[STATEMENT]
lemma wf_ExtC:
"ws_cdecl tprg ExtC \<and>
  wf_cdecl_mdecl wf_java_mdecl tprg ExtC \<and> wf_mrT tprg ExtC"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. ws_cdecl tprg ExtC \<and> wf_cdecl_mdecl wf_java_mdecl tprg ExtC \<and> wf_mrT tprg ExtC
[PROOF STEP]
apply (unfold ws_cdecl_def wf_cdecl_mdecl_def
  wf_mrT_def wf_fdecl_def ExtC_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (case (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]) of (C, D, fs, ms) \<Rightarrow> (\<forall>f\<in>set fs. case f of (fn, ft) \<Rightarrow> is_type [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] ft) \<and> unique fs \<and> (\<forall>(sig, rT, mb)\<in>set ms. wf_mhead [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] sig rT) \<and> unique ms \<and> (C \<noteq> Object \<longrightarrow> is_class [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] D \<and> (D, C) \<notin> (subcls1 [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC])\<^sup>*)) \<and> (case (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]) of (C, D, fs, ms) \<Rightarrow> \<forall>m\<in>set ms. wf_java_mdecl [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] C m) \<and> (case (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]) of (C, D, fs, ms) \<Rightarrow> C \<noteq> Object \<longrightarrow> (\<forall>(sig, rT, b)\<in>set ms. \<forall>D' rT' b'. method ([ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC], D) sig = Some (D', rT', b') \<longrightarrow> [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] \<turnstile> rT \<preceq> rT'))
[PROOF STEP]
apply (simp (no_asm))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_mhead [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] (foo, [Class Base]) (Class Ext) \<and> (\<exists>a aa b. class [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] Base = Some (a, aa, b)) \<and> (Base, Ext) \<notin> (subcls1 [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC])\<^sup>* \<and> wf_java_mdecl [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] Ext ((foo, [Class Base]), Class Ext, foo_Ext) \<and> (\<forall>D' rT'. (\<exists>a aa ab b. method ([ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC], Base) (foo, [Class Base]) = Some (D', rT', a, aa, ab, b)) \<longrightarrow> [ObjectC, BaseC, (Ext, Base, [(vee, PrimT Integer)], [((foo, [Class Base]), Class Ext, foo_Ext)]), ClassCastC, NullPointerC, OutOfMemoryC] \<turnstile> Class Ext \<preceq> rT')
[PROOF STEP]
apply (fold ExtC_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_mhead tprg (foo, [Class Base]) (Class Ext) \<and> (\<exists>a aa b. class tprg Base = Some (a, aa, b)) \<and> (Base, Ext) \<notin> (subcls1 tprg)\<^sup>* \<and> wf_java_mdecl tprg Ext ((foo, [Class Base]), Class Ext, foo_Ext) \<and> (\<forall>D' rT'. (\<exists>a aa ab b. method (tprg, Base) (foo, [Class Base]) = Some (D', rT', a, aa, ab, b)) \<longrightarrow> tprg \<turnstile> Class Ext \<preceq> rT')
[PROOF STEP]
