[STATEMENT]
lemma if_type'':
  "\<lbrakk>type_bexpr \<Gamma> e t; pred_entailment P t;
    has_type  \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P';
    has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P'';
    pred_entailment P' {e}; pred_entailment P'' {bexp_neg e};
    P''' = restrict_preds_to_vars (((Imp e) ` (P' - {e})) \<union> ((Imp (bexp_neg e)) ` (P'' - {bexp_neg e}))) {v. stable \<S>' v}\<rbrakk>
\<Longrightarrow> has_type \<Gamma> \<S> P (Stmt.If e c\<^sub>1 c\<^sub>2) \<Gamma>' \<S>' P'''"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>type_bexpr \<Gamma> e t; pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> has_type \<Gamma> \<S> P (Stmt.If e c\<^sub>1 c\<^sub>2) \<Gamma>' \<S>' P'''
[PROOF STEP]
apply(erule (3) if_type,simp+)
[PROOF STATE]
proof (prove)
goal (4 subgoals):
 1. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp.Not e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp.Not e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp.Not e) ` (P'' - {bexp.Not e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> pred_entailment P' (restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp.Not e) ` (P'' - {bexp.Not e})) {v. local.stable \<S>' v})
 2. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> pred_entailment P'' P'''
 3. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
 4. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
[PROOF STEP]
apply(auto simp: pred_entailment_def pred_def image_def restrict_preds_to_vars_def)[1]
[PROOF STATE]
proof (prove)
goal (3 subgoals):
 1. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> pred_entailment P'' P'''
 2. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
 3. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
[PROOF STEP]
apply(auto simp: pred_entailment_def pred_def image_def restrict_preds_to_vars_def)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
 2. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
[PROOF STEP]
apply(clarsimp simp: tyenv_wellformed_def mds_consistent_def stable_def image_def restrict_preds_to_vars_def)
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>mds p x. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' (mds AsmNoWrite, mds AsmNoReadOrWrite) P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp.Not e)) c\<^sub>2 \<Gamma>' (mds AsmNoWrite, mds AsmNoReadOrWrite) P''; pred_entailment P' {e}; pred_entailment P'' {bexp.Not e}; P''' = {ea. ((\<exists>x\<in>P' - {e}. ea = Imp e x) \<or> (\<exists>x\<in>P'' - {bexp.Not e}. ea = Imp (bexp.Not e) x)) \<and> bexp_vars ea \<subseteq> {v. v \<in> mds AsmNoWrite \<or> v \<in> mds AsmNoReadOrWrite}}; \<S>' = (mds AsmNoWrite, mds AsmNoReadOrWrite); dom \<Gamma>' = {x. x \<notin> \<C> \<and> (x \<in> mds AsmNoWrite \<or> x \<in> mds AsmNoReadOrWrite)}; \<forall>p\<in>P'. \<forall>x\<in>bexp_vars p. x \<in> mds AsmNoWrite \<or> x \<in> mds AsmNoReadOrWrite; types_wellformed \<Gamma>'; types_stable \<Gamma>' (mds AsmNoWrite, mds AsmNoReadOrWrite); x \<in> bexp_vars p; (\<exists>x\<in>P' - {e}. p = Imp e x) \<or> (\<exists>x\<in>P'' - {bexp.Not e}. p = Imp (bexp.Not e) x); bexp_vars p \<subseteq> {v. v \<in> mds AsmNoWrite \<or> v \<in> mds AsmNoReadOrWrite}; x \<notin> mds AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> x \<in> mds AsmNoWrite
