[STATEMENT]
lemma "\<lbrakk>A \<notin> bad;  B \<notin> bad;  evs \<in> ns_public\<rbrakk>
       \<Longrightarrow> Says B A (Crypt (pubEK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs
           \<longrightarrow> Nonce NB \<notin> analz (spies evs)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>A \<notin> bad; B \<notin> bad; evs \<in> ns_public\<rbrakk> \<Longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs \<longrightarrow> Nonce NB \<notin> analz (knows Spy evs)
[PROOF STEP]
apply (erule ns_public.induct, simp_all, spy_analz)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>evs1 NAa Ba. \<lbrakk>A \<notin> bad; B \<notin> bad; evs1 \<in> ns_public; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs1 \<longrightarrow> Nonce NB \<notin> analz (knows Spy evs1); Nonce NAa \<notin> used evs1\<rbrakk> \<Longrightarrow> Ba \<in> bad \<longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs1 \<longrightarrow> NB \<noteq> NAa
 2. \<And>evs2 NBa A' Ba NAa Aa. \<lbrakk>A \<notin> bad; B \<notin> bad; evs2 \<in> ns_public; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs2 \<longrightarrow> Nonce NB \<notin> analz (knows Spy evs2); Nonce NBa \<notin> used evs2; Says A' Ba (Crypt (pubK Ba) \<lbrace>Nonce NAa, Agent Aa\<rbrace>) \<in> set evs2\<rbrakk> \<Longrightarrow> (Aa \<in> bad \<longrightarrow> (NA = NAa \<longrightarrow> A = Aa \<longrightarrow> B = Ba \<longrightarrow> NB \<noteq> NBa) \<and> (Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs2 \<longrightarrow> NB \<noteq> NAa \<and> NB \<noteq> NBa)) \<and> (Aa \<notin> bad \<longrightarrow> B = Ba \<and> A = Aa \<and> NA = NAa \<and> NB = NBa \<longrightarrow> Nonce NBa \<notin> analz (knows Spy evs2))
 3. \<And>evs3 Aa Ba NAa B' NBa. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_public; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Nonce NB \<notin> analz (knows Spy evs3); Says Aa Ba (Crypt (pubK Ba) \<lbrace>Nonce NAa, Agent Aa\<rbrace>) \<in> set evs3; Says B' Aa (Crypt (pubK Aa) \<lbrace>Nonce NAa, Nonce NBa\<rbrace>) \<in> set evs3\<rbrakk> \<Longrightarrow> Ba \<in> bad \<longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> NB \<noteq> NBa
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>evs2 NBa A' Ba NAa Aa. \<lbrakk>A \<notin> bad; B \<notin> bad; evs2 \<in> ns_public; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs2 \<longrightarrow> Nonce NB \<notin> analz (knows Spy evs2); Nonce NBa \<notin> used evs2; Says A' Ba (Crypt (pubK Ba) \<lbrace>Nonce NAa, Agent Aa\<rbrace>) \<in> set evs2\<rbrakk> \<Longrightarrow> (Aa \<in> bad \<longrightarrow> (NA = NAa \<longrightarrow> A = Aa \<longrightarrow> B = Ba \<longrightarrow> NB \<noteq> NBa) \<and> (Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs2 \<longrightarrow> NB \<noteq> NAa \<and> NB \<noteq> NBa)) \<and> (Aa \<notin> bad \<longrightarrow> B = Ba \<and> A = Aa \<and> NA = NAa \<and> NB = NBa \<longrightarrow> Nonce NBa \<notin> analz (knows Spy evs2))
 2. \<And>evs3 Aa Ba NAa B' NBa. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_public; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Nonce NB \<notin> analz (knows Spy evs3); Says Aa Ba (Crypt (pubK Ba) \<lbrace>Nonce NAa, Agent Aa\<rbrace>) \<in> set evs3; Says B' Aa (Crypt (pubK Aa) \<lbrace>Nonce NAa, Nonce NBa\<rbrace>) \<in> set evs3\<rbrakk> \<Longrightarrow> Ba \<in> bad \<longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> NB \<noteq> NBa
[PROOF STEP]
apply (blast intro: no_nonce_NS1_NS2)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs3 Aa Ba NAa B' NBa. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_public; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> Nonce NB \<notin> analz (knows Spy evs3); Says Aa Ba (Crypt (pubK Ba) \<lbrace>Nonce NAa, Agent Aa\<rbrace>) \<in> set evs3; Says B' Aa (Crypt (pubK Aa) \<lbrace>Nonce NAa, Nonce NBa\<rbrace>) \<in> set evs3\<rbrakk> \<Longrightarrow> Ba \<in> bad \<longrightarrow> Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3 \<longrightarrow> NB \<noteq> NBa
[PROOF STEP]
apply clarify
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs3 Aa Ba NAa B' NBa. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_public; Says Aa Ba (Crypt (pubK Ba) \<lbrace>Nonce NAa, Agent Aa\<rbrace>) \<in> set evs3; Says B' Aa (Crypt (pubK Aa) \<lbrace>Nonce NAa, Nonce NB\<rbrace>) \<in> set evs3; Ba \<in> bad; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3; Nonce NB \<notin> analz (knows Spy evs3)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (frule_tac A' = A in
       Says_imp_knows_Spy [THEN parts.Inj, THEN unique_NB], auto)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs3 Ba B'. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_public; Says A Ba (Crypt (pubK Ba) \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs3; Says B' A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3; Ba \<in> bad; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3; Nonce NB \<notin> analz (knows Spy evs3)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
apply (rename_tac evs3 B' C)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs3 B' C. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_public; Says A B' (Crypt (pubK B') \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs3; Says C A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3; B' \<in> bad; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3; Nonce NB \<notin> analz (knows Spy evs3)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
txt\<open>This is the attack!