apply (rule mp)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. ?P24 \<longrightarrow> wf_mhead tprg (foo, [Class Base]) (Class Ext) \<and> (\<exists>a aa b. class tprg Base = Some (a, aa, b)) \<and> (Base, Ext) \<notin> (subcls1 tprg)\<^sup>* \<and> wf_java_mdecl tprg Ext ((foo, [Class Base]), Class Ext, foo_Ext) \<and> (\<forall>D' rT'. (\<exists>a aa ab b. method (tprg, Base) (foo, [Class Base]) = Some (D', rT', a, aa, ab, b)) \<longrightarrow> tprg \<turnstile> Class Ext \<preceq> rT')
 2. ?P24
[PROOF STEP]
defer
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. ?P24
 2. ?P24 \<longrightarrow> wf_mhead tprg (foo, [Class Base]) (Class Ext) \<and> (\<exists>a aa b. class tprg Base = Some (a, aa, b)) \<and> (Base, Ext) \<notin> (subcls1 tprg)\<^sup>* \<and> wf_java_mdecl tprg Ext ((foo, [Class Base]), Class Ext, foo_Ext) \<and> (\<forall>D' rT'. (\<exists>a aa ab b. method (tprg, Base) (foo, [Class Base]) = Some (D', rT', a, aa, ab, b)) \<longrightarrow> tprg \<turnstile> Class Ext \<preceq> rT')
[PROOF STEP]
apply (rule wf_foo_Ext)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. wf_mdecl wf_java_mdecl tprg Ext ((foo, [Class Base]), Class Ext, foo_Ext) \<longrightarrow> wf_mhead tprg (foo, [Class Base]) (Class Ext) \<and> (\<exists>a aa b. class tprg Base = Some (a, aa, b)) \<and> (Base, Ext) \<notin> (subcls1 tprg)\<^sup>* \<and> wf_java_mdecl tprg Ext ((foo, [Class Base]), Class Ext, foo_Ext) \<and> (\<forall>D' rT'. (\<exists>a aa ab b. method (tprg, Base) (foo, [Class Base]) = Some (D', rT', a, aa, ab, b)) \<longrightarrow> tprg \<turnstile> Class Ext \<preceq> rT')
[PROOF STEP]
apply (auto simp add: wf_mdecl_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_mhead tprg (foo, [Class Base]) (Class Ext); wf_java_mdecl tprg Ext ((foo, [Class Base]), Class Ext, foo_Ext); tprg \<turnstile> Base \<preceq>C Ext\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (drule rtranclD)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>wf_mhead tprg (foo, [Class Base]) (Class Ext); wf_java_mdecl tprg Ext ((foo, [Class Base]), Class Ext, foo_Ext); Base = Ext \<or> Base \<noteq> Ext \<and> (Base, Ext) \<in> (subcls1 tprg)\<^sup>+\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma non_volatile_owned_or_read_only_outstanding_refs:
  "\<And>\<O> \<S> pending_write. \<lbrakk>non_volatile_owned_or_read_only pending_write \<S> \<O> sb\<rbrakk>
   \<Longrightarrow>
  outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> all_acquired sb \<union> read_only_reads \<O> sb"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> all_acquired sb \<union> read_only_reads \<O> sb
[PROOF STEP]
proof (induct sb)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> [] \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) [] \<subseteq> \<O> \<union> all_acquired [] \<union> read_only_reads \<O> []
 2. \<And>a sb \<O> \<S> pending_write. \<lbrakk>\<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> all_acquired sb \<union> read_only_reads \<O> sb; non_volatile_owned_or_read_only pending_write \<S> \<O> (a # sb)\<rbrakk> \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (a # sb) \<subseteq> \<O> \<union> all_acquired (a # sb) \<union> read_only_reads \<O> (a # sb)
[PROOF STEP]
case Nil
[PROOF STATE]
proof (state)
this:
non_volatile_owned_or_read_only pending_write \<S> \<O> []