 2. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' \<S>' P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp_neg e)) c\<^sub>2 \<Gamma>' \<S>' P''; pred_entailment P' {e}; pred_entailment P'' {bexp_neg e}; P''' = restrict_preds_to_vars (Imp e ` (P' - {e}) \<union> Imp (bexp_neg e) ` (P'' - {bexp_neg e})) {v. local.stable \<S>' v}\<rbrakk> \<Longrightarrow> \<forall>mds. tyenv_wellformed mds \<Gamma>' \<S>' P'' \<longrightarrow> tyenv_wellformed mds \<Gamma>' \<S>' P'''
[PROOF STEP]
apply(clarsimp simp: tyenv_wellformed_def mds_consistent_def stable_def image_def restrict_preds_to_vars_def)
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>mds p x. \<lbrakk>pred_entailment P t; has_type \<Gamma> \<S> (add_pred P \<S> e) c\<^sub>1 \<Gamma>' (mds AsmNoWrite, mds AsmNoReadOrWrite) P'; has_type \<Gamma> \<S> (add_pred P \<S> (bexp.Not e)) c\<^sub>2 \<Gamma>' (mds AsmNoWrite, mds AsmNoReadOrWrite) P''; pred_entailment P' {e}; pred_entailment P'' {bexp.Not e}; P''' = {ea. ((\<exists>x\<in>P' - {e}. ea = Imp e x) \<or> (\<exists>x\<in>P'' - {bexp.Not e}. ea = Imp (bexp.Not e) x)) \<and> bexp_vars ea \<subseteq> {v. v \<in> mds AsmNoWrite \<or> v \<in> mds AsmNoReadOrWrite}}; \<S>' = (mds AsmNoWrite, mds AsmNoReadOrWrite); dom \<Gamma>' = {x. x \<notin> \<C> \<and> (x \<in> mds AsmNoWrite \<or> x \<in> mds AsmNoReadOrWrite)}; \<forall>p\<in>P''. \<forall>x\<in>bexp_vars p. x \<in> mds AsmNoWrite \<or> x \<in> mds AsmNoReadOrWrite; types_wellformed \<Gamma>'; types_stable \<Gamma>' (mds AsmNoWrite, mds AsmNoReadOrWrite); x \<in> bexp_vars p; (\<exists>x\<in>P' - {e}. p = Imp e x) \<or> (\<exists>x\<in>P'' - {bexp.Not e}. p = Imp (bexp.Not e) x); bexp_vars p \<subseteq> {v. v \<in> mds AsmNoWrite \<or> v \<in> mds AsmNoReadOrWrite}; x \<notin> mds AsmNoReadOrWrite\<rbrakk> \<Longrightarrow> x \<in> mds AsmNoWrite
[PROOF STEP]
apply fastforce
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma set_child_nodes_get_child_nodes_is_l_set_child_nodes_get_child_nodes [instances]:
  "l_set_child_nodes_get_child_nodes type_wf known_ptr get_child_nodes get_child_nodes_locs set_child_nodes set_child_nodes_locs"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. l_set_child_nodes_get_child_nodes ShadowRootClass.type_wf ShadowRootClass.known_ptr Shadow_DOM.get_child_nodes Shadow_DOM.get_child_nodes_locs Shadow_DOM.set_child_nodes Shadow_DOM.set_child_nodes_locs
[PROOF STEP]
apply(auto simp add: instances l_set_child_nodes_get_child_nodes_def l_set_child_nodes_get_child_nodes_axioms_def)[1]
[PROOF STATE]
proof (prove)
goal (2 subgoals):
 1. \<And>h ptr children h'. \<lbrakk>ShadowRootClass.type_wf h; ShadowRootClass.known_ptr ptr; h \<turnstile> Shadow_DOM.set_child_nodes ptr children \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> h' \<turnstile> Shadow_DOM.get_child_nodes ptr \<rightarrow>\<^sub>r children
 2. \<And>ptr ptr' w h h' r. \<lbrakk>ptr \<noteq> ptr'; w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> Shadow_DOM.get_child_nodes_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
using set_child_nodes_get_child_nodes
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>ShadowRootClass.known_ptr ?ptr; ShadowRootClass.type_wf ?h; ?h \<turnstile> Shadow_DOM.set_child_nodes ?ptr ?children \<rightarrow>\<^sub>h ?h'\<rbrakk> \<Longrightarrow> ?h' \<turnstile> Shadow_DOM.get_child_nodes ?ptr \<rightarrow>\<^sub>r ?children