@{subgoals[display,indent=0,margin=65]}
\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>evs3 B' C. \<lbrakk>A \<notin> bad; B \<notin> bad; evs3 \<in> ns_public; Says A B' (Crypt (pubK B') \<lbrace>Nonce NA, Agent A\<rbrace>) \<in> set evs3; Says C A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3; B' \<in> bad; Says B A (Crypt (pubK A) \<lbrace>Nonce NA, Nonce NB\<rbrace>) \<in> set evs3; Nonce NB \<notin> analz (knows Spy evs3)\<rbrakk> \<Longrightarrow> False
[PROOF STEP]
oops


[STATEMENT]
lemma valid_refs_inv_dequeue_Mutate_Payload:
  notes if_split_asm[split del]
  fixes s :: "('field, 'mut, 'payload, 'ref) lsts"
  assumes vri: "valid_refs_inv s"
  assumes sb: "sys_mem_store_buffers (mutator m') s = mw_Mutate_Payload r f pl # ws"
  shows "valid_refs_inv (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)),
                                        mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>))" (is "valid_refs_inv ?s'")
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. valid_refs_inv (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>))
[PROOF STEP]
apply (rule valid_refs_invI)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ma x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)) (mutator ma)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)) (mutator ma)) \<union> mut_m.tso_store_refs ma (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>))
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
valid_refs_inv s
sys_mem_store_buffers (mutator m') s = mw_Mutate_Payload r f pl # ws

goal (1 subgoal):
 1. \<And>ma x y. \<lbrakk>(x reaches y) (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)); x \<in> roots ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)) (mutator ma)) \<union> ghost_honorary_root ((s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)) (mutator ma)) \<union> mut_m.tso_store_refs ma (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>)) \<or> grey x (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>))\<rbrakk> \<Longrightarrow> obj_at (\<lambda>s. True) y (s(sys := s sys\<lparr>heap := (sys_heap s)(r := map_option (\<lambda>obj. obj\<lparr>obj_payload := (obj_payload obj)(f := pl)\<rparr>) (sys_heap s r)), mem_store_buffers := (mem_store_buffers (s sys))(mutator m := ws)\<rparr>))
[PROOF STEP]
apply (clarsimp simp: valid_refs_invD fun_upd_apply split: obj_at_splits mem_store_action.splits)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ma x y. \<lbrakk>(x reaches y) s; x \<in> roots (s (mutator ma)) \<or> x \<in> ghost_honorary_root (s (mutator ma)) \<or> x \<in> (if m = ma then \<Union> (store_refs ` set ws) else mut_m.tso_store_refs ma s) \<or> grey x s; valid_refs_inv s; sys_mem_store_buffers (mutator m') s = mw_Mutate_Payload r f pl # ws\<rbrakk> \<Longrightarrow> \<exists>ya. sys_heap s y = Some ya
[PROOF STEP]
apply auto
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>ma x y. \<lbrakk>(x reaches y) s; valid_refs_inv s; sys_mem_store_buffers (mutator m') s = mw_Mutate_Payload r f pl # ws; x \<in> (if m = ma then \<Union> (store_refs ` set ws) else mut_m.tso_store_refs ma s)\<rbrakk> \<Longrightarrow> \<exists>ya. sys_heap s y = Some ya
 2. \<And>x y. \<lbrakk>(x reaches y) s; valid_refs_inv s; sys_mem_store_buffers (mutator m') s = mw_Mutate_Payload r f pl # ws; grey x s\<rbrakk> \<Longrightarrow> \<exists>ya. sys_heap s y = Some ya
[PROOF STEP]
apply (metis (mono_tags, lifting) UN_insert Un_iff list.simps(15) mut_m.tso_store_refs_def valid_refs_invD(4))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>(x reaches y) s; valid_refs_inv s; sys_mem_store_buffers (mutator m') s = mw_Mutate_Payload r f pl # ws; grey x s\<rbrakk> \<Longrightarrow> \<exists>ya. sys_heap s y = Some ya
[PROOF STEP]
apply (metis case_optionE obj_at_def valid_refs_invD(7))
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma get_root_node_wf_is_l_get_root_node_wf [instances]:
  "l_get_root_node_wf heap_is_wellformed get_root_node type_wf known_ptr known_ptrs get_ancestors
    get_parent"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_get_root_node_wf Shadow_DOM.heap_is_wellformed Shadow_DOM.get_root_node ShadowRootClass.type_wf ShadowRootClass.known_ptr ShadowRootClass.known_ptrs Shadow_DOM.get_ancestors Shadow_DOM.get_parent
[PROOF STEP]
using known_ptrs_is_l_known_ptrs
[PROOF STATE]
proof (prove)
using this:
l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs

goal (1 subgoal):
 1. l_get_root_node_wf Shadow_DOM.heap_is_wellformed Shadow_DOM.get_root_node ShadowRootClass.type_wf ShadowRootClass.known_ptr ShadowRootClass.known_ptrs Shadow_DOM.get_ancestors Shadow_DOM.get_parent
[PROOF STEP]
apply(auto simp add: l_get_root_node_wf_def l_get_root_node_wf_axioms_def)[1]
[PROOF STATE]
proof (prove)
goal (8 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.known_ptrs h; ShadowRootClass.type_wf h; ptr |\<in>| object_ptr_kinds h\<rbrakk> \<Longrightarrow> h \<turnstile> ok Shadow_DOM.get_root_node ptr