goal (2 subgoals):
 1. \<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> [] \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) [] \<subseteq> \<O> \<union> all_acquired [] \<union> read_only_reads \<O> []
 2. \<And>a sb \<O> \<S> pending_write. \<lbrakk>\<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> all_acquired sb \<union> read_only_reads \<O> sb; non_volatile_owned_or_read_only pending_write \<S> \<O> (a # sb)\<rbrakk> \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (a # sb) \<subseteq> \<O> \<union> all_acquired (a # sb) \<union> read_only_reads \<O> (a # sb)
[PROOF STEP]
thus ?case
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only pending_write \<S> \<O> []

goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) [] \<subseteq> \<O> \<union> all_acquired [] \<union> read_only_reads \<O> []
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) [] \<subseteq> \<O> \<union> all_acquired [] \<union> read_only_reads \<O> []

goal (1 subgoal):
 1. \<And>a sb \<O> \<S> pending_write. \<lbrakk>\<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> all_acquired sb \<union> read_only_reads \<O> sb; non_volatile_owned_or_read_only pending_write \<S> \<O> (a # sb)\<rbrakk> \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (a # sb) \<subseteq> \<O> \<union> all_acquired (a # sb) \<union> read_only_reads \<O> (a # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>a sb \<O> \<S> pending_write. \<lbrakk>\<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> all_acquired sb \<union> read_only_reads \<O> sb; non_volatile_owned_or_read_only pending_write \<S> \<O> (a # sb)\<rbrakk> \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (a # sb) \<subseteq> \<O> \<union> all_acquired (a # sb) \<union> read_only_reads \<O> (a # sb)
[PROOF STEP]
case (Cons x sb)
[PROOF STATE]
proof (state)
this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> ?\<O> \<union> all_acquired sb \<union> read_only_reads ?\<O> sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)

goal (1 subgoal):
 1. \<And>a sb \<O> \<S> pending_write. \<lbrakk>\<And>\<O> \<S> pending_write. non_volatile_owned_or_read_only pending_write \<S> \<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> all_acquired sb \<union> read_only_reads \<O> sb; non_volatile_owned_or_read_only pending_write \<S> \<O> (a # sb)\<rbrakk> \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (a # sb) \<subseteq> \<O> \<union> all_acquired (a # sb) \<union> read_only_reads \<O> (a # sb)
[PROOF STEP]
show ?case
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
proof (cases x)
[PROOF STATE]
proof (state)
goal (4 subgoals):
 1. \<And>x11 x12 x13 x14 x15 x16 x17 x18. x = Write\<^sub>s\<^sub>b x11 x12 x13 x14 x15 x16 x17 x18 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 3. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 4. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
case (Write\<^sub>s\<^sub>b volatile a sop v A L R W)
[PROOF STATE]
proof (state)
this:
x = Write\<^sub>s\<^sub>b volatile a sop v A L R W

goal (4 subgoals):
 1. \<And>x11 x12 x13 x14 x15 x16 x17 x18. x = Write\<^sub>s\<^sub>b x11 x12 x13 x14 x15 x16 x17 x18 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 3. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 4. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
proof (cases volatile)
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. volatile \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<not> volatile \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
case True
[PROOF STATE]
proof (state)
this:
volatile

goal (2 subgoals):
 1. volatile \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<not> volatile \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
from Cons.hyps [of True "(\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)" "(\<O> \<union> A - R)"] Cons.prems
[PROOF STATE]
proof (chain)
picking this:
non_volatile_owned_or_read_only True (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> A - R \<union> all_acquired sb \<union> read_only_reads (\<O> \<union> A - R) sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only True (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> A - R \<union> all_acquired sb \<union> read_only_reads (\<O> \<union> A - R) sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)

goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
by (auto simp add: Write\<^sub>s\<^sub>b True)
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)

goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
case False
[PROOF STATE]
proof (state)
this:
\<not> volatile

goal (1 subgoal):
 1. \<not> volatile \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
with Cons
[PROOF STATE]
proof (chain)
picking this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> ?\<O> \<union> all_acquired sb \<union> read_only_reads ?\<O> sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
\<not> volatile
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> ?\<O> \<union> all_acquired sb \<union> read_only_reads ?\<O> sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
\<not> volatile

goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
by (auto simp add: Write\<^sub>s\<^sub>b)
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)

goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
case Read\<^sub>s\<^sub>b
[PROOF STATE]
proof (state)
this:
x = Read\<^sub>s\<^sub>b x21_ x22_ x23_ x24_

goal (3 subgoals):
 1. \<And>x21 x22 x23 x24. x = Read\<^sub>s\<^sub>b x21 x22 x23 x24 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 3. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
with Cons
[PROOF STATE]
proof (chain)
picking this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> ?\<O> \<union> all_acquired sb \<union> read_only_reads ?\<O> sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
x = Read\<^sub>s\<^sub>b x21_ x22_ x23_ x24_
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> ?\<O> \<union> all_acquired sb \<union> read_only_reads ?\<O> sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
x = Read\<^sub>s\<^sub>b x21_ x22_ x23_ x24_

goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
case Prog\<^sub>s\<^sub>b
[PROOF STATE]
proof (state)
this:
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_

goal (2 subgoals):
 1. \<And>x31 x32 x33. x = Prog\<^sub>s\<^sub>b x31 x32 x33 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
 2. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
with Cons
[PROOF STATE]
proof (chain)
picking this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> ?\<O> \<union> all_acquired sb \<union> read_only_reads ?\<O> sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only ?pending_write ?\<S> ?\<O> sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> ?\<O> \<union> all_acquired sb \<union> read_only_reads ?\<O> sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
x = Prog\<^sub>s\<^sub>b x31_ x32_ x33_

goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)

goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
next
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
case (Ghost\<^sub>s\<^sub>b A L R W)
[PROOF STATE]
proof (state)
this:
x = Ghost\<^sub>s\<^sub>b A L R W

goal (1 subgoal):
 1. \<And>x41 x42 x43 x44. x = Ghost\<^sub>s\<^sub>b x41 x42 x43 x44 \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
from Cons.hyps [of pending_write "(\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L)" "(\<O> \<union> A - R)"] Cons.prems
[PROOF STATE]
proof (chain)
picking this:
non_volatile_owned_or_read_only pending_write (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> A - R \<union> all_acquired sb \<union> read_only_reads (\<O> \<union> A - R) sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
non_volatile_owned_or_read_only pending_write (\<S> \<oplus>\<^bsub>W\<^esub> R \<ominus>\<^bsub>A\<^esub> L) (\<O> \<union> A - R) sb \<Longrightarrow> outstanding_refs (Not \<circ> is_volatile) sb \<subseteq> \<O> \<union> A - R \<union> all_acquired sb \<union> read_only_reads (\<O> \<union> A - R) sb
non_volatile_owned_or_read_only pending_write \<S> \<O> (x # sb)

goal (1 subgoal):
 1. outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)
[PROOF STEP]
by (auto simp add: Ghost\<^sub>s\<^sub>b)
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
outstanding_refs (Not \<circ> is_volatile) (x # sb) \<subseteq> \<O> \<union> all_acquired (x # sb) \<union> read_only_reads \<O> (x # sb)

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma "P (x::('a,'b) T3)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P x
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P x
[PROOF STEP]
oops


[STATEMENT]
lemma "(P \<or> Q) \<longrightarrow> (P \<and> Q)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<or> Q \<longrightarrow> P \<and> Q
[PROOF STEP]
nitpick [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. P \<or> Q \<longrightarrow> P \<and> Q
[PROOF STEP]
oops


[STATEMENT]
lemma clm_disj_res:"\<Turnstile> \<^bold>\<not> \<^bold>\<langle> cl(c) \<^bold>\<and> re(c) \<^bold>\<rangle>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<forall>ts v. \<nexists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True)
[PROOF STEP]
proof (rule allI|rule notI)+
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ts v. \<exists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True) \<Longrightarrow> False
[PROOF STEP]
fix ts v
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>ts v. \<exists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True) \<Longrightarrow> False
[PROOF STEP]
assume "ts,v \<Turnstile>\<^bold>\<langle>cl(c) \<^bold>\<and> re(c)\<^bold>\<rangle>"
[PROOF STATE]
proof (state)
this:
\<exists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True)

goal (1 subgoal):
 1. \<And>ts v. \<exists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
\<exists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True)
[PROOF STEP]
obtain v' where "v' \<le> v \<and> (ts,v' \<Turnstile> cl(c) \<^bold>\<and> re(c))"
[PROOF STATE]
proof (prove)
using this:
\<exists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True)

goal (1 subgoal):
 1. (\<And>v'. v' \<le> v \<and> (0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (clm ts) c = lan v' \<and> |lan v'| = 1) \<and> 0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (res ts) c = lan v' \<and> |lan v'| = 1 \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by (meson view.somewhere_leq)
[PROOF STATE]
proof (state)
this:
v' \<le> v \<and> (0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (clm ts) c = lan v' \<and> |lan v'| = 1) \<and> 0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (res ts) c = lan v' \<and> |lan v'| = 1

