signed sn ∧ bv_signed sn < bv_signed sz) ∧ bv_signed sn = loopi * bv_unsigned (BaseInfo.exp info) ∧ in_base (bv_signed base) (pelts sp1) (offset sp1) (offset sp1 + bv_signed sn) ∧ 0%Z < bv_unsigned (pelts up1 (offset up1 + bv_signed n - 1%Z)) ∧ (∀(j : Z), j < offset sp1 ∨ offset sp1 + bv_signed sz ≤ j -> pelts sp1 j = pelts sp j) -> (if decide (1%Z < bv_signed n) then let o5 : bv 64%N := bb info in (valid up1 (bv_signed n) ∧ valid tp1 (bv_signed n) ∧ writable tp1 = true ∧ 0%Z < bv_signed n ∧ 0%Z < bv_unsigned o5) ∧ (∀(tp2 : ptr (bv 64%N)), length (data tp2) = length (data tp1) ∧ offset tp2 = offset tp1 ∧ min tp2 = min tp1 ∧ C.max tp2 = C.max tp1 ∧ writable tp2 = writable tp1 ∧ zone1 tp2 = zone1 tp1 -> (∀(o6 : bv 64%N), value up1 (bv_signed n) = value tp2 (bv_signed n) * bv_unsigned o5 + bv_unsigned o6 ∧ bv_unsigned o6 < bv_unsigned o5 -> (valid tp2 (bv_signed n) ∧ valid up1 (bv_signed n) ∧ writable up1 = true) ∧ (∀(up2 : ptr (bv 64%N)), length (data up2) = length (data up1) ∧ offset up2 = offset up1 ∧ min up2 = min up1 ∧ C.max up2 = C.max up1 ∧ writable up2 = writable up1 ∧ zone1 up2 = zone1 up1 -> map_eq_sub_shift (pelts up2) (pelts tp2) (offset up2) (offset tp2) (bv_signed n) ∧ (∀(j : Z), j < offset up2 ∨ offset up2 + bv_signed n ≤ j -> pelts up2 j = pelts up1 j) -> int'32_in_bounds (bv_signed n - 1%Z) ∧ (∀(o7 : bv 32%N), bv_signed o7 = bv_signed n - 1%Z -> (min up2 ≤ offset up2 + bv_signed o7 ∧ offset up2 + bv_signed o7 < C.max up2) ∧ (let o8 : bv 64%N := pelts up2 (offset up2 + bv_signed o7) in ∀(o9 : bool), (bv_unsigned o8 = bv_unsigned (0%bv : bv 64%N) -> o9 = true) ∧ (o9 = true -> o8 = (0%bv : bv 64%N)) -> (∀(o10 : bv 32%N), (if decide (o9 = true) then o10 = (1%bv : bv 32%N) else o10 = (0%bv : bv 32%N)) -> int'32_in_bounds (bv_signed n - bv_signed o10) ∧ (∀(o11 : bv 32%N), bv_signed o11 = bv_signed n - bv_signed o10 -> (min sp1 ≤ offset sp1 + bv_signed sn ∧ offset sp1 + bv_signed sn ≤ C.max sp1) ∧ (∀(spn : ptr (bv 8%N)), offset spn = offset sp1 + bv_signed sn ∧ plength spn = plength sp1 ∧ pelts spn = pelts sp1 ∧ data spn = data sp1 ∧ min spn = min sp1 ∧ C.max spn = C.max sp1 ∧ zone1 spn = zone1 sp1 ∧ writable spn = writable sp1 -> (let o12 : bv 32%N := BaseInfo.exp info in bv_unsigned o12 ≤ 2147483647%Z ∧ (∀(o13 : bv 32%N), bv_signed o13 = bv_unsigned o12 -> int'32_in_bounds (bv_signed o13 + 1%Z) ∧ (∀(o14 : bv 32%N), bv_signed o14 = bv_signed o13 + 1%Z -> ((2%Z ≤ b info ∧ b info ≤ 256%Z) ∧ writable spn = true ∧ ZEuclid.div (18446744073709551615%Z + 1%Z) 2%Z ≤ bv_unsigned d1 ∧ (0%Z ≤ bv_unsigned shift ∧ bv_unsigned shift ≤ 63%Z) ∧ b info * Z.pow 2%Z (bv_unsigned shift) = bv_unsigned d1 ∧ reciprocal di d1 ∧ valid spn (bv_signed o14) ∧ 0%Z < bv_signed o14 ∧ bv_unsigned o6 < Z.pow (b info) (bv_signed o14)) ∧ (∀(spn1 : ptr (bv 8%N)) (sp2 : ptr (bv 8%N)), data spn1 = data sp2 ∧ length (data sp2) = length (data spn) ∧ offset spn1 = offset spn ∧ min spn1 = min spn ∧ C.max spn1 = C.max spn ∧ writable spn1 = writable spn ∧ zone1 spn1 = zone1 spn -> length (data sp2) = length (data sp1) ∧ offset sp2 = offset sp1 ∧ min sp2 = min sp1 ∧ C.max sp2 = C.max sp1 ∧ writable sp2 = writable sp1 ∧ zone1 sp2 = zone1 sp1 -> (∀(o15 : bv 32%N), svalue_le (b info) spn1 (bv_unsigned o15) = bv_unsigned o6 ∧ (0%Z ≤ bv_unsigned o15 ∧ bv_unsigned o15 ≤ bv_signed o14) ∧ (0%Z < bv_unsigned o15 -> 0%Z < bv_signed (pelts spn1 (offset spn1 + bv_unsigned o15 - 1%Z))) ∧ (∀(i : Z), i < offset spn1 ∨ offset spn1 + bv_unsigned o15 ≤ i -> pelts spn1 i = pelts spn i) ∧ in_base (b info) (pelts spn1) (offset spn1) (offset spn1 + bv_unsigned o15) -> bv_unsigned o15 ≤ 2147483647%Z ∧ (∀(o16 : bv 32%N), bv_signed o16 = bv_unsigned o15 -> int'32_in_bounds (bv_signed sn + bv_signed o16) ∧ (∀(o17 : bv 32%N), bv_signed o17 = bv_signed sn + bv_signed o16 -> (bv_unsigned o15 ≤ bv_unsigned (BaseInfo.exp info) ∧ bv_signed o17 = bv_signed sn + bv_unsigned o15 ∧ in_base (bv_signed base) (pelts sp2) (offset sp2) (offset sp2 + bv_signed o17) ∧ svalue_le (bv_signed base) sp2 (bv_signed o17) + Z.pow (bv_signed base) (bv_signed o17 - bv_unsigned o15 + bv_unsigned (BaseInfo.exp info)) * value up2 (bv_signed o11) = vu ∧ (∀(j : Z), j < offset sp2 ∨ offset sp2 + bv_signed sz ≤ j -> pelts sp2 j = pelts sp j)) ∧ (∀(sdone : bv 32%N) (sn1 : bv 32%N) (sp3 : ptr (bv 8%N)), length (data sp3) = length (data sp2) ∧ offset sp3 = offset sp2 ∧ min sp3 = min sp2 ∧ C.max sp3 = C.max sp2 ∧ writable sp3 = writable sp2 ∧ zone1 sp3 = zone1 sp2 -> bv_unsigned sdone ≤ bv_unsigned (BaseInfo.exp info) ∧ bv_signed sn1 = bv_signed sn + bv_unsigned sdone ∧ in_base (bv_signed base) (pelts sp3) (offset sp3) (offset sp3 + bv_signed sn1) ∧ svalue_le (bv_signed base) sp3 (bv_signed sn1) + Z.pow (bv_signed base) (bv_signed sn1 - bv_unsigned sdone + bv_unsigned (BaseInfo.exp info)) * value up2 (bv_signed o11) = vu ∧ (∀(j : Z), j < offset sp3 ∨ offset sp3 + bv_signed sz ≤ j -> pelts sp3 j = pelts sp j) -> (if decide (bv_unsigned sdone < bv_unsigned (BaseInfo.exp info)) then ((min sp3 ≤ offset sp3 + bv_signed sn1 ∧ offset sp3 + bv_signed sn1 < C.max sp3) ∧ writable sp3 = true) ∧ (∀(sp4 : ptr (bv 8%N)), length (data sp4) = length (data sp3) ∧ offset sp4 = offset sp3 ∧ min sp4 = min sp3 ∧ C.max sp4 = C.max sp3 ∧ writable sp4 = writable sp3 ∧ zone1 sp4 = zone1 sp3 -> pelts sp4 = fun_updt (pelts sp3) (offset sp4 + bv_signed sn1) (0%bv : bv 8%N) ∧ pelts sp4 (offset sp4 + bv_signed sn1) = (0%bv : bv 8%N) -> int'32_in_bounds (bv_signed sn1 + 1%Z) ∧ (∀(o18 : bv 32%N), bv_signed o18 = bv_signed sn1 + 1%Z -> uint'32_in_bounds (bv_unsigned sdone + 1%Z) ∧ (∀(o19 : bv 32%N), bv_unsigned o19 = bv_unsigned sdone + 1%Z -> (0%Z ≤ bv_unsigned (BaseInfo.exp info) - bv_unsigned sdone ∧ bv_unsigned (BaseInfo.exp info) - bv_unsigned o19 < bv_unsigned (BaseInfo.exp info) - bv_unsigned sdone) ∧ bv_unsigned o19 ≤ bv_unsigned (BaseInfo.exp info) ∧ bv_signed o18 = bv_signed sn + bv_unsigned o19 ∧ in_base (bv_signed base) (pelts sp4) (offset sp4) (offset sp4 + bv_signed o18) ∧ svalue_le (bv_signed base) sp4 (bv_signed o18) + Z.pow (bv_signed base) (bv_signed o18 - bv_unsigned o19 + bv_unsigned (BaseInfo.exp info)) * value up2 (bv_signed o11) = vu ∧ (∀(j : Z), j < offset sp4 ∨ offset sp4 + bv_signed sz ≤ j -> pelts sp4 j = pelts sp j)))) else (0%Z ≤ value up1 (bv_signed n) ∧ value up2 (bv_signed o11) < value up1 (bv_signed n)) ∧ svalue_le (bv_signed base) sp3 (bv_signed sn1) + Z.pow (bv_signed base) (bv_signed sn1) * value up2 (bv_signed o11) = vu ∧ (1%Z ≤ bv_signed o11 ∧ bv_signed o11 ≤ bv_signed un) ∧ bv_signed un - bv_signed o11 ≤ loopi + 1%Z ∧ (0%Z ≤ bv_signed sn1 ∧ bv_signed sn1 < bv_signed sz) ∧ bv_signed sn1 = (loopi + 1%Z) * bv_unsigned (BaseInfo.exp info) ∧ in_base (bv_signed base) (pelts sp3) (offset sp3) (offset sp3 + bv_signed sn1) ∧ 0%Z < bv_unsigned (pelts up2 (offset up2 + bv_signed o11 - 1%Z)) ∧ (∀(j : Z), j < offset sp3 ∨ offset sp3 + bv_signed sz ≤ j -> pelts sp3 j = pelts sp j)))))))))))))))))) else svalue_le (bv_signed base) sp1 (bv_signed sn) + Z.pow (bv_signed base) (bv_signed sn) * value up1 1%Z = vu ∧ in_base (bv_signed base) (pelts sp1) (offset sp1) (offset sp1 + bv_signed sn) ∧ (0%Z ≤ bv_signed sn ∧ bv_signed sn < bv_signed sz) ∧ 0%Z < value up1 1%Z ∧ (∀(j : Z), j < offset sp1 ∨ offset sp1 + bv_signed sz ≤ j -> pelts sp1 j = pelts sp j))))) else svalue_le (bv_signed base) sp 0%Z + Z.pow (bv_signed base) 0%Z * value up 1%Z = vu ∧ in_base (bv_signed base) (pelts sp) (offset sp) (offset sp + 0%Z) ∧ (0%Z ≤ 0%Z ∧ 0%Z < bv_signed sz) ∧ 0%Z < value up 1%Z) ∧ (∀(sn : bv 32%N) (up1 : ptr (bv 64%N)) (sp1 : ptr (bv 8%N)), length (data up1) = length (data up) ∧ offset up1 = offset up ∧ min up1 = min up ∧ C.max up1 = C.max up ∧ writable up1 = writable up ∧ zone1 up1 = zone1 up -> length (data sp1) = length (data sp) ∧ offset sp1 = offset sp ∧ min sp1 = min sp ∧ C.max sp1 = C.max sp ∧ writable sp1 = writable sp ∧ zone1 sp1 = zone1 sp -> svalue_le (bv_signed base) sp1 (bv_signed sn) + Z.pow (bv_signed base) (bv_signed sn) * value up1 1%Z = vu ∧ in_base (bv_signed base) (pelts sp1) (offset sp1) (offset sp1 + bv_signed sn) ∧ (0%Z ≤ bv_signed sn ∧ bv_signed sn < bv_signed sz) ∧ 0%Z < value up1 1%Z ∧ (∀(j : Z), j < offset sp1 ∨ offset sp1 + bv_signed sz ≤ j -> pelts sp1 j = pelts sp j) -> (min up1 ≤ offset up1 ∧ offset up1 < C.max up1) ∧ (let o4 : bv 64%N := pelts up1 (offset up1) in (min sp1 ≤ offset sp1 + bv_signed sn ∧ offset sp1 + bv_signed sn ≤ C.max sp1) ∧ (∀(spn : ptr (bv 8%N)), offset spn = offset sp1 + bv_signed sn ∧ plength spn = plength sp1 ∧ pelts spn = pelts sp1 ∧ data spn = data sp1 ∧ min spn = min sp1 ∧ C.max spn = C.max sp1 ∧ zone1 spn = zone1 sp1 ∧ writable spn = writable sp1 -> int'32_in_bounds (bv_signed sz - 1%Z) ∧ (∀(o5 : bv 32%N), bv_signed o5 = bv_signed sz - 1%Z -> int'32_in_bounds (bv_signed o5 - bv_signed sn) ∧ (∀(o6 : bv 32%N), bv_signed o6 = bv_signed o5 - bv_signed sn -> ((2%Z ≤ b info ∧ b info ≤ 256%Z) ∧ writable spn = true ∧ ZEuclid.div (18446744073709551615%Z + 1%Z) 2%Z ≤ bv_unsigned d1 ∧ (0%Z ≤ bv_unsigned shift ∧ bv_unsigned shift ≤ 63%Z) ∧ b info * Z.pow 2%Z (bv_unsigned shift) = bv_unsigned d1 ∧ reciprocal di d1 ∧ valid spn (bv_signed o6) ∧ 0%Z < bv_signed o6 ∧ bv_unsigned o4 < Z.pow (b info) (bv_signed o6)) ∧ (∀(spn1 : ptr (bv 8%N)) (sp2 : ptr (bv 8%N)), data spn1 = data sp2 ∧ length (data sp2) = length (data spn) ∧ offset spn1 = offset spn ∧ min spn1 = min spn ∧ C.max spn1 = C.max spn ∧ writable spn1 = writable spn ∧ zone1 spn1 = zone1 spn -> length (data sp2) = length (data sp1) ∧ offset sp2 = offset sp1 ∧ min sp2 = min sp1 ∧ C.max sp2 = C.max sp1 ∧ writable sp2 = writable sp1 ∧ zone1 sp2 = zone1 sp1 -> (∀(sdone : bv 32%N), svalue_le (b info) spn1 (bv_unsigned sdone) = bv_unsigned o4 ∧ (0%Z ≤ bv_unsigned sdone ∧ bv_unsigned sdone ≤ bv_signed o6) ∧ (0%Z < bv_unsigned sdone -> 0%Z < bv_signed (pelts spn1 (offset spn1 + bv_unsigned sdone - 1%Z))) ∧ (∀(i : Z), i < offset spn1 ∨ offset spn1 + bv_unsigned sdone ≤ i -> pelts spn1 i = pelts spn i) ∧ in_base (b info) (pelts spn1) (offset spn1) (offset spn1 + bv_unsigned sdone) -> bv_unsigned sdone ≤ 2147483647%Z ∧ (∀(o7 : bv 32%N), bv_signed o7 = bv_unsigned sdone -> int'32_in_bounds (bv_signed sn + bv_signed o7) ∧ (∀(o8 : bv 32%N), bv_signed o8 = bv_signed sn + bv_signed o7 -> ((0%Z ≤ 2%Z * 0%Z + 1%Z ∧ 2%Z * 0%Z + 1%Z ≤ bv_signed o8 + 1%Z) ∧ in_base (bv_signed base) (pelts sp2) (offset sp2) (offset sp2 + bv_signed o8) ∧ svalue_sub (bv_signed base) (pelts sp2) (offset