 2. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 3. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 6. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 8. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_ok
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.known_ptrs ?h; ShadowRootClass.type_wf ?h; ?ptr |\<in>| object_ptr_kinds ?h\<rbrakk> \<Longrightarrow> ?h \<turnstile> ok Shadow_DOM.get_root_node ?ptr

goal (8 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.known_ptrs h; ShadowRootClass.type_wf h; ptr |\<in>| object_ptr_kinds h\<rbrakk> \<Longrightarrow> h \<turnstile> ok Shadow_DOM.get_root_node ptr
 2. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 3. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 6. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 8. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (7 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 2. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_ptr_in_heap
[PROOF STATE]
proof (prove)
using this:
?h \<turnstile> ok Shadow_DOM.get_root_node ?ptr \<Longrightarrow> ?ptr |\<in>| object_ptr_kinds ?h

goal (7 subgoals):
 1. \<And>h ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> ok Shadow_DOM.get_root_node ptr\<rbrakk> \<Longrightarrow> ptr |\<in>| object_ptr_kinds h
 2. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 5. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 7. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (6 subgoals):
 1. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_root_in_heap
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.type_wf ?h; ShadowRootClass.known_ptrs ?h; ?h \<turnstile> Shadow_DOM.get_root_node ?ptr \<rightarrow>\<^sub>r ?root\<rbrakk> \<Longrightarrow> ?root |\<in>| object_ptr_kinds ?h

goal (6 subgoals):
 1. \<And>h ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> root |\<in>| object_ptr_kinds h
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 4. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 6. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (5 subgoals):
 1. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 4. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_ancestors_same_root_node
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.type_wf ?h; ShadowRootClass.known_ptrs ?h; ?h \<turnstile> Shadow_DOM.get_ancestors ?ptr \<rightarrow>\<^sub>r ?ancestors; ?ptr' \<in> set ?ancestors; ?ptr'' \<in> set ?ancestors\<rbrakk> \<Longrightarrow> ?h \<turnstile> Shadow_DOM.get_root_node ?ptr' \<rightarrow>\<^sub>r ?root_ptr = ?h \<turnstile> Shadow_DOM.get_root_node ?ptr'' \<rightarrow>\<^sub>r ?root_ptr

goal (5 subgoals):
 1. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr
 2. \<And>h ptr ancestors ptr' ptr'' root_ptr. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_ancestors ptr \<rightarrow>\<^sub>r ancestors; ptr' \<in> set ancestors; ptr'' \<in> set ancestors; h \<turnstile> Shadow_DOM.get_root_node ptr'' \<rightarrow>\<^sub>r root_ptr\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr' \<rightarrow>\<^sub>r root_ptr
 3. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 4. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 5. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply(blast, blast)
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 3. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_same_no_parent
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>Shadow_DOM.heap_is_wellformed ?h; ShadowRootClass.type_wf ?h; ShadowRootClass.known_ptrs ?h; ?h \<turnstile> Shadow_DOM.get_root_node ?ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child\<rbrakk> \<Longrightarrow> ?h \<turnstile> Shadow_DOM.get_parent ?child \<rightarrow>\<^sub>r None

goal (3 subgoals):
 1. \<And>h ptr child. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; Shadow_DOM.heap_is_wellformed h; ShadowRootClass.type_wf h; ShadowRootClass.known_ptrs h; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r None
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 3. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply blast
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
(* using get_root_node_not_node_same apply blast *)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
using get_root_node_parent_same
[PROOF STATE]
proof (prove)
using this:
?h \<turnstile> Shadow_DOM.get_parent ?child \<rightarrow>\<^sub>r Some ?ptr \<Longrightarrow> ?h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r ?child) \<rightarrow>\<^sub>r ?root = ?h \<turnstile> Shadow_DOM.get_root_node ?ptr \<rightarrow>\<^sub>r ?root

goal (2 subgoals):
 1. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root
 2. \<And>h child ptr root. \<lbrakk>l_known_ptrs ShadowRootClass.known_ptr ShadowRootClass.known_ptrs; h \<turnstile> Shadow_DOM.get_parent child \<rightarrow>\<^sub>r Some ptr; h \<turnstile> Shadow_DOM.get_root_node ptr \<rightarrow>\<^sub>r root\<rbrakk> \<Longrightarrow> h \<turnstile> Shadow_DOM.get_root_node (cast\<^sub>n\<^sub>o\<^sub>d\<^sub>e\<^sub>_\<^sub>p\<^sub>t\<^sub>r\<^sub>2\<^sub>o\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t\<^sub>_\<^sub>p\<^sub>t\<^sub>r child) \<rightarrow>\<^sub>r root