goal (1 subgoal):
 1. \<And>ts v. \<exists>va u. v=va\<parallel>u \<and> True \<and> (\<exists>v ua. u=v\<parallel>ua \<and> (\<exists>va u. v=va--u \<and> True \<and> (\<exists>v ua. u=v--ua \<and> ((0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (clm ts) c = lan v \<and> |lan v| = 1) \<and> 0 < \<parallel>ext v\<parallel> \<and> len v ts c = ext v \<and> restrict v (res ts) c = lan v \<and> |lan v| = 1) \<and> True)) \<and> True) \<Longrightarrow> False
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
v' \<le> v \<and> (0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (clm ts) c = lan v' \<and> |lan v'| = 1) \<and> 0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (res ts) c = lan v' \<and> |lan v'| = 1
[PROOF STEP]
show False
[PROOF STATE]
proof (prove)
using this:
v' \<le> v \<and> (0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (clm ts) c = lan v' \<and> |lan v'| = 1) \<and> 0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (res ts) c = lan v' \<and> |lan v'| = 1

goal (1 subgoal):
 1. False
[PROOF STEP]
using disjoint
[PROOF STATE]
proof (prove)
using this:
v' \<le> v \<and> (0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (clm ts) c = lan v' \<and> |lan v'| = 1) \<and> 0 < \<parallel>ext v'\<parallel> \<and> len v' ts c = ext v' \<and> restrict v' (res ts) c = lan v' \<and> |lan v'| = 1
res ?ts ?c \<sqinter> clm ?ts ?c = bot

goal (1 subgoal):
 1. False
[PROOF STEP]
by (metis card_non_empty_geq_one inf.idem restriction.restriction_clm_leq_one
        restriction.restriction_clm_res_disjoint)
[PROOF STATE]
proof (state)
this:
False

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma shadow_root_delete_get_7 [simp]:
  "delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr h = Some h' \<Longrightarrow> document_ptr  \<noteq> cast shadow_root_ptr \<Longrightarrow>
get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h' = get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t document_ptr h"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>delete\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t shadow_root_ptr h = Some h'; document_ptr \<noteq> cast shadow_root_ptr\<rbrakk> \<Longrightarrow> get document_ptr h' = get document_ptr h
[PROOF STEP]
by(simp add: get\<^sub>D\<^sub>o\<^sub>c\<^sub>u\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def)


[STATEMENT]
lemma weakSimE:
  fixes F   :: 'b
  and   P   :: "('a, 'b, 'c) psi"
  and   Rel :: "('b \<times> ('a, 'b, 'c) psi \<times> ('a, 'b, 'c) psi) set"
  and   Q   :: "('a, 'b, 'c) psi"

  assumes "\<Psi> \<rhd> P \<leadsto><Rel> Q"

  shows "\<And>\<Psi>' \<alpha> Q'. \<lbrakk>\<Psi> \<rhd> Q \<longmapsto>\<alpha> \<prec> Q'; bn \<alpha> \<sharp>* \<Psi>; bn \<alpha> \<sharp>* P; \<alpha> \<noteq> \<tau>\<rbrakk> \<Longrightarrow>
                            \<exists>P''. \<Psi> : Q \<rhd> P \<Longrightarrow>\<alpha> \<prec> P'' \<and> (\<exists>P'. \<Psi> \<otimes> \<Psi>' \<rhd> P'' \<Longrightarrow>\<^sup>^\<^sub>\<tau> P' \<and> (\<Psi> \<otimes> \<Psi>', P', Q') \<in> Rel)"
  and   "\<And>Q'. \<Psi> \<rhd> Q \<longmapsto>\<tau> \<prec> Q' \<Longrightarrow> \<exists>P'. \<Psi> \<rhd> P \<Longrightarrow>\<^sup>^\<^sub>\<tau> P' \<and> (\<Psi>, P', Q') \<in> Rel"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (\<And>\<Psi>' \<alpha> Q'. \<lbrakk>\<Psi> \<rhd> Q \<longmapsto> \<alpha> \<prec> Q'; bn \<alpha> \<sharp>* \<Psi>; bn \<alpha> \<sharp>* P; \<alpha> \<noteq> \<tau>\<rbrakk> \<Longrightarrow> \<exists>P''. \<Psi> : Q \<rhd> P \<Longrightarrow>\<alpha> \<prec> P'' \<and> (\<exists>P'. \<Psi> \<otimes> \<Psi>' \<rhd> P'' \<Longrightarrow>\<^sup>^\<^sub>\<tau> P' \<and> (\<Psi> \<otimes> \<Psi>', P', Q') \<in> Rel)) &&& (\<And>Q'. \<Psi> \<rhd> Q \<longmapsto> \<tau> \<prec> Q' \<Longrightarrow> \<exists>P'. \<Psi> \<rhd> P \<Longrightarrow>\<^sup>^\<^sub>\<tau> P' \<and> (\<Psi>, P', Q') \<in> Rel)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
\<Psi> \<rhd> P \<leadsto><Rel> Q