goal (2 subgoals):
 1. \<And>h ptr children h'. \<lbrakk>ShadowRootClass.type_wf h; ShadowRootClass.known_ptr ptr; h \<turnstile> Shadow_DOM.set_child_nodes ptr children \<rightarrow>\<^sub>h h'\<rbrakk> \<Longrightarrow> h' \<turnstile> Shadow_DOM.get_child_nodes ptr \<rightarrow>\<^sub>r children
 2. \<And>ptr ptr' w h h' r. \<lbrakk>ptr \<noteq> ptr'; w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> Shadow_DOM.get_child_nodes_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr' w h h' r. \<lbrakk>ptr \<noteq> ptr'; w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> Shadow_DOM.get_child_nodes_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
using set_child_nodes_get_child_nodes_different_pointers
[PROOF STATE]
proof (prove)
using this:
\<lbrakk>?ptr \<noteq> ?ptr'; ?w \<in> Shadow_DOM.set_child_nodes_locs ?ptr; ?h \<turnstile> ?w \<rightarrow>\<^sub>h ?h'; ?r \<in> Shadow_DOM.get_child_nodes_locs ?ptr'\<rbrakk> \<Longrightarrow> ?r ?h ?h'

goal (1 subgoal):
 1. \<And>ptr ptr' w h h' r. \<lbrakk>ptr \<noteq> ptr'; w \<in> Shadow_DOM.set_child_nodes_locs ptr; h \<turnstile> w \<rightarrow>\<^sub>h h'; r \<in> Shadow_DOM.get_child_nodes_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
apply fast
[PROOF STATE]
proof (prove)
goal:
No subgoals!
[PROOF STEP]
done


[STATEMENT]
lemma cmp_in_hom [intro]:
    assumes "B.VV.arr \<mu>\<nu>"
    shows "\<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
have "cmp \<mu>\<nu> = G (F (H\<^sub>B (fst \<mu>\<nu>) (snd \<mu>\<nu>))) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D
                     \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>)))"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. cmp \<mu>\<nu> = G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>)))
[PROOF STEP]
using assms cmp_def
[PROOF STATE]
proof (prove)
using this:
B.VV.arr \<mu>\<nu>
cmp ?\<mu>\<nu> = (if B.VV.arr ?\<mu>\<nu> then G (F (fst ?\<mu>\<nu> \<star>\<^sub>B snd ?\<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom ?\<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst ?\<mu>\<nu>)), F (B.dom (snd ?\<mu>\<nu>))) else D.null)

goal (1 subgoal):
 1. cmp \<mu>\<nu> = G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>)))
[PROOF STEP]
by simp
[PROOF STATE]
proof (state)
this:
cmp \<mu>\<nu> = G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>)))

goal (1 subgoal):
 1. \<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
moreover
[PROOF STATE]
proof (state)
this:
cmp \<mu>\<nu> = G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>)))

goal (1 subgoal):
 1. \<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
have "\<guillemotleft> ... : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
proof (intro D.comp_in_homI)
[PROOF STATE]
proof (state)
goal (3 subgoals):
 1. \<guillemotleft>\<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D ?b1\<guillemotright>
 2. \<guillemotleft>G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) : ?b1 \<Rightarrow>\<^sub>D ?b\<guillemotright>
 3. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : ?b \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>\<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) :
                 H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>)
                   \<Rightarrow>\<^sub>D G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>)))\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>\<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>)))\<guillemotright>
[PROOF STEP]
using assms F.FF_def FF_def B.VV.arr_char\<^sub>S\<^sub>b\<^sub>C B.VV.dom_simp
[PROOF STATE]
proof (prove)
using this:
B.VV.arr \<mu>\<nu>
F.FF \<equiv> \<lambda>\<mu>\<nu>. if B.VV.arr \<mu>\<nu> then (F (fst \<mu>\<nu>), F (snd \<mu>\<nu>)) else C.VV.null
FF \<equiv> \<lambda>\<mu>\<nu>. if B.VV.arr \<mu>\<nu> then (local.map (fst \<mu>\<nu>), local.map (snd \<mu>\<nu>)) else D.VV.null
B.VV.arr ?f = (B.arr (fst ?f) \<and> B.arr (snd ?f) \<and> src\<^sub>B (fst ?f) = trg\<^sub>B (snd ?f))
B.VV.arr ?f \<Longrightarrow> B.VV.dom ?f = B.VxV.dom ?f

goal (1 subgoal):
 1. \<guillemotleft>\<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>)))\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>\<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>)))\<guillemotright>

goal (2 subgoals):
 1. \<guillemotleft>G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) : G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>))) \<Rightarrow>\<^sub>D ?b\<guillemotright>
 2. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : ?b \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) :
                 G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>)))
                   \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>)\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) : G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>))) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
using assms B.VV.arr_char\<^sub>S\<^sub>b\<^sub>C F.FF_def B.VV.dom_simp B.VV.cod_simp
[PROOF STATE]
proof (prove)
using this:
B.VV.arr \<mu>\<nu>
B.VV.arr ?f = (B.arr (fst ?f) \<and> B.arr (snd ?f) \<and> src\<^sub>B (fst ?f) = trg\<^sub>B (snd ?f))
F.FF \<equiv> \<lambda>\<mu>\<nu>. if B.VV.arr \<mu>\<nu> then (F (fst \<mu>\<nu>), F (snd \<mu>\<nu>)) else C.VV.null
B.VV.arr ?f \<Longrightarrow> B.VV.dom ?f = B.VxV.dom ?f
B.VV.arr ?f \<Longrightarrow> B.VV.cod ?f = B.VxV.cod ?f