[PROOF STEP]
apply (blast, blast)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma "my_foo"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. my_foo
[PROOF STEP]
find_proof UserSimp2
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. my_foo
[PROOF STEP]
oops


[STATEMENT]
lemma "x \<noteq> (y::bool bounded) \<Longrightarrow> z = x \<or> z = y"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<noteq> y \<Longrightarrow> z = x \<or> z = y
[PROOF STEP]
nitpick [expect = potential]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. x \<noteq> y \<Longrightarrow> z = x \<or> z = y
[PROOF STEP]
sorry


[STATEMENT]
theorem edka_refine[refine]: "edka \<le> \<Down>Id edka_partial"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. edka \<le> \<Down> Id edka_partial
[PROOF STEP]
unfolding edka_def edka_partial_def
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. (let f = \<lambda>_. 0::'capacity in while\<^sub>T\<^bsup>fofu_invar\<^esup> (\<lambda>(f, brk). \<not> brk) (\<lambda>(f, uu_). find_shortest_augmenting_spec f \<bind> (\<lambda>p. case p of None \<Rightarrow> return (f, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t f p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of f) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c f p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False))))))) (f, False) \<bind> (\<lambda>(f, uu_). assert (NFlow c s t f) \<bind> (\<lambda>_. return f))) \<le> \<Down> Id (let f = \<lambda>_. 0::'capacity in while\<^bsup>fofu_invar\<^esup> (\<lambda>(f, brk). \<not> brk) (\<lambda>(f, uu_). find_shortest_augmenting_spec f \<bind> (\<lambda>p. case p of None \<Rightarrow> return (f, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t f p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of f) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c f p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False))))))) (f, False) \<bind> (\<lambda>(f, uu_). assert (NFlow c s t f) \<bind> (\<lambda>_. return f)))
[PROOF STEP]
apply (refine_rcg bind_refine'
    WHILEIT_refine_WHILEI[where V=edka_wf_rel])
[PROOF STATE]
proof (prove)
goal (16 subgoals):
 1. wf edka_wf_rel
 2. \<And>sa x1 x2. \<lbrakk>fofu_invar sa; case sa of (f, brk) \<Rightarrow> \<not> brk; (case sa of (f, uu_) \<Rightarrow> find_shortest_augmenting_spec f \<bind> (\<lambda>p. case p of None \<Rightarrow> return (f, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t f p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of f) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c f p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False))))))) \<le> SPEC fofu_invar; sa = (x1, x2)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1 \<bind> (\<lambda>p. case p of None \<Rightarrow> return (x1, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1 p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1 p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> (spec s'. (s', sa) \<in> edka_wf_rel)
 3. fofu_invar (\<lambda>_. 0::'capacity, False) \<Longrightarrow> ((\<lambda>_. 0::'capacity, False), \<lambda>_. 0::'capacity, False) \<in> ?R'1
 4. \<And>x x' x1 x2. \<lbrakk>(x, x') \<in> ?R'1; fofu_invar x'; x = (x1, x2)\<rbrakk> \<Longrightarrow> NFlow c s t x1
 5. \<And>x x' x1 x2 p. \<lbrakk>(x, x') \<in> ?R'1; fofu_invar x'; x = (x1, x2); x2\<rbrakk> \<Longrightarrow> \<not> NPreflow.isAugmentingPath c s t x1 p
 6. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> ?R'1; fofu_invar x; fofu_invar x'; x = (x1, x2); x' = (x1a, x2a)\<rbrakk> \<Longrightarrow> (\<not> x2) = (\<not> x2a)
 7. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> ?R'1; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1a \<le> \<Down> (?R'48 x x' x1 x2 x1a x2a) (find_shortest_augmenting_spec x1)
 8. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> ?R'1; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> ?R'48 x x' x1 x2 x1a x2a; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1)\<rbrakk> \<Longrightarrow> (p, pa) \<in> \<langle>?Ra49 x x' x1 x2 x1a x2a p pa\<rangle>option_rel
 9. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> ?R'1; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> ?R'48 x x' x1 x2 x1a x2a; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = None; pa = None\<rbrakk> \<Longrightarrow> ((x1a, True), x1, True) \<in> ?R'1
 10. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> ?R'1; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> ?R'48 x x' x1 x2 x1a x2a; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> ?Ra49 x x' x1 x2 x1a x2a p pa; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t\<rbrakk> \<Longrightarrow> xa \<noteq> []
A total of 16 subgoals...