goal (1 subgoal):
 1. (\<And>\<Psi>' \<alpha> Q'. \<lbrakk>\<Psi> \<rhd> Q \<longmapsto> \<alpha> \<prec> Q'; bn \<alpha> \<sharp>* \<Psi>; bn \<alpha> \<sharp>* P; \<alpha> \<noteq> \<tau>\<rbrakk> \<Longrightarrow> \<exists>P''. \<Psi> : Q \<rhd> P \<Longrightarrow>\<alpha> \<prec> P'' \<and> (\<exists>P'. \<Psi> \<otimes> \<Psi>' \<rhd> P'' \<Longrightarrow>\<^sup>^\<^sub>\<tau> P' \<and> (\<Psi> \<otimes> \<Psi>', P', Q') \<in> Rel)) &&& (\<And>Q'. \<Psi> \<rhd> Q \<longmapsto> \<tau> \<prec> Q' \<Longrightarrow> \<exists>P'. \<Psi> \<rhd> P \<Longrightarrow>\<^sup>^\<^sub>\<tau> P' \<and> (\<Psi>, P', Q') \<in> Rel)
[PROOF STEP]
by(auto simp add: weakSimulation_def)


[STATEMENT]
lemma "annil x \<Longrightarrow> annil y \<Longrightarrow> x = y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>annil x; annil y\<rbrakk> \<Longrightarrow> x = y
[PROOF STEP]
(* nitpick [expext=genuine] *)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>annil x; annil y\<rbrakk> \<Longrightarrow> x = y
[PROOF STEP]
oops


[STATEMENT]
lemma "f = (\<lambda>x::'a\<times>'b. x)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f = (\<lambda>x. x)
[PROOF STEP]
nitpick [card = 8, expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f = (\<lambda>x. x)
[PROOF STEP]
oops


[STATEMENT]
lemma "f x = g x"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x = g x
[PROOF STEP]
refute [expect = genuine]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. f x = g x
[PROOF STEP]
oops


[STATEMENT]
lemma "1\<^sub>\<sigma> \<inter> R \<cdot> U = R"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1\<^sub>\<sigma> \<inter> R \<cdot> Multirelations.U = R
[PROOF STEP]
nitpick
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 1\<^sub>\<sigma> \<inter> R \<cdot> Multirelations.U = R
[PROOF STEP]
oops


[STATEMENT]
lemma SCDNonInterference:
  "NonInterferenceIntra src trg knd
     (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
       (_Entry_) (_Exit_))
     NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
     (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id
     (PDG.PDG_BS src trg
       (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
         (_Entry_) (_Exit_))
       (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
       (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)
       (Postdomination.standard_control_dependence src trg
         (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
           (_Entry_) (_Exit_)) NewExit))
     reds (labels_LDCFG_nodes prog)
     NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
from inner_node_exists
[PROOF STATE]
proof (chain)
picking this:
Ex (While_CFGExit.inner_node ?prog)
[PROOF STEP]
obtain n where "CFGExit.inner_node sourcenode targetnode
    (valid_edge prog) (_Entry_) (_Exit_) n"
[PROOF STATE]
proof (prove)
using this:
Ex (While_CFGExit.inner_node ?prog)