sp2) (offset sp2 + 0%Z) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp2 + bv_signed o8 - 0%Z) (offset sp2 + bv_signed o8) ∧ svalue_sub (bv_signed base) (pelts sp2) (offset sp2 + bv_signed o8 - 0%Z) (offset sp2 + bv_signed o8) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp2) (offset sp2 + 0%Z) ∧ (0%Z < 0%Z -> 0%Z < bv_signed (pelts sp2 (offset sp2))) ∧ (∀(j : Z), j < offset sp2 ∨ offset sp2 + bv_signed sz ≤ j -> pelts sp2 j = pelts sp j)) ∧ (∀(i : bv 32%N) (sp3 : ptr (bv 8%N)), length (data sp3) = length (data sp2) ∧ offset sp3 = offset sp2 ∧ min sp3 = min sp2 ∧ C.max sp3 = C.max sp2 ∧ writable sp3 = writable sp2 ∧ zone1 sp3 = zone1 sp2 -> (0%Z ≤ 2%Z * bv_signed i + 1%Z ∧ 2%Z * bv_signed i + 1%Z ≤ bv_signed o8 + 1%Z) ∧ (∀(j : Z), offset sp3 + bv_signed i ≤ j ∧ j < offset sp3 + bv_signed o8 - bv_signed i -> pelts sp3 j = pelts sp2 j) ∧ in_base (bv_signed base) (pelts sp3) (offset sp3) (offset sp3 + bv_signed o8) ∧ svalue_sub (bv_signed base) (pelts sp3) (offset sp3) (offset sp3 + bv_signed i) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp3 + bv_signed o8 - bv_signed i) (offset sp3 + bv_signed o8) ∧ svalue_sub (bv_signed base) (pelts sp3) (offset sp3 + bv_signed o8 - bv_signed i) (offset sp3 + bv_signed o8) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp3) (offset sp3 + bv_signed i) ∧ svalue_le_sub (bv_signed base) (pelts sp3) (offset sp3 + bv_signed i) (offset sp3 + bv_signed o8 - bv_signed i) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp3 + bv_signed i) (offset sp3 + bv_signed o8 - bv_signed i) ∧ (0%Z < bv_signed i -> 0%Z < bv_signed (pelts sp3 (offset sp3))) ∧ (∀(j : Z), j < offset sp3 ∨ offset sp3 + bv_signed sz ≤ j -> pelts sp3 j = pelts sp j) -> int'32_in_bounds (2%Z * bv_signed i) ∧ (∀(o9 : bv 32%N), bv_signed o9 = 2%Z * bv_signed i -> int'32_in_bounds (bv_signed o9 + 1%Z) ∧ (∀(o10 : bv 32%N), bv_signed o10 = bv_signed o9 + 1%Z -> (if decide (bv_signed o10 < bv_signed o8) then (min sp3 ≤ offset sp3 + bv_signed i ∧ offset sp3 + bv_signed i < C.max sp3) ∧ (let t : bv 8%N := pelts sp3 (offset sp3 + bv_signed i) in int'32_in_bounds (bv_signed o8 - bv_signed i) ∧ (∀(o11 : bv 32%N), bv_signed o11 = bv_signed o8 - bv_signed i -> int'32_in_bounds (bv_signed o11 - 1%Z) ∧ (∀(o12 : bv 32%N), bv_signed o12 = bv_signed o11 - 1%Z -> (min sp3 ≤ offset sp3 + bv_signed o12 ∧ offset sp3 + bv_signed o12 < C.max sp3) ∧ (let o13 : bv 8%N := pelts sp3 (offset sp3 + bv_signed o12) in ((min sp3 ≤ offset sp3 + bv_signed i ∧ offset sp3 + bv_signed i < C.max sp3) ∧ writable sp3 = true) ∧ (∀(sp4 : ptr (bv 8%N)), length (data sp4) = length (data sp3) ∧ offset sp4 = offset sp3 ∧ min sp4 = min sp3 ∧ C.max sp4 = C.max sp3 ∧ writable sp4 = writable sp3 ∧ zone1 sp4 = zone1 sp3 -> pelts sp4 = fun_updt (pelts sp3) (offset sp4 + bv_signed i) o13 ∧ pelts sp4 (offset sp4 + bv_signed i) = o13 -> int'32_in_bounds (bv_signed o8 - bv_signed i) ∧ (∀(o14 : bv 32%N), bv_signed o14 = bv_signed o8 - bv_signed i -> int'32_in_bounds (bv_signed o14 - 1%Z) ∧ (∀(o15 : bv 32%N), bv_signed o15 = bv_signed o14 - 1%Z -> ((min sp4 ≤ offset sp4 + bv_signed o15 ∧ offset sp4 + bv_signed o15 < C.max sp4) ∧ writable sp4 = true) ∧ (∀(sp5 : ptr (bv 8%N)), length (data sp5) = length (data sp4) ∧ offset sp5 = offset sp4 ∧ min sp5 = min sp4 ∧ C.max sp5 = C.max sp4 ∧ writable sp5 = writable sp4 ∧ zone1 sp5 = zone1 sp4 -> pelts sp5 = fun_updt (pelts sp4) (offset sp5 + bv_signed o15) t ∧ pelts sp5 (offset sp5 + bv_signed o15) = t -> int'32_in_bounds (bv_signed i + 1%Z) ∧ (∀(o16 : bv 32%N), bv_signed o16 = bv_signed i + 1%Z -> (0%Z ≤ bv_signed o8 - bv_signed i ∧ bv_signed o8 - bv_signed o16 < bv_signed o8 - bv_signed i) ∧ (0%Z ≤ 2%Z * bv_signed o16 + 1%Z ∧ 2%Z * bv_signed o16 + 1%Z ≤ bv_signed o8 + 1%Z) ∧ (∀(j : Z), offset sp5 + bv_signed o16 ≤ j ∧ j < offset sp5 + bv_signed o8 - bv_signed o16 -> pelts sp5 j = pelts sp2 j) ∧ in_base (bv_signed base) (pelts sp5) (offset sp5) (offset sp5 + bv_signed o8) ∧ svalue_sub (bv_signed base) (pelts sp5) (offset sp5) (offset sp5 + bv_signed o16) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp5 + bv_signed o8 - bv_signed o16) (offset sp5 + bv_signed o8) ∧ svalue_sub (bv_signed base) (pelts sp5) (offset sp5 + bv_signed o8 - bv_signed o16) (offset sp5 + bv_signed o8) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp5) (offset sp5 + bv_signed o16) ∧ svalue_le_sub (bv_signed base) (pelts sp5) (offset sp5 + bv_signed o16) (offset sp5 + bv_signed o8 - bv_signed o16) = svalue_le_sub (bv_signed base) (pelts sp2) (offset sp5 + bv_signed o16) (offset sp5 + bv_signed o8 - bv_signed o16) ∧ (0%Z < bv_signed o16 -> 0%Z < bv_signed (pelts sp5 (offset sp5))) ∧ (∀(j : Z), j < offset sp5 ∨ offset sp5 + bv_signed sz ≤ j -> pelts sp5 j = pelts sp j)))))))))) else 0%Z ≤ bv_signed o8 ∧ (∀(result : bv 32%N), bv_unsigned result = bv_signed o8 -> (0%Z ≤ bv_unsigned result ∧ bv_unsigned result < bv_signed sz) ∧ svalue (bv_signed base) sp3 (bv_unsigned result) = value up (bv_signed un) ∧ in_base (bv_signed base) (pelts sp3) (offset sp3) (offset sp3 + bv_unsigned result) ∧ 0%Z < bv_signed (pelts sp3 (offset sp3)) ∧ (∀(j : Z), j < offset sp3 ∨ offset sp3 + bv_signed sz ≤ j -> pelts sp3 j = pelts sp j)))))))))))))))))))))).
Admitted.