[PROOF STEP]
apply (refine_dref_type)
[PROOF STATE]
proof (prove)
goal (15 subgoals):
 1. wf edka_wf_rel
 2. \<And>sa x1 x2. \<lbrakk>fofu_invar sa; case sa of (f, brk) \<Rightarrow> \<not> brk; (case sa of (f, uu_) \<Rightarrow> find_shortest_augmenting_spec f \<bind> (\<lambda>p. case p of None \<Rightarrow> return (f, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t f p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of f) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c f p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False))))))) \<le> SPEC fofu_invar; sa = (x1, x2)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1 \<bind> (\<lambda>p. case p of None \<Rightarrow> return (x1, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1 p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1 p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> (spec s'. (s', sa) \<in> edka_wf_rel)
 3. fofu_invar (\<lambda>_. 0::'capacity, False) \<Longrightarrow> ((\<lambda>_. 0::'capacity, False), \<lambda>_. 0::'capacity, False) \<in> Id \<times>\<^sub>r bool_rel
 4. \<And>x x' x1 x2. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2)\<rbrakk> \<Longrightarrow> NFlow c s t x1
 5. \<And>x x' x1 x2 p. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2); x2\<rbrakk> \<Longrightarrow> \<not> NPreflow.isAugmentingPath c s t x1 p
 6. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x; fofu_invar x'; x = (x1, x2); x' = (x1a, x2a)\<rbrakk> \<Longrightarrow> (\<not> x2) = (\<not> x2a)
 7. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1a \<le> \<Down> (\<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel) (find_shortest_augmenting_spec x1)
 8. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = None; pa = None\<rbrakk> \<Longrightarrow> ((x1a, True), x1, True) \<in> Id \<times>\<^sub>r bool_rel
 9. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t\<rbrakk> \<Longrightarrow> xa \<noteq> []
 10. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []\<rbrakk> \<Longrightarrow> NPreflow.isAugmentingPath c s t x1a xa
A total of 15 subgoals...
[PROOF STEP]
apply (simp; fail)
[PROOF STATE]
proof (prove)
goal (14 subgoals):
 1. \<And>sa x1 x2. \<lbrakk>fofu_invar sa; case sa of (f, brk) \<Rightarrow> \<not> brk; (case sa of (f, uu_) \<Rightarrow> find_shortest_augmenting_spec f \<bind> (\<lambda>p. case p of None \<Rightarrow> return (f, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t f p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of f) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c f p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False))))))) \<le> SPEC fofu_invar; sa = (x1, x2)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1 \<bind> (\<lambda>p. case p of None \<Rightarrow> return (x1, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1 p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1 p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> (spec s'. (s', sa) \<in> edka_wf_rel)
 2. fofu_invar (\<lambda>_. 0::'capacity, False) \<Longrightarrow> ((\<lambda>_. 0::'capacity, False), \<lambda>_. 0::'capacity, False) \<in> Id \<times>\<^sub>r bool_rel
 3. \<And>x x' x1 x2. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2)\<rbrakk> \<Longrightarrow> NFlow c s t x1
 4. \<And>x x' x1 x2 p. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2); x2\<rbrakk> \<Longrightarrow> \<not> NPreflow.isAugmentingPath c s t x1 p
 5. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x; fofu_invar x'; x = (x1, x2); x' = (x1a, x2a)\<rbrakk> \<Longrightarrow> (\<not> x2) = (\<not> x2a)
 6. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1a \<le> \<Down> (\<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel) (find_shortest_augmenting_spec x1)
 7. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = None; pa = None\<rbrakk> \<Longrightarrow> ((x1a, True), x1, True) \<in> Id \<times>\<^sub>r bool_rel
 8. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t\<rbrakk> \<Longrightarrow> xa \<noteq> []
 9. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []\<rbrakk> \<Longrightarrow> NPreflow.isAugmentingPath c s t x1a xa
 10. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []; NPreflow.isAugmentingPath c s t x1a xa\<rbrakk> \<Longrightarrow> Graph.isShortestPath (cf_of x1a) s xa t
A total of 14 subgoals...