goal (1 subgoal):
 1. (\<And>n. While_CFGExit.inner_node prog n \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by blast
[PROOF STATE]
proof (state)
this:
While_CFGExit.inner_node prog n

goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
While_CFGExit.inner_node prog n
[PROOF STEP]
interpret NonInterferenceIntraGraph src trg knd
     "lift_valid_edge (valid_edge prog) sourcenode targetnode kind
       (_Entry_) (_Exit_)"
     NewEntry "lift_Def (Defs prog) (_Entry_) (_Exit_) H L"
     "lift_Use (Uses prog) (_Entry_) (_Exit_) H L" id
     "PDG.PDG_BS src trg
       (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
         (_Entry_) (_Exit_))
       (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
       (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)
       (Postdomination.standard_control_dependence src trg
         (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
           (_Entry_) (_Exit_)) NewExit)"
     NewExit H L "LDCFG_node.Node (_Entry_)" "LDCFG_node.Node (_Exit_)"
[PROOF STATE]
proof (prove)
using this:
While_CFGExit.inner_node prog n

goal (1 subgoal):
 1. NonInterferenceIntraGraph src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_))
[PROOF STEP]
by(fastforce intro:SCDNonInterferenceGraph)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
interpret BackwardSlice_wf src trg knd
    "lift_valid_edge (valid_edge prog) sourcenode targetnode kind
      (_Entry_) (_Exit_)"
    NewEntry "lift_Def (Defs prog) (_Entry_) (_Exit_) H L"
    "lift_Use (Uses prog) (_Entry_) (_Exit_) H L" id
    "PDG.PDG_BS src trg
       (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
         (_Entry_) (_Exit_))
       (lift_Def (Defs prog) (_Entry_) (_Exit_) H L)
       (lift_Use (Uses prog) (_Entry_) (_Exit_) H L)
       (Postdomination.standard_control_dependence src trg
         (lift_valid_edge (valid_edge prog) sourcenode targetnode kind
           (_Entry_) (_Exit_)) NewExit)" reds "labels_LDCFG_nodes prog"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. BackwardSlice_wf src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog)
[PROOF STEP]
proof(unfold_locales)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n c s c' s'. \<lbrakk>labels_LDCFG_nodes prog n c; \<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
fix n c s c' s'
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>n c s c' s'. \<lbrakk>labels_LDCFG_nodes prog n c; \<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
assume "labels_LDCFG_nodes prog n c" and "\<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>"
[PROOF STATE]
proof (state)
this:
labels_LDCFG_nodes prog n c
\<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>

goal (1 subgoal):
 1. \<And>n c s c' s'. \<lbrakk>labels_LDCFG_nodes prog n c; \<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>\<rbrakk> \<Longrightarrow> \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
thus "\<exists>n' as. CFG.path src trg
     (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_))
      n as n' \<and> transfers (CFG.kinds knd as) s = s' \<and>
      preds (CFG.kinds knd as) s \<and> labels_LDCFG_nodes prog n' c'"
[PROOF STATE]
proof (prove)
using this:
labels_LDCFG_nodes prog n c
\<langle>c,s\<rangle> \<rightarrow>* \<langle>c',s'\<rangle>

goal (1 subgoal):
 1. \<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'
[PROOF STEP]
by(rule lifted_CFG_fund_prop)
[PROOF STATE]
proof (state)
this:
\<exists>n' as. local.path n as n' \<and> transfers (kinds as) s = s' \<and> preds (kinds as) s \<and> labels_LDCFG_nodes prog n' c'

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final
[PROOF STEP]
proof(unfold_locales)
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
fix c n
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
assume "final c" and "labels_LDCFG_nodes prog n c"
[PROOF STATE]
proof (state)
this:
final c
labels_LDCFG_nodes prog n c