goal (1 subgoal):
 1. \<guillemotleft>G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) : G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>))) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) : G (F (B.dom (fst \<mu>\<nu>)) \<star>\<^sub>C F (B.dom (snd \<mu>\<nu>))) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>)\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
show "\<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) :
                 GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
proof -
[PROOF STATE]
proof (state)
goal (1 subgoal):
 1. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
have "B.VV.in_hom \<mu>\<nu> (B.VV.dom \<mu>\<nu>) (B.VV.cod \<mu>\<nu>)"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. B.VV.in_hom \<mu>\<nu> (B.VV.dom \<mu>\<nu>) (B.VV.cod \<mu>\<nu>)
[PROOF STEP]
using assms
[PROOF STATE]
proof (prove)
using this:
B.VV.arr \<mu>\<nu>

goal (1 subgoal):
 1. B.VV.in_hom \<mu>\<nu> (B.VV.dom \<mu>\<nu>) (B.VV.cod \<mu>\<nu>)
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
B.VV.in_hom \<mu>\<nu> (B.VV.dom \<mu>\<nu>) (B.VV.cod \<mu>\<nu>)

goal (1 subgoal):
 1. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
thus ?thesis
[PROOF STATE]
proof (prove)
using this:
B.VV.in_hom \<mu>\<nu> (B.VV.dom \<mu>\<nu>) (B.VV.cod \<mu>\<nu>)

goal (1 subgoal):
 1. \<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
by auto
[PROOF STATE]
proof (state)
this:
\<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) : GFoH\<^sub>B.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>

goal:
No subgoals!
[PROOF STEP]
qed
[PROOF STATE]
proof (state)
this:
\<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
ultimately
[PROOF STATE]
proof (chain)
picking this:
cmp \<mu>\<nu> = G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>)))
\<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
show ?thesis
[PROOF STATE]
proof (prove)
using this:
cmp \<mu>\<nu> = G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>)))
\<guillemotleft>G (F (fst \<mu>\<nu> \<star>\<^sub>B snd \<mu>\<nu>)) \<cdot>\<^sub>D G (\<Phi>\<^sub>F (B.VV.dom \<mu>\<nu>)) \<cdot>\<^sub>D \<Phi>\<^sub>G (F (B.dom (fst \<mu>\<nu>)), F (B.dom (snd \<mu>\<nu>))) : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>

goal (1 subgoal):
 1. \<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>
[PROOF STEP]
by argo
[PROOF STATE]
proof (state)
this:
\<guillemotleft>cmp \<mu>\<nu> : H\<^sub>DoGF_GF.map (B.VV.dom \<mu>\<nu>) \<Rightarrow>\<^sub>D GFoH\<^sub>B.map (B.VV.cod \<mu>\<nu>)\<guillemotright>

goal:
No subgoals!
[PROOF STEP]
qed


[STATEMENT]
lemma get_tag_name_new_shadow_root:
  "h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr \<Longrightarrow> h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h'
     \<Longrightarrow> r \<in> get_tag_name_locs ptr' \<Longrightarrow> r h h'"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>r new_shadow_root_ptr; h \<turnstile> new\<^sub>S\<^sub>h\<^sub>a\<^sub>d\<^sub>o\<^sub>w\<^sub>R\<^sub>o\<^sub>o\<^sub>t_M \<rightarrow>\<^sub>h h'; r \<in> get_tag_name_locs ptr'\<rbrakk> \<Longrightarrow> r h h'
[PROOF STEP]
by (auto simp add: CD.get_tag_name_locs_def new_shadow_root_get_M\<^sub>O\<^sub>b\<^sub>j\<^sub>e\<^sub>c\<^sub>t new_shadow_root_get_M\<^sub>E\<^sub>l\<^sub>e\<^sub>m\<^sub>e\<^sub>n\<^sub>t
      split: prod.splits if_splits option.splits
      elim!: bind_returns_result_E bind_returns_heap_E intro: is_element_ptr_kind_obtains)


[STATEMENT]
lemma "(x :: rat) >= 0"
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> x
[PROOF STEP]
quickcheck[random, expect = counterexample]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> x
[PROOF STEP]
quickcheck[exhaustive, expect = counterexample]
[PROOF STATE]
proof (prove)
goal (1 subgoal):
 1. 0 \<le> x
[PROOF STEP]
oops