[PROOF STEP]
subgoal
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fofu_invar sa_; case sa_ of (f, brk) \<Rightarrow> \<not> brk; (case sa_ of (f, uu_) \<Rightarrow> find_shortest_augmenting_spec f \<bind> (\<lambda>p. case p of None \<Rightarrow> return (f, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t f p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of f) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c f p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False))))))) \<le> SPEC fofu_invar; sa_ = (x1_, x2_)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1_ \<bind> (\<lambda>p. case p of None \<Rightarrow> return (x1_, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1_ p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1_) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1_ p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> (spec s'. (s', sa_) \<in> edka_wf_rel)
[PROOF STEP]
txt \<open>Unfortunately, the verification condition for introducing
      the variant requires a bit of manual massaging to be solved:\<close>
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>fofu_invar sa_; case sa_ of (f, brk) \<Rightarrow> \<not> brk; (case sa_ of (f, uu_) \<Rightarrow> find_shortest_augmenting_spec f \<bind> (\<lambda>p. case p of None \<Rightarrow> return (f, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t f p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of f) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c f p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False))))))) \<le> SPEC fofu_invar; sa_ = (x1_, x2_)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1_ \<bind> (\<lambda>p. case p of None \<Rightarrow> return (x1_, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1_ p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1_) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1_ p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> (spec s'. (s', sa_) \<in> edka_wf_rel)
[PROOF STEP]
apply (simp)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>NFlow c s t x1_; \<not> x2_; find_shortest_augmenting_spec x1_ \<bind> case_option (return (x1_, True)) (\<lambda>p. assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1_ p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1_) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1_ p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> SPEC fofu_invar; sa_ = (x1_, False)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1_ \<bind> (\<lambda>p. case p of None \<Rightarrow> return (x1_, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1_ p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1_) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1_ p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> (spec s'. (s', x1_, False) \<in> edka_wf_rel)
[PROOF STEP]
apply (erule bind_sim_select_rule)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>NFlow c s t x1_; \<not> x2_; sa_ = (x1_, False); nofail (find_shortest_augmenting_spec x1_); inres (find_shortest_augmenting_spec x1_) x; (case x of None \<Rightarrow> return (x1_, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1_ p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1_) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1_ p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> SPEC fofu_invar\<rbrakk> \<Longrightarrow> (case x of None \<Rightarrow> return (x1_, True) | Some p \<Rightarrow> assert (p \<noteq> []) \<bind> (\<lambda>_. assert (NPreflow.isAugmentingPath c s t x1_ p) \<bind> (\<lambda>_. assert (Graph.isShortestPath (cf_of x1_) s p t) \<bind> (\<lambda>_. let f = NFlow.augment_with_path c x1_ p in assert (NFlow c s t f) \<bind> (\<lambda>_. return (f, False)))))) \<le> (spec s'. (s', x1_, False) \<in> edka_wf_rel)
[PROOF STEP]
apply (auto split: option.split
      simp: NFlow.augment_with_path_def
      simp: assert_bind_spec_conv Let_def
      simp: find_shortest_augmenting_spec_def
      simp: edka_wf_rel_def NFlow.shortest_path_decr_ek_measure
    ; fail) []
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. fofu_invar (\<lambda>_. 0::'capacity, False) \<Longrightarrow> ((\<lambda>_. 0::'capacity, False), \<lambda>_. 0::'capacity, False) \<in> Id \<times>\<^sub>r bool_rel
 2. \<And>x x' x1 x2. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2)\<rbrakk> \<Longrightarrow> NFlow c s t x1
 3. \<And>x x' x1 x2 p. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2); x2\<rbrakk> \<Longrightarrow> \<not> NPreflow.isAugmentingPath c s t x1 p
 4. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x; fofu_invar x'; x = (x1, x2); x' = (x1a, x2a)\<rbrakk> \<Longrightarrow> (\<not> x2) = (\<not> x2a)
 5. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1a \<le> \<Down> (\<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel) (find_shortest_augmenting_spec x1)
 6. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = None; pa = None\<rbrakk> \<Longrightarrow> ((x1a, True), x1, True) \<in> Id \<times>\<^sub>r bool_rel
 7. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t\<rbrakk> \<Longrightarrow> xa \<noteq> []
 8. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []\<rbrakk> \<Longrightarrow> NPreflow.isAugmentingPath c s t x1a xa
 9. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []; NPreflow.isAugmentingPath c s t x1a xa\<rbrakk> \<Longrightarrow> Graph.isShortestPath (cf_of x1a) s xa t
 10. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []; NPreflow.isAugmentingPath c s t x1a xa; Graph.isShortestPath (cf_of x1a) s xa t; NFlow c s t (NFlow.augment_with_path c x1 x'a)\<rbrakk> \<Longrightarrow> NFlow c s t (NFlow.augment_with_path c x1a xa)
A total of 13 subgoals...
[PROOF STEP]
txt \<open>The other VCs are straightforward\<close>
[PROOF STATE]
proof (prove)
goal (13 subgoals):
 1. fofu_invar (\<lambda>_. 0::'capacity, False) \<Longrightarrow> ((\<lambda>_. 0::'capacity, False), \<lambda>_. 0::'capacity, False) \<in> Id \<times>\<^sub>r bool_rel
 2. \<And>x x' x1 x2. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2)\<rbrakk> \<Longrightarrow> NFlow c s t x1
 3. \<And>x x' x1 x2 p. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x'; x = (x1, x2); x2\<rbrakk> \<Longrightarrow> \<not> NPreflow.isAugmentingPath c s t x1 p
 4. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; fofu_invar x; fofu_invar x'; x = (x1, x2); x' = (x1a, x2a)\<rbrakk> \<Longrightarrow> (\<not> x2) = (\<not> x2a)
 5. \<And>x x' x1 x2 x1a x2a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a)\<rbrakk> \<Longrightarrow> find_shortest_augmenting_spec x1a \<le> \<Down> (\<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel) (find_shortest_augmenting_spec x1)
 6. \<And>x x' x1 x2 x1a x2a p pa. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = None; pa = None\<rbrakk> \<Longrightarrow> ((x1a, True), x1, True) \<in> Id \<times>\<^sub>r bool_rel
 7. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t\<rbrakk> \<Longrightarrow> xa \<noteq> []
 8. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []\<rbrakk> \<Longrightarrow> NPreflow.isAugmentingPath c s t x1a xa
 9. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []; NPreflow.isAugmentingPath c s t x1a xa\<rbrakk> \<Longrightarrow> Graph.isShortestPath (cf_of x1a) s xa t
 10. \<And>x x' x1 x2 x1a x2a p pa xa x'a. \<lbrakk>(x, x') \<in> Id \<times>\<^sub>r bool_rel; case x of (f, brk) \<Rightarrow> \<not> brk; case x' of (f, brk) \<Rightarrow> \<not> brk; fofu_invar x; fofu_invar x'; x' = (x1, x2); x = (x1a, x2a); (p, pa) \<in> \<langle>\<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel\<rangle>option_rel; inres (find_shortest_augmenting_spec x1a) p; inres (find_shortest_augmenting_spec x1) pa; nofail (find_shortest_augmenting_spec x1a); nofail (find_shortest_augmenting_spec x1); p = Some xa; pa = Some x'a; (xa, x'a) \<in> \<langle>nat_rel \<times>\<^sub>r nat_rel\<rangle>list_rel; x'a \<noteq> []; NPreflow.isAugmentingPath c s t x1 x'a; Graph.isShortestPath (cf_of x1) s x'a t; xa \<noteq> []; NPreflow.isAugmentingPath c s t x1a xa; Graph.isShortestPath (cf_of x1a) s xa t; NFlow c s t (NFlow.augment_with_path c x1 x'a)\<rbrakk> \<Longrightarrow> NFlow c s t (NFlow.augment_with_path c x1a xa)
A total of 13 subgoals...