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
from \<open>final c\<close>
[PROOF STATE]
proof (chain)
picking this:
final c
[PROOF STEP]
have [simp]:"c = Skip"
[PROOF STATE]
proof (prove)
using this:
final c

goal (1 subgoal):
 1. c = Skip
[PROOF STEP]
by(cases c) auto
[PROOF STATE]
proof (state)
this:
c = Skip

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
from \<open>labels_LDCFG_nodes prog n c\<close>
[PROOF STATE]
proof (chain)
picking this:
labels_LDCFG_nodes prog n c
[PROOF STEP]
obtain nx where [simp]:"n = Node nx"
      and "labels_nodes prog nx Skip"
[PROOF STATE]
proof (prove)
using this:
labels_LDCFG_nodes prog n c

goal (1 subgoal):
 1. (\<And>nx. \<lbrakk>n = LDCFG_node.Node nx; labels_nodes prog nx Skip\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(cases n) auto
[PROOF STATE]
proof (state)
this:
n = LDCFG_node.Node nx
labels_nodes prog nx Skip

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
from \<open>labels_nodes prog nx Skip\<close>
[PROOF STATE]
proof (chain)
picking this:
labels_nodes prog nx Skip
[PROOF STEP]
have "prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)"
[PROOF STATE]
proof (prove)
using this:
labels_nodes prog nx Skip

goal (1 subgoal):
 1. prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)
[PROOF STEP]
by(rule final_edge)
[PROOF STATE]
proof (state)
this:
prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
then
[PROOF STATE]
proof (chain)
picking this:
prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)
[PROOF STEP]
obtain a where "valid_edge prog a" and "sourcenode a = nx"
      and "kind a = \<Up>id" and "targetnode a = (_Exit_)"
[PROOF STATE]
proof (prove)
using this:
prog \<turnstile> nx -\<Up>id\<rightarrow> (_Exit_)

goal (1 subgoal):
 1. (\<And>a. \<lbrakk>valid_edge prog a; sourcenode a = nx; kind a = \<Up>id; targetnode a = (_Exit_)\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis
[PROOF STEP]
by(auto simp:valid_edge_def)
[PROOF STATE]
proof (state)
this:
valid_edge prog a
sourcenode a = nx
kind a = \<Up>id
targetnode a = (_Exit_)

goal (1 subgoal):
 1. \<And>c n. \<lbrakk>final c; labels_LDCFG_nodes prog n c\<rbrakk> \<Longrightarrow> \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
with \<open>labels_nodes prog nx Skip\<close>
[PROOF STATE]
proof (chain)
picking this:
labels_nodes prog nx Skip
valid_edge prog a
sourcenode a = nx
kind a = \<Up>id
targetnode a = (_Exit_)
[PROOF STEP]
show "\<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode
      kind (_Entry_) (_Exit_) a \<and>
      src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id"
[PROOF STATE]
proof (prove)
using this:
labels_nodes prog nx Skip
valid_edge prog a
sourcenode a = nx
kind a = \<Up>id
targetnode a = (_Exit_)

goal (1 subgoal):
 1. \<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id
[PROOF STEP]
by(rule_tac x="(Node nx,\<Up>id,Node (_Exit_))" in exI)
        (auto intro!:lve_edge simp:knd_def valid_edge_def)
[PROOF STATE]
proof (state)
this:
\<exists>a. lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_) a \<and> src a = n \<and> trg a = LDCFG_node.Node (_Exit_) \<and> knd a = \<Up>id

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
NonInterferenceIntra src trg knd (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewEntry (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) id (PDG.PDG_BS src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) (lift_Def (Defs prog) (_Entry_) (_Exit_) H L) (lift_Use (Uses prog) (_Entry_) (_Exit_) H L) (Postdomination.standard_control_dependence src trg (lift_valid_edge (valid_edge prog) sourcenode targetnode kind (_Entry_) (_Exit_)) NewExit)) reds (labels_LDCFG_nodes prog) NewExit H L (LDCFG_node.Node (_Entry_)) (LDCFG_node.Node (_Exit_)) final

goal:
No subgoals!
[PROOF STEP]
qed