[PROOF STEP]
apply (vc_solve)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma Call_lemma_switch_Call_body:
 assumes
 call: "\<forall>q \<in> dom \<Gamma>. \<forall>Z. \<Gamma>,\<Theta> \<turnstile>\<^sub>t\<^bsub>/F\<^esub>
                 {s. s=Z \<and> \<Gamma>\<turnstile>\<langle>Call q,Normal s\<rangle> \<Rightarrow>\<notin>({Stuck} \<union> Fault ` (-F)) \<and>
                    \<Gamma>\<turnstile>Call q\<down>Normal s \<and> ((s,q),(\<sigma>,p)) \<in> termi_call_steps \<Gamma>}
                 (Call q)
                {t. \<Gamma>\<turnstile>\<langle>Call q,Normal Z\<rangle> \<Rightarrow> Normal t},
                {t. \<Gamma>\<turnstile>\<langle>Call q,Normal Z\<rangle> \<Rightarrow> Abrupt t}"
 assumes p_defined: "p \<in> dom \<Gamma>"
 shows "\<And>Z. \<Gamma>,\<Theta> \<turnstile>\<^sub>t\<^bsub>/F\<^esub>
              ({\<sigma>} \<inter> {s. s=Z \<and> \<Gamma>\<turnstile>\<langle>Call p,Normal s\<rangle> \<Rightarrow>\<notin>({Stuck} \<union> Fault ` (-F)) \<and>
                                 \<Gamma>\<turnstile>Call p\<down>Normal s})
                 the (\<Gamma> p)
              {t. \<Gamma>\<turnstile>\<langle>Call p,Normal Z\<rangle> \<Rightarrow> Normal t},
              {t. \<Gamma>\<turnstile>\<langle>Call p,Normal Z\<rangle> \<Rightarrow> Abrupt t}"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>Call p,Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>Call p \<down> Normal s}) the (\<Gamma> p) {t. \<Gamma>\<turnstile> \<langle>Call p,Normal Z\<rangle> \<Rightarrow> Normal t},{t. \<Gamma>\<turnstile> \<langle>Call p,Normal Z\<rangle> \<Rightarrow> Abrupt t}
[PROOF STEP]
apply (simp only: exec_Call_body' [OF p_defined] noFaultStuck_Call_body' [OF p_defined] terminates_Normal_Call_body [OF p_defined])
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> ({\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s}) the (\<Gamma> p) {t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Normal t},{t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Abrupt t}
[PROOF STEP]
apply (rule conseqPre)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Z. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> (?P' Z) the (\<Gamma> p) {t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Normal t},{t. \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal Z\<rangle> \<Rightarrow> Abrupt t}
 2. \<And>Z. {\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s} \<subseteq> ?P' Z
[PROOF STEP]
apply (rule Call_lemma')
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>Z. \<forall>q\<in>dom \<Gamma>. \<forall>Za. \<Gamma>,\<Theta>\<turnstile>\<^sub>t\<^bsub>/F\<^esub> {s. s = Za \<and> \<Gamma>\<turnstile> \<langle>Call q,Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>Call q \<down> Normal s \<and> ((s, q), ?\<sigma>3 Z, ?p3 Z) \<in> termi_call_steps \<Gamma>} Call q {t. \<Gamma>\<turnstile> \<langle>Call q,Normal Za\<rangle> \<Rightarrow> Normal t},{t. \<Gamma>\<turnstile> \<langle>Call q,Normal Za\<rangle> \<Rightarrow> Abrupt t}
 2. \<And>Z. {\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s} \<subseteq> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>Call (?p3 Z) \<down> Normal (?\<sigma>3 Z) \<and> (\<exists>c'. \<Gamma>\<turnstile> (Call (?p3 Z), Normal (?\<sigma>3 Z)) \<rightarrow>\<^sup>+ (c', Normal s) \<and> the (\<Gamma> p) \<in> redexes c')}
[PROOF STEP]
apply (rule call)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>Z. {\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s} \<subseteq> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>Call p \<down> Normal \<sigma> \<and> (\<exists>c'. \<Gamma>\<turnstile> (Call p, Normal \<sigma>) \<rightarrow>\<^sup>+ (c', Normal s) \<and> the (\<Gamma> p) \<in> redexes c')}
[PROOF STEP]
using p_defined
[PROOF STATE]
proof (prove)
using this:
p \<in> dom \<Gamma>

goal (1 subgoal):
 1. \<And>Z. {\<sigma>} \<inter> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>the (\<Gamma> p) \<down> Normal s} \<subseteq> {s. s = Z \<and> \<Gamma>\<turnstile> \<langle>the (\<Gamma> p),Normal s\<rangle> \<Rightarrow>\<notin>{Stuck} \<union> Fault ` (- F) \<and> \<Gamma>\<turnstile>Call p \<down> Normal \<sigma> \<and> (\<exists>c'. \<Gamma>\<turnstile> (Call p, Normal \<sigma>) \<rightarrow>\<^sup>+ (c', Normal s) \<and> the (\<Gamma> p) \<in> redexes c')}
[PROOF STEP]
apply (fastforce intro: terminates.intros tranclp.r_into_trancl [of "(step \<Gamma>)", OF step.Call]
root_in_redexes)
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma put_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_attrs_type_wf_preserved [simp]:
  "h \<turnstile> put_M element_ptr attrs_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> type_wf h = type_wf h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. h \<turnstile> put_M element_ptr attrs_update v \<rightarrow>\<^sub>h h' \<Longrightarrow> DocumentClass.type_wf h = DocumentClass.type_wf h'
[PROOF STEP]
apply(auto simp add: ElementMonad.put_M_defs put\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def put\<^sub>N\<^sub>o\<^sub>d\<^sub>e_def
      DocumentClass.type_wf\<^sub>C\<^sub>h\<^sub>a\<^sub>r\<^sub>a\<^sub>c\<^sub>t\<^sub>e\<^sub>r\<^sub>D\<^sub>a\<^sub>t\<^sub>a DocumentClass.type_wf\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      DocumentClass.type_wf\<^sub>N\<^sub>o\<^sub>d\<^sub>e DocumentClass.type_wf\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t
      is_node_kind_def
      dest!: get_heap_E
      elim!: bind_returns_heap_E2
      intro!: type_wf_put_I CharacterDataMonad.type_wf_put_I ElementMonad.type_wf_put_I
      NodeMonad.type_wf_put_I ObjectMonad.type_wf_put_I)[1]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x. \<lbrakk>h \<turnstile> get_M element_ptr id \<rightarrow>\<^sub>r x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>attrs := v\<rparr>))) h; DocumentClass.type_wf (put (cast (cast element_ptr)) (cast (cast (x\<lparr>attrs := v\<rparr>))) h)\<rbrakk> \<Longrightarrow> DocumentClass.type_wf h
[PROOF STEP]
apply(auto simp add: is_node_kind_def type_wf_defs ElementClass.type_wf_defs
      NodeClass.type_wf_defs ElementMonad.get_M_defs ObjectClass.type_wf_defs
      CharacterDataClass.type_wf_defs split: option.splits)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>x node_ptr. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; \<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>attrs := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>attrs := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>attrs := v\<rparr>)) else get element_ptra h) = Some y; node_ptr |\<in>| node_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get node_ptr h = Some y
 2. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; \<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>attrs := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>attrs := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>attrs := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
apply (metis NodeClass.a_type_wf_def NodeClass.get\<^sub>N\<^sub>o\<^sub>d\<^sub>e_type_wf ObjectClass.a_type_wf_def
      bind.bind_lzero finite_set_in get\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t_def l_type_wf_def\<^sub>N\<^sub>o\<^sub>d\<^sub>e.a_type_wf_def option.collapse
      option.distinct(1) option.simps(3))
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>x element_ptra. \<lbrakk>\<forall>character_data_ptr\<in>fset (character_data_ptr_kinds h). \<exists>y. get character_data_ptr h = Some y; \<forall>document_ptr\<in>fset (document_ptr_kinds h). \<exists>y. get document_ptr h = Some y; get element_ptr h = Some x; h' = put (cast (cast element_ptr)) (cast (cast (x\<lparr>attrs := v\<rparr>))) h; \<forall>node_ptr\<in>fset (node_ptr_kinds h). \<exists>y. (if cast element_ptr = node_ptr then cast (cast (cast (x\<lparr>attrs := v\<rparr>))) else get node_ptr h) = Some y; \<forall>element_ptra\<in>fset (element_ptr_kinds h). \<exists>y. (if element_ptr = element_ptra then cast (cast (x\<lparr>attrs := v\<rparr>)) else get element_ptra h) = Some y; element_ptra |\<in>| element_ptr_kinds h\<rbrakk> \<Longrightarrow> \<exists>y. get element_ptra h = Some y
[PROOF STEP]
by (metis fmember.rep_